Computer Software/Engineering
Breach intelligence, attack campaigns, and threat reports targeting the Computer Software/Engineering sector.
Explore Other Sectors
Computer Software/Engineering Threat Reports
Hades Campaign: A New Threat to PyPI Security
In June 2026, a sophisticated supply chain attack targeted the Python Package Index (PyPI), compromising 37 wheels across 19 packages. The attackers, adopting a 'Hades' naming convention, deployed a variant of the Shai-Hulud worm, which is known for its self-propagating and information-stealing capabilities. This malware infects software components, utilizes the access to publish malicious versions, and harvests repository accounts of downstream users. The attack chain's cross-runtime design involved the installation of Bun—a JavaScript runtime—as a heavily obfuscated JavaScript stealer before executing the payload. This incident underscores the persistent and evolving nature of software supply chain threats. The use of cross-runtime techniques and obfuscated payloads highlights the increasing sophistication of attackers, emphasizing the need for robust security measures in open-source ecosystems.
3 months ago
Kill Chain
Weekly Recap: Instagram Account Hacks, Android Zero-Day, GitHub Worm and More
In early June 2026, multiple significant cybersecurity incidents emerged, including the exploitation of Meta's AI-driven customer support system to hijack high-profile Instagram accounts, a critical zero-day vulnerability in Qualcomm chipsets affecting numerous Android devices, and a self-replicating worm targeting Microsoft's GitHub repositories. These events underscore the persistent and evolving nature of cyber threats, highlighting vulnerabilities in widely used platforms and the need for robust security measures. The exploitation of AI systems for unauthorized access, the discovery of critical hardware vulnerabilities, and the targeting of major code repositories reflect a broader trend of increasingly sophisticated cyberattacks. Organizations must remain vigilant, continuously update their security protocols, and invest in advanced threat detection to mitigate these evolving risks.
3 months ago
Kill Chain
Red Hat npm Packages Compromised in June 2026 Supply Chain Attack
In June 2026, a sophisticated supply chain attack was identified, involving the compromise of Red Hat's npm packages. Attackers infiltrated a Red Hat employee's GitHub account, injecting malware into numerous npm packages under the Red Hat Cloud Services namespace. This breach led to over 80,000 downloads of compromised packages within a week, targeting sensitive data such as GitHub Actions secrets, npm tokens, SSH keys, and cloud credentials. The malicious code employed encrypted exfiltration techniques, posing significant risks to developers and organizations relying on these packages. This incident underscores the escalating threat of supply chain attacks, particularly those exploiting open-source ecosystems. The attackers' use of advanced techniques, including encrypted exfiltration and targeting cloud identities, highlights the need for enhanced vigilance and robust security measures in software development and distribution processes.
3 months ago
Kill Chain
Critical Vulnerability in Everest Forms Pro Exploited to Hijack WordPress Sites
In June 2026, a critical vulnerability (CVE-2026-3300) in the Everest Forms Pro plugin for WordPress was actively exploited by attackers to gain unauthorized control over websites. The flaw, present in versions up to and including 1.9.12, resided in the plugin's Complex Calculation feature, which improperly handled user input, allowing unauthenticated remote code execution. Exploiting this, attackers created rogue administrator accounts, enabling them to modify content, install malicious plugins, and access sensitive data. The vulnerability was patched on March 18, 2026, but exploitation began on April 13, 2026, with over 29,300 attempts blocked by security tools. This incident underscores the persistent threat posed by vulnerabilities in widely-used WordPress plugins. Website administrators are urged to promptly update plugins and monitor for unauthorized access to mitigate such risks.
3 months ago
Kill Chain
Miasma Worm Infiltrates 73 Microsoft GitHub Repositories in Major 2026 Supply Chain Attack
In June 2026, Microsoft faced a significant supply chain attack when the self-replicating Miasma worm compromised 73 of its GitHub repositories across organizations such as Azure, Azure-Samples, Microsoft, and MicrosoftDocs. The worm embedded malicious code that activated upon developers cloning and opening the affected repositories in AI coding agents, leading to the harvesting of credentials for platforms including AWS, Azure, GCP, Kubernetes, npm, and GitHub. This incident underscores the evolving nature of supply chain attacks, particularly targeting AI-assisted development tools. The Miasma worm, a variant of the Mini Shai-Hulud worm, exploits the inherent trust in authenticated maintainers and signed packages, highlighting the need for enhanced security measures in software development and distribution processes.
3 months ago
Kill Chain
AI Agent Uncovers 21 Zero-Days in FFmpeg; Chrome Patches Record 429 Bugs
In early June 2026, an autonomous AI agent developed by security startup Depthfirst identified 21 zero-day vulnerabilities in FFmpeg, a widely used open-source media library. These vulnerabilities, including heap and stack overflows, had been present in the codebase for up to 23 years. Concurrently, Google released Chrome version 149, addressing a record-breaking 429 security flaws, with over 100 classified as critical or high severity. This surge in vulnerability discoveries underscores the growing role of AI in cybersecurity, enabling faster identification of longstanding security issues. Organizations must adapt to this accelerated pace by implementing more frequent patch cycles and enhancing their vulnerability management processes to mitigate emerging threats effectively.
3 months ago
Kill Chain
Bright Data SDK Exploits Smart TVs for Web Scraping: Privacy Implications Unveiled
In June 2026, security researchers revealed that Bright Data's SDK, embedded in various consumer applications, transforms devices such as smart TVs and smartphones into residential proxy nodes. This setup allows these devices to relay web-scraping traffic for Bright Data's data collection services, which are heavily marketed to the AI industry. Users, often unaware, consent to this by opting into free apps that promise benefits like reduced advertisements. The SDK operates in the background, utilizing the device's internet connection to route third-party web requests, effectively turning personal devices into components of a vast proxy network. This incident underscores the growing trend of leveraging consumer devices for large-scale data collection, particularly to fuel AI model training. The practice raises significant privacy and security concerns, as users' home IP addresses and bandwidth are exploited without explicit, informed consent. The lack of transparency and potential for misuse highlight the urgent need for stricter regulations and user awareness regarding the permissions granted to applications and the data-sharing implications involved. ([techspot.com](https://www.techspot.com/news/111492-smart-tv-apps-quietly-scraping-web-data-ai.html?utm_source=openai))
3 months ago
Kill Chain
UNC5221's Prolonged Cyber-Espionage via Brickstorm Malware
In June 2026, the Chinese state-sponsored group UNC5221, also known as VerdantBamboo, was found to have infiltrated U.S. organizations using the Brickstorm backdoor and newly identified malware variants, Plenet and AgentPSD. The attackers maintained undetected access for over 18 months, compromising Microsoft 365 environments and managed service providers. Their tactics included exploiting zero-day vulnerabilities in edge devices and deploying advanced malware implants written in Golang and Rust. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/chinese-apt-deploys-new-malware-to-keep-access-to-hacked-networks/amp/?utm_source=openai)) This incident underscores the evolving sophistication of state-sponsored cyber-espionage campaigns, highlighting the need for organizations to enhance their detection capabilities, particularly in monitoring network appliances and implementing robust access controls to prevent prolonged unauthorized access.
3 months ago
Kill Chain
IronWorm and Miasma Worm Supply Chain Attacks on npm - June 2026
In early June 2026, the npm ecosystem faced significant supply chain attacks involving the IronWorm and a new variant of the Miasma worm. Threat actors compromised over 50 legitimate npm packages to distribute a Rust-based information stealer and a self-propagating worm. The IronWorm malware, concealed by an eBPF kernel rootkit, harvested sensitive data from developers' machines and propagated by injecting malicious code into GitHub repositories. Concurrently, the Miasma worm variant targeted 57 npm packages, deploying credential-stealing payloads that executed during package installation, compromising cloud credentials and CI/CD secrets. These attacks underscore the escalating threats to software supply chains, emphasizing the need for robust security measures in package management and development workflows. The rapid propagation and sophisticated techniques employed highlight the urgency for organizations to enhance their defenses against such evolving threats.
3 months ago
Kill Chain
Toshiba and Muji Websites Compromised by Malicious Polyfill.io Scripts
In early June 2026, Toshiba and Muji reported unauthorized login prompts appearing on their websites, potentially compromising user credentials. These prompts were linked to the external service polyfill.io, which had previously introduced malicious code in 2024. Both companies advised users who entered their credentials to change their passwords immediately. The issue has since been resolved, with the affected service suspended. This incident underscores the persistent risks associated with third-party services and the importance of regular security audits. Organizations must remain vigilant, especially when integrating external code, to prevent similar vulnerabilities.
3 months ago
Kill Chain
Gartner Highlights Four Critical Cybersecurity Threats for 2026
In June 2026, Gartner analysts highlighted four critical cybersecurity threats where attackers currently have the upper hand: deepfakes, software supply chain risks, prompt injections, and AI application compromises. These threats exploit vulnerabilities in enterprise defenses, leading to significant security breaches and operational disruptions. Organizations are urged to enhance their security postures by implementing additional controls and stronger policies to mitigate these emerging risks. The urgency to address these threats is underscored by the rapid evolution of attack techniques and the increasing sophistication of threat actors. Enterprises must proactively adapt their security strategies to counteract these advanced threats and protect their assets effectively.
3 months ago
Kill Chain
IronWorm Malware: A 2026 npm Supply Chain Attack
In June 2026, a sophisticated supply chain attack named 'IronWorm' targeted the npm ecosystem, compromising 36 packages with over 32,000 combined monthly downloads. The Rust-written malware infiltrated developers' environments through malicious npm package updates, harvesting sensitive credentials such as API keys, cloud credentials, SSH keys, and npm publishing tokens. Utilizing a rootkit that exploits the Linux kernel's eBPF, IronWorm concealed its activities and communicated with command-and-control servers via the Tor network, enabling it to propagate further across the software supply chain. ([darkreading.com](https://www.darkreading.com/cyberattacks-data-breaches/rust-written-ironworm-npm-supply-chain?utm_source=openai)) This incident underscores the escalating threat of supply chain attacks within open-source ecosystems. The use of advanced techniques like eBPF rootkits and Tor-based communications highlights the increasing sophistication of threat actors. Organizations must enhance their security measures to protect development environments and prevent the infiltration of malicious code into trusted software projects. ([darkreading.com](https://www.darkreading.com/cyberattacks-data-breaches/rust-written-ironworm-npm-supply-chain?utm_source=openai))
3 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports