Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Computer Software/Engineering

Breach intelligence, attack campaigns, and threat reports targeting the Computer Software/Engineering sector.

2541 threat reports
Page 71 of 212
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Computer Software/Engineering Threat Reports

Showing 841–852 / 2541 reports
OkoBot Malware: A New Threat to Cryptocurrency Security
Financial Services3 months ago

OkoBot Malware: A New Threat to Cryptocurrency Security

In July 2026, cybersecurity researchers identified OkoBot, a sophisticated malware framework comprising over 20 modules designed to steal cryptocurrency wallet seed phrases, credentials, and other sensitive data. OkoBot infiltrates systems through deceptive ClickFix attacks and malicious GitHub repositories masquerading as legitimate software tools. Once installed, it deploys various payloads, including browser injectors and keyloggers, to harvest user information and monitor activities. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/new-okobot-framework-deploys-20-payloads-to-steal-data-crypto/?utm_source=openai)) The emergence of OkoBot underscores a growing trend of targeted attacks on cryptocurrency users, highlighting the need for enhanced vigilance and robust security measures within the crypto community. As the malware continues to evolve, staying informed about such threats is crucial for safeguarding digital assets.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Critical Vulnerability in Claude Chrome Extension Exposes User Data
Computer Software/Engineering3 months ago

Critical Vulnerability in Claude Chrome Extension Exposes User Data

In July 2026, a critical vulnerability was discovered in Anthropic's Claude for Chrome browser extension. This flaw allowed malicious extensions to simulate user interactions, triggering predefined AI actions without user consent. Exploiting this, attackers could access connected services such as Gmail, Google Docs, Google Calendar, and Salesforce, leading to unauthorized data access and potential data exfiltration. The vulnerability stemmed from the extension's failure to verify the origin of click events, accepting synthetic events generated by other extensions as legitimate user actions. This incident underscores the growing risks associated with browser extensions and their integration with AI-powered services. As organizations increasingly adopt such tools to enhance productivity, ensuring robust security measures and thorough validation of user interactions becomes imperative to prevent unauthorized access and data breaches.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
ClickLock: The New macOS Malware Exploiting User Trust
Financial Services3 months ago

ClickLock: The New macOS Malware Exploiting User Trust

In July 2026, cybersecurity researchers identified a new macOS malware named ClickLock, which employs social engineering tactics to deceive users into revealing their system login passwords. The malware initiates by presenting a fake Cloudflare 'human verification' prompt, leading users to execute a command in the Terminal. This action triggers the download of malicious modules that disable keyboard interrupts and suppress system notifications. Subsequently, ClickLock displays a counterfeit macOS password dialog, coercing users into entering their credentials. Upon obtaining the password, the malware exfiltrates sensitive data, including login credentials, cryptocurrency assets, and browser information, to the attackers via Telegram. Additionally, it installs a persistent backdoor, granting ongoing remote access to the compromised systems. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/new-clicklock-macos-malware-traps-users-into-revealing-login-password/?utm_source=openai)) The emergence of ClickLock underscores a growing trend in macOS-targeted malware leveraging sophisticated social engineering techniques. This incident highlights the necessity for heightened user awareness and the implementation of robust security measures to counteract such deceptive attacks.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Outdated UEFI Bootloaders Pose Security Risks
Computer Hardware3 months ago

Outdated UEFI Bootloaders Pose Security Risks

In July 2026, researchers identified 11 outdated UEFI shim bootloaders, all signed by Microsoft, that remained trusted components within the Secure Boot framework. These bootloaders, versions 0.9 and earlier, lacked modern security protections and could be exploited by attackers to bypass Secure Boot, allowing the execution of malicious code during the boot process and establishing persistent access below the operating system level. Microsoft addressed the issue by revoking these vulnerable bootloaders in June 2026 through Secure Boot revocation updates. However, systems that have not applied these updates remain susceptible to boot-level attacks, as the revoked shims continue to be trusted on unpatched machines. This incident underscores the critical importance of timely firmware updates and the need for organizations to maintain vigilance over the security of their boot processes to prevent potential exploits.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
OpenAI's GPT-Red: Revolutionizing AI Security with Automated Prompt Injection Testing
Computer Software/Engineering3 months ago

OpenAI's GPT-Red: Revolutionizing AI Security with Automated Prompt Injection Testing

In July 2026, OpenAI unveiled GPT-Red, an internal AI model designed to autonomously identify and exploit prompt injection vulnerabilities within its own AI systems. This initiative aims to proactively detect and mitigate security flaws before deployment. GPT-Red demonstrated a remarkable success rate, identifying vulnerabilities in 84% of test scenarios, significantly outperforming human red-teamers who achieved a 13% success rate. The model employs self-play reinforcement learning, continuously refining its attack strategies to uncover weaknesses that might be overlooked by human testers. This proactive approach underscores OpenAI's commitment to enhancing the robustness and security of its AI models. The introduction of GPT-Red highlights the escalating sophistication of AI-driven security testing. As AI systems become more integrated into critical applications, the ability to autonomously identify and address vulnerabilities is crucial. This development also reflects a broader industry trend towards leveraging AI for cybersecurity, emphasizing the need for continuous innovation to stay ahead of emerging threats.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Daxin and Stupig Malware Resurface in Taiwan Manufacturing Firm
Computer Software/Engineering3 months ago

Daxin and Stupig Malware Resurface in Taiwan Manufacturing Firm

In May 2026, Symantec's Threat Hunter Team identified the re-emergence of Backdoor.Daxin, a sophisticated kernel-mode rootkit previously linked to China-based threat actors, on a compromised host within a Taiwan-based subsidiary of a multinational high-tech manufacturer. Alongside Daxin, researchers discovered a novel backdoor named Stupig, which exploits a trojanized keyboard-layout DLL to execute commands with SYSTEM privileges directly from the Windows logon screen, bypassing standard authentication mechanisms. Both malware samples carry compile timestamps from early 2013, suggesting a prolonged undetected presence of up to 13 years within the victim's network. This incident underscores the persistent and evolving nature of cyber threats targeting critical infrastructure and high-tech industries. The discovery of Stupig's unique pre-authentication execution method highlights the need for continuous vigilance and advanced detection capabilities to identify and mitigate such stealthy intrusions.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
Agent Data Injection: A New Frontier in AI Security Threats
Computer Software/Engineering3 months ago

Agent Data Injection: A New Frontier in AI Security Threats

In July 2026, researchers from Seoul National University, the University of Illinois Urbana-Champaign, and Largosoft identified a novel cybersecurity threat termed Agent Data Injection (ADI). This attack manipulates AI agents by embedding malicious data within trusted inputs, such as sender names or button IDs, leading the agents to perform unintended actions like unauthorized purchases or executing attacker commands. Unlike traditional prompt injections that insert overt instructions, ADI subtly corrupts the data AI agents rely upon, making detection challenging. The researchers demonstrated ADI's effectiveness across various platforms, including web agents like Claude in Chrome and coding assistants such as OpenAI's Codex, highlighting the vulnerability of AI systems to this sophisticated form of data manipulation. The emergence of ADI underscores the evolving landscape of AI security threats. As AI agents become more integrated into critical applications, the potential for such attacks to cause significant harm increases. This incident serves as a crucial reminder for organizations to reassess and fortify their AI security measures to mitigate the risks associated with data manipulation attacks.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
AsyncAPI npm Supply Chain Attack: A Wake-Up Call for Open-Source Security
Computer Software/Engineering3 months ago

AsyncAPI npm Supply Chain Attack: A Wake-Up Call for Open-Source Security

In July 2026, a sophisticated supply chain attack targeted the AsyncAPI project, resulting in the publication of five malicious versions of its npm packages. The attacker exploited misconfigured GitHub Actions workflows to inject a remote access trojan (RAT) into the @asyncapi namespace, affecting packages with a cumulative weekly download count exceeding 2.25 million. The compromised packages included @asyncapi/generator, @asyncapi/generator-helpers, @asyncapi/generator-components, and @asyncapi/specs. The attack involved multiple stages, with the final payload establishing persistence and exfiltrating sensitive data such as credentials, authentication keys, and tokens. This incident underscores the critical need for securing CI/CD pipelines and the potential risks associated with open-source software dependencies. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/-asyncapi-npm-packages-infected-with-credential-stealing-malware/?utm_source=openai)) The AsyncAPI supply chain attack highlights a growing trend of targeting software development infrastructure to distribute malware. As organizations increasingly rely on open-source components, ensuring the integrity of these dependencies becomes paramount. This incident serves as a stark reminder of the vulnerabilities inherent in the software supply chain and the necessity for robust security measures to protect against such sophisticated attacks.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
AI Tools in Cyberattacks: The Misuse of Google's Gemini CLI
Health Care / Life Sciences3 months ago

AI Tools in Cyberattacks: The Misuse of Google's Gemini CLI

In mid-2026, a Russian-speaking threat actor known as "bandcampro" exploited Google's open-source Gemini CLI AI tool to orchestrate a small-scale botnet targeting a dental clinic's systems. Over approximately two months, the attacker utilized the AI agent to deploy and manage infrastructure controlling eight systems, gaining unauthorized access to the OpenDental database. The AI facilitated tasks such as troubleshooting, operational improvements, and command-and-control (C2) migration, demonstrating advanced capabilities in automating cyberattack processes. This incident underscores the evolving landscape of cyber threats, where adversaries increasingly leverage AI tools to enhance the efficiency and sophistication of their operations. The misuse of AI in cyberattacks highlights the urgent need for robust security measures and vigilant monitoring to detect and mitigate such advanced threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Dutch Authorities Dismantle €100 Million Investment Fraud Network
Financial Services3 months ago

Dutch Authorities Dismantle €100 Million Investment Fraud Network

In July 2026, Dutch authorities dismantled a sophisticated international investment fraud scheme that operated 20 call centers across multiple countries, employing over 700 individuals posing as financial advisors. The organization is estimated to have defrauded tens of thousands of victims, amassing over €100 million per month at its peak. The fraudsters built trust with victims over extended periods, introducing them to realistic-looking investment platforms that displayed fictitious profits. Victims were persuaded to increase their investments, often through cryptocurrency transfers, while the criminals siphoned the funds and presented fake dashboards showing inflated returns. This incident underscores the evolving complexity and scale of cyber-enabled financial fraud, highlighting the need for enhanced vigilance and regulatory measures in the financial sector. The use of sophisticated social engineering tactics and the exploitation of cryptocurrency platforms for illicit gains reflect broader trends in cybercrime, necessitating continuous adaptation of security strategies by organizations and individuals alike.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Critical 'PromptFiction' Vulnerability in Claude Desktop Exposes AI to Malicious Prompts
Computer Software/Engineering3 months ago

Critical 'PromptFiction' Vulnerability in Claude Desktop Exposes AI to Malicious Prompts

In July 2026, a critical vulnerability named 'PromptFiction' was discovered in Anthropic's Claude Desktop application. This flaw allowed attackers to automatically submit malicious prompts to the AI assistant without any user interaction, leveraging a custom URI scheme ('claude://') to execute commands upon clicking a crafted link. Exploiting this, attackers could exfiltrate sensitive user data and potentially execute remote code on the victim's machine. The vulnerability was promptly patched in Claude Desktop version 1.1.2321. This incident underscores the evolving nature of prompt injection attacks, highlighting the need for robust security measures in AI applications to prevent unauthorized access and data breaches.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Critical Vulnerabilities in Cursor AI IDE Expose Developers to Remote Code Execution
Computer Software/Engineering3 months ago

Critical Vulnerabilities in Cursor AI IDE Expose Developers to Remote Code Execution

In early 2026, multiple critical vulnerabilities were discovered in the Cursor AI-integrated development environment (IDE), notably CVE-2026-50548 and CVE-2026-50549. These flaws allowed attackers to escape the IDE's sandbox environment, enabling remote code execution (RCE) on developers' machines. Exploits involved manipulating the working directory parameter and leveraging symbolic link (symlink) manipulation to bypass security controls. The vulnerabilities posed significant risks, including unauthorized access to source code, sensitive data exposure, and potential compromise of development environments. ([csoonline.com](https://www.csoonline.com/article/4191923/sandbox-bypass-flaws-in-cursor-ide-highlight-prompt-injection-as-an-rce-vector.html?utm_source=openai)) The discovery of these vulnerabilities underscores the growing security challenges associated with AI-assisted development tools. As organizations increasingly adopt such tools to enhance productivity, it is imperative to implement robust security measures to mitigate risks associated with prompt injection attacks and sandbox escapes. This incident highlights the need for continuous monitoring and updating of AI development environments to safeguard against emerging threats.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports