Computer Software/Engineering
Breach intelligence, attack campaigns, and threat reports targeting the Computer Software/Engineering sector.
Explore Other Sectors
Computer Software/Engineering Threat Reports
Google Engineer Charged with Insider Trading on Polymarket
In May 2026, Michele Spagnuolo, a 36-year-old Google security engineer, was charged with insider trading after allegedly using confidential company data to place bets on the cryptocurrency-based prediction platform Polymarket, resulting in $1.2 million in gains. Spagnuolo accessed internal Google tools containing nonpublic search trend data and, under the alias "AlphaRaccoon," placed bets on Polymarket regarding Google's top trending search terms for 2025. His actions led to charges including commodities fraud, wire fraud, and money laundering, with potential prison sentences ranging from 10 to 20 years if convicted. This incident underscores the growing concerns over the misuse of proprietary information in emerging financial platforms like prediction markets. It highlights the need for robust internal controls and monitoring mechanisms to prevent insider trading and protect the integrity of both corporate data and financial markets.
3 months ago
Kill Chain
Addressing Container Security Vulnerabilities: Insights from 2026
In 2026, Kaspersky's research highlighted significant security vulnerabilities within containerized environments, emphasizing the risks associated with outdated software, misconfigurations, and the use of untrusted images. The study revealed that 64 out of 100 analyzed Docker images contained critical vulnerabilities, with only 10% being fully up to date. These vulnerabilities expose organizations to potential attacks, including unauthorized access, data breaches, and system compromises. The findings underscore the necessity for organizations to implement robust security measures, such as regular updates, thorough configuration audits, and the use of trusted container images, to safeguard their containerized infrastructures.
3 months ago
Kill Chain
The Rise of DDoS-as-a-Service: Implications for Cybersecurity
In May 2026, cybersecurity researchers highlighted the rapid evolution of the DDoS-as-a-Service market, where Distributed Denial-of-Service (DDoS) attacks are commoditized and sold as services. This transformation has led to a significant increase in the scale and sophistication of DDoS attacks, exemplified by Cloudflare's mitigation of a record-breaking 31.4 Tbps attack in late 2025. The Aisuru-Kimwolf botnet, comprising millions of compromised devices, was identified as a primary source of these hyper-volumetric attacks, targeting various industries and critical infrastructure. ([blog.cloudflare.com](https://blog.cloudflare.com/ddos-threat-report-2025-q4?utm_source=openai)) The commodification of DDoS services has lowered the barrier to entry for cybercriminals, enabling even those with limited technical expertise to launch large-scale attacks. This trend underscores the urgent need for organizations to enhance their cybersecurity defenses and adopt proactive measures to mitigate the growing threat posed by DDoS-as-a-Service platforms.
3 months ago
Kill Chain
Exploitation of ChatGPT Share Links for Malware Distribution
In May 2026, threat actors exploited ChatGPT's content-sharing feature to distribute malware. They created fake outage messages on legitimate ChatGPT URLs, prompting users to download a malicious desktop application. This campaign, known as 'LLMShare,' utilized Google ads to direct users to these deceptive pages, leveraging the trust associated with OpenAI's domain. Upon clicking the download link, users were redirected to a counterfeit OpenAI download portal, delivering malware for both Windows and macOS systems. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/chatgpt-share-links-abused-to-host-fake-outage-pages-to-deliver-malware/?utm_source=openai)) This incident underscores a growing trend where attackers abuse trusted AI platforms to disseminate malware. The use of legitimate domains and sophisticated social engineering tactics highlights the need for heightened vigilance and user education to prevent such deceptive attacks.
3 months ago
Kill Chain
ChatGPhish: Unveiling the New Phishing Threat in AI Systems
In May 2026, cybersecurity researchers at Permiso Security identified a vulnerability in OpenAI's ChatGPT, termed 'ChatGPhish'. This flaw exploits ChatGPT's handling of Markdown links and images within web summaries, allowing attackers to inject malicious content. By embedding harmful payloads in web pages that users prompt ChatGPT to summarize, adversaries can cause the AI to render phishing links, deceptive system alerts, and QR codes directly within its trusted interface. This method can lead to unauthorized data exposure, including users' IP addresses and browser details, and potentially trick users into engaging with malicious content. The ChatGPhish vulnerability underscores the evolving threat landscape where AI tools become vectors for sophisticated phishing attacks. As organizations increasingly rely on AI for information processing, this incident highlights the critical need for robust security measures in AI systems to prevent exploitation through indirect prompt injections and ensure user trust.
3 months ago
Kill Chain
Silent Ransom Group's In-Person Data Extortion Tactics Target U.S. Law Firms
In May 2026, the Silent Ransom Group (SRG), also known as Luna Moth or Chatty Spider, escalated their cyber extortion tactics by physically infiltrating U.S. law firms. Posing as IT support personnel, SRG operatives gained unauthorized access to sensitive data by inserting malicious devices into firm computers. This method allowed them to exfiltrate confidential information without deploying traditional ransomware, subsequently threatening to publish the stolen data unless ransoms were paid. The FBI has confirmed that SRG has already leaked data from over 38 law firms on their public site, with total attacks exceeding 100 since early 2026. ([techtimes.com](https://www.techtimes.com/articles/317293/20260527/silent-ransom-group-sends-operatives-law-firm-offices-38-firms-already-leaked.htm?utm_source=openai)) This incident underscores a significant shift in cybercriminal strategies, combining social engineering with physical intrusion to bypass digital defenses. The legal sector, handling highly sensitive client information, is particularly vulnerable to such attacks. Organizations must enhance both digital and physical security measures to mitigate these evolving threats.
3 months ago
Kill Chain
The Com's 2026 Cyberattacks: A Wake-Up Call for Cloud Security
In May 2026, the cybercriminal collective known as 'The Com' orchestrated a series of sophisticated cyberattacks targeting cloud environments and SaaS platforms of major organizations. These breaches resulted in significant data exfiltration and operational disruptions. The Com, comprising subgroups like Scattered Lapsus$ Hunters, utilized advanced social engineering tactics, including vishing campaigns, to infiltrate IT helpdesks and gain unauthorized access to sensitive systems. The financial gains from these cybercrimes were reportedly funneled into supporting violent activities and the exploitation of minors, highlighting the broader societal impact of such security breaches. This incident underscores the evolving threat landscape where cybercriminal groups are increasingly targeting cloud infrastructures and leveraging social engineering to bypass traditional security measures. Organizations must enhance their security protocols, particularly around identity verification and access controls, to mitigate the risks posed by such sophisticated threat actors.
3 months ago
Kill Chain
Zapier Exploit Chain Reveals Critical Cloud Security Vulnerabilities
In May 2026, researchers from Token Security identified a critical vulnerability in Zapier's platform, demonstrating how a series of misconfigurations and over-permissioned roles could lead to a full platform takeover. The exploit chain began with the ability to execute code within Zapier's 'Code by Zapier' feature, allowing attackers to perform sandbox reconnaissance and extract credentials from memory. This access enabled lateral movement to Zapier's private repositories, where a high-privilege NPM token was discovered, potentially allowing the publication of malicious code to all authenticated users. Zapier promptly addressed the issue by revoking the leaked token and tightening IAM roles, with full remediation confirmed by March 2026. This incident underscores the critical importance of securing cloud integrations and managing permissions effectively. As cloud services become increasingly complex, even minor misconfigurations can be exploited to orchestrate significant breaches, highlighting the need for continuous security assessments and robust access controls.
3 months ago
Kill Chain
Major Supply Chain Attacks Target Nx Console and GitHub Repositories in 2026
In May 2026, two significant supply chain attacks targeted the developer ecosystem. The first involved a compromised version of the Nx Console Visual Studio Code extension (v18.95.0), which was live for approximately 18 minutes on May 18, 2026. This malicious extension exfiltrated credentials from developer machines, leading to unauthorized access and exfiltration of approximately 3,800 internal GitHub repositories. The second attack, dubbed 'Megalodon,' occurred on the same day and compromised over 5,500 GitHub repositories by injecting malicious GitHub Actions workflows designed to harvest CI/CD secrets and cloud credentials. These incidents underscore the escalating threat landscape targeting software development pipelines and the critical need for robust security measures in CI/CD environments. The rapid execution and widespread impact of these attacks highlight the urgency for organizations to implement stringent supply chain security practices and continuous monitoring to detect and mitigate such threats promptly.
3 months ago
Kill Chain
Critical BLE Vulnerability Discovered in Fourth Frontier's Frontier X2 Devices
In May 2026, a critical vulnerability (CVE-2026-5768) was identified in Fourth Frontier's Frontier X2 wearable device and its associated mobile applications. This flaw allows unauthenticated Bluetooth Low Energy (BLE) access, enabling attackers within proximity to manipulate device functions and inject fabricated health telemetry data. Affected versions include the Frontier X Android application prior to version 15.0.0, the iOS application before version 25.0.0, and all versions of the Frontier X2 device firmware. The vulnerability has been assigned a CVSS score of 8.8, indicating high severity. ([windowsforum.com](https://windowsforum.com/threads/cisa-warns-frontier-x2-ble-auth-flaw-can-spoof-ecg-and-health-readings.420539/?utm_source=openai)) The exploitation of this vulnerability could lead to unauthorized control over device functions, such as starting or stopping activities and triggering vibrations, potentially resulting in patient harm. Additionally, attackers can impersonate legitimate devices, injecting false health data like heart rate and breathing rate into the mobile application, compromising the integrity of health monitoring. ([windowsforum.com](https://windowsforum.com/threads/cisa-warns-frontier-x2-ble-auth-flaw-can-spoof-ecg-and-health-readings.420539/?utm_source=openai))
3 months ago
Kill Chain
The Hidden Dangers of AI-Generated Applications: A 2026 Security Analysis
In May 2026, cybersecurity firm RedAccess identified over 380,000 publicly accessible web assets created using AI-driven development platforms, commonly referred to as 'vibe coding' tools. Among these, approximately 5,000 assets appeared to be corporate-related, with more than 2,000 containing sensitive corporate, operational, or personal data. These applications were often deployed without basic access controls, granting administrative access to anyone who accessed the URL. This widespread exposure underscores the significant security risks associated with the rapid adoption of AI-generated code without proper oversight. The incident highlights the urgent need for organizations to implement robust security measures and governance frameworks to manage the risks posed by unauthorized AI-generated applications. As AI-driven development becomes more prevalent, ensuring the security and integrity of these applications is paramount to prevent data breaches and maintain compliance with regulatory standards.
3 months ago
Kill Chain
Malicious Sicoob NuGet Package Compromises Banking Credentials
In May 2026, cybersecurity researchers discovered a malicious NuGet package named 'Sicoob.Sdk' that impersonated a C# software development kit for Sicoob, one of Brazil's largest cooperative financial systems. Versions 2.0.0 through 2.0.4 of this package were found to exfiltrate sensitive information, including client IDs and PFX certificates, which are crucial for secure communications. This incident underscores the growing trend of supply chain attacks targeting software development ecosystems to steal sensitive data. The discovery of 'Sicoob.Sdk' aligns with a series of recent supply chain attacks where malicious packages infiltrate trusted repositories. For instance, the 'TrapDoor' campaign targeted npm, PyPI, and Crates.io ecosystems to distribute credential-stealing malware. These incidents highlight the urgent need for enhanced vigilance and security measures within software supply chains to protect against such threats.
3 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports