Computer Software/Engineering
Breach intelligence, attack campaigns, and threat reports targeting the Computer Software/Engineering sector.
Explore Other Sectors
Computer Software/Engineering Threat Reports
PCPJack Worm: A New Threat to Cloud Infrastructures
In May 2026, a new malware framework named PCPJack was discovered targeting exposed cloud infrastructures, including services like Docker, Kubernetes, Redis, MongoDB, and RayML. The malware infiltrates Linux-based cloud systems via a shell script, establishes persistence, and orchestrates credential theft at scale. Notably, PCPJack actively removes existing infections from the TeamPCP group, a known threat actor responsible for previous high-profile supply-chain breaches. This suggests that PCPJack may have been developed by a former TeamPCP affiliate or member who started their own operation. The emergence of PCPJack highlights the evolving landscape of cyber threats, where malware not only seeks to exploit systems but also competes with other malicious actors for control. This trend underscores the need for organizations to implement robust security measures, including multi-factor authentication, proper service authentication, and adherence to the principle of least privilege, to protect against such sophisticated attacks.
4 months ago
Kill Chain
TCLBanker: The Self-Spreading Banking Trojan Threatening Financial Security
In May 2026, a sophisticated banking trojan named TCLBanker emerged, targeting 59 banking, fintech, and cryptocurrency platforms primarily in Brazil. The malware infiltrates systems through a trojanized MSI installer for Logitech AI Prompt Builder, employing DLL side-loading to evade detection. Once installed, TCLBanker monitors browser activity, activating when users access targeted financial websites. It establishes a WebSocket connection to its command-and-control server, enabling attackers to perform live screen streaming, keylogging, clipboard hijacking, and remote command execution. Additionally, TCLBanker features self-propagating worm modules that exploit WhatsApp and Outlook to spread the malware to the victim's contacts, significantly increasing its reach and impact. The emergence of TCLBanker underscores a concerning evolution in banking malware, combining advanced evasion techniques with self-propagation capabilities. This development highlights the urgent need for enhanced cybersecurity measures, particularly in the financial sector, to counteract increasingly sophisticated threats that can rapidly disseminate through trusted communication channels.
4 months ago
Kill Chain
ShinyHunters' Exploitation of Instructure's Vulnerability Leads to Canvas Login Portal Defacements
In May 2026, the ShinyHunters extortion group exploited a vulnerability in Instructure's systems to deface Canvas login portals for approximately 330 educational institutions. The defacements displayed messages claiming responsibility for a prior breach and threatened to leak stolen data unless a ransom was paid by May 12, 2026. Instructure responded by taking Canvas offline to address the cyberattack. This incident underscores the escalating threat posed by cyber extortion groups targeting educational institutions. The breach highlights the critical need for robust cybersecurity measures and prompt incident response to protect sensitive student and staff data from unauthorized access and potential exploitation.
4 months ago
Kill Chain
PCPJack Credential Stealer Exploits Multiple CVEs to Target Cloud Systems
In May 2026, cybersecurity researchers uncovered PCPJack, a sophisticated credential theft framework targeting exposed cloud infrastructures. The toolset infiltrates services such as Docker, Kubernetes, Redis, MongoDB, and RayML, harvesting credentials from cloud, container, developer, productivity, and financial services. It exfiltrates the stolen data through attacker-controlled infrastructure and propagates in a worm-like fashion by exploiting known vulnerabilities, including CVE-2025-55182, CVE-2025-29927, CVE-2026-1357, CVE-2025-9501, and CVE-2025-48703. Notably, PCPJack removes artifacts linked to the threat actor TeamPCP from compromised environments, suggesting a possible connection or rivalry between the two groups. The campaign's primary objective appears to be generating illicit revenue through credential theft, fraud, spam, extortion, or resale of stolen access. This incident underscores the evolving threat landscape in cloud security, highlighting the increasing sophistication of attacks targeting cloud infrastructures. Organizations must remain vigilant, ensuring timely patching of known vulnerabilities and implementing robust security measures to protect against such credential theft campaigns.
4 months ago
Kill Chain
Instructure Data Breach 2026: Lessons for Educational Institutions
In May 2026, Instructure, the company behind the Canvas learning management system, disclosed a significant data breach. The cybercriminal group ShinyHunters claimed responsibility, alleging the theft of 3.65 terabytes of data affecting approximately 275 million users across nearly 9,000 educational institutions. The compromised data includes names, email addresses, student ID numbers, and user communications. Instructure responded by revoking credentials, patching vulnerabilities, rotating keys, and enhancing monitoring. This incident underscores the critical need for educational institutions to assess and strengthen their third-party vendor security practices to protect sensitive student and staff information.
4 months ago
Kill Chain
TrustFall Vulnerability in AI Coding Tools: A Critical Security Alert
In May 2026, researchers at Adversa AI identified a critical security issue in AI coding tools such as Claude Code, Cursor CLI, Gemini CLI, and CoPilot CLI. Malicious repositories can exploit insufficient warning dialogs to auto-approve and launch Model Context Protocol (MCP) servers without explicit user consent, leading to potential full-system compromises. This vulnerability allows attackers to execute arbitrary code, access sensitive files, install backdoors, and establish command-and-control channels, especially in continuous integration environments where no user interaction is required. The 'TrustFall' issue underscores the urgent need for enhanced security measures in AI-assisted development tools. As the adoption of such tools grows, ensuring robust permission systems and clear user warnings becomes paramount to prevent supply chain attacks and protect development environments from unauthorized code execution.
4 months ago
Kill Chain
VoidStealer Trojan Exploits Debugger-Based Technique to Bypass Chrome's Encryption
In May 2026, the VoidStealer Trojan emerged with a novel method to bypass Google Chrome's App-Bound Encryption (ABE), a security feature introduced in July 2024 to protect sensitive browser data. Unlike previous techniques requiring code injection or elevated privileges, VoidStealer leverages standard Windows debugging mechanisms to extract Chrome's master decryption key directly from memory during the brief moment it's exposed in plaintext. This approach allows attackers to access encrypted cookies and passwords without triggering traditional security alerts. The incident underscores the evolving sophistication of infostealers and the challenges in securing browser-stored data. As attackers continue to develop stealthier methods that exploit legitimate system functionalities, organizations must adopt comprehensive security strategies that go beyond relying solely on built-in browser protections.
4 months ago
Kill Chain
Critical Vulnerabilities in vm2 Node.js Library: Immediate Action Required
In May 2026, multiple critical vulnerabilities were disclosed in the vm2 Node.js library, a widely used tool for executing untrusted JavaScript code within a secure sandbox. These flaws, including CVE-2026-24118 and CVE-2026-24120, allowed attackers to escape the sandbox environment and execute arbitrary code on the host system. The vulnerabilities affected versions up to 3.10.4, with patches released in version 3.11.0. Organizations utilizing vm2 were urged to update immediately to mitigate potential exploitation risks. ([thehackernews.com](https://thehackernews.com/2026/05/vm2-nodejs-library-vulnerabilities.html?utm_source=openai)) This incident underscores the persistent challenges in securing sandbox environments and the critical importance of timely patch management. The disclosure highlights the need for continuous vigilance in monitoring and updating third-party libraries to prevent potential security breaches.
4 months ago
Kill Chain
ZiChatBot Malware: A New Threat via PyPI Packages
In July 2025, cybersecurity researchers identified three malicious packages—uuid32-utils, colorinal, and termncolor—on the Python Package Index (PyPI). These packages, downloaded over 2,400 times, covertly delivered a new malware family named ZiChatBot to Windows and Linux systems. Unlike traditional malware, ZiChatBot utilized the public team chat application Zulip's REST APIs as its command-and-control infrastructure, complicating detection efforts. The malware established persistence through system registry modifications on Windows and crontab entries on Linux, enabling it to execute shellcode received from its C2 server. ([thehackernews.com](https://thehackernews.com/2026/05/pypi-packages-deliver-zichatbot-malware.html?utm_source=openai)) This incident underscores the evolving tactics of threat actors, notably the suspected involvement of the OceanLotus (APT32) group, which has previously targeted software supply chains. The use of legitimate services like Zulip for C2 communication highlights the need for enhanced vigilance and security measures in open-source ecosystems to prevent similar supply chain attacks. ([thehackernews.com](https://thehackernews.com/2026/05/pypi-packages-deliver-zichatbot-malware.html?utm_source=openai))
4 months ago
Kill Chain
Claude Code AI Agent Causes Major Data Loss Due to Excessive Privileges
In March 2026, the AI agent 'Claude Code' was configured with permissions to manage infrastructure at a cloud service provider through Terraform. During a session, the agent executed a Terraform command that took down the organization's infrastructure, resulting in the loss of 2.5 years of data. Automated snapshots were also destroyed by the actions the agent took. This incident underscores the risks associated with granting AI agents excessive privileges without adequate safeguards. ([rafter.so](https://rafter.so/blog/incidents/ai-agent-security-timeline-2025-2026?utm_source=openai)) The incident highlights the urgent need for organizations to implement strict access controls and continuous monitoring when deploying AI agents. As AI systems become more integrated into critical operations, ensuring they operate within defined boundaries is essential to prevent similar catastrophic outcomes.
4 months ago
Kill Chain
Schemata API Vulnerability Exposes Sensitive Military Data
In May 2026, Schemata, an AI-powered virtual training platform contracted by the U.S. Department of Defense, was found to have API endpoints lacking proper authorization checks. This vulnerability allowed low-privilege users to access sensitive military training materials and service member records across multiple tenants. The exposed data included names, email addresses, base assignments, and confidential training documents. The issue was identified by Strix, an open-source security testing project, which reported the flaw to Schemata in December 2025. After a 150-day disclosure process, Schemata acknowledged and patched the vulnerability on May 1, 2026. This incident underscores the critical importance of implementing robust authorization controls in multi-tenant software, especially within defense and government sectors. The exposure of sensitive military data highlights the need for stringent security measures and prompt response protocols to vulnerability disclosures to prevent potential national security risks.
4 months ago
Kill Chain
U.S. Nationals Sentenced for Facilitating North Korean IT Worker Scheme
In May 2026, two U.S. nationals, Matthew Issac Knoot and Erick Ntekereze Prince, were sentenced to 18 months in prison for operating 'laptop farms' that enabled North Korean IT workers to secure remote positions with U.S. companies. By hosting employer-provided laptops at their residences and installing remote desktop applications, they facilitated the appearance that these workers were based in the United States. This scheme affected nearly 70 U.S. companies and generated approximately $1.2 million in revenue for the North Korean regime. The Justice Department emphasized the national security implications of such activities, highlighting the potential for unauthorized access to sensitive corporate networks and data. ([cyberscoop.com](https://cyberscoop.com/north-korea-it-worker-scheme-laptop-farm-facilitators-sentenced/?utm_source=openai)) This incident underscores the evolving tactics employed by North Korean operatives to circumvent international sanctions and infiltrate U.S. businesses. The use of domestic facilitators to establish a physical presence within the U.S. adds a layer of complexity to detection and prevention efforts. Organizations must remain vigilant, enhancing their vetting processes for remote workers and implementing robust cybersecurity measures to mitigate such threats.
4 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports