Computer Software/Engineering
Breach intelligence, attack campaigns, and threat reports targeting the Computer Software/Engineering sector.
Explore Other Sectors
Computer Software/Engineering Threat Reports
Claude Mythos AI Enhances Firefox Security with 271 Vulnerability Fixes
In April 2026, Mozilla collaborated with Anthropic to utilize the advanced AI model, Claude Mythos, for a comprehensive security audit of Firefox. This partnership led to the identification and remediation of 271 vulnerabilities in Firefox 150, marking a significant advancement in AI-assisted cybersecurity. The vulnerabilities ranged from minor issues to critical flaws, all of which were addressed in the latest release. This initiative underscores the potential of AI in enhancing software security by rapidly detecting and mitigating vulnerabilities that might elude traditional methods. The success of this collaboration highlights a pivotal shift in cybersecurity, where defenders can leverage AI to gain a decisive advantage over potential threats. As AI tools become more sophisticated, their integration into security protocols is expected to become standard practice, offering a proactive approach to threat detection and resolution.
4 months ago
Kill Chain
Vercel's 2026 Security Breach: A Wake-Up Call for Third-Party Integration Risks
In April 2026, Vercel, a cloud development platform known for supporting frameworks like Next.js, experienced a security breach originating from a compromised third-party AI tool, Context.ai. An attacker exploited this tool to access a Vercel employee's Google Workspace account, subsequently infiltrating Vercel's internal systems. This led to unauthorized access to non-sensitive environment variables, posing potential risks to customer data. The breach underscores the vulnerabilities associated with interconnected systems and the importance of stringent access controls. ([vercel.com](https://vercel.com/kb/bulletin/vercel-april-2026-security-incident/?utm_source=openai)) This incident highlights the growing threat landscape where attackers leverage third-party integrations to gain unauthorized access to enterprise systems. Organizations must reassess their security postures, especially concerning third-party tools, to mitigate such risks effectively.
5 months ago
Kill Chain
Exploring AI Security: The 'Otto Support' MCP Challenge
In April 2026, Bishop Fox introduced 'Otto Support,' a Capture-The-Flag (CTF) challenge designed to expose vulnerabilities in Model Context Protocol (MCP)-based AI systems. This hands-on exercise simulates real-world attack scenarios where AI assistants interact with tools, services, and local resources, highlighting potential security flaws in modern AI architectures. Participants are tasked with escalating privileges, exfiltrating data, and executing code, thereby uncovering how MCP-enabled systems can be exploited in practice. The relevance of this challenge is underscored by the rapid adoption of AI technologies and the corresponding emergence of new attack surfaces. As organizations integrate AI assistants into their operations, understanding and mitigating the security risks associated with MCP-based systems becomes imperative to prevent potential breaches and maintain trust in AI-driven processes.
5 months ago
Kill Chain
Navigating the Cybersecurity Challenges of Frontier AI Models in 2026
In April 2026, the cybersecurity landscape witnessed a significant shift with the emergence of frontier AI models like Anthropic's Claude Mythos. These advanced AI systems demonstrated unprecedented capabilities in autonomously identifying and exploiting software vulnerabilities, effectively performing tasks that previously required extensive human expertise. The rapid development and deployment of such models have raised concerns about their potential misuse, as they can lower the barrier for launching sophisticated cyberattacks and accelerate the exploitation of vulnerabilities across critical infrastructures. ([weforum.org](https://www.weforum.org/stories/2026/04/anthropic-mythos-ai-cybersecurity/?utm_source=openai)) This development underscores the urgent need for organizations to reassess their cybersecurity strategies. The dual-use nature of frontier AI models means they can be harnessed for both defensive and offensive purposes, necessitating robust governance frameworks and collaborative efforts between AI developers, cybersecurity professionals, and policymakers to mitigate emerging risks and ensure the safe deployment of these powerful technologies. ([openai.com](https://openai.com/index/frontier-ai-regulation/?utm_source=openai))
5 months ago
Kill Chain
NASA Employees Targeted in Chinese Phishing Scheme
Between January 2017 and December 2021, Chinese national Song Wu orchestrated a sophisticated spear-phishing campaign targeting NASA, the U.S. military, universities, and private companies. By impersonating U.S. researchers and engineers, Wu successfully obtained sensitive aerospace software and source code, violating U.S. export control laws. The scheme led to unauthorized access to defense-related technologies, posing significant national security risks. In September 2024, Wu was indicted on multiple counts of wire fraud and aggravated identity theft but remains at large. This incident underscores the persistent threat of state-sponsored cyber espionage and the critical need for robust cybersecurity measures to protect sensitive information. Organizations must remain vigilant against increasingly sophisticated phishing tactics employed by foreign adversaries.
4 months ago
Kill Chain
Kaspersky Uncovers 26 Fake Crypto Wallet Apps on Apple App Store
In April 2026, Kaspersky identified 26 fraudulent applications on the Apple App Store that impersonated popular cryptocurrency wallets such as MetaMask, Ledger, and Coinbase. These apps redirected users to phishing pages mimicking the App Store, leading to the installation of trojanized wallet applications designed to steal recovery phrases and private keys, thereby draining users' cryptocurrency holdings. The campaign, active since at least fall 2025, is attributed with moderate confidence to the threat actors behind SparkKitty. ([kaspersky.co.uk](https://www.kaspersky.co.uk/about/press-releases/kaspersky-finds-26-fake-crypto-wallet-apps-on-apples-app-store-that-can-drain-digital-assets?utm_source=openai)) This incident underscores the evolving sophistication of cyber threats targeting cryptocurrency users, highlighting the need for heightened vigilance and robust security measures. The exploitation of trusted platforms like the Apple App Store for distributing malicious apps signifies a concerning trend in cybercriminal tactics.
4 months ago
Kill Chain
Tropic Trooper's 2026 Cyber Espionage Campaign: A Deep Dive
In March 2026, the advanced persistent threat group Tropic Trooper launched a targeted cyber espionage campaign against Chinese-speaking individuals in Taiwan, South Korea, and Japan. The attackers utilized a trojanized version of the SumatraPDF reader to deploy the AdaptixC2 Beacon agent, facilitating remote access through the abuse of Microsoft Visual Studio Code tunnels. This multi-stage attack began with military-themed document lures, leading to the execution of malicious payloads that established command and control channels via GitHub repositories. The campaign underscores the evolving tactics of Tropic Trooper, known for its focus on intelligence gathering in East Asia. This incident highlights the increasing sophistication of state-sponsored cyber threats, particularly in their use of legitimate tools and platforms to evade detection. Organizations must remain vigilant against such tactics, emphasizing the need for robust endpoint security, user education on phishing schemes, and continuous monitoring of network activities to detect and mitigate unauthorized access attempts.
4 months ago
Kill Chain
LMDeploy CVE-2026-33626: A Case Study in Rapid Vulnerability Exploitation
A high-severity Server-Side Request Forgery (SSRF) vulnerability, identified as CVE-2026-33626 with a CVSS score of 7.5, was discovered in LMDeploy, an open-source toolkit for compressing, deploying, and serving large language models (LLMs). This flaw resides in the vision-language module's `load_image()` function, which fetches arbitrary URLs without validating internal or private IP addresses, potentially allowing attackers to access cloud metadata services, internal networks, and sensitive resources. The vulnerability affects all versions up to 0.12.2 and was patched in version 0.12.3. Notably, within 13 hours of its public disclosure, the vulnerability was actively exploited in the wild, with attackers targeting AWS Instance Metadata Service (IMDS) and Redis instances, testing egress with out-of-band DNS callbacks, and performing port scans on the loopback interface. This rapid exploitation underscores the critical need for prompt vulnerability management and patching practices. The incident highlights a concerning trend where threat actors swiftly weaponize newly disclosed vulnerabilities, particularly in AI infrastructure components, emphasizing the importance of proactive security measures and continuous monitoring to mitigate potential risks.
4 months ago
Kill Chain
Lazarus Group's 'ClickFix' Campaign: A Wake-Up Call for macOS Security
In April 2026, North Korea's Lazarus Group initiated a cyberattack campaign targeting macOS users in the fintech and cryptocurrency sectors. Utilizing a social engineering technique known as 'ClickFix,' attackers impersonated trusted contacts to send fake online meeting invitations via platforms like Telegram. Victims were deceived into executing malicious commands in their macOS Terminal, leading to the installation of a malware toolkit named 'Mach-O Man.' This malware facilitated credential theft, system profiling, and data exfiltration, compromising corporate systems and financial resources. This incident underscores the evolving sophistication of state-sponsored cyber threats, particularly against macOS platforms previously considered less vulnerable. The use of social engineering tactics like ClickFix highlights the critical need for organizations to enhance user awareness and implement robust security measures to mitigate such deceptive attack vectors.
4 months ago
Kill Chain
Project Glasswing: AI's Role in Transforming Cybersecurity
In April 2026, Anthropic launched Project Glasswing, an initiative leveraging its advanced AI model, Claude Mythos Preview, to identify and remediate critical software vulnerabilities. Collaborating with major tech companies like AWS, Apple, Cisco, CrowdStrike, Google, Microsoft, and Palo Alto Networks, the project uncovered thousands of zero-day vulnerabilities across major operating systems and browsers, including a 27-year-old OpenBSD flaw and a 16-year-old FFmpeg bug. This initiative underscores the shift from traditional enumeration-based security tools to AI-driven analysis capable of understanding code intent and relationships, thereby identifying flaws that eluded conventional methods. The significance of Project Glasswing lies in its demonstration of AI's potential to revolutionize cybersecurity by proactively detecting and addressing vulnerabilities before they can be exploited. This proactive approach is crucial in an era where attackers increasingly leverage sophisticated tools, including AI, to identify and exploit security weaknesses. Organizations must adapt to this evolving threat landscape by integrating AI-driven security solutions to enhance their defensive capabilities.
4 months ago
Kill Chain
ADT Data Breach 2026: Lessons in SSO Security
In April 2026, home security company ADT experienced a data breach orchestrated by the ShinyHunters extortion group. The attackers gained unauthorized access to ADT's systems through a voice phishing (vishing) attack, compromising an employee's Okta single sign-on (SSO) account. This access allowed them to infiltrate ADT's Salesforce instance and exfiltrate personal information, including names, phone numbers, addresses, and, in some cases, dates of birth and partial Social Security numbers. Notably, no payment information or customer security systems were affected. ADT promptly terminated the intrusion, launched an investigation, and notified all affected individuals. This incident underscores the escalating threat posed by sophisticated social engineering attacks targeting SSO credentials. Organizations must enhance their security awareness training and implement robust multi-factor authentication protocols to mitigate such risks.
4 months ago
Kill Chain
In-Depth Analysis of the 2026 Axios npm Supply Chain Attack
In March 2026, attackers compromised the npm account of a lead maintainer of Axios, a widely-used JavaScript HTTP client library with over 100 million weekly downloads. They released two malicious versions of the package—axios@1.14.1 and axios@0.30.4—which included a trojan-laden dependency named 'plain-crypto-js'. This rogue package executed a post-installation script that downloaded and installed a cross-platform Remote Access Trojan (RAT) targeting macOS, Windows, and Linux systems. The malware connected to a command-and-control server, deployed system-specific payloads, and erased its tracks to evade detection. The malicious versions were available for approximately two to three hours before being removed from the npm registry. ([tomshardware.com](https://www.tomshardware.com/tech-industry/cyber-security/axios-npm-package-compromised-in-supply-chain-attack-that-deployed-a-cross-platform-rat?utm_source=openai)) This incident underscores the escalating threat of supply chain attacks within the open-source ecosystem. The rapid deployment and widespread use of compromised packages highlight the need for enhanced security measures in software development pipelines. Organizations are urged to implement stringent access controls, conduct regular audits of dependencies, and monitor for unusual activity to mitigate the risks associated with such attacks.
4 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports