✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
E-Learning
Breach intelligence, attack campaigns, and threat reports targeting the E-Learning sector.
Explore Other Sectors
E-Learning Threat Reports
React2Shell (CVE-2025-55182) Exploitation in 2025
In December 2025, a critical vulnerability known as React2Shell (CVE-2025-55182) was disclosed, affecting React Server Components (RSC) versions 19.0 through 19.2.0. This flaw allowed unauthenticated remote code execution (RCE) via malicious HTTP POST requests, enabling attackers to execute arbitrary code on vulnerable servers. Within hours of disclosure, state-sponsored threat groups, including China's Earth Lamia and Jackpot Panda, as well as North Korean actors, began exploiting the vulnerability to deploy malware, establish persistent backdoors, and conduct cyber-espionage activities. The rapid exploitation underscored the severity of the vulnerability and the need for immediate remediation. ([aws.amazon.com](https://aws.amazon.com/blogs/security/china-nexus-cyber-threat-groups-rapidly-exploit-react2shell-vulnerability-cve-2025-55182/?utm_source=openai)) The widespread use of React in web applications, including major platforms like Facebook, Netflix, and Airbnb, amplifies the potential impact of this vulnerability. Organizations are urged to update to patched versions 19.0.1, 19.1.2, and 19.2.1 to mitigate the risk. ([techradar.com](https://www.techradar.com/pro/security/experts-warn-this-worst-case-scenario-react-vulnerability-could-soon-be-exploited-so-patch-now?utm_source=openai))
5 months ago
Kill Chain
MongoDB's 2025 MongoBleed Vulnerability: A Wake-Up Call for Database Security
In December 2025, a critical vulnerability known as MongoBleed (CVE-2025-14847) was discovered in MongoDB servers, allowing unauthenticated attackers to extract sensitive data from server memory. This flaw, stemming from improper handling of compressed network packets, exposed credentials, API keys, and personal information. Despite the release of patches, over 87,000 MongoDB instances remained vulnerable, leading to active exploitation and data breaches. ([cyberinsider.com](https://cyberinsider.com/over-87000-mongodb-instances-remain-exposed-to-mongobleed-attacks/?utm_source=openai)) The rapid exploitation of MongoBleed underscores the persistent risks associated with unpatched software and misconfigured databases. Organizations must prioritize timely updates and robust security configurations to mitigate such vulnerabilities.
5 months ago
Kill Chain
Malicious Chrome Extensions Compromise User Security by Hijacking Affiliate Links and Stealing ChatGPT Tokens
In January 2026, cybersecurity researchers uncovered a series of malicious Google Chrome extensions designed to hijack affiliate links and steal OpenAI ChatGPT authentication tokens. Notably, the 'Amazon Ads Blocker' extension, uploaded by '10Xprofit' on January 19, 2026, claimed to block Amazon ads but covertly injected the developer's affiliate tag into product links, replacing existing ones. This extension was part of a larger cluster targeting e-commerce platforms like AliExpress, Amazon, Best Buy, Shein, Shopify, and Walmart. Additionally, 16 other extensions masquerading as ChatGPT productivity tools were found to exfiltrate ChatGPT session tokens, granting attackers full access to users' conversation histories and associated data. This incident underscores the growing trend of malicious browser extensions exploiting the popularity of AI tools and e-commerce platforms. The deceptive nature of these extensions, often appearing legitimate and even bearing 'Featured' badges, highlights the need for heightened vigilance among users and stricter vetting processes by browser extension stores to prevent such security breaches.
5 months ago
Kill Chain
Cloudflare ACME WAF Bypass: How a 2026 Edge Vulnerability Left Origins Exposed
In January 2026, Cloudflare disclosed and remediated a critical vulnerability in its ACME (Automatic Certificate Management Environment) HTTP-01 validation process. The flaw allowed attackers to craft requests that bypassed Cloudflare's Web Application Firewall (WAF), gaining unauthorized access to protected origin servers by exploiting the path handling for ACME challenges. There is no evidence of mass exploitation, but the vulnerability exposed the underlying infrastructure to potential attacks until it was patched. Cloudflare identified, investigated, and quickly deployed a fix to mitigate further risk to its global customer base. The incident highlights the ongoing importance of robust validation logic and continuous testing in security edge infrastructure. As attackers adapt to complex cloud architectures, bypass techniques targeting certificate management or internal authentication flows are increasingly relevant for organizations using shared security platforms.
6 months ago
Kill Chain
Critical WordPress Modular DS Plugin Vulnerability Enables Site Takeover
In January 2026, a critical security vulnerability (CVE-2026-23550, CVSS 10.0) surfaced in all versions of the WordPress Modular DS plugin prior to 2.5.2. The flaw allowed unauthenticated attackers to escalate privileges and take over administrator accounts by exploiting a combination of weak route authentication and permissive auto-login features, impacting over 40,000 active websites. Active exploitation began on January 13, 2026, with attackers leveraging specifically crafted HTTP GET requests through the exposed "/api/modular-connector/login/" endpoint and originating from known malicious IPs. Compromised sites faced risks of full takeover, data exfiltration, or malware delivery. This incident underscores the growing trend of supply-chain and plugin-based attacks in widely used web platforms, highlighting attackers’ shift to exploiting software design weaknesses over traditional single code bugs. The case serves as a cautionary tale for organizations reliant on third-party integrations and CMS plugins, reinforcing the importance of timely patching and continuous risk assessments.
6 months ago
Kill Chain
Kyowon 2026 Ransomware Attack: Lessons from a Massive Data Breach
In January 2026, Kyowon Group, a major South Korean conglomerate specializing in education and consumer services, suffered a disruptive ransomware attack impacting approximately 600 out of 800 servers. The attack resulted in significant operational outages and the confirmed exfiltration of internal data, with the potential exposure of information tied to over 9.6 million registered user accounts. While the full scope of compromised customer data is under investigation, Kyowon immediately notified authorities and began working with security experts to contain the breach and restore services. No ransomware group has publicly claimed responsibility as of now. This incident highlights an ongoing trend of large-scale cyberattacks against major South Korean enterprises, with mounting pressure from regulatory bodies to improve cyber resilience. The Kyowon case exemplifies how attackers are increasingly targeting critical service infrastructure and customer databases for extortion, making robust endpoint protection and incident response capabilities more essential than ever.
6 months ago
Kill Chain
Browser-in-Browser Phishing Surge: Facebook Credential Thefts Expose New Risks in 2024
In early 2024, cybercriminals dramatically escalated the use of the 'browser-in-browser' (BitB) attack technique to steal Facebook login credentials. This method mimics a legitimate browser popup within the user's real window, tricking individuals into entering their login details on phishing sites that look identical to authentic Facebook authentication dialogs. Attackers lure victims through targeted ads, social engineering, and cleverly crafted phishing emails. The impact includes widespread account compromise, enabling follow-on fraud, spam campaigns, and potential data exfiltration from the compromised users' profiles. Facebook, along with the wider cybersecurity community, is warning users and rolling out alerts in response, but overall threat exposure remains high. The BitB phishing approach reflects a concerning trend of attackers using more advanced visual deceptions to bypass user awareness and established security controls. Its prevalence highlights a widening capability gap in traditional anti-phishing technologies, reinforcing the need for robust anomaly response and continuous education amid shifting adversary tactics.
6 months ago
Kill Chain
Critical AdonisJS Bodyparser Flaw Exposes Servers to Arbitrary File Write (CVE-2026-21440)
In January 2026, a critical vulnerability (CVE-2026-21440, CVSS 9.2) was disclosed in the widely-used @adonisjs/bodyparser npm package, a foundational component for handling multipart form data in AdonisJS applications. The flaw, attributed to improper validation of user-supplied input, allowed remote attackers to exploit a path traversal bug, thereby enabling arbitrary file writes to affected servers. Successful exploitation could ultimately lead to full system compromise, data breach or destructive attacks, due to the broad permissions often held by server-side runtimes. The risk was amplified by the widespread use of AdonisJS across SaaS, fintech, and e-commerce platforms. This incident underscores broader supply-chain security concerns impacting open-source software ecosystems. Attackers are aggressively targeting commonly used packages to gain upstream access, making robust dependency management, real-time vulnerability monitoring, and rapid patch adoption vital defensive practices for modern development teams.
6 months ago
Kill Chain
MongoBleed: Active Exploitation of MongoDB Memory Leak Puts Credentials at Risk in 2024
In June 2024, a critical vulnerability nicknamed "MongoBleed" was discovered in MongoDB, exposing servers to a memory leak flaw that enables unauthenticated attackers to extract sensitive data such as passwords and authentication tokens. Threat actors are actively exploiting the flaw by sending specially crafted requests to exposed MongoDB endpoints, resulting in chunks of memory—including user credentials and potentially session information—being sent in response. Organizations running unpatched MongoDB instances faced increased risk of credential theft, lateral movement, and potential data breaches, with attacks escalating once public proof-of-concept exploits were released. The MongoBleed incident highlights a surge in opportunistic attacks against cloud-managed databases and underscores the crucial need for rapid patch deployment. The attack's simplicity, combined with the prevalence of cloud-exposed databases in hybrid environments, makes this vulnerability especially relevant as organizations transition to zero-trust and improved segmentation to defend against credential harvesting and related threats.
6 months ago
Kill Chain
RondoDox Botnet: React2Shell Flaw Drives Massive Next.js Server Breaches
In December 2025, the RondoDox botnet exploited the critical React2Shell vulnerability (CVE-2025-55182) to breach hundreds of Next.js servers worldwide. Researchers observed the botnet initiating mass scans and automated remote code execution attacks against exposed servers, deploying malware, persistent botnet loaders, and cryptominers. RondoDox leveraged the unpatched flaw in the widely used React Server Components protocol, enrolling compromised systems and IoT devices into its botnet and wiping out competing malware. The attack impacted both consumer and enterprise networks, risking data exfiltration, service outages, and broader supply chain compromise. This campaign underscores the increased urgency around patching application-layer vulnerabilities at scale, as attackers rapidly weaponize zero-day and n-day exploits across popular frameworks. The prevalence of automated exploitation and lateral expansion tactics reflects a shifting threat landscape that challenges traditional perimeter security and requires robust detection, segmentation, and rapid response capabilities.
6 months ago
Kill Chain
ErrTraffic ClickFix: The 2024 Malware Campaign Exploiting Fake Browser Glitches
In March 2024, security researchers uncovered a large-scale cybercriminal campaign leveraging a service named ErrTraffic to automate 'ClickFix' attacks via fake browser glitches. Threat actors compromised legitimate websites, deploying scripts to simulate error pop-ups and glitches that tricked users into downloading malicious payloads or executing harmful actions. The attackers utilized advanced social engineering, presenting credible browser dialog impersonations, and used the campaign to rapidly distribute information-stealing malware across multiple geographies. The impact included significant compromises of user credentials and personal information, highlighting growing risk to businesses reliant on web applications. This incident is particularly notable as it demonstrates both evolving infostealer TTPs and the increasing sophistication of social engineering through browser-manipulation. The widespread adoption of automated 'glitch' services like ErrTraffic signals a broader shift towards commoditizing web-based attacks targeting both enterprises and individuals.
6 months ago
Kill Chain
MongoBleed 2025: Critical MongoDB Vulnerability Exposes Data on 87K Servers
In early June 2025, the MongoBleed vulnerability (CVE-2025-14847) was actively exploited against MongoDB servers worldwide, exposing sensitive database secrets and credentials on over 87,000 publicly accessible systems. Attackers exploited a flaw present in multiple MongoDB versions, allowing unauthorized access to in-transit data and internal database secrets without authentication. The exposure occurred as a result of inadequate encryption and misconfiguration, providing an entry point for lateral movement, data exfiltration, and potentially further compromise of enterprise networks. Organizations in finance, healthcare, SaaS, and retail sectors have been especially impacted by this incident, given their widespread MongoDB adoption for critical workloads. This breach highlights an increasingly common pattern of weaponizing newly disclosed database vulnerabilities at scale by sophisticated threat actors. The incident underscores the urgent need for robust encryption practices, Zero Trust segmentation, and vigilant patch management to protect highly sensitive data and prevent large-scale exposure as regulatory scrutiny and attacker sophistication intensify.
6 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports