✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
E-Learning
Breach intelligence, attack campaigns, and threat reports targeting the E-Learning sector.
Explore Other Sectors
E-Learning Threat Reports
How Phantom Shuttle Chrome Extensions Undermined Enterprise Security with Man-in-the-Middle Attacks
In December 2025, cybersecurity researchers discovered two versions of a Google Chrome extension named 'Phantom Shuttle' that secretly intercepted network traffic and stole user credentials from over 170 targeted domains. Masquerading as a legitimate VPN and speed test tool, these browser add-ons leveraged proxy permissions and malicious JavaScript code to inject authentication credentials and enable man-in-the-middle attacks. Users paid for subscriptions believing they were purchasing a secure service, while in reality, their web traffic, including passwords, authentication cookies, credit card information, API keys, and browsing histories, was exfiltrated continuously to a threat actor-controlled command-and-control server. The operation leveraged a subscription model and payment integrations via Alipay and WeChat, while traffic was routed through threat actor proxies managed via PAC scripts. This incident highlights a growing trend of browser extension abuse, with attackers monetizing malicious add-ons under the guise of productivity or security tools. With enterprise users increasingly utilizing browser extensions for business workflows, unmanaged browser risk is rapidly becoming a critical threat to organizational data security and compliance.
6 months ago
Kill Chain
RansomHouse's 2025 Encryption Leap: The Rise of 'Mario' and Multi-Layered Ransomware
In December 2025, the RansomHouse ransomware-as-a-service (RaaS) group unveiled a major upgrade to its encryptor, dubbed ‘Mario’, shifting from a basic linear technique to a complex multi-layered encryption process. This variant leverages dynamic chunking, dual encryption keys, sophisticated memory organization, and non-linear file processing, making data recovery and reverse engineering significantly more challenging. Targeting environments such as VMware ESXi, the upgraded tooling enables attackers to encrypt large volumes of files efficiently, evidenced by attacks on organizations including Japanese e-commerce giant Askul, leading to substantial operational disruption and customer data compromise. RansomHouse’s encryption evolution underscores the continuing professionalization of RaaS groups, complicating detection and recovery for defenders. As multi-layered and adaptive ransomware proliferates, organizations face heightened risks, regulatory scrutiny, and the need to adopt advanced segmentation, visibility, and threat response controls.
6 months ago
Kill Chain
GhostPoster Malware Infects 17 Firefox Extensions: Supply Chain Risks Hit 50,000+ Users
In late 2025, cybersecurity researchers discovered a campaign named GhostPoster, which compromised the supply chain of Mozilla Firefox by infiltrating 17 browser add-ons with malicious JavaScript. These extensions, collectively downloaded over 50,000 times, were found to hijack affiliate links, inject tracking scripts, and facilitate click and ad fraud. Threat actors used logo image files within the add-ons to conceal the payload and persist across infected hosts. The extensions were promptly removed from the Mozilla add-ons marketplace upon disclosure, but impacted users may have experienced privacy violations and fraudulent activity. This incident highlights continued escalation in browser extension-based supply chain attacks and the increased sophistication of threat actors at targeting trusted ecosystem channels. With organizations relying on browser tools for productivity, ongoing diligence is required to detect, respond to, and prevent similar infiltrations leveraging obfuscated techniques.
6 months ago
Kill Chain
React2Shell CVE-2025-55182: Remote Code Execution Attacks Surge in 2025
In December 2025, active exploitation of a critical vulnerability in React2Shell (CVE-2025-55182) was detected, enabling remote code execution on unpatched servers. Attackers deployed a sequence of crafted HTTP requests to download and write malicious binaries onto world-writable Linux directories, such as /dev/shm and /tmp, then modified permissions to prepare for subsequent execution. The threat was identified by security researchers monitoring exploit payloads, which often leveraged ambiguous malware—classified as either adware or crypto miners—resulting in the compromise of affected servers and potentially unauthorized resource usage or data exfiltration. This campaign exemplifies the ongoing risk posed by delayed patch management, with adversaries swiftly evolving their payloads and exploiting widespread attack surfaces. The frequency of similar incidents underscores the importance of timely security updates and hardened configurations, particularly for widely deployed web services.
6 months ago
Kill Chain
PayPal Subscriptions Abused for Advanced Phishing Campaigns in 2024
In mid-2024, cybercriminals exploited PayPal’s legitimate ‘Subscriptions’ billing feature to send authentic-looking emails with fraudulent purchase notifications. By inserting malicious information into the Customer Service URL field, attackers leveraged PayPal’s trusted platform to bypass spam filters, tricking recipients into believing they had initiated a costly subscription. Victims, startled by these official-looking emails, contacted the provided phone numbers, which connected them to threat actors conducting social engineering attacks, potentially resulting in credential theft or financial loss. This incident highlights a growing trend of attackers abusing trusted platforms and supply chain features to execute highly persuasive phishing campaigns. Increased reliance on platform-generated transactional emails, coupled with social engineering, presents new security and compliance challenges for organizations and consumers alike.
6 months ago
Kill Chain
React2Shell Exploit Wave Exposes Web App Security Gaps in 2025
In December 2025, the critical React2Shell (CVE-2025-55182) vulnerability was actively exploited following its public disclosure. Attackers leveraged unsafe deserialization in React Server Components, impacting frameworks including React and Next.js. Proof-of-concept exploits rapidly spread online, with some functional variants enabling remote code execution. Exploit activity was observed from China-nexus threat groups and opportunistic cybercriminals, resulting in widespread targeting of vulnerable systems with cryptominers, infostealers, and webshells. Security vendors and threat researchers noted that while many PoC attacks were ineffective, validated exploits—some featuring advanced WAF bypasses and in-memory payloads—posed serious risks to organizations relying on web application frameworks. The incident highlights the increasing sophistication of attackers in quickly adapting and bypassing newly deployed defenses such as WAF rules. As automated scanning and exploit release cycles accelerate, enterprises face mounting challenges in promptly identifying, patching, and defending against RCE vulnerabilities across their web application infrastructure.
6 months ago
Kill Chain
Coupang’s 2024 Insider Breach: Ex-Employee Exposes 33.7 Million Customer Records
In June 2024, Coupang suffered a major data breach that exposed the personal information of approximately 33.7 million customers. The incident was traced to a former employee who maintained unauthorized access to internal systems after leaving the company. The ex-employee exploited residual system credentials to retrieve sensitive data, which included names, addresses, and contact details. Coupang discovered the breach during a security review and promptly notified regulatory authorities, emphasizing no financial information or passwords were accessed. Immediate actions included revoking all unnecessary access and tightening access control policies. This breach underscores the persistent issue of insider threats and the dangers of insufficient deprovisioning of system access. As remote work and rapid staff turnovers continue, organizations face heightened pressures to implement robust identity and access management to prevent similar incidents.
6 months ago
Kill Chain
Cloudflare 2024 Outage: Why Network Resilience and Redundancy Matter More Than Ever
On June 20, 2024, Cloudflare, a major internet infrastructure and security provider, suffered a widespread service outage that disrupted access to thousands of websites and web services globally. The event was characterized by persistent 500 Internal Server Error messages for end users. Cloudflare initiated an internal investigation, ultimately attributing the incident to a critical infrastructure failure rather than a cyberattack or external threat. Throughout the outage, web-facing businesses, SaaS providers, and end-users experienced degraded network performance, extended downtime, and impact to brand trust, illustrating the magnitude of hyperscaler dependencies. The Cloudflare outage highlights the increasing risks associated with concentration of critical internet services and underscores the urgency for organizations to bolster resilience strategies. In an era of heightened service interdependencies and upticks in both incidents and attacks targeting fundamental service providers, outage preparedness and robust incident response planning are more essential than ever.
6 months ago
Kill Chain
Critical RCE in React Server Components Exposes Applications Worldwide (CVE-2025-55182)
In December 2025, a critical remote code execution (RCE) vulnerability—CVE-2025-55182—was discovered in the Flight protocol used by React Server Components. Rated CVSS 10.0, this flaw enabled unauthenticated attackers to craft malicious requests, resulting in the compromise of application servers running affected versions. Security researchers observed exploitation in the wild, with threat actors leveraging the flaw for lateral movement and potential data exfiltration. Organizations using Next.js and other frameworks integrating the vulnerable protocol faced heightened risk until urgent patches were issued. Immediate remediation efforts, threat monitoring, and network segmentation were necessary to mitigate the rapid spread. This incident underscores the increasing threat posed by supply chain vulnerabilities in widely adopted developer ecosystems. The exploitation of core component flaws in popular open-source projects amplifies business risk, as attackers accelerate adoption of frontline vulnerabilities for larger-scale impact.
6 months ago
Kill Chain
Critical React2Shell Flaw in React & Next.js Puts Web Servers at Risk
In June 2024, a critical vulnerability known as 'React2Shell' was discovered in the React Server Components (RSC) 'Flight' protocol, impacting React and Next.js applications worldwide. This flaw enables unauthenticated remote code execution (RCE), allowing attackers to execute arbitrary JavaScript code on affected web servers. Security researchers observed that threat actors could exploit the protocol by sending crafted requests, potentially leading to a full compromise of application environments and exposure of sensitive data or further lateral movement within networks. This incident underscores heightened risk in modern web application supply chains and the urgent need for timely patching within frameworks. Growing attacks on open-source packages and widespread usage of React/Next.js frameworks amplify the incident's relevance, especially as application-layer vulnerabilities facilitate high-impact breaches at scale.
6 months ago
Kill Chain
Critical King Addons Elementor Plugin Flaw Exploited in WordPress Sites (CVE-2025-8489)
In early 2025, attackers began actively exploiting a critical privilege escalation flaw (CVE-2025-8489) in the King Addons for Elementor plugin on WordPress sites. By abusing an insecure registration process, threat actors were able to escalate privileges and gain administrative control over vulnerable sites without authorization. This access could be used to manipulate website content, add malicious backdoors, or exfiltrate sensitive data, impacting website owners' security and reputation. The attacks have been widespread due to the plugin's popularity and ease of exploitation, highlighting the persistent risks present in third-party WordPress extensions. This incident is particularly relevant as it exemplifies an ongoing wave of attacks targeting web application vulnerabilities in widely used CMS platforms. The proliferation of such zero-day exploits magnifies risk for organizations, especially as adversaries move quickly to weaponize flaws before patches are broadly applied.
6 months ago
Kill Chain
Leroy Merlin Customer Data Breach Exposes Personal Information in France
In June 2024, French home improvement retailer Leroy Merlin disclosed a security incident impacting its French customer base. Attackers gained unauthorized access to customer accounts and personal data, including names, email addresses, physical addresses, phone numbers, and order histories. While no financial data or passwords were compromised, the company became aware of unusual activity and swiftly launched an internal investigation and incident response procedures. Affected users were notified and advised to remain vigilant against phishing attempts. The incident has triggered regulatory attention and widespread concern among customers. The breach at Leroy Merlin highlights the increasing frequency of attacks targeting customer data in the retail sector. As organizations digitize more customer interactions, they face mounting regulatory pressure to safeguard personal information and promptly report security incidents to minimize reputational and financial risk.
6 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports