The breach isn’t the problem. The spread is. →The breach isn’t the problem. The spread is. →Measure in 5 min. Free AssessmentFree Assessment
Entertainment/Movie Production
Breach intelligence, attack campaigns, and threat reports targeting the Entertainment/Movie Production sector.
Explore Other Sectors
Entertainment/Movie Production Threat Reports
Plex Issues Urgent Security Warning: Multiple Critical Vulnerabilities Require Immediate Patching
In September 2026, Plex issued an urgent security advisory warning users to immediately update their media servers and desktop clients to patch multiple critical vulnerabilities affecting Plex Media Server v1.43.2 and earlier. The company released patched versions (Media Server 1.43.3 and Desktop 1.115.0) and took the unusual step of emailing customers directly about the severity of these flaws, though specific CVE details were not yet published. This follows Plex's history of serious security incidents, including a 2025 credential theft vulnerability (CVE-2025-34158) and a 2022 data breach that compromised user credentials and personal information. This incident highlights the growing trend of threat actors targeting popular media streaming platforms and home entertainment systems as attack vectors for lateral movement into personal and corporate networks, particularly as remote work continues to blur the lines between home and business environments.
3 weeks ago
Kill Chain
Meta Ads Campaign Delivers StreamRat Android Banking Trojan to 570K+ Users
Between June and July 2026, cybercriminals leveraged Meta advertising platforms to distribute StreamRat, a sophisticated Android banking trojan targeting Spanish-speaking users through fake television streaming campaigns. The malvertising operation reached approximately 570,950 Meta accounts across the European Union, directing victims to download malicious APK files that granted attackers near-complete device control. Once installed, StreamRat could capture keystrokes, steal credentials through overlay attacks, take screenshots, and remotely control infected devices by exploiting Android's Accessibility services and VPN capabilities. This incident highlights the growing threat of malvertising on major social platforms and the evolution of mobile banking trojans that abuse legitimate Android features for malicious purposes, demonstrating how attackers increasingly target mobile users through trusted advertising channels.
3 weeks ago
Kill Chain
Supply Chain Attack: Malicious Packagist Packages Exploit iOS Devices to Steal Cryptocurrency Wallets
In September 2026, cybersecurity researchers discovered 13 malicious Composer theme packages on Packagist targeting Vietnamese movie and comic streaming sites. These supply chain attacks injected JavaScript that deployed spyware on unpatched iOS devices running versions 18.4 through 18.6.x. The campaign exploited WebKit vulnerabilities CVE-2025-31277 and CVE-2025-43529 to break out of Safari's sandbox and install kernel-level malware. The sophisticated attack chain exfiltrated keychain databases, Wi-Fi passwords, SMS data, photos, and cryptocurrency wallet seeds from popular wallets including Bitget, Trust Wallet, and OKX, uploading encrypted data to command and control servers hosted on Funnull infrastructure. This incident highlights the evolving threat landscape where supply chain attacks increasingly target mobile platforms and cryptocurrency assets. The campaign's focus on stealing wallet seeds represents a concerning escalation from traditional data theft to direct financial crime, particularly as mobile cryptocurrency adoption accelerates across Southeast Asia.
3 weeks ago
Kill Chain
Hasbro Employee Data Breach Exposes Corporate Cybersecurity Vulnerabilities
In December 2024, toy manufacturing giant Hasbro disclosed a significant data breach affecting employee information after discovering unauthorized access to their systems. The company detected the security incident through their monitoring systems and immediately launched an investigation with external cybersecurity experts. The breach potentially exposed sensitive employee data including personal identification information, employment records, and other confidential details. Hasbro has notified affected employees and is working with law enforcement and regulatory authorities while implementing additional security measures to prevent future incidents. This incident highlights the ongoing vulnerability of large corporations to sophisticated cyber attacks targeting employee databases and internal systems, potentially affecting thousands of workers across the company's global operations. This breach reflects the accelerating trend of attackers targeting employee data as a pathway to broader organizational compromise, particularly as companies expand remote work capabilities and digital HR systems.
3 weeks ago
Kill Chain
Critical Unpatched Kaltura mwEmbed Vulnerabilities Expose Video Platforms to Remote Attacks
Two critical unpatched vulnerabilities in Kaltura's HTML5 video player library (CVE-2026-19913 and CVE-2026-19912) allow remote, unauthenticated attackers to read arbitrary files and execute code on affected servers. The flaws stem from unsafe deserialization in the mwEmbedLoader.php endpoint, affecting both individual customer installations and Kaltura's shared multi-tenant CDN infrastructure. With CVSS scores of 9.1 and 10.0 respectively, these vulnerabilities require only network access to exploit, with no authentication needed. CERT/CC reported being unable to coordinate with Kaltura for patches, leaving administrators to implement workarounds. This incident highlights the growing risk of unpatched vulnerabilities in widely-deployed media platforms and the challenges of coordinating disclosures with unresponsive vendors, particularly as video streaming infrastructure becomes increasingly critical to business operations.
4 weeks ago
Kill Chain
CyberLeek's GTA VI Data Theft: How Gaming's Biggest Leak Redefined Cyber Extortion
In late 2024, threat actor 'CyberLeek' launched a sophisticated data theft and extortion campaign against Rockstar Games, leaking pre-release gameplay footage from the highly anticipated Grand Theft Auto VI game. The attacker published proprietary content across multiple platforms including Discord, demonstrating either insider access or a significant breach of Rockstar's development systems. The incident caused substantial reputational damage and prompted aggressive legal action from Take-Two Interactive, including federal subpoenas against Discord, Google, Microsoft, and X to identify the perpetrators. The attack employed a novel monetization strategy, combining cryptocurrency schemes with watermarked stolen content and crowdsourced pressure tactics to maximize financial gain from the leaked intellectual property. This incident represents an evolution in data extortion tactics, where threat actors leverage public anticipation and social media amplification to maximize pressure on victims. The attack demonstrates how modern cybercriminals are adapting traditional ransomware playbooks to target high-value intellectual property in the entertainment industry, creating new challenges for incident response and legal remediation.
4 weeks ago
Kill Chain
LACMA Data Breach Exposes Critical Security Gaps in Cultural Institutions
The Los Angeles County Museum of Art (LACMA) disclosed a significant data breach that occurred in July 2025, where attackers gained unauthorized access to their systems for four days before detection. The incident exposed highly sensitive personal information of customers and employees, including Social Security numbers, medical records, health insurance information, partial financial account details, and government-issued identification numbers. The investigation took over a year to complete, with the full scope of compromised data only identified in February 2026, highlighting the complexity and severity of the breach. This incident underscores the growing threat to cultural institutions and the healthcare sector, as attackers increasingly target organizations storing mixed personal and medical data for identity theft and fraud schemes.
1 month ago
Kill Chain
Weedhack Malware Campaign Exploits Minecraft Community Through Advanced SEO Manipulation
In August 2026, cybersecurity researchers discovered that the Weedhack malware family continues to actively target Minecraft gamers through sophisticated SEO poisoning campaigns and fake gaming websites. The attackers created convincing replicas of legitimate Minecraft clients and tools, using platforms like Discord, MediaFire, and GitHub to distribute malicious JAR files. McAfee Labs detected over 6,300 attempts to access these malicious sites, which successfully outranked legitimate sources in search engine results. The malware establishes persistence by disabling Microsoft Defender, stealing sensitive data, and maintaining command and control communications. This incident highlights the growing sophistication of gaming-focused malware campaigns and the increasing use of AI-powered tools to create convincing fake websites. The success of these SEO poisoning techniques demonstrates how threat actors are adapting their distribution methods to exploit trusted platforms and search engine algorithms.
1 month ago
Kill Chain
Cybercriminals Invest Millions in Expired Domains for Malicious Activities
In the first half of 2026, cybercriminals have increasingly exploited expired domains, known as 'dropcatch' domains, to conduct large-scale scams and malware distribution. By re-registering these domains, threat actors inherit their previous reputation and traffic, enabling them to evade detection and effectively target victims. Notably, the group 'Sable Squirrel' invested over $7 million to acquire more than 10,000 such domains, which they utilized for illegal streaming, online gambling, and as command-and-control servers for various malware families, including Quasar RAT and AsyncRAT. This trend underscores a significant shift in cybercriminal tactics, leveraging the residual trust of expired domains to facilitate malicious activities. The prevalence of this method highlights the urgent need for organizations to monitor and manage their domain portfolios proactively, ensuring that expired domains are not left vulnerable to exploitation. Additionally, it emphasizes the importance of enhancing detection mechanisms to identify and mitigate threats originating from re-registered domains.
1 month ago
Kill Chain
FBI Issues Warning on Rising Sextortion Threats Targeting Online Accounts
In August 2026, the FBI issued a public service announcement warning that cybercriminals are targeting both adults' and children's online accounts to steal sexually explicit images and videos. These attackers gain unauthorized access through methods such as phishing, social engineering, and exploiting weak passwords. Once obtained, the explicit content is used to blackmail victims, sold on criminal marketplaces, or shared with other malicious actors, leading to further exploitation and harassment. This incident underscores a growing trend in cyber threats where personal and sensitive data are exploited for financial gain and coercion. The increasing sophistication of these attacks highlights the urgent need for enhanced cybersecurity measures, public awareness, and proactive defense strategies to protect individuals from such exploitation.
1 month ago
Kill Chain
Kimwolf Botnet's 2026 Resurgence: A New Challenge in Cybersecurity
In August 2026, researchers identified a resurgence of the Kimwolf botnet, which had previously been dismantled by international law enforcement. This new iteration employs advanced techniques to evade detection and takedown efforts. Notably, it utilizes HTTP/2 protocols to mimic legitimate Chrome browser traffic, complicating traditional DDoS mitigation strategies. Additionally, the botnet's command-and-control infrastructure now leverages the Ethereum Name Service (ENS) on the blockchain, making it resistant to domain seizures and enhancing its resilience against law enforcement interventions. The re-emergence of Kimwolf underscores the evolving sophistication of botnet operations and the challenges in combating cyber threats that adapt to previous countermeasures. Organizations must remain vigilant and update their security protocols to address these advanced evasion techniques.
1 month ago
Kill Chain
Kimwolf v7 Botnet: A New Era of Sophisticated DDoS Attacks
In August 2026, cybersecurity researchers identified Kimwolf v7, an evolved version of the Kimwolf/AISURU Android and IoT botnet. This variant introduces HTTP/2-based DDoS attacks that mimic legitimate browser behavior, complicating detection efforts. Additionally, it employs a resilient command-and-control infrastructure utilizing Ethereum Name Service (ENS) and Tor hidden services, enhancing its resistance to takedown attempts. The botnet primarily targets Android TV boxes with exposed Android Debug Bridge (ADB) services, enabling the installation of malware capable of conducting DDoS attacks and relaying malicious traffic. The emergence of Kimwolf v7 underscores a significant advancement in botnet capabilities, particularly in evading detection and maintaining operational resilience. This development highlights the urgent need for organizations to implement robust security measures, including disabling unnecessary services like ADB, to mitigate the risk of such sophisticated threats.
1 month ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports