The breach isn’t the problem. The spread is. →The breach isn’t the problem. The spread is. →Measure in 5 min. Free AssessmentFree Assessment
Higher Education/Acadamia
Breach intelligence, attack campaigns, and threat reports targeting the Higher Education/Acadamia sector.
Explore Other Sectors
Higher Education/Acadamia Threat Reports
How FBI Takedown of Chinese QTFY Network Exposes Critical Zero Trust Gaps
In August 2026, the FBI disrupted a sophisticated Chinese state-sponsored cyber espionage operation conducted by the QTFY threat group, operated by Nanjing Xinjiuwei Network Technology Company. The group utilized QScan and QTRouter platforms to create an obfuscation network of compromised IoT devices and commercial proxies, enabling attacks against critical U.S. infrastructure including NASA, the Federal Reserve, Department of Energy, and the U.S. Senate. The operation leveraged zero-day vulnerabilities in Ivanti CSA appliances and numerous N-day exploits to establish persistent access while using the botnet to mask attack origins. This incident demonstrates the evolving sophistication of state-sponsored threat actors who are increasingly adopting industrialized, multi-tenant infrastructure models for large-scale espionage campaigns. The use of legitimate commercial proxy services mixed with compromised devices represents a significant challenge to traditional IP-based blocking and geographic filtering defenses.
4 weeks ago
Kill Chain
How AI Voice Agents Are Revolutionizing Mobile Device Theft: The AnonyMousKIT Case Study
In 2026, cybersecurity researchers from SOCRadar discovered AnonyMousKIT, a sophisticated phishing-as-a-service (PhaaS) platform designed to bypass Apple's Activation Lock on stolen devices. The platform employs AI-powered voice agents that impersonate Apple Support representatives, calling theft victims to extract device passcodes, Apple ID credentials, and live two-factor authentication codes. Operating across five channels including email, SMS, WhatsApp, recorded calls, and AI voice agents, the service targets owners of recently stolen Apple devices with highly convincing lures that reference specific device identifiers and live Find My status. This incident demonstrates the concerning evolution of cybercriminal services, where AI technology is being weaponized to automate social engineering attacks at scale. The rise of AI-powered phishing platforms represents a significant escalation in threat sophistication, making device theft more profitable and highlighting the urgent need for enhanced user awareness and technical countermeasures against voice-based social engineering.
4 weeks ago
Kill Chain
Russian Actors Exploit ChatGPT for Sophisticated Influence Operation
In August 2026, OpenAI disrupted a Russian-linked influence operation that used ChatGPT accounts with VPNs to bypass geographic restrictions and generate social media content across multiple platforms. The operation promoted the International Burke Institute (IBI), a fake think tank registered in February 2025, which featured copied academic work, false attributions, and a sovereignty index designed to cast Russia favorably. While the campaign reached relatively small audiences of 10-20,000 followers per channel, it demonstrated sophisticated infrastructure building for long-term influence operations. This incident highlights the emerging threat of AI-powered disinformation campaigns that leverage large language models to create credible-appearing institutions and content at scale, representing a new frontier in state-sponsored information warfare.
4 weeks ago
Kill Chain
Critical Unpatched Kaltura mwEmbed Vulnerabilities Expose Video Platforms to Remote Attacks
Two critical unpatched vulnerabilities in Kaltura's HTML5 video player library (CVE-2026-19913 and CVE-2026-19912) allow remote, unauthenticated attackers to read arbitrary files and execute code on affected servers. The flaws stem from unsafe deserialization in the mwEmbedLoader.php endpoint, affecting both individual customer installations and Kaltura's shared multi-tenant CDN infrastructure. With CVSS scores of 9.1 and 10.0 respectively, these vulnerabilities require only network access to exploit, with no authentication needed. CERT/CC reported being unable to coordinate with Kaltura for patches, leaving administrators to implement workarounds. This incident highlights the growing risk of unpatched vulnerabilities in widely-deployed media platforms and the challenges of coordinating disclosures with unresponsive vendors, particularly as video streaming infrastructure becomes increasingly critical to business operations.
4 weeks ago
Kill Chain
Mass Zimbra Server Compromise: CVE-2026-73570 Exploitation Reaches 270+ Instances
In August 2026, threat actors exploited CVE-2026-73570, a high-severity command injection vulnerability in Zimbra Collaboration Suite's SNMP monitoring component, to compromise over 270 Zimbra instances worldwide. The vulnerability allows unauthenticated attackers to achieve remote code execution when SNMP notifications are enabled. Despite Synacor patching the flaw in ZCS version 10.1.20 on July 20, 2026, CERT Polska and Shadowserver reported active exploitation with over 8,200 unpatched instances still exposed. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog and ordered federal agencies to patch within three days. This incident underscores the continued targeting of email infrastructure by cybercriminals and state-sponsored groups, particularly given Zimbra's widespread use among government agencies and businesses. The rapid exploitation timeline and global scale of compromises highlight the critical importance of timely patch management for Internet-facing collaboration platforms.
1 month ago
Kill Chain
Critical WordPress Admin Bypass: miniOrange SAML Vulnerabilities Under Active Attack
In August 2026, security researchers discovered two critical authentication bypass vulnerabilities in the miniOrange SAML 2.0 Single Sign-On WordPress plugin, allowing attackers to gain administrator access without credentials. CVE-2026-61979 and CVE-2026-15981 stem from signature validation flaws that enable attackers to craft malformed SAML responses and bypass authentication entirely. Active exploitation attempts have been observed from multiple IP addresses in what appears to be opportunistic scanning campaigns targeting vulnerable WordPress sites. The vulnerabilities affect the plugin's signature verification process, where malformed signatures trigger OpenSSL errors that are incorrectly treated as valid authentication. DigitalOcean's security team first identified the threat when they detected anomalous admin session attempts from outside their trusted network, revealing an attacker had already obtained admin cookies through these exploits. This incident highlights the growing trend of attackers targeting identity and authentication systems, particularly SAML implementations that serve as critical trust boundaries in enterprise environments. With proof-of-concept code now available and active scanning campaigns underway, organizations face immediate risk from these easily exploitable vulnerabilities.
1 month ago
Kill Chain
Mirage2FA Campaign Exposes Critical Gaps in Traditional MFA Security
The Mirage2FA phishing-as-a-service campaign targeted over 4,500 organizations across the US and EU from 2024 to 2026, exploiting Microsoft 365 login flows to bypass two-factor authentication. Using adversary-in-the-middle (AiTM) techniques, attackers stole passwords and session cookies, achieving a 48% compromise rate among targeted email addresses. The campaign primarily affected US-based companies in technology, manufacturing, and education sectors, with attackers gaining authenticated access to Microsoft 365 sessions and SSO-connected services, enabling account impersonation and data theft. This incident highlights the evolving threat landscape where traditional MFA is insufficient against sophisticated phishing operations that steal active sessions rather than just credentials, demonstrating the urgent need for phishing-resistant authentication methods and enhanced session management controls.
1 month ago
Kill Chain
Critical Code Injection Flaw in Marimo Notebooks Exposes AI Development Environments
In August 2026, Marimo addressed a critical code injection vulnerability (CVE-2026-75149) in its notebook software that allowed attackers to execute malicious Model Context Protocol (MCP) commands through specially crafted notebooks. The flaw, scoring 8.7-8.8 on CVSS scales, enabled arbitrary command execution as local subprocesses when victims opened malicious notebooks in edit mode, requiring no authentication but needing user interaction. Marimo patched the vulnerability in version 0.23.15 by implementing configuration allowlisting to treat notebook metadata as attacker-controlled content. This incident highlights the growing security risks in AI development environments as organizations increasingly adopt notebook-based workflows for machine learning and data science projects. With the rise of collaborative AI development and shared notebook repositories, similar supply chain attacks targeting development tools are becoming more prevalent.
1 month ago
Kill Chain
Federal Agencies Race Against 3-Day Deadline to Patch Critical Zimbra Exploit
In August 2026, CISA issued an emergency directive ordering federal agencies to patch CVE-2026-73570 within three days after confirming active exploitation of a critical remote code execution vulnerability in Zimbra Collaboration Suite. The flaw allows unauthenticated attackers to execute arbitrary commands through improper input sanitization in the SNMP monitoring component. Over 270 compromised Zimbra instances have been identified, with more than 12,000 servers potentially exposed online, affecting hundreds of millions of users worldwide including government agencies. This incident highlights the accelerating pace of vulnerability exploitation and the persistent targeting of email infrastructure by threat actors. With Zimbra's extensive deployment across government and enterprise environments, and given recent APT campaigns targeting similar platforms, organizations face increased pressure to implement rapid patch management and enhanced monitoring capabilities.
1 month ago
Kill Chain
Critical Authentication Bypass Vulnerabilities Target WordPress SSO Integrations
In August 2026, threat actors began actively exploiting two critical authentication bypass vulnerabilities (CVE-2026-61979 and CVE-2026-15981) in the miniOrange SAML 2.0 Single Sign On plugin for WordPress. The vulnerabilities allow attackers to forge SAML responses and gain administrator access by manipulating signature algorithms and exploiting OpenSSL verification errors. While patches were released in July 2026, inadequate disclosure for paid plugin editions left many sites vulnerable, leading to confirmed exploitation attempts across multiple IP addresses in Europe, Africa, and the United States. This incident highlights the growing trend of authentication bypass attacks targeting enterprise SSO integrations, particularly as organizations increasingly rely on SAML-based identity federation. The delayed patching response and incomplete vendor disclosure demonstrate critical gaps in third-party plugin security management that continue to plague WordPress ecosystems.
1 month ago
Kill Chain
Weedhack Malware Campaign Exploits Minecraft Community Through Advanced SEO Manipulation
In August 2026, cybersecurity researchers discovered that the Weedhack malware family continues to actively target Minecraft gamers through sophisticated SEO poisoning campaigns and fake gaming websites. The attackers created convincing replicas of legitimate Minecraft clients and tools, using platforms like Discord, MediaFire, and GitHub to distribute malicious JAR files. McAfee Labs detected over 6,300 attempts to access these malicious sites, which successfully outranked legitimate sources in search engine results. The malware establishes persistence by disabling Microsoft Defender, stealing sensitive data, and maintaining command and control communications. This incident highlights the growing sophistication of gaming-focused malware campaigns and the increasing use of AI-powered tools to create convincing fake websites. The success of these SEO poisoning techniques demonstrates how threat actors are adapting their distribution methods to exploit trusted platforms and search engine algorithms.
1 month ago
Kill Chain
UAT-10147 Cybercrime Group Weaponizes AI for Massive Server Attack Campaign
In August 2026, cybersecurity researchers disclosed details of UAT-10147, a Chinese-speaking cybercrime group leveraging AI-powered tools to conduct large-scale attacks against Windows and Linux web servers globally. The threat actor deployed artificial intelligence frameworks including PentestGPT, DeepAudit, and custom AI-generated Python scripts to automate vulnerability exploitation, reconnaissance, and payload generation across approximately 170,000 target URLs. UAT-10147 exploited known vulnerabilities to establish initial access, then deployed the cross-platform SPECTRE implant featuring advanced EDR bypass capabilities and Linux rootkit functionality, primarily targeting education, media, technology, and gaming sectors in Brazil, Bolivia, China, Canada, and Vietnam for SEO fraud and data theft operations. This incident represents a significant evolution in cybercrime operations, demonstrating how threat actors are integrating AI capabilities to scale attacks and enhance operational efficiency. The emergence of AI-driven offensive frameworks marks a critical shift in the threat landscape, enabling lower-skilled actors to conduct sophisticated attacks while highlighting the urgent need for organizations to strengthen their security postures against automated exploitation campaigns.
1 month ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports