✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Human Resources/HR
Breach intelligence, attack campaigns, and threat reports targeting the Human Resources/HR sector.
Explore Other Sectors
Human Resources/HR Threat Reports
Hackers Exploit Authentication Bypass in JobMonster WordPress Theme (2024)
In June 2024, threat actors exploited a critical authentication bypass vulnerability in the JobMonster WordPress theme, enabling attackers to gain unauthorized administrative access on affected websites. The flaw, discovered and disclosed by security researchers, allowed attackers to escalate privileges and hijack admin accounts under certain misconfiguration conditions. Attackers rapidly leveraged the flaw in active campaigns, placing thousands of sites at risk of compromise, defacement, or further malware infection. The widespread usage of the JobMonster theme among job board and recruitment-firm websites amplified the potential impact and data exposure. This incident demonstrates the rising trend of web application targeting via plugin and theme vulnerabilities. The exploitation reinforces concerns around supply chain security in the WordPress ecosystem and highlights growing attacker sophistication in exploiting authentication flaws before site owners can apply available patches.
6 months ago
Kill Chain
OpenAI Atlas Browser Exposed: LLM Cloaking and Security Weaknesses in 2024
In early 2024, security researchers at SPLX and LayerX exposed significant vulnerabilities in OpenAI’s ChatGPT Atlas browser agent and similar AI-powered web agents. Through cloaking techniques, malicious actors can serve manipulated web content specifically to AI crawlers by altering the user-agent header, causing the agent to process misleading information while human users see normal content. This opens doors for smear campaigns, scam promotions, and manipulation of automated tasks like recruitment screening. Additional flaws in Atlas were discovered, including weak OAuth token storage and susceptibility to memory corruption exploits, raising serious concerns for business and consumer users. These vulnerabilities highlight the pressing need for AI governance and protection as adoption accelerates, with compliance and supply chain risk in sharp focus. With the rapid growth of generative AI in enterprise settings and lagging regulatory frameworks, businesses face mounting risks tied to both intentional adversarial content and platform design oversights.
6 months ago
Kill Chain
Vampire Bot: Infostealer Malware Drains Job Hunters in BatShadow’s 2024 Campaign
In early June 2024, security researchers uncovered a widespread infostealer campaign targeting global job seekers through malicious job postings across popular employment platforms. The attack, orchestrated by the Vietnamese cybercriminal group BatShadow, involved the sophisticated Vampire Bot malware, which was delivered via phishing emails and deceptive job application portals. Once installed, Vampire Bot silently harvested sensitive personal data, login credentials, and browser-stored financial information, enabling unauthorized access to victims' accounts. Numerous job seekers reported financial losses and identity theft, highlighting the campaign's destructive business and personal impacts. This incident underscores a growing trend of cybercriminal groups exploiting economic anxieties and job market vulnerabilities to launch tailored infostealer attacks. The operation signals a broader shift towards targeted social engineering and the increasing professionalization of threat actors in Southeast Asia.
6 months ago
Kill Chain
Universities Targeted: Storm-2657 Orchestrates 2025 Business Email Compromise via Payroll Phishing
In March 2025, a financially motivated threat group tracked as Storm-2657 launched a series of "payroll pirate" attacks targeting U.S. university staff. The attackers leveraged advanced social engineering and adversary-in-the-middle (AITM) phishing techniques to compromise HR-related SaaS accounts, notably Workday. After stealing MFA credentials, they accessed Exchange Online accounts, manipulated payroll settings to hijack salary payments, set inbox rules for concealment, and enrolled attacker-controlled MFA devices for persistence. At least 11 accounts across three universities were breached, enabling phishing campaigns to almost 6,000 recipients spanning 25 institutions. The incident showcases a significant escalation in business email compromise (BEC) targeting the education sector, exploiting gaps in MFA and SSO implementations. With BEC attacks surging industry-wide—resulting in multimillion-dollar annual losses—this campaign emphasizes the urgent need for phishing-resistant MFA and robust email monitoring across academia and beyond.
6 months ago
Kill Chain
Hackers Exploit Auth Bypass in Service Finder WordPress Theme (CVE-2025-5947)
In the autumn of 2025, a critical authentication bypass vulnerability (CVE-2025-5947) was discovered and actively exploited in the Service Finder WordPress theme, affecting versions 6.0 and older. Attackers leveraged improper validation in the 'service_finder_switch_back()' function, allowing them to impersonate any user—including administrators—simply by sending HTTP requests with a crafted cookie or query parameter. The flaw enabled threat actors to gain full administrative control over thousands of websites, with over 13,800 exploitation attempts recorded by Wordfence since August 1. Attackers could then create or modify site content, add malicious code, or export sensitive data undetected, putting site owners and users at risk. This breach is particularly relevant as it illustrates the continued targeting of WordPress ecosystems with privilege escalation exploits, highlighting growing risks from vulnerable third-party themes and plugins. It underscores the urgency of rapid patching, improved logging, and continuous monitoring to defend against evolving web application threats.
6 months ago
Kill Chain
Volvo NA Employee SSNs Exposed in 2023 Supply Chain Ransomware Attack
In August 2023, Volvo Group North America (Volvo NA) suffered a significant data breach when its third-party HR software provider, Miljödata, was compromised by the DataCarry ransomware group. Attackers exploited weaknesses in Miljödata's cloud infrastructure, gaining unauthorized access and exfiltrating sensitive employee data—including names and Social Security numbers—belonging to nearly 20,000 Volvo NA employees. The incident, discovered days after the intrusion, led to a ransom demand before the stolen data was published on the Dark Web. While Volvo NA's own systems were not directly breached, the exposure of highly sensitive employee data has far-reaching implications for individual privacy and trust. This breach highlights growing risks from supply chain cyberattacks targeting SaaS providers and underscores the importance of rigorous third-party risk management. High-value employee PII leaks also raise urgent questions around operational resilience, compliance, and the potential for subsequent identity-driven fraud.
6 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports