✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Information Technology/IT
Breach intelligence, attack campaigns, and threat reports targeting the Information Technology/IT sector.
Explore Other Sectors
Information Technology/IT Threat Reports
Xygeni GitHub Action Compromised via Tag Poisoning in 2026
In early March 2026, Xygeni's GitHub Action, xygeni-action, was compromised through a tag poisoning attack. An attacker with access to compromised credentials created pull requests injecting obfuscated shell code into action.yml. Although these pull requests were blocked by branch protection rules and not merged into the main branch, the attacker exploited the compromised GitHub App credentials to move the mutable v5 tag to point at a malicious commit. This allowed any workflow referencing xygeni/xygeni-action@v5 to fetch and execute the compromised code, resulting in a supply chain compromise via tag poisoning. Workflows using xygeni/xygeni-action@v5 during the affected window (approximately March 3–10, 2026) executed a command-and-control (C2) implant that granted the attacker arbitrary command execution on the CI runner for up to 180 seconds per workflow run. This incident underscores the critical need for robust security measures in CI/CD pipelines to prevent similar supply chain attacks.
4 months ago
Kill Chain
Mirai Botnet 2016: A Wake-Up Call for IoT Security
In October 2016, the Mirai botnet exploited default credentials on IoT devices to orchestrate one of the largest Distributed Denial-of-Service (DDoS) attacks in history. By scanning the internet for devices with open Telnet ports and using a list of common default usernames and passwords, Mirai infected hundreds of thousands of devices, including routers and IP cameras. These compromised devices were then used to launch massive DDoS attacks, notably targeting DNS provider Dyn, which resulted in widespread internet outages affecting major websites like Twitter, Netflix, and Amazon. The incident underscored the critical security risk posed by default credentials in IoT devices and highlighted the need for manufacturers and users to implement stronger security practices. ([en.wikipedia.org](https://en.wikipedia.org/wiki/Mirai_%28malware%29?utm_source=openai)) The Mirai attack remains relevant today as IoT device proliferation continues, with many devices still shipping with default credentials. Recent studies indicate that a significant percentage of IoT devices retain factory-default passwords, making them susceptible to similar exploitation. This ongoing vulnerability emphasizes the importance of changing default credentials and implementing robust security measures to protect against potential large-scale cyberattacks. ([vulnsy.com](https://www.vulnsy.com/vulnerabilities/default-and-weak-iot-credentials?utm_source=openai))
4 months ago
Kill Chain
Microsoft Copilot's 2026 Reprompt Exploit: A Wake-Up Call for AI Security
In early 2026, a critical vulnerability known as the "Reprompt" exploit was discovered in Microsoft Copilot by Varonis Threat Labs. This flaw allowed attackers to embed a "q parameter" within phishing links, which, when clicked, silently activated Copilot to exfiltrate sensitive user data to attacker-controlled servers. Remarkably, this attack required no further user interaction beyond the initial click, effectively bypassing existing enterprise security controls. Microsoft promptly addressed and patched the vulnerability by January 13, 2026. ([windowscentral.com](https://www.windowscentral.com/artificial-intelligence/microsoft-copilot/copilot-ai-reprompt-exploit-detailed-2026?utm_source=openai)) The Reprompt exploit underscores the escalating sophistication of AI-targeted cyberattacks, highlighting the necessity for continuous vigilance and robust security measures in AI-integrated applications. As AI systems become more embedded in daily workflows, ensuring their security against such advanced threats is paramount.
4 months ago
Kill Chain
Contagious Interview 2026: A Wake-Up Call for Developer Security
In early 2026, North Korean state-sponsored hackers launched the 'Contagious Interview' campaign, targeting software developers through fake job interviews. Posing as recruiters, they lured victims into cloning malicious repositories from platforms like GitHub and opening them in Visual Studio Code. Upon granting trust to these repositories, embedded malicious payloads executed automatically, establishing backdoors for data theft and persistent access. ([microsoft.com](https://www.microsoft.com/en-us/security/blog/2026/03/11/contagious-interview-malware-delivered-through-fake-developer-job-interviews/?utm_source=openai)) This incident underscores the evolving sophistication of social engineering attacks, particularly within trusted development environments. The exploitation of Visual Studio Code's trusted workspace feature highlights the need for heightened vigilance and security measures in developer workflows. ([csoonline.com](https://www.csoonline.com/article/4119927/contagious-interview-turns-vs-code-into-an-attack-vector.html?utm_source=openai))
4 months ago
Kill Chain
PhantomRaven NPM Attack 2026: A Wake-Up Call for Open-Source Security
Between November 2025 and February 2026, the 'PhantomRaven' supply-chain attack targeted the npm registry, introducing 88 malicious packages through 50 disposable accounts. These packages, often mimicking legitimate projects like Babel and GraphQL Codegen, utilized a technique called Remote Dynamic Dependencies (RDD) to fetch and execute malicious code from external URLs during installation. The malware harvested sensitive information from developers' systems, including emails, CI/CD tokens, and system details, subsequently exfiltrating this data to the attackers' command-and-control servers. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/new-phantomraven-npm-attack-wave-steals-dev-data-via-88-packages/?utm_source=openai)) This incident underscores the escalating threat of supply-chain attacks in open-source ecosystems, highlighting the need for developers to exercise caution when integrating third-party packages. The use of AI-generated package names and sophisticated evasion techniques like RDD exemplify the evolving tactics of threat actors, emphasizing the importance of vigilant package management and verification practices.
4 months ago
Kill Chain
Stryker's 2026 Cyberattack: A Wake-Up Call for Healthcare Cybersecurity
In March 2026, Stryker Corporation, a leading medical technology company, experienced a significant cyberattack attributed to the pro-Iranian hacktivist group Handala. The attackers claimed to have infiltrated Stryker's global network, exfiltrated 50 terabytes of sensitive data, and deployed wiper malware that erased data on over 200,000 systems, servers, and mobile devices. This attack led to widespread operational disruptions across Stryker's offices in 79 countries, severely impacting their ability to deliver medical products and services. ([investing.com](https://www.investing.com/news/stock-market-news/stryker-stock-falls-34-on-iranlinked-cyberattack-report-93CH-4554963?utm_source=openai)) This incident underscores the escalating threat posed by politically motivated cyberattacks targeting critical infrastructure sectors. Organizations in the healthcare and medical technology industries must enhance their cybersecurity measures to protect against such sophisticated and destructive attacks.
4 months ago
Kill Chain
Critical n8n RCE Vulnerability (CVE-2025-68613) Exposes Systems to Full Compromise
In December 2025, a critical Remote Code Execution (RCE) vulnerability, identified as CVE-2025-68613, was discovered in n8n, an open-source workflow automation platform. This flaw allowed authenticated users to execute arbitrary code on the server by exploiting insufficient isolation in the workflow expression evaluation system. Successful exploitation could lead to full system compromise, including unauthorized access to sensitive data and modification of workflows. ([nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2025-68613?utm_source=openai)) The vulnerability was addressed in n8n versions 1.120.4, 1.121.1, and 1.122.0. However, as of March 2026, over 40,000 unpatched instances remain exposed online, with significant concentrations in North America and Europe. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/cisa-orders-feds-to-patch-n8n-rce-flaw-exploited-in-attacks/?utm_source=openai))
4 months ago
Kill Chain
Malicious Rust Crates and AI Bot Exploit CI/CD Pipelines to Steal Developer Secrets
In early March 2026, cybersecurity researchers identified a coordinated supply chain attack involving five malicious Rust crates—'chrono_anchor', 'dnp3times', 'time_calibrator', 'time_calibrators', and 'time-sync'—that masqueraded as time-related utilities. These crates exfiltrated sensitive '.env' files containing developer secrets to attacker-controlled infrastructure. Concurrently, an AI-powered bot named 'hackerbot-claw' exploited misconfigured GitHub Actions workflows in major open-source repositories, achieving remote code execution and stealing access tokens. This bot targeted repositories from organizations such as Microsoft, Datadog, and Aqua Security, leading to unauthorized code execution and potential repository takeovers. These incidents underscore the escalating threats to software supply chains, particularly through the exploitation of CI/CD pipeline vulnerabilities and the use of AI-driven automation in cyber attacks. Organizations must prioritize securing their development environments by auditing dependencies, implementing strict access controls, and continuously monitoring for anomalous activities to mitigate such risks.
4 months ago
Kill Chain
UNC6426's Rapid Exploitation of nx npm Supply Chain: A 72-Hour Breach to AWS Admin Access
In August 2025, the threat actor UNC6426 exploited a supply chain vulnerability in the nx npm package to infiltrate a victim's cloud environment. The attackers published malicious versions of the nx package, which, when installed, exfiltrated developer credentials, including GitHub tokens. Utilizing these stolen tokens, UNC6426 gained unauthorized access to the victim's GitHub account, abused the GitHub-to-AWS OpenID Connect (OIDC) trust relationship to create a new AWS administrator role, and within 72 hours, exfiltrated data from Amazon S3 buckets and destroyed production environments. This incident underscores the escalating sophistication of supply chain attacks, where attackers leverage trusted relationships between development tools and cloud services to escalate privileges rapidly. The breach highlights the critical need for organizations to implement stringent security measures, such as enforcing the principle of least privilege, regularly rotating credentials, and monitoring for anomalous activities within their CI/CD pipelines and cloud environments.
4 months ago
Kill Chain
Critical SQL Injection Vulnerability in Elementor Ally Plugin Puts Over 250,000 WordPress Sites at Risk
In March 2026, a critical SQL injection vulnerability (CVE-2026-2313) was discovered in the Ally – Web Accessibility & Usability plugin for WordPress, affecting versions up to 4.0.3. This flaw allows unauthenticated attackers to inject malicious SQL queries via the URL path, potentially leading to unauthorized access to sensitive database information. The vulnerability arises from insufficient escaping of user-supplied URL parameters in the `get_global_remediations()` method, which are directly concatenated into SQL JOIN clauses without proper sanitization. Exploitation is possible when the plugin is connected to an Elementor account with the Remediation module active. Despite the release of a patched version (4.1.0) on February 23, 2026, data indicates that only about 36% of the affected websites have updated, leaving over 250,000 sites vulnerable. This incident underscores the persistent threat posed by SQL injection vulnerabilities in web applications, emphasizing the need for developers to implement robust input validation and sanitization practices. Website administrators are urged to promptly update plugins and maintain regular security audits to mitigate such risks.
4 months ago
Kill Chain
Microsoft's March 2026 Patch Tuesday: Addressing Critical Zero-Day Vulnerabilities
In March 2026, Microsoft released patches addressing 84 security vulnerabilities across its software portfolio, including two publicly disclosed zero-day flaws: CVE-2026-26127, a denial-of-service vulnerability in .NET, and CVE-2026-21262, an elevation of privilege vulnerability in SQL Server. Notably, over half of the patched vulnerabilities were related to privilege escalation, underscoring the critical need for organizations to apply these updates promptly to mitigate potential exploitation risks. ([anonhaven.com](https://anonhaven.com/en/news/microsoft-march-2026-patch-tuesday-83-cves/?utm_source=openai)) This incident highlights the ongoing challenges in securing complex software ecosystems and the importance of timely patch management. The disclosure of zero-day vulnerabilities before patches are available increases the window of opportunity for threat actors, emphasizing the need for organizations to maintain robust vulnerability management practices.
4 months ago
Kill Chain
Critical n8n Vulnerabilities Expose Systems to Remote Code Execution
In early 2026, multiple critical vulnerabilities were identified in n8n, an open-source workflow automation platform. Notably, CVE-2026-27577 and CVE-2026-27493 allowed for remote code execution (RCE) through expression sandbox escapes and unauthenticated expression evaluations via Form nodes, respectively. These flaws enabled attackers to execute arbitrary commands on the n8n host, potentially leading to full system compromise. ([thehackernews.com](https://thehackernews.com/2026/03/critical-n8n-flaws-allow-remote-code.html?utm_source=openai)) The discovery of these vulnerabilities underscores the importance of timely software updates and vigilant security practices. Organizations utilizing n8n are urged to upgrade to patched versions immediately to mitigate potential exploitation risks.
4 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports