✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Information Technology/IT
Breach intelligence, attack campaigns, and threat reports targeting the Information Technology/IT sector.
Explore Other Sectors
Information Technology/IT Threat Reports
AWS Data Centers in Middle East Damaged by Drone Strikes
In early March 2026, Amazon Web Services (AWS) experienced significant disruptions after drone strikes targeted its data centers in the Middle East. Two facilities in the United Arab Emirates (UAE) were directly hit, while a third in Bahrain sustained damage from a nearby strike. These attacks resulted in structural damage, power outages, and water damage due to fire suppression efforts, leading to elevated error rates and degraded availability for services such as Amazon EC2, Amazon S3, and Amazon DynamoDB. AWS is collaborating with local authorities to restore services, but recovery is expected to be prolonged due to the extent of the physical damage. This incident underscores the vulnerability of critical cloud infrastructure to physical attacks, especially in regions experiencing geopolitical tensions. Organizations relying on cloud services are reminded of the importance of robust disaster recovery plans and the need to consider geographic redundancy to mitigate risks associated with localized disruptions.
5 months ago
Kill Chain
The Rising Threat of Compromised cPanel Credentials in Cybercrime Markets
In March 2025, a cybercriminal known as "miya" advertised for sale compromised SSH, cPanel, Mail, and WebHost Manager (WHM) credentials belonging to a Canadian car dealership on a dark web forum, pricing the access at $400. These credentials provided potential attackers with privileged access to the dealership's critical systems, including remote command-line server control via SSH, administrative capabilities through WHM and cPanel, and access to sensitive communications via the mail server. The breach underscored the escalating cybersecurity risks faced by automotive retailers, who increasingly rely on interconnected digital systems to manage sales, customer data, and backend infrastructure. ([cyberpress.org](https://cyberpress.org/cybercriminal-miya-stolen/?utm_source=openai)) This incident highlights a broader trend of cybercriminals targeting cPanel and other site management credentials to facilitate unauthorized access to web servers and associated services. The sale of such credentials on underground forums has become increasingly common, with prices ranging from $3 to $5, depending on the target and level of access provided. ([documents.trendmicro.com](https://documents.trendmicro.com/assets/wp/wp-north-american-underground.pdf?utm_source=openai))
5 months ago
Kill Chain
Microsoft 2026 OAuth Redirection Abuse: A New Phishing Threat
In early March 2026, Microsoft identified a sophisticated phishing campaign targeting government and public-sector organizations. Attackers exploited the OAuth 2.0 redirection mechanism to bypass traditional email and browser defenses, redirecting users from legitimate authentication pages to malicious sites. This technique involved crafting OAuth authorization requests with parameters designed to trigger authentication errors, leading to redirects that facilitated malware delivery or credential harvesting. The campaign underscores the evolving tactics of threat actors in leveraging trusted authentication flows to compromise user accounts and deliver malicious payloads. This incident highlights a growing trend in the abuse of OAuth mechanisms for phishing and malware distribution. Organizations must remain vigilant, as attackers continue to refine their methods to exploit authentication protocols, emphasizing the need for robust security measures and user education to mitigate such threats.
5 months ago
Kill Chain
Starkiller Phishing Kit: A New Era of MFA Bypass Attacks
In early 2026, cybersecurity researchers uncovered 'Starkiller,' a sophisticated phishing-as-a-service (PhaaS) platform developed by the cybercrime group Jinkusu. Unlike traditional phishing kits that rely on static HTML clones, Starkiller employs a headless Chrome browser within a Docker container to proxy legitimate login pages in real-time. This adversary-in-the-middle (AiTM) approach allows attackers to intercept user credentials and session tokens, effectively bypassing multi-factor authentication (MFA) mechanisms. The platform's user-friendly control panel enables even low-skilled cybercriminals to launch advanced phishing campaigns, posing a significant threat to organizations relying solely on conventional MFA for security. ([abnormal.ai](https://abnormal.ai/blog/starkiller-phishing-kit?utm_source=openai)) The emergence of Starkiller underscores a critical shift in the cyber threat landscape, highlighting the limitations of traditional MFA solutions against evolving phishing techniques. Organizations must adopt phishing-resistant authentication methods, such as FIDO2/WebAuthn-based hardware security keys, and implement continuous monitoring for anomalous session behaviors to mitigate the risks posed by such advanced phishing platforms. ([bytearchitect.io](https://bytearchitect.io/network-security/Starkiller-Phishing-Kit-Why-MFA-Fails-Against-Real-Time-Reverse-Proxies/?utm_source=openai))
5 months ago
Kill Chain
Microsoft Warns of OAuth Redirect Abuse Delivering Malware to Government Targets
In March 2026, Microsoft identified phishing campaigns exploiting OAuth's standard redirection mechanisms to deliver malware to government and public-sector organizations. Attackers created malicious applications with redirect URLs pointing to rogue domains hosting malware. They distributed OAuth phishing links prompting recipients to authenticate via these applications using intentionally invalid scopes. This process redirected users to attacker-controlled pages, leading to inadvertent malware downloads. The payloads, often in ZIP archives, executed PowerShell commands upon opening, resulting in host reconnaissance, DLL side-loading, and connections to external command-and-control servers. Phishing emails employed lures such as e-signature requests, Teams recordings, and financial themes, sent through mass-sending tools and custom solutions developed in Python and Node.js. Microsoft has since removed several malicious OAuth applications and advises organizations to limit user consent, periodically review application permissions, and remove unused or overprivileged apps. ([microsoft.com](https://www.microsoft.com/en-us/security/blog/2026/03/02/oauth-redirection-abuse-enables-phishing-malware-delivery/?utm_source=openai))
5 months ago
Kill Chain
AI-Assisted FortiGate Breach 2026: A Wake-Up Call for Network Security
Between January 11 and February 18, 2026, a Russian-speaking, financially motivated threat actor utilized multiple commercial generative AI services to compromise over 600 Fortinet FortiGate firewalls across more than 55 countries. The attacker exploited exposed management interfaces and weak credentials lacking multi-factor authentication, without leveraging any known FortiGate vulnerabilities. This campaign underscores the growing trend of cybercriminals employing AI tools to automate and scale attacks, significantly reducing the technical expertise required to execute large-scale intrusions. The incident highlights the urgent need for organizations to secure management interfaces, enforce strong authentication mechanisms, and stay vigilant against AI-assisted cyber threats.
5 months ago
Kill Chain
Cybercriminals Exploit Fake Tech Support to Deploy Havoc C2 Framework
In February 2026, a sophisticated cyberattack campaign was identified targeting multiple organizations. Threat actors impersonated IT support personnel, initiating contact through spam emails followed by phone calls. They convinced victims to grant remote access via tools like AnyDesk, leading to the deployment of a customized version of the Havoc command-and-control (C2) framework. This allowed rapid lateral movement within networks, with the attackers compromising multiple endpoints within hours, indicating objectives of data exfiltration or ransomware deployment. This incident underscores the evolving tactics of cybercriminals, combining social engineering with advanced malware to infiltrate organizations. The use of open-source C2 frameworks like Havoc, customized to evade detection, highlights the need for enhanced vigilance and updated security protocols to counter such multifaceted threats.
5 months ago
Kill Chain
OpenClaw Vulnerability Highlights AI Agent Security Risks
In February 2026, a critical vulnerability (CVE-2026-25253) was discovered in OpenClaw, an open-source AI agent platform, allowing attackers to execute arbitrary code on users' systems via malicious web pages. This flaw exposed over 42,000 instances globally, leading to unauthorized access, data exfiltration, and potential system compromise. The vulnerability was promptly patched in version 2026.1.29, but the incident highlighted significant security concerns inherent in AI agent architectures. ([taoapex.com](https://taoapex.com/en/guides/deploy-personal-ai-assistant-openclaw/?utm_source=openai)) The rapid adoption of AI agents like OpenClaw has outpaced the development of robust security measures, making them attractive targets for cybercriminals. This incident underscores the urgent need for comprehensive security frameworks and best practices to mitigate risks associated with autonomous AI systems.
5 months ago
Kill Chain
Understanding OAuth Redirection Abuse in Phishing Attacks
In March 2026, Microsoft identified a sophisticated phishing campaign exploiting OAuth's redirection mechanisms to deliver malware. Attackers crafted URLs using legitimate identity providers like Microsoft Entra ID and Google Workspace, embedding them in phishing emails with themes such as e-signature requests and financial documents. When recipients clicked these links, they were redirected through trusted domains to attacker-controlled sites, leading to malware downloads. This method effectively bypassed traditional email and browser security defenses, resulting in significant compromises across government and public-sector organizations. ([microsoft.com](https://www.microsoft.com/en-us/security/blog/2026/03/02/oauth-redirection-abuse-enables-phishing-malware-delivery/?utm_source=openai)) This incident underscores a growing trend where threat actors leverage legitimate protocol features to conduct malicious activities. The abuse of OAuth redirection highlights the need for organizations to enhance monitoring of authentication flows and implement stricter controls over third-party application permissions to mitigate such evolving threats.
5 months ago
Kill Chain
CrushFTP 2025 Brute-Force Attack Highlights Credential Vulnerabilities
In March 2025, CrushFTP servers were targeted by brute-force attacks exploiting default or weak credentials, particularly the 'crushadmin' account with the password 'crushadmin'. These attacks originated from IP address 5.189.139.225, a French IP with a history of exploit attempts targeting simple vulnerabilities. The attackers aimed to gain unauthorized administrative access, potentially leading to data exfiltration and system compromise. This incident underscores the critical importance of enforcing strong password policies and regularly updating default credentials to prevent unauthorized access. Organizations are advised to review their authentication mechanisms and implement multi-factor authentication where possible to mitigate such risks.
5 months ago
Kill Chain
North Korean Hackers Exploit npm Packages in 2026 Supply Chain Attack
In March 2026, North Korean state-sponsored hackers launched a sophisticated supply chain attack by publishing 26 malicious npm packages disguised as developer tools. These packages utilized steganography to extract command-and-control (C2) URLs from seemingly benign Pastebin content, ultimately deploying a cross-platform remote access trojan (RAT) targeting developers. The C2 infrastructure was hosted on Vercel across 31 deployments, enabling the attackers to execute commands, exfiltrate sensitive data, and maintain persistent access to compromised systems. This incident underscores the evolving tactics of threat actors in exploiting trusted open-source ecosystems to infiltrate developer environments. The use of steganography and multi-stage payload delivery highlights the increasing complexity of supply chain attacks, emphasizing the need for enhanced vigilance and security measures within the software development community.
5 months ago
Kill Chain
Understanding the Google Gemini 2025 Prompt Injection Vulnerability
In mid-2025, security researchers identified a significant vulnerability in Google's AI assistant, Gemini, integrated into Gmail and other Workspace applications. This flaw, known as 'prompt injection,' allowed attackers to embed hidden instructions within emails using HTML and CSS techniques, such as invisible text. When Gemini processed these emails to generate summaries, it executed the concealed commands, potentially leading to deceptive summaries that could mislead users into divulging sensitive information or performing unintended actions. The exploitation of this vulnerability posed substantial risks, including unauthorized access to user data and increased susceptibility to phishing attacks. ([techradar.com](https://www.techradar.com/pro/security/google-gemini-can-be-hijacked-to-display-fake-email-summaries-in-phishing-scams?utm_source=openai)) The discovery of this vulnerability underscores the evolving nature of cyber threats targeting AI-driven platforms. As AI assistants become more integrated into daily workflows, they present new attack vectors that traditional security measures may not fully address. This incident highlights the critical need for continuous monitoring and updating of AI systems to safeguard against emerging threats and to maintain user trust in these technologies.
5 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports