✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Information Technology/IT
Breach intelligence, attack campaigns, and threat reports targeting the Information Technology/IT sector.
Explore Other Sectors
Information Technology/IT Threat Reports
Lucide Proxy Campaign: A New Wave of Supply Chain Attacks
In May 2026, a campaign involving 148 malicious npm packages, disguised as student web proxies, covertly transformed users' browsers into nodes of a distributed denial-of-service (DDoS) botnet. These packages, branded as 'Lucide' and presented as tutoring services like 'Riverbend Tutoring' and 'Northstar Tutoring,' lured students seeking to bypass school web filters. Upon visiting these proxy sites, users' browsers loaded remote JavaScript payloads that executed DDoS attacks and injected aggressive popunder advertisements. The campaign exploited the npm ecosystem to distribute these packages, leveraging the browsers of end-users for malicious activities without their knowledge. ([research.jfrog.com](https://research.jfrog.com/post/lucide-proxy-npm-malware-campaign/?utm_source=openai)) This incident underscores a significant evolution in supply chain threats, highlighting the vulnerability of end-user systems to malicious code distributed through trusted platforms. The attackers' use of mutable remote loaders and rapid iteration of package versions indicates a low operational security posture, focusing on maximizing short-term impact. Organizations must remain vigilant against such deceptive tactics, emphasizing the importance of scrutinizing third-party packages and educating users about the risks associated with untrusted proxy tools.
1 week ago
Kill Chain
U.S. Sanctions 1VPNS and Cryptor Seller for Enabling Ransomware Attacks
On July 13, 2026, the U.S. Department of the Treasury's Office of Foreign Assets Control (OFAC) sanctioned First VPN Service (1VPNS), its Ukrainian administrator Dmytro Rashevskyi, and Belarusian cryptor seller Yevgeniy Vladimirovich Silayev for facilitating ransomware attacks against American entities. 1VPNS provided anonymizing infrastructure that enabled ransomware groups to obscure their operations, while Silayev sold cryptors that disguised malware to evade detection. These services were instrumental in attacks targeting U.S. businesses, financial services, hospitals, and municipal governments, resulting in billions of dollars in losses. ([publicnow.com](https://www.publicnow.com/view/0E2E8ABF10AF6840E4588F09B8C6B2408783C702?utm_source=openai)) This action underscores the U.S. government's commitment to disrupting the cybercriminal ecosystem by targeting not only the perpetrators but also the enablers of ransomware operations. The sanctions highlight the critical role that infrastructure providers and tool developers play in the proliferation of ransomware, emphasizing the need for comprehensive cybersecurity measures and international cooperation to combat these threats.
1 week ago
Kill Chain
Grok Build CLI's Unauthorized Git Repository Uploads Raise Privacy Concerns
In July 2026, security researcher cereblab discovered that xAI's Grok Build CLI (version 0.2.93) was uploading entire Git repositories, including full commit histories and files not accessed during coding tasks, to a Google Cloud Storage bucket managed by xAI. This behavior occurred even when users disabled the 'Improve the model' setting, which was presumed to prevent such data transmissions. The uploads included sensitive information, such as credentials stored in `.env` files, raising significant privacy and security concerns. xAI addressed the issue by implementing a server-side configuration change to halt these unauthorized uploads. ([breachnews.com](https://breachnews.com/research/grok-build-uploaded-entire-git-repositories-to-xai-storage-by-default/?utm_source=openai)) This incident underscores the critical importance of transparency and user consent in AI tools handling sensitive data. It highlights the need for developers to scrutinize the data practices of AI coding assistants and for organizations to implement robust data governance policies to protect proprietary information.
1 week ago
Kill Chain
Understanding OAuth Client ID Spoofing in Microsoft Entra ID
In early 2026, attackers began exploiting a technique known as OAuth client ID spoofing to stealthily enumerate user accounts and validate credentials within Microsoft Entra ID environments. By submitting authentication requests with spoofed client IDs—identifiers that do not correspond to registered applications—attackers could infer valid usernames and passwords without generating successful sign-in events, thereby evading traditional detection mechanisms. This method allowed unauthorized access to cloud services without alerting defenders. ([proofpoint.com](https://www.proofpoint.com/us/blog/threat-insight/oauth-client-id-spoofing-why-fake-client-ids-are-gaining-traction-stealthy?utm_source=openai)) The adoption of OAuth client ID spoofing signifies a shift in attacker tactics towards more covert credential validation methods. Organizations must enhance their monitoring strategies to detect such evasive techniques and implement robust authentication policies to mitigate the risk of unauthorized access.
1 week ago
Kill Chain
EU and UK Sanction Russian Entities Over Cyberespionage Campaign
In July 2026, the European Union and the United Kingdom imposed coordinated sanctions on Russian military intelligence officers, hackers, and private companies in response to a prolonged cyberespionage campaign attributed to Russian actors. The EU targeted nine individuals and four entities, while the UK sanctioned 24 individuals and organizations. These sanctions, including asset freezes and travel bans, were directed at actors linked to Russia's FSB and GRU intelligence agencies, accused of conducting cyber operations targeting governments and critical infrastructure since 2010. Key affected countries include France, Germany, Poland, the Netherlands, and Finland, with specific incidents such as the sabotage of Polish railway infrastructure highlighted. ([apnews.com](https://apnews.com/article/1d3c542e1409b54a10856eacad18b7ca?utm_source=openai)) This incident underscores the escalating threat of state-sponsored cyberattacks on critical infrastructure and governmental networks. The coordinated response by the EU and UK reflects a growing recognition of the need for unified action against cyber threats, emphasizing the importance of robust cybersecurity measures and international cooperation to safeguard national security and public services.
1 week ago
Kill Chain
Lidl Data Breach: Safeguarding Customer Information in the Digital Age
In July 2026, Lidl, a leading European supermarket chain, disclosed a data breach affecting customers in Germany, Belgium, and the Netherlands. The breach occurred due to unauthorized access to a file stored by a third-party IT service provider, resulting in the exposure of personal customer information, including names, contact details, dates of birth, and customer numbers. Importantly, Lidl confirmed that passwords, billing and shipping addresses, and payment information were not compromised. The company has notified affected customers and relevant authorities, advising vigilance against potential phishing attempts. This incident underscores the critical importance of securing third-party service providers, as supply chain vulnerabilities can lead to significant data breaches. Organizations are increasingly recognizing the need to implement robust security measures and conduct thorough assessments of their external partners to mitigate such risks.
2 weeks ago
Kill Chain
CrashStealer: New macOS Malware Impersonates Apple CrashReporter
In early July 2026, security researchers identified 'CrashStealer,' a sophisticated macOS infostealer malware that masquerades as Apple's CrashReporter tool. Delivered through a signed and notarized installer named 'Werkbit Setup,' CrashStealer bypasses macOS's Gatekeeper protections. Once executed, it prompts users with a fake system password request to gain access to the Keychain, subsequently exfiltrating sensitive data including browser credentials, cookies, and cryptocurrency wallet information. The malware employs advanced techniques such as client-side AES-256-GCM encryption for data exfiltration and re-signing its binary to evade detection. This incident underscores a growing trend of macOS-targeted malware leveraging social engineering and legitimate-looking applications to infiltrate systems. Organizations must enhance their security posture by implementing robust endpoint protection, user education on phishing tactics, and continuous monitoring to detect and mitigate such threats.
2 weeks ago
Kill Chain
Jscrambler npm Package Compromise: A Wake-Up Call for Supply Chain Security
In July 2026, Jscrambler's npm package was compromised, leading to the publication of malicious versions (8.14, 8.16, 8.17, and 8.20) containing an infostealer malware executed during the 'preinstall' hook. This breach resulted in approximately 1,500 downloads within a two-hour window before the issue was addressed. The malware targeted sensitive data, including source code, developer credentials, cloud service keys, and cryptocurrency wallets. Jscrambler promptly deprecated the affected versions and released a secure version 8.22. This incident underscores the critical importance of securing software supply chains, as attackers increasingly exploit trusted development tools to distribute malware. Organizations must implement stringent security measures, such as code integrity checks and continuous monitoring, to prevent similar supply chain attacks.
2 weeks ago
Kill Chain
Cyberattack on Nihon Kotsu Disrupts Taxi Services Across Japan
In July 2026, Nihon Kotsu, Japan's largest taxi operator, experienced a cyberattack that compromised its internal systems, leading to the shutdown of critical infrastructure, including the taxi dispatch system. The attack occurred early Saturday morning, prompting the company to implement emergency measures to prevent further damage. As a result, services such as car hire, web booking, reservation management, and telephone dispatch remain unavailable. The company has engaged external cybersecurity experts to investigate the incident and assess potential data leaks. Customers are advised to use the 'GO' taxi app or visit nearby taxi stands for services. This incident underscores the escalating threat of cyberattacks targeting critical infrastructure and essential services. Organizations must prioritize robust cybersecurity measures and incident response plans to mitigate operational disruptions and protect sensitive data.
2 weeks ago
Kill Chain
ModHeader Extension Removed by Google and Microsoft Over Security Concerns
In July 2026, Google and Microsoft removed the ModHeader browser extension, which had approximately 1.6 million combined installs across Chrome and Edge, due to the discovery of a dormant data collection module. Security researchers found that version 7.0.18 of ModHeader contained code capable of collecting users' browsing histories and transmitting the encrypted data to an external server. Although the data collection feature was inactive, its presence raised significant privacy concerns, leading to the extension's removal from both browsers. This incident underscores the critical need for rigorous security assessments of browser extensions, especially those with extensive user bases. It highlights the potential risks associated with third-party software components and the importance of continuous monitoring to detect and mitigate hidden threats that could compromise user privacy and security.
2 weeks ago
Kill Chain
Yellow Teams: Defining the Future of AI Security
In 2026, organizations like Anthropic and OpenAI initiated projects such as Project Glasswing and Daybreak, respectively, to explore the integration of advanced AI models like Claude Mythos and GPT-5.5 into cybersecurity operations. These initiatives led to the formation of 'yellow teams'—engineering groups dedicated to developing both offensive and defensive AI tools. These teams collaborated with red (offensive) and blue (defensive) teams to harness AI capabilities for identifying vulnerabilities and enhancing security measures. The collaboration resulted in the discovery of numerous vulnerabilities, including some longstanding ones, and emphasized the necessity of integrating AI into the software development life cycle to proactively mitigate future threats. The emergence of yellow teams underscores a significant shift in cybersecurity strategies, highlighting the critical role of AI in both offensive and defensive operations. As AI technologies continue to evolve, the integration of such teams is essential for organizations aiming to stay ahead of sophisticated cyber threats and to adapt to the rapidly changing threat landscape.
2 weeks ago
Kill Chain
CISA's 2026 GitHub Credential Leak: Lessons in Security Oversight
In May 2026, the Cybersecurity and Infrastructure Security Agency (CISA) experienced a significant security lapse when a contractor inadvertently exposed sensitive credentials on a public GitHub repository named 'Private-CISA.' This repository, maintained by an employee of Nightwing—a contractor for CISA—contained approximately 844 MB of internal data, including administrative AWS GovCloud keys, plaintext passwords for internal systems, SSH keys, and SAML certificates. The repository was publicly accessible from November 2025 until its discovery in May 2026 by security researcher Guillaume Valadon of GitGuardian. Upon notification, CISA took steps to remove the repository and revoke the exposed credentials. ([techcrunch.com](https://techcrunch.com/2026/05/19/us-cyber-agency-cisa-exposed-reams-of-passwords-and-cloud-keys-to-the-open-web/?utm_source=openai)) This incident underscores the critical importance of stringent credential management and the need for continuous monitoring of public code repositories to prevent unauthorized data exposure. It also highlights the necessity for organizations, especially those responsible for national cybersecurity, to enforce robust security protocols and ensure that contractors adhere to the same standards to mitigate potential risks.
2 weeks ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports