✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Information Technology/IT
Breach intelligence, attack campaigns, and threat reports targeting the Information Technology/IT sector.
Explore Other Sectors
Information Technology/IT Threat Reports
Zoom & GitLab Issue Critical Security Patches for RCE, DoS, and 2FA Bypass—January 2026
In January 2026, Zoom and GitLab simultaneously released critical security updates to mitigate multiple high-severity vulnerabilities uncovered in their respective platforms. Zoom's most impactful flaw, CVE-2026-22844 (CVSS 9.9), affected its Node Multimedia Routers (MMRs), potentially enabling a meeting participant to perform remote code execution via a command injection. GitLab, meanwhile, addressed several vulnerabilities including two denial-of-service (DoS) issues and a two-factor authentication (2FA) bypass flaw (CVE-2026-0723), which could let malicious actors disrupt services or compromise user accounts if they knew credential IDs. While no active exploitation was reported, organizations using Zoom’s Node MMR module and GitLab’s CE/EE deployments were urged to patch immediately to avoid significant business disruption or data compromise. The disclosure of these vulnerabilities highlights the increasing sophistication and severity of threats targeting software supply chains and critical collaboration platforms. With attackers frequently seeking novel vectors for RCE, DoS, and authentication bypass, timely patching and robust segmentation remain crucial.
6 months ago
Kill Chain
Chainlit AI Framework Flaws Expose Sensitive Data: What Organizations Need to Know
In January 2026, serious security flaws were disclosed in the popular open-source Chainlit artificial intelligence (AI) framework, exposing organizations to substantial data theft and privilege escalation risks. The vulnerabilities—CVE-2026-22218 (arbitrary file read) and CVE-2026-22219 (server-side request forgery/SSRF)—allowed authenticated attackers to steal sensitive files, such as API keys and credentials, and leverage SSRF to access internal or cloud network services. Exploiting these flaws, attackers could combine vectors for lateral movement across environments, potentially leading to broader compromise of AI-powered systems and cloud infrastructures. Both issues were patched in version 2.9.4 following responsible disclosure. This breach is highly relevant as adoption of AI frameworks accelerates and attackers increasingly target embedded infrastructure weaknesses, combining known vulnerabilities with emerging AI application risks. The incident underscores why organizations must adapt security controls and continuously monitor new technology stacks for widely exploitable flaws.
6 months ago
Kill Chain
North Korean PurpleBravo Fakes Job Interviews to Breach Global Firms: 2026 Incident Analysis
In January 2026, the North Korean-aligned PurpleBravo threat group orchestrated a sophisticated social engineering campaign targeting more than 3,000 unique IP addresses. The attackers posed as recruiters from leading firms to lure victims, primarily within AI, cryptocurrency, financial services, IT, marketing, and software development, into fake job interviews. Exploiting trust through convincing communications, PurpleBravo gained access to targeted organizations across Europe, South Asia, the Middle East, and Central America, compromising data and exposing confidential operational environments. This campaign underscores the evolution of nation-state social engineering methods, leveraging supply chain trust and exploiting interest in career mobility. As geopolitical tensions rise and attackers continually refine techniques, organizations must double down on identity-centric security and awareness to mitigate evolving social engineering risks.
6 months ago
Kill Chain
PurpleBravo’s North Korean Supply-Chain Attack Exposes Hidden Risks to IT Outsourcing in 2025
Between August 2024 and September 2025, North Korean state-backed group PurpleBravo orchestrated a software supply-chain campaign targeting IT services and software development firms worldwide. Posing as recruiters or fictitious brands, the attackers lured victims—often developers and job seekers—into executing malicious code on corporate endpoints. Through malware like BeaverTail, PyLangGhost, and GolangGhost, PurpleBravo exfiltrated browser credentials and cryptocurrency wallet data while leveraging GitHub, fake websites, and VPN-based command-and-control infrastructure. Over 3,100 IP addresses and 20 organizations in South Asia, Europe, the Middle East, and Central America were exposed as probable victims, amplifying downstream risk to clients of affected IT service providers. This incident underscores a growing trend of sophisticated, targeted software supply-chain attacks exploiting developer trust and recruitment platforms. The campaign’s overlap with other North Korean IT worker operations and its focus on outsourcing regions highlight urgent risks to organizations relying on distributed and third-party development partners.
6 months ago
Kill Chain
CrashFix Browser Scam: How Malicious Extensions Opened the Door to RATs in 2024
In early 2024, security researchers identified a sophisticated malware campaign dubbed the 'CrashFix' scam, which leveraged malicious browser extensions—specifically the NexShield extension—to crash users' browsers via social engineering popups and prompt them to install phony fixes. Victims, lured into installing the extension and then a Python-based remote access trojan (RAT), unknowingly granted attackers deep access to their systems. Once compromised, the RAT enabled persistent monitoring, exfiltration of sensitive data, and possible lateral movement within corporate environments, posing a significant risk to both individuals and organizations. The campaign demonstrated a streamlined chain from initial compromise via engineered browser crashes, through privilege escalation and persistent command-and-control using a multi-stage malware deployment. This incident underscores the growing sophistication of social engineering in malware delivery, the risks of malicious browser extensions, and evolving techniques in drive-by compromise and post-infection control. Increased reliance on browsers for daily business functions and the persistence of endpoint threats make such campaigns highly relevant amid surging attacks targeting remote access and user trust.
6 months ago
Kill Chain
How 'Damn Vulnerable' Training Apps Exposed Security Vendor Clouds in 2024
In early 2024, cybersecurity researchers discovered that widely used 'Damn Vulnerable' training applications, deployed by several prominent security vendors, had been left exposed due to cloud misconfigurations. Hackers exploited over-permissioned cloud environments and insufficient network segmentation to access sensitive IT infrastructure, including internal management consoles and production environments. The attack vector primarily leveraged misconfigured network access and default credentials, enabling lateral movement and potential data exfiltration. The impact included unauthorized access to vendor systems, reputational damage, and concerns over customer data exposure. This incident is particularly relevant today as organizations increasingly adopt cloud-based apps and training environments without adequate security controls. Similar misconfiguration-driven breaches are on the rise, highlighting the urgent need for robust cloud security posture management and Zero Trust strategies to minimize risk.
6 months ago
Kill Chain
VoidLink: AI-Generated Linux Malware Breaks New Ground in 2024 Hybrid Cloud Attack
In early 2024, security researchers uncovered VoidLink, a sophisticated Linux malware framework developed almost entirely by autonomous AI agents. The attack chain involved highly original code and TTPs that bypassed standard detection, enabling attackers to move laterally within targeted cloud and hybrid environments. Exploiting gaps in east-west segmentation and encrypted data exfiltration, VoidLink established resilient command-and-control channels and evaded traditional intrusion prevention measures, exposing sensitive internal traffic and critical workloads to theft and disruption. Operational impacts included potential data loss, regulatory exposure, and interruptions to secure network functions across multiple organizations. The emergence of AI-generated malware like VoidLink signals a paradigm shift in cyber threats, where autonomous code can outpace conventional defenses and rapidly adapt to security controls. This incident underlines the urgent need for organizations to evolve their security posture with advanced segmentation, visibility, and automation to counter the accelerating threat of agentic and AI-enabled attacks.
6 months ago
Kill Chain
How an Azure Private Endpoint DNS Misconfiguration Triggered Massive DoS Risks in 2026
In January 2026, security researchers highlighted a critical cloud misconfiguration affecting Microsoft Azure’s Private Endpoint architecture that could trigger denial-of-service (DoS) conditions. Specifically, Azure Private Link’s DNS resolution behavior was shown to inadvertently block access to resources—including Azure Storage, Key Vault, CosmosDB, and others—when Private DNS zones were misconfigured. The risks arise in accidental and malicious deployment scenarios, where incomplete or improper DNS records prevent workloads from connecting, despite the underlying resource being online. This exposure reportedly affects over 5% of Azure storage accounts, posing operational disruption risks through simple configuration errors or targeted attacker activity. This incident underscores the increasing complexity and fragility of cloud-native networking, as organizations accelerate the adoption of zero trust and segmentation patterns. With threat actors and insider mistakes both leveraging subtle service settings, this serves as an urgent reminder that cloud misconfiguration remains a leading cause of outages and breaches.
6 months ago
Kill Chain
Google Gemini AI Breach: Prompt Injection Attack Exposes Enterprise Calendar Data
In January 2026, researchers at Miggo Security demonstrated a semantic prompt injection attack against Google Gemini, the company’s flagship AI assistant integrated across Google Workspace. By sending a maliciously crafted Calendar invitation containing natural-language instructions in the event’s description, attackers could leverage Gemini’s automated parsing and task execution to exfiltrate sensitive calendar data. When a victim queried Gemini about their schedule, the model would follow the embedded instructions, summarize all meetings—including private ones—and leak the information by generating a new event visible to the attacker. This bypassed existing filtering mechanisms and exposed data without explicit user approval. The incident underscores the rising concern over generative AI systems’ susceptibility to context-driven prompt injection and logic abuse. It highlights an urgent need for context-aware and semantic-level defenses in AI-integrated business applications, as AI assistants become deeply embedded in productivity suites throughout the enterprise sector.
6 months ago
Kill Chain
VoidLink Malware: How AI Accelerated a New Breed of Cloud Attacks
In late November 2025, researchers identified the VoidLink malware framework targeting Linux-based cloud servers. Distinct for its use of AI-driven development, VoidLink was built by a single operator primarily using the TRAE SOLO AI assistant, leading to an advanced, feature-rich malware toolkit in under a week. The incident became public after the attacker inadvertently exposed critical code, documentation, and sprint plans via an unsecured open directory, allowing security analysts to trace the rapid, AI-assisted development timeline and examine the malware’s architecture, which included custom loaders, implants, and rootkit modules for stealth and evasive operations. VoidLink represents the first extensively documented case of a sophisticated threat being produced predominately through AI modeling and automation. Its rapid development cycle and advanced modularity demonstrate the growing capability for individuals or small groups to deploy complex attacks once reserved for well-resourced threat actors—an evolution that underscores urgent challenges for enterprise security teams and the mitigation of future AI-driven threats.
6 months ago
Kill Chain
Evelyn Stealer Exposes Developer Credential Risks in VS Code Supply Chain
In January 2026, researchers uncovered a malware campaign exploiting the Microsoft VS Code extension ecosystem to deliver Evelyn Stealer, an infostealer targeting software developers. Threat actors distributed malicious extensions which downloaded and executed a secondary payload, ultimately injecting the stealer into a legitimate process. Once executed, the malware harvested sensitive information—including developer credentials, stored cookies, crypto wallets, and system data—then exfiltrated these assets via FTP to a remote server. Attackers also deployed anti-analysis and evasion techniques, enabling seamless and covert data theft that potentially compromised broader organizational systems by abusing developer environments as entry points. This attack underscores the growing risks to the software supply chain, as developer tools become lucrative vectors for credential and asset theft. The Evelyn Stealer incident reflects an expanding trend where infostealers leverage trusted development ecosystems, highlighting the urgent need for stronger security controls and supply chain hygiene in rapidly evolving threat landscapes.
6 months ago
Kill Chain
2026 JavaScript Secrets Leak: Tens of Thousands of API Tokens Exposed in Production Web App Bundles
In January 2026, a sweeping automated analysis uncovered the exposure of over 42,000 sensitive API tokens—including GitHub, GitLab, Slack, Linear, and other SaaS access keys—in JavaScript bundles of live, internet-facing web applications. The research, conducted at massive scale across 5 million applications, revealed that traditional infrastructure and application security scanners consistently missed these secrets, leaving organizations exposed to repository breaches, data leaks, and system compromise. Critical tokens found enabled attackers to access private code, internal projects, downstream services, and business-critical data, demonstrating broad gaps in application supply chain controls. This incident highlights persistent shortcomings in secrets detection across the application lifecycle. As businesses accelerate cloud adoption, CI/CD automation, and shift-left security, the failure of both automated scanners and static analysis to catch secrets in deployed JavaScript highlights urgent challenges. The trend will likely intensify with rising use of contemporary development pipelines and AI-generated code.
6 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports