✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Information Technology/IT
Breach intelligence, attack campaigns, and threat reports targeting the Information Technology/IT sector.
Explore Other Sectors
Information Technology/IT Threat Reports
How an XSS Bug in StealC Malware Panel Unmasked Threat Actors in 2026
In January 2026, cybersecurity researchers exploited a cross-site scripting (XSS) vulnerability in the StealC information stealer's web-based control panel. By leveraging this flaw, they monitored active threat actor sessions, collected system fingerprints, and obtained critical intelligence on StealC's illicit operations. The StealC malware, known for targeting credentials and sensitive data from infected endpoints, was actively managed via this compromised control panel by cybercriminal operators. As a result of this research, defenders gained unprecedented visibility into threat actor workflow and TTPs, turning a malicious tool’s own infrastructure against its controllers. This incident highlights the growing focus on attacking the infrastructure of threat actors themselves, signifying a shift in defensive strategies. Vulnerabilities within criminal tooling and panels can be weaponized by blue teams to gain actionable threat intelligence, reflecting broader trends in intrusion analysis and adversary disruption.
6 months ago
Kill Chain
Fortinet 2026: How RedLine Clipjack and Copilot Shaped a New Breed of Multi-Vector Attacks
In early 2026, multiple organizations suffered a multi-vector cyberattack campaign leveraging Fortinet device vulnerabilities, RedLine stealer variants with clipjack capabilities, and weaponized Copilot-integrated phishing. Threat actors gained initial access through unpatched Fortinet appliances, moved laterally via east-west traffic, and deployed RedLine malware to intercept credentials and exfiltrate sensitive data. The attackers further abused cloud AI tools to automate reconnaissance and launch targeted campaigns, leading to significant data compromise and operational disruption across cloud and hybrid environments. This incident underscores an accelerating trend: attackers are combining zero-day exploits, infostealers, and AI-driven automation to bypass traditional defenses. As threat actors become more agile and creative with emerging tools, organizations face growing pressure to secure east-west flows and implement real-time anomaly detection to mitigate multi-stage breaches.
6 months ago
Kill Chain
Google Gemini AI Prompt Injection Breach Exposes Calendar Data in 2026
In early 2026, researchers uncovered a significant security flaw in Google Gemini’s AI/ML integrations that allowed attackers to exploit indirect prompt injection to circumvent authorization guardrails and access private Google Calendar events. By embedding hidden instructions in malicious calendar invites, attackers could cause Gemini to exfiltrate sensitive information from users’ calendars without their knowledge or explicit consent. The exploit, disclosed by Miggo Security, demonstrated how AI-driven features can inadvertently expand attack surfaces, resulting in unauthorized data exposure and raising serious concerns for enterprise users relying on AI-powered productivity platforms. This breach highlights an evolving trend of attackers targeting embedded AI agents within trusted cloud services. As organizations increasingly leverage AI-powered workflows, the risks of novel exploitation methods like prompt injection become more pressing, driving renewed urgency around reinforcing authorization layers and AI security best practices.
6 months ago
Kill Chain
Fortinet FortiSIEM CVE-2025-64155: Critical Vulnerability Exploited in the Wild
In June 2025, Fortinet disclosed CVE-2025-64155, a critical command injection vulnerability affecting FortiSIEM, its security information and event management solution. Attackers began exploiting the flaw almost immediately after disclosure, leveraging it to execute unauthorized system commands and gain persistent access across multiple targeted networks. Malicious activity was detected from a diverse array of IP addresses, suggesting widespread probing and potential compromise. The rapid weaponization of the vulnerability placed organizations relying on FortiSIEM at risk of data exfiltration, lateral movement, and potential service disruption, underscoring the importance of timely patch management and layered defenses. This incident is emblematic of a growing trend where attackers aggressively target newly disclosed vulnerabilities in widely used security platforms. The event highlights the urgent need for rapid vulnerability response processes and reevaluation of vendor risk in security-critical infrastructure, as threat actors continue to automate exploitation of critical flaws in security tooling itself.
6 months ago
Kill Chain
Fortinet FortiSIEM Zero-Day: Exploitation Surge Exposes SIEM Risks in 2024
In June 2024, attackers began actively exploiting a critical vulnerability (CVE-2024-XXXX) in Fortinet FortiSIEM, a widely deployed security event management solution. The flaw, which allows remote code execution via specially crafted API requests, was leveraged soon after public proof-of-concept exploit code emerged. Threat actors targeted unpatched FortiSIEM instances to gain privileged access, deploy malware, and establish persistence within enterprise environments, impacting security visibility and putting sensitive data at risk. Public advisories highlighted patch urgency, as exploitation was observed globally in both private and government sectors. This incident underscores sharp escalation in exploitation of high-impact vulnerabilities immediately following public disclosure and POC release. The attack illustrates the need for rapid patching, robust segmentation, and comprehensive monitoring, as threat actors increasingly automate targeting of critical management infrastructure.
6 months ago
Kill Chain
LOTUSLITE Backdoor: How Mustang Panda Targeted U.S. Policy Organizations in 2026
In January 2026, researchers revealed a spear phishing campaign targeting US government and policy organizations utilizing geopolitical lures themed around US intervention in Venezuela. Attackers distributed a malicious ZIP archive containing a DLL file using side-loading techniques to deploy the LOTUSLITE backdoor. The campaign, attributed to the Chinese state-linked Mustang Panda group, leveraged reliable execution flows such as DLL sideloading, beaconed over WinHTTP APIs, enabled remote command execution, and exfiltrated data. While the exact scope of any successful compromise remains unclear, the operation demonstrates a focused cyber espionage effort using proven tactics for initial access and persistence. This campaign highlights the ongoing trend where threat actors employ familiar, effective tradecraft combined with timely or provocative lures. It underscores the continued risk posed to policy organizations from geopolitical-themed spear phishing as attackers adapt their delivery but rely on consistent, operationally sound techniques.
6 months ago
Kill Chain
Malicious Chrome Extensions Target Workday and NetSuite Users in Coordinated Attack
In January 2026, cybersecurity researchers uncovered a campaign involving five malicious Google Chrome extensions that impersonated enterprise platforms such as Workday, NetSuite, and SuccessFactors. These extensions worked in unison to steal authentication tokens, disrupt incident response procedures, and seize control of victim user accounts. Attackers leveraged the trust users place in HR and ERP browser tools, exploiting their position to achieve data exfiltration and persistent account takeover across corporate environments. The attack’s main impact included unauthorized access to sensitive business systems and increased potential for widespread lateral movement within organizations. This incident underscores the growing sophistication of browser-based threats as attackers increasingly mimic legitimate business tools to infiltrate organizations. With a rise in social engineering and token theft techniques targeting identity and SaaS workflows, enterprises face heightened risk to cloud and hybrid environments, necessitating additional focus on endpoint, browser, and application-layer defenses.
6 months ago
Kill Chain
Microsoft Dismantles RedVDS: Takedown of a Major Cybercrime Infrastructure in 2026
In January 2026, Microsoft, in collaboration with Europol and German authorities, disrupted RedVDS, a global cybercrime-as-a-service platform responsible for at least $40 million in fraud losses since March 2025. RedVDS provided criminals with affordable, disposable virtual Windows servers and administrator-level access, enabling mass phishing, business email compromise (BEC) scams, credential theft, and sophisticated social engineering—including attacks leveraging AI technologies. The takedown involved legal action, seizure of RedVDS infrastructure, and removal of its marketplace and customer portal, significantly impacting cybercriminal campaigns that leveraged these services to attack organizations and individuals worldwide. This incident underscores the increasing threat posed by cybercrime-as-a-service models, which drastically lower barriers for criminals to launch high-volume, geographically-targeted attacks leveraging cloud infrastructure. The rise of AI-generated phishing, deepfakes, and anonymized payment methods heightens risk, challenging both organizational defenses and global law enforcement.
6 months ago
Kill Chain
Grubhub 2024 Data Breach: Hackers Steal Sensitive Customer Information
In June 2024, Grubhub, a major food delivery platform, experienced a significant data breach after hackers gained unauthorized access to its internal systems. According to official statements and media reports, the attackers stole sensitive customer data, including contact details and potentially account credentials. The incident led to extortion demands from the threat actors, prompting Grubhub to initiate incident response protocols and notify affected users. The breach highlighted the attackers’ ability to navigate network defenses, exfiltrate data, and potentially disrupt business operations with ransom threats. This incident is particularly relevant amid a surge in data breaches targeting large consumer platforms and the continued evolution of extortion-based attacks. With regulatory scrutiny increasing and attackers using sophisticated lateral movement tactics, organizations must reassess data protection, segmentation, and threat detection strategies.
6 months ago
Kill Chain
Modular DS WordPress Plugin Flaw Grants Attackers Admin Access in Widespread 2026 Breach
In January 2026, a critical authentication bypass vulnerability (CVE-2026-23550) was discovered and exploited in the Modular DS WordPress plugin. With over 40,000 installations, the plugin allowed central management of multiple WordPress sites. The flaw enabled unauthenticated attackers to remotely access admin-level privileges by exploiting flawed logic in the plugin’s direct request mode, resulting in privileged access without cryptographic checks. Attackers were able to select or auto-enroll themselves as site administrators, exposing affected sites to full compromise and potential downstream attacks. A patch was quickly released in version 2.5.2, closing the immediate vulnerability. This incident stands out as attackers increasingly target plugin ecosystems in widely-used CMS platforms, exploiting software supply chain vectors for rapid, broad impact. The case illustrates the urgency for continuous code review and rapid patch management in response to emergent threats.
6 months ago
Kill Chain
Reprompt Attack on Microsoft Copilot Unlocks Single-Click Data Exfiltration
In January 2026, cybersecurity researchers discovered a novel attack technique, dubbed 'Reprompt,' targeting Microsoft Copilot and similar enterprise AI chatbots. This method leverages legitimate Microsoft links requiring only a single user click to trigger silent, one-click exfiltration of sensitive corporate data – all while circumventing standard enterprise security controls. The attack exploits weaknesses in how Copilot processes prompts and allows threat actors to quickly access confidential information without needing additional malware or user authentication bypasses. This incident highlights the increasing risk posed by attacks on generative AI systems within enterprise environments. As the adoption of LLM-powered assistants accelerates, organizations must remain vigilant against rapidly evolving prompt-injection threats, and are under new regulatory, compliance, and reputational pressures to secure data in AI workflows.
6 months ago
Kill Chain
Salt Typhoon Exploits Redis Unauthenticated RCE: 2026 Lessons for Zero Trust
In early January 2026, a critical security flaw was discovered in Redis servers that allowed unauthenticated remote code execution (RCE). Exploited by a new threat group dubbed Salt Typhoon, the attackers leveraged unencrypted traffic and lack of east-west network controls to gain foothold via exposed Redis instances. The operation enabled lateral movement within affected organizations’ environments, resulting in rapid credential access and potential data exfiltration. Numerous enterprises faced service disruptions and urgent patching efforts, as exploitation spread quickly amidst widespread cloud and on-prem deployments. This incident highlights the resurgence of unauthenticated RCE exploits targeting core data store infrastructure, particularly where zero trust segmentation and encrypted traffic policies are not rigorously applied. Growing attacker interest in lateral movement, compounded by hybrid cloud complexity, has made traditional perimeter defenses insufficient.
6 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports