✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Information Technology/IT
Breach intelligence, attack campaigns, and threat reports targeting the Information Technology/IT sector.
Explore Other Sectors
Information Technology/IT Threat Reports
MongoBleed: Active Exploitation of MongoDB Memory Leak Puts Credentials at Risk in 2024
In June 2024, a critical vulnerability nicknamed "MongoBleed" was discovered in MongoDB, exposing servers to a memory leak flaw that enables unauthenticated attackers to extract sensitive data such as passwords and authentication tokens. Threat actors are actively exploiting the flaw by sending specially crafted requests to exposed MongoDB endpoints, resulting in chunks of memory—including user credentials and potentially session information—being sent in response. Organizations running unpatched MongoDB instances faced increased risk of credential theft, lateral movement, and potential data breaches, with attacks escalating once public proof-of-concept exploits were released. The MongoBleed incident highlights a surge in opportunistic attacks against cloud-managed databases and underscores the crucial need for rapid patch deployment. The attack's simplicity, combined with the prevalence of cloud-exposed databases in hybrid environments, makes this vulnerability especially relevant as organizations transition to zero-trust and improved segmentation to defend against credential harvesting and related threats.
6 months ago
Kill Chain
NordVPN 2026: False Data Breach Claim Traced to Vendor Test Environment
In January 2026, a threat actor claimed to have breached NordVPN's internal Salesforce development servers, alleging access to over ten databases containing sensitive Salesforce API keys and Jira tokens. The attacker purportedly leveraged brute-force tactics against a misconfigured server; however, NordVPN clarified that the data originated from a vendor's temporary test environment used months prior for automated testing. The breached environment contained only non-sensitive, dummy data, was never linked to NordVPN's production infrastructure, and did not expose customer information or production credentials. The company immediately investigated, engaged with the affected vendor, and publicly denied any compromise of its operational assets. This incident highlights how false breach claims—when amplified by threat actors and forums—can impact enterprise reputation, erode trust, and distract security teams. The event also spotlights the importance of robust controls and clear communication regarding third-party environments, even those used only for testing, as threat actors increasingly seek to exploit every operational touchpoint.
6 months ago
Kill Chain
VSCode IDE Forks Expose Software Supply Chain Risks via Recommended Extensions
In late 2025, researchers at Koi Security identified a vulnerability across several AI-powered IDEs forked from Microsoft Visual Studio Code—including Cursor, Windsurf, Google Antigravity, and Trae—whereby hardcoded lists of "recommended" extensions pointed to namespaces that were unclaimed in the OpenVSX extension registry. Threat actors could exploit this by registering these namespaces and publishing malicious extensions, leveraging user trust in built-in recommendations. The risk affected any developer using these IDE forks, potentially opening the door for supply chain malware. After reporting, project maintainers began removing vulnerable recommendations and placeholder, non-functional extensions were uploaded to block exploitation. No evidence of active malicious abuse was found prior to remediation. This incident underscores the growing risk of software supply chain attacks, particularly via open-source repositories and trusted platform recommendations. As more AI-powered tools automate software development environments, attackers are increasingly targeting overlooked dependency and plugin ecosystems, forcing organizations to enhance extension and third-party controls.
6 months ago
Kill Chain
Corporate Cloud File-Sharing Sites Targeted in Major Zestix Data Theft (2024)
In early 2024, a threat actor identified as Zestix orchestrated a widespread campaign targeting corporate instances of popular cloud file-sharing services, including ShareFile, Nextcloud, and OwnCloud. By exploiting vulnerable configurations and access controls, Zestix infiltrated dozens of organizations, exfiltrating sensitive corporate data and offering it for sale on underground forums. Attackers leveraged cloud-native techniques to blend in with legitimate traffic, complicating detection and response efforts. The incident has resulted in operational disruption for several affected companies and increased scrutiny over cloud data management strategies. This breach highlights the growing sophistication of cybercriminals in targeting SaaS-based collaboration platforms, exploiting the accelerated shift to cloud storage. As data sovereignty and regulatory demands intensify, organizations must urgently address evolving cloud security gaps to counter both traditional and cloud-native threats.
6 months ago
Kill Chain
VVS Stealer: Obfuscated Python Malware Compromises Discord Accounts in 2025
In April 2025, researchers discovered a new information stealer, VVS Stealer, distributed via obfuscated Python code targeting Discord users. The malware, sold on Telegram, leverages Pyarmor obfuscation techniques to evade detection and focuses on harvesting Discord credentials and authentication tokens. Attackers propagated the malware through malicious campaigns that trick users into executing compromised scripts, resulting in unauthorized access to their Discord accounts. The impact was the loss of sensitive credentials, potential identity theft, and exposure of personal communications, with widespread risk for Discord communities and possibly further compromise of cloud-connected services. This incident exemplifies the growing sophistication in malware targeting online communities, particularly through social engineering and advanced obfuscation. There is a notable trend of threat actors exploiting popular platforms and leveraging encryption or evasion techniques to bypass standard security controls — elevating the urgency for endpoint protection, behavioral monitoring, and defense-in-depth controls.
6 months ago
Kill Chain
RondoDox Botnet Leverages React2Shell to Breach Next.js Servers
In early 2024, the RondoDox botnet launched widespread attacks targeting exposed Next.js servers by exploiting a vulnerability known as React2Shell. The threat actors leveraged this exploit to install cryptomining malware, enroll compromised enterprise and IoT devices into their botnet, and facilitate lateral movement across affected networks. The campaign demonstrates advanced threat sophistication, including rapid deployment of botnet payloads and persistent communication over encrypted channels, resulting in operational disruption and the risk of sensitive data exposure for impacted organizations. This incident underscores an uptick in supply chain and application-layer attacks, particularly on modern frameworks like Next.js. With attackers automating exploitation of recently disclosed vulnerabilities, organizations must prioritize patch management and adopt Zero Trust controls to defend against evolving botnet campaigns.
6 months ago
Kill Chain
Resecurity 2025: How a Cybersecurity Firm Turned an Alleged Breach Into a Threat Intelligence Win
In December 2025, threat actors identifying as the 'Scattered Lapsus$ Hunters' claimed they had breached systems belonging to cybersecurity firm Resecurity, stealing employee data, internal communications, threat intelligence reports, and client information. The attackers published screenshots to support their claims, including evidence of access to collaboration platforms. However, Resecurity quickly countered the claims, explaining that the compromised environment was actually a carefully monitored honeypot populated with synthetic datasets and fake credentials, intentionally designed to attract cybercriminals for research purposes. The company monitored and logged the attackers’ behaviors, collected valuable intelligence—including reconnaissance, OPSEC failures, and the use of residential proxy infrastructure—and shared key data with law enforcement. No real customer data or production systems were at risk during the incident, according to Resecurity. This case highlights the growing trend of cyber attackers targeting security firms as retaliation for investigations, as well as the strategic use of deceptive honeypots to gather adversary intelligence. The incident underlines the importance of controlled cyber deception, advanced detection, and proactive threat intelligence amid an escalating environment of data theft claims and public leak extortion tactics.
6 months ago
Kill Chain
RondoDox Botnet: React2Shell Flaw Drives Massive Next.js Server Breaches
In December 2025, the RondoDox botnet exploited the critical React2Shell vulnerability (CVE-2025-55182) to breach hundreds of Next.js servers worldwide. Researchers observed the botnet initiating mass scans and automated remote code execution attacks against exposed servers, deploying malware, persistent botnet loaders, and cryptominers. RondoDox leveraged the unpatched flaw in the widely used React Server Components protocol, enrolling compromised systems and IoT devices into its botnet and wiping out competing malware. The attack impacted both consumer and enterprise networks, risking data exfiltration, service outages, and broader supply chain compromise. This campaign underscores the increased urgency around patching application-layer vulnerabilities at scale, as attackers rapidly weaponize zero-day and n-day exploits across popular frameworks. The prevalence of automated exploitation and lateral expansion tactics reflects a shifting threat landscape that challenges traditional perimeter security and requires robust detection, segmentation, and rapid response capabilities.
6 months ago
Kill Chain
GlassWorm Malware Hits macOS: Supply Chain Attack via Malicious VSCode Extensions (2026)
In late 2025 and into January 2026, a new wave of the "GlassWorm" malware campaign targeted macOS developers by infiltrating Visual Studio Code and OpenVSX extension marketplaces. Malicious extensions, embedding AES-256-CBC–encrypted JavaScript payloads, were uploaded using covert techniques. Once installed, the malware stole sensitive credentials, including GitHub, NPM, and crypto wallet data, and established persistence via AppleScript and LaunchAgents. The campaign also attempted to replace popular hardware cryptocurrency wallet apps like Ledger Live and Trezor Suite, although this payload failed due to incomplete attacker infrastructure. Over 33,000 installs were recorded, potentially impacting individual developers and organizations reliant on secure software supply chains. GlassWorm’s evolution targets not only Windows but also macOS ecosystems, signaling a rising trend in sophisticated supply chain attacks against developer tooling. This incident is a cautionary reminder for organizations and developers to tightly scrutinize third-party plugins, raising urgency to implement stronger extension vetting, threat detection, and least-privilege controls.
6 months ago
Kill Chain
AI Supply Chain: Ultralytics, Nx, and ChatGPT Breaches Expose Massive Secrets Leakage
Between late 2024 and mid-2025, a series of major AI supply chain security breaches exposed severe vulnerabilities in widely used machine learning and development platforms. In December 2024, the Ultralytics AI library was compromised and distributed malicious code that hijacked victims’ systems for illicit cryptocurrency mining. By August 2025, attackers published malicious Nx packages that leaked over 2,300 GitHub, cloud, and AI credentials, enabling unauthorized access to sensitive resources. Throughout 2024, vulnerabilities in ChatGPT enabled cross-user data extractions via memory leakage, resulting in the exposure of personal and proprietary information. In total, an alarming 23.77 million secrets were leaked through AI-centric software and supply chain vectors within this period. This string of incidents impacted a wide spectrum of organizations, undermining trust in AI-based workflows and amplifying compliance and regulatory risk. These attacks underscore the rapidly escalating risk of supply chain compromise in AI-centric infrastructure. As organizations increasingly rely on open-source ML libraries and cloud-native platforms, threats targeting code dependencies, API memory, and package repositories are proliferating, outpacing traditional security controls. The incident highlights the urgent need for AI-aware, zero-trust frameworks, advanced east-west traffic monitoring, and routine credential hygiene to prevent similar future exposures.
6 months ago
Kill Chain
Worm in the Code: Shai Hulud & Cobalt Strike Unleash Supply Chain Threats on npm and Maven (2025)
In December 2025, researchers identified a modified strain of the Shai Hulud worm circulating in the npm registry via the package '@vietmoney/react-big-calendar.' While detected early with no large-scale infections, analysis showed the worm’s ability to compromise developer environments, harvest API keys, cloud credentials, and npm/GitHub tokens, and exfiltrate them to attacker-controlled GitHub repositories. Simultaneously, an unrelated but similar threat surfaced on Maven Central, where a typosquatted 'org.fasterxml.jackson.core/jackson-databind' package delivered an obfuscated Cobalt Strike beacon through supply chain compromise. Both incidents exploited weaknesses in public software repositories, targeting developer trust and facilitating potential lateral spread across the ecosystem. These incidents underscore the escalating risks of open source supply chain attacks, in which adversaries leverage trusted development components to sneak malware into organizations. With attacker sophistication growing and repository defenses lagging, enterprises face pressure to enhance visibility, automate dependency monitoring, and enforce zero-trust principles for third-party code integration.
6 months ago
Kill Chain
Phishing Goes Cloud-Native: Google Cloud Application Integration Abused in 2026 Attack
In early 2026, a sophisticated phishing campaign was uncovered in which cybercriminals leveraged Google Cloud’s Application Integration service to send deceptive emails that mimicked legitimate Google communications. By exploiting the inherent trust in Google’s cloud infrastructure, attackers generated emails from authentic Google addresses, increasing the likelihood of victims engaging with malicious links or sharing sensitive information. According to Check Point researchers, this multi-stage approach enabled attackers to bypass traditional email security measures, posing significant risks to organizations that rely heavily on cloud-based productivity suites for daily operations. This campaign highlights an emerging trend in the abuse of trusted SaaS and cloud platforms for targeted phishing attacks. As adversaries shift toward cloud-native TTPs and social engineering techniques, organizations must enhance detection, improve user awareness, and adapt inline controls to mitigate risks tied to trusted service abuse.
6 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports