✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Information Technology/IT
Breach intelligence, attack campaigns, and threat reports targeting the Information Technology/IT sector.
Explore Other Sectors
Information Technology/IT Threat Reports
Entra Passkey Enrollment Vishing Targets Microsoft 365 Users
In April 2026, a threat actor identified as O-UNC-066, operating under the extortion brand 'Pink,' initiated a vishing campaign targeting Microsoft 365 users across multiple sectors, including food and beverage, technology, healthcare, automotive, construction, and aviation. The attackers impersonated IT personnel, contacting employees by phone and instructing them to enroll a new Microsoft Entra passkey for security purposes. Victims were directed to phishing websites mimicking legitimate Microsoft enrollment portals, where attackers captured credentials and multi-factor authentication (MFA) responses. Subsequently, the attackers registered passkeys under their control, gaining unauthorized access to victims' Microsoft accounts and exfiltrating data from services like SharePoint and OneDrive. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/entra-passkey-enrollment-vishing-targets-microsoft-365-users/amp/?utm_source=openai)) This incident underscores a growing trend of sophisticated social engineering attacks exploiting emerging authentication technologies. The use of real-time phishing kits capable of adapting to various MFA methods highlights the evolving tactics of cybercriminals. Organizations must remain vigilant, as such attacks can lead to significant data breaches and financial extortion. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/entra-passkey-enrollment-vishing-targets-microsoft-365-users/amp/?utm_source=openai))
2 weeks ago
Kill Chain
Mount Royal University 2026 Ransomware Attack: A Case Study
In June 2026, Mount Royal University (MRU) in Calgary experienced a significant cyberattack attributed to the CMD Organization ransomware group. The attackers infiltrated MRU's network, exfiltrated data from the H drive—used by students and employees—and subsequently deleted the original files to hinder recovery efforts. This breach disrupted various university services, including online platforms and internal systems, affecting current and former students and staff. The university has engaged external cybersecurity experts and reported the incident to relevant authorities. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/mount-royal-university-confirms-breach-as-hackers-claim-attack/?utm_source=openai)) This incident underscores the evolving tactics of ransomware groups like CMD Organization, which employ auction-based extortion models to maximize financial gain. Their approach not only involves data encryption but also public data leaks and auctions, amplifying pressure on victims. ([labs.beazley.security](https://labs.beazley.security/articles/cmd-organization-new-ransomware-operator-moves-to-place-public-bidding-wars-on-ransomed-data?utm_source=openai))
2 weeks ago
Kill Chain
Major Brands Impersonated in Phishing Scam Targeting Marketing Professionals
In July 2026, a sophisticated phishing campaign targeted marketing professionals by impersonating recruiters from renowned companies such as Netflix, Coca-Cola, and FIFA. Attackers utilized legitimate platforms like PeopleForce and Salesforce's ExactTarget to send personalized emails, leading recipients through nested redirects to a fake Google sign-in page designed to harvest credentials. This method effectively evaded traditional detection mechanisms, posing significant risks to individuals and organizations. ([darkreading.com](https://www.darkreading.com/cyberattacks-data-breaches/big-brand-jobs-scam-marketing-pros-google-accounts?utm_source=openai)) The incident underscores a growing trend of cybercriminals exploiting trusted services and personalized lures to deceive professionals. As the job market becomes increasingly competitive and AI-generated content enhances the realism of such scams, organizations must bolster their defenses against these evolving threats. ([malwarebytes.com](https://www.malwarebytes.com/blog/scams/2026/07/fake-netflix-coca-cola-and-fifa-job-scams-target-marketers?utm_source=openai))
2 weeks ago
Kill Chain
GhostLock Vulnerability: A 15-Year-Old Flaw Exposing Linux Systems to Root Exploits
In July 2026, Nebula Security disclosed a critical vulnerability in the Linux kernel, known as GhostLock (CVE-2026-43499). This 15-year-old flaw allows any local user to escalate privileges to root without special permissions or network access. The vulnerability resides in the kernel's real-time mutex (rtmutex) component, where improper handling of task pointers during proxy-lock rollback leads to a use-after-free condition. Exploiting this flaw enables attackers to gain full control over affected systems and escape containerized environments. The issue affects nearly all mainstream Linux distributions since 2011, with a reported 97% exploit reliability. The disclosure of GhostLock underscores the persistent risk posed by longstanding vulnerabilities in widely used open-source software. The availability of public exploit code increases the urgency for organizations to apply patches promptly. This incident highlights the need for continuous monitoring and timely updating of systems to mitigate potential security threats.
2 weeks ago
Kill Chain
Critical Vulnerability in Siemens Mendix Studio Pro: CVE-2026-48192
In June 2026, Siemens disclosed a vulnerability (CVE-2026-48192) in Mendix Studio Pro versions 10.11 through 10.24 (prior to V10.24.21) and 11.0 through 11.11. The flaw arises from improper validation and sanitization of project files during the build pipeline, allowing attackers to execute arbitrary code if a user opens a specially crafted malicious project. This vulnerability could lead to unauthorized code execution within the user's context, potentially compromising developer workstations and downstream build artifacts. ([sentinelone.com](https://www.sentinelone.com/vulnerability-database/cve-2026-48192/?utm_source=openai)) The incident underscores the critical importance of validating and sanitizing project files in development environments. As low-code platforms like Mendix Studio Pro gain popularity, ensuring robust security measures against such vulnerabilities becomes imperative to protect development processes and prevent potential supply chain attacks.
2 weeks ago
Kill Chain
Critical Vulnerabilities Discovered in Digi International's PortServer TS and Digi One SP IA Devices
In July 2026, Digi International disclosed two significant vulnerabilities affecting their PortServer TS and Digi One SP IA devices. The first, CVE-2026-12352, allows unauthenticated attackers to bypass authentication mechanisms, granting unauthorized access to restricted resources. The second, CVE-2026-12948, is a stored cross-site scripting (XSS) vulnerability that enables authenticated administrators to inject malicious scripts into system configuration fields, which execute in the browsers of users viewing the affected pages. These vulnerabilities pose risks of unauthorized access, credential theft, and potential system compromise. The disclosure of these vulnerabilities underscores the critical importance of securing networked devices, especially those integral to industrial control systems. Organizations must prioritize timely firmware updates and implement robust network segmentation to mitigate such risks. This incident highlights the ongoing challenges in maintaining the security of legacy systems and the necessity for continuous monitoring and proactive defense strategies.
2 weeks ago
Kill Chain
CISA Highlights Three Actively Exploited Vulnerabilities in Latest KEV Catalog Update
On July 7, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added three vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, indicating active exploitation. These vulnerabilities include CVE-2026-48908, an unrestricted file upload flaw in JoomShaper's SP Page Builder; CVE-2026-55255, an authorization bypass in Langflow; and CVE-2026-56290, an improper access control issue in Joomlack's Page Builder. Such vulnerabilities are commonly exploited by malicious actors, posing significant risks to federal enterprises. The inclusion of these vulnerabilities underscores the critical need for organizations to prioritize remediation efforts. CISA's Binding Operational Directive (BOD) 26-04 mandates federal agencies to address high-risk vulnerabilities promptly, emphasizing the importance of proactive vulnerability management to safeguard against active threats.
2 weeks ago
Kill Chain
HalluSquatting: Exploiting AI Coding Assistants to Deploy Botnet Malware
In July 2026, researchers identified a novel cyberattack technique termed 'HalluSquatting,' which exploits AI coding assistants' tendency to generate plausible but non-existent resource names. Attackers predict these hallucinated names, register them, and embed malicious code. When users prompt their AI assistants to fetch these resources, the assistants inadvertently execute the malicious code, potentially installing botnet malware on the user's machine. This method leverages AI hallucinations and prompt injections to compromise systems without direct user interaction. The emergence of HalluSquatting underscores the evolving threat landscape in AI-integrated development environments. As AI tools become more prevalent, attackers are increasingly targeting their inherent vulnerabilities. This incident highlights the urgent need for enhanced security measures in AI-driven tools to prevent exploitation through such sophisticated techniques.
2 weeks ago
Kill Chain
Critical Authentication Bypass Vulnerabilities in BeyondTrust Remote Support
In July 2026, BeyondTrust disclosed critical vulnerabilities in its Remote Support (RS) and Privileged Remote Access (PRA) software, notably CVE-2026-40138 and CVE-2026-40139. These flaws, stemming from improper authentication handling, could allow unauthenticated attackers to bypass access controls and gain elevated privileges. Exploitation requires specific authentication configurations to be enabled. BeyondTrust has released patches to address these issues. The disclosure underscores the persistent risks associated with remote access solutions, especially as organizations increasingly rely on them for remote work. Ensuring timely application of security patches and reviewing authentication configurations are crucial to mitigate potential exploitation.
2 weeks ago
Kill Chain
Januscape Vulnerability: Critical Linux Kernel Flaw Enables VM Escape
In July 2026, a critical vulnerability known as 'Januscape' (CVE-2026-53359) was disclosed in the Linux kernel's KVM/x86 virtualization component. This 16-year-old flaw allows attackers with root access inside a guest virtual machine to execute arbitrary code on the host, potentially compromising all other guests and the host system itself. The vulnerability arises from a use-after-free issue in the shadow MMU emulation, affecting both Intel and AMD processor architectures. The disclosure of Januscape underscores the persistent risks associated with long-standing vulnerabilities in widely used open-source software. It highlights the necessity for organizations to maintain rigorous patch management practices and to monitor for emerging threats that could exploit such vulnerabilities, especially in multi-tenant cloud environments where the impact can be widespread.
2 weeks ago
Kill Chain
Understanding the Cordyceps Vulnerability in GitHub Actions
In June 2026, Novee Security identified a critical vulnerability class in GitHub Actions workflows, termed 'Cordyceps.' This flaw allows unauthenticated attackers to exploit CI/CD pipelines by manipulating untrusted pull requests, leading to unauthorized code execution and potential supply chain compromises. Over 300 repositories, including those of Microsoft, Google, and Apache, were confirmed vulnerable, exposing them to credential theft and malicious code injection. The Cordyceps vulnerability underscores the escalating risks in software supply chains, especially as AI-generated code becomes more prevalent. Traditional security scanners often miss such complex, composition-based flaws, highlighting the need for enhanced security measures in CI/CD workflows to prevent potential large-scale attacks.
2 weeks ago
Kill Chain
Accenture Confirms Data Breach After Hacker Offers Stolen Data for Sale
In July 2026, Accenture, a global professional services company, confirmed a security breach after a threat actor known as "888" claimed to have stolen 35 GB of data, including source code, RSA keys, SSH keys, Azure personal access tokens, Azure Storage access keys, and configuration files. The threat actor began offering this data for sale on a cybercrime forum. Accenture stated that they were aware of the incident, had remediated its source, and that there was no impact on their operations and service delivery. However, the company did not disclose how the attackers gained access or whether customer data was affected. This incident underscores the persistent threat posed by cybercriminals targeting large enterprises for sensitive data. The exposure of source code and access keys can lead to further exploitation, including intellectual property theft and potential supply chain attacks. Organizations must remain vigilant, continuously assess their security postures, and implement robust measures to protect against such breaches.
2 weeks ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports