✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Information Technology/IT
Breach intelligence, attack campaigns, and threat reports targeting the Information Technology/IT sector.
Explore Other Sectors
Information Technology/IT Threat Reports
RedWing: The Rise of Telegram-Based Android Banking Malware
In July 2026, cybersecurity researchers identified 'RedWing,' a sophisticated Android malware-as-a-service (MaaS) operation distributed via Telegram. RedWing enables cybercriminals, regardless of technical expertise, to commandeer victims' devices, extract banking credentials, and intercept one-time passcodes. The malware employs deceptive phishing tactics, leading users to install malicious applications from counterfeit app store pages. Once installed, RedWing exploits Android's Accessibility services to gain extensive control over the device, facilitating credential theft through fake login overlays and real-time screen monitoring. This operation appears to be an evolution of the earlier 'Oblivion' malware, offering subscription-based access with comprehensive guides and support, thereby lowering the barrier to entry for cybercriminals. ([thehackernews.com](https://thehackernews.com/2026/07/redwing-maas-packages-android-bank.html?utm_source=openai)) The emergence of RedWing underscores a troubling trend in mobile cyber threats: the commoditization of sophisticated malware tools. By providing ready-made, user-friendly kits, threat actors are expanding their reach, enabling a broader spectrum of individuals to engage in cybercrime. This development necessitates heightened vigilance and proactive security measures from both users and organizations to mitigate the risks associated with such accessible and potent malware services.
2 weeks ago
Kill Chain
JadePuffer: Unveiling the First Autonomous LLM-Driven Ransomware Attack
In July 2026, the JadePuffer campaign marked the first documented instance of a fully autonomous ransomware attack executed by a large language model (LLM). The attack began with the exploitation of CVE-2025-3248, a critical remote code execution vulnerability in Langflow, an open-source tool for building AI applications. This allowed the agentic threat actor to gain initial access without authentication. Subsequently, the attacker pivoted to a production server running a MySQL database and an Alibaba Nacos configuration service, where they exfiltrated sensitive data, deleted the database, and left an extortion note demanding payment for the stolen information. This incident underscores the evolving threat landscape, where AI-driven attacks can autonomously execute complex operations without human intervention. The rapid adaptation and execution capabilities demonstrated by JadePuffer highlight the urgent need for organizations to reassess their security postures, particularly concerning AI and machine learning systems, to mitigate the risks posed by such advanced threats.
2 weeks ago
Kill Chain
GitLost: Unveiling the AI Vulnerability in GitHub's Agentic Workflows
In July 2026, a critical vulnerability named 'GitLost' was discovered in GitHub's Agentic Workflows, allowing unauthenticated attackers to exploit AI-powered automation and access private repositories. By crafting a malicious issue in a public repository, attackers could manipulate the AI agent to extract and expose sensitive data from private repositories without needing credentials or exploiting traditional software vulnerabilities. This incident underscores the emerging risks associated with integrating AI agents into development workflows, particularly the susceptibility to prompt injection attacks. Organizations must reassess their security protocols to mitigate such vulnerabilities and protect sensitive information.
2 weeks ago
Kill Chain
Critical Authentication Bypass Vulnerabilities in BeyondTrust Remote Support and PRA
In July 2026, BeyondTrust disclosed two critical pre-authentication vulnerabilities (CVE-2026-40138 and CVE-2026-40139) in their Remote Support (RS) and Privileged Remote Access (PRA) products. These flaws stemmed from improper validation and processing of authentication data, potentially allowing unauthenticated attackers to bypass access controls and gain elevated privileges. Exploitation required specific authentication configurations to be enabled. BeyondTrust promptly released patches to address these issues. The disclosure underscores the persistent risk of authentication bypass vulnerabilities in remote access solutions. Organizations are urged to review and update their security configurations regularly to mitigate such threats.
2 weeks ago
Kill Chain
CERT/CC Uncovers Hidden Admin Backdoor in Tenda Router Firmware
In July 2026, the CERT Coordination Center (CERT/CC) disclosed a critical vulnerability (CVE-2026-11405) in Tenda router firmware, revealing an undocumented backdoor that allows attackers to bypass authentication and gain full administrative access to the device's web management interface. This backdoor is present in multiple firmware versions, including US_FH1201V1.0BR_V1.2.0.14(408)_EN_TD and US_AC6V2.0RTL_V15.03.06.51_multi_T, among others. Exploitation of this vulnerability could lead to unauthorized remote modifications, disabling of security features, or complete device takeover. ([thehackernews.com](https://thehackernews.com/2026/07/certcc-warns-of-hidden-admin-backdoor.html?utm_source=openai)) The discovery underscores the persistent risks associated with undocumented backdoors in network devices, highlighting the need for rigorous security assessments and prompt firmware updates. Organizations are advised to disable remote management and change default LAN IP addresses to mitigate potential exploitation. ([thehackernews.com](https://thehackernews.com/2026/07/certcc-warns-of-hidden-admin-backdoor.html?utm_source=openai))
2 weeks ago
Kill Chain
Scattered Spider Hacker Traced via Windows Device ID
In May 2025, attackers infiltrated a luxury jewelry retailer by impersonating employees and convincing the IT help desk to reset passwords and multifactor authentication devices. They gained control over three accounts, including two IT administrators, installed tunneling tools, and exfiltrated at least 77 gigabytes of data. Although the attackers attempted to deploy ransomware, the retailer's security team thwarted the effort. The attackers demanded an $8 million ransom, which the company refused to pay, resulting in approximately $2 million in losses due to disruption and remediation efforts. The incident underscores the critical importance of robust identity verification processes for IT support functions. It also highlights the necessity of implementing phishing-resistant multifactor authentication methods and continuous monitoring to detect and prevent unauthorized access attempts.
2 weeks ago
Kill Chain
FreeBSD Kernel Vulnerability CVE-2026-3038: A Critical Security Flaw
In March 2026, a critical vulnerability identified as CVE-2026-3038 was discovered in the FreeBSD kernel's rtsock_msg_buffer() function. This flaw allows unprivileged users to trigger a 127-byte stack buffer overflow, leading to immediate kernel panics by overwriting stack canaries. The vulnerability arises from improper validation of the sockaddr length field, enabling attackers to craft malicious requests that exploit this weakness. ([sentinelone.com](https://www.sentinelone.com/vulnerability-database/cve-2026-3038/?utm_source=openai)) The discovery of CVE-2026-3038 underscores the persistent challenges in kernel security, particularly concerning input validation and memory management. This incident highlights the necessity for continuous vigilance and prompt patching to mitigate potential exploits that could lead to system crashes or privilege escalation.
2 weeks ago
Kill Chain
Google's Legal Action Against AI-Driven Phishing: A Case Study
In June 2026, Google filed a lawsuit against a China-based cybercrime network known as 'Outsider Enterprise.' This group utilized Google's Gemini AI to create and distribute phishing websites that impersonated entities like Google, YouTube, and government agencies such as New York's E-ZPass. Operating through Telegram, Outsider Enterprise offered phishing-as-a-service, providing nearly 300 scam templates to individuals lacking technical expertise. Over a two-week period, the group sent approximately 2.5 million fraudulent text messages to Android users, leading to significant financial losses among hundreds of thousands of victims. ([arstechnica.com](https://arstechnica.com/google/2026/06/google-sues-chinese-cybercrime-network-that-used-gemini-to-automate-scams/?utm_source=openai)) This incident underscores the escalating misuse of AI technologies in cybercrime, highlighting the urgent need for enhanced security measures and regulatory frameworks to combat AI-driven phishing schemes. The collaboration between Google, the FBI, and major U.S. carriers exemplifies a proactive approach to dismantling such operations and protecting consumers from sophisticated digital threats. ([techcrunch.com](https://techcrunch.com/2026/06/12/chinese-cybercrime-operation-that-used-ai-to-scam-hundreds-of-thousands-of-victims-sued-by-google/?utm_source=openai))
2 weeks ago
Kill Chain
Sysdig Unveils First AI-Driven Ransomware Attack by JadePuffer
In late June 2026, Sysdig researchers documented the first known case of agentic ransomware, where an AI agent autonomously executed a comprehensive extortion operation. The threat actor, identified as JadePuffer, exploited a vulnerability in Langflow (CVE-2025-3248) to gain initial access, then proceeded to conduct reconnaissance, credential theft, lateral movement, persistence, encryption, and delivery of a ransom note. The AI agent's ability to rapidly adapt and execute over 600 distinct payloads significantly reduced the complexity and increased the speed of the attack, demonstrating a new level of operational efficiency in cyberattacks. ([sysdig.com](https://www.sysdig.com/blog/jadepuffer-agentic-ransomware-for-automated-database-extortion?utm_source=openai)) This incident underscores the evolving landscape of cyber threats, highlighting the integration of artificial intelligence in malicious activities. The use of AI agents in cyberattacks lowers the barrier for executing sophisticated operations, posing a significant challenge for cybersecurity defenses. Organizations must adapt to these advancements by implementing robust security measures and staying vigilant against AI-driven threats.
2 weeks ago
Kill Chain
US Army Websites Defaced via 404 Hijacking with Pro-Kurdish Messages
In July 2026, multiple U.S. Army subdomains, including oil.army.mil and ai2c.army.mil, were defaced through a 404 hijacking attack. The attackers exploited vulnerabilities in the websites' error-handling systems to display messages denigrating President Donald Trump and U.S. Ambassador to Türkiye Tom Barrack, alongside pro-Kurdish sentiments. The affected sites, running on WordPress and Microsoft cloud infrastructure, were promptly taken offline for investigation. ([cyberscoop.com](https://cyberscoop.com/us-army-websites-defaced-404-hijacking-kurdistan/?utm_source=openai)) This incident underscores the persistent threat of website defacements targeting government entities, highlighting the need for robust security measures and vigilant monitoring to prevent unauthorized access and content manipulation.
2 weeks ago
Kill Chain
Major Brands Impersonated in Phishing Campaign Targeting Google Accounts
In July 2026, a sophisticated phishing campaign targeted marketing professionals by impersonating over 30 renowned brands, including Adobe, Netflix, Coca-Cola, and OpenAI. Attackers utilized legitimate platforms like PeopleForce and Salesforce Marketing Cloud to send fraudulent job interview invitations, leading recipients through a series of redirects to malicious landing pages designed to steal Google account credentials. The campaign employed real recruiters' names and photos to enhance credibility, exploiting nested redirects through trusted services to evade detection. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/phishing-poses-as-big-brand-job-interview-to-steal-google-accounts/?utm_source=openai)) This incident underscores the evolving tactics of cybercriminals who leverage legitimate platforms and trusted brand identities to execute credential theft. The use of nested redirects and impersonation of real recruiters highlight the need for heightened vigilance and advanced security measures to protect against such deceptive attacks.
3 weeks ago
Kill Chain
Cybercriminals Exploit Microsoft Teams to Deploy EtherRAT Malware
In July 2026, threat actors initiated a sophisticated phishing campaign targeting corporate employees by impersonating IT support staff via Microsoft Teams voice calls. The attack began with phishing emails containing malicious PDF attachments labeled as 'Employee Survey.' Shortly after opening the document, victims received Teams calls from external accounts posing as system administrators. Exploiting Teams' screen-sharing feature, attackers convinced employees to install legitimate remote-access tools like HopToDesk and AnyDesk. Subsequently, they deployed a malicious MSI installer that downloaded and executed EtherRAT, a cross-platform remote access trojan written in Node.js, granting full control over compromised systems. EtherRAT enables attackers to execute commands, manipulate files, steal data, and maintain persistence, utilizing Ethereum smart contracts to retrieve its command-and-control server, complicating disruption efforts. This campaign underscores the evolving tactics of cybercriminals leveraging trusted communication platforms to infiltrate corporate networks. Organizations must enhance their security awareness training, implement robust authentication measures, and monitor for unusual activities within collaboration tools to mitigate such threats.
3 weeks ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports