✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Information Technology/IT
Breach intelligence, attack campaigns, and threat reports targeting the Information Technology/IT sector.
Explore Other Sectors
Information Technology/IT Threat Reports
Malicious npm Package Attack Exposes Software Supply Chain Risks in 2024
In June 2024, security researchers identified a supply chain attack involving at least ten malicious npm packages uploaded to the public registry. Masquerading as legitimate software components, these packages were designed to infect developer environments across Windows, Linux, and macOS. Once installed, they downloaded and executed an information-stealing payload capable of harvesting sensitive data such as credentials and environment variables, potentially enabling lateral movement or further breaches within affected organizations. The attack leveraged trusted software distribution channels to bypass traditional defenses and amplify impact among open-source users. This incident underlines escalating risks in the software supply chain, highlighting how open-source package ecosystems have become prime targets for attackers. The trend represents a growing challenge for organizations relying on third-party code, driving new urgency around vetting procedures, continuous monitoring, and enforcing granular security controls in developer pipelines.
6 months ago
Kill Chain
10 Malicious npm Packages Expose Global Supply Chain Risks in 2025 Credential Stealer Attack
In October 2025, security researchers uncovered a coordinated supply chain attack targeting the npm ecosystem. Ten malicious npm packages, collectively downloaded over 5,000 times, were found to contain sophisticated multi-platform information stealers. These packages, distributed via the npm registry and impersonating legitimate developer tools, leveraged obfuscated code to deploy a payload capable of extracting sensitive credentials and environment data from Windows, macOS, and Linux developer workstations. The malware used deceptive tactics like a fake CAPTCHA screen and fingerprinted victims prior to exfiltrating stolen data to attacker-controlled infrastructure. This incident underscores the growing trend of software supply chain attacks, as developer tool ecosystems like npm remain high-value targets for both financially motivated cybercriminals and state-sponsored groups. The event has fueled concerns about package registry hygiene, developer workstation security, and the need for stronger zero trust and anomaly detection controls across the software development lifecycle.
6 months ago
Kill Chain
Russian APT Attackers Compromise Ukrainian Networks Using Living-Off-the-Land (LOTL) Tactics
In mid-2025, Russian advanced persistent threat (APT) actors launched highly targeted campaigns against Ukrainian organizations, focusing on business services firms and local government entities. Over the course of several weeks, attackers gained initial access through stealthy living-off-the-land (LOTL) techniques, leveraging legitimate administrative tools and native Windows utilities to evade detection and persist on networks. Their primary objectives were the exfiltration of sensitive data and establishing long-term, covert access, which allowed the attackers to move laterally with minimal noise and avoid triggering common security alerts. The operational impact included compromise of confidential internal documents and increased risk to ongoing operations. This incident underscores a growing reliance on LOTL tactics by sophisticated nation-state actors, complicating traditional detection and response methods. With geopolitical tensions in Eastern Europe remaining high, organizations and government agencies must anticipate and defend against stealthy, low-profile intrusions that exploit trusted system tools to bypass conventional defenses.
6 months ago
Kill Chain
Identity Chaos: 2026 Breach Highlights Risks of Ghost Accounts & AI Agents
In mid-2026, a coordinated cyberattack leveraged unmanaged 'ghost' identities and dormant privileged accounts in a multinational enterprise's cloud environment. Advanced threat actors combined long-standing identity debt from old breaches with modern, AI-powered autonomous agents to hijack internal east-west traffic and exfiltrate sensitive data using encrypted channels. The attackers discreetly escalated privileges through unused accounts, bypassed segmentation controls, and evaded legacy monitoring through encrypted, high-speed service-to-service traffic. This led to a multi-week data theft and operational disruption across cloud, on-premises, and hybrid infrastructure, impacting customer trust and critical regulatory compliance. This incident highlights the urgent need for advanced identity governance and zero trust segmentation as adversaries exploit both inherited identity risks and cutting-edge automation. With ransomware and shadow AI toolchains on the rise, organizations face increasing regulatory scrutiny and evolving attack surfaces that obsolete traditional perimeter-based defenses.
6 months ago
Kill Chain
Cloaking Attack Against AI Crawlers Uncovers New Context Poisoning Risks
In October 2025, cybersecurity researchers uncovered a sophisticated cloaking attack that targets AI-driven web crawlers used by popular agentic browsers such as OpenAI ChatGPT Atlas and Perplexity. Threat actors deployed malicious websites capable of serving misleading or false content only to AIbots, while displaying legitimate information to typical users. This context poisoning technique allows harmful actors to manipulate AI models at scale, tricking them into citing fabricated facts as verified information, and undermines AI trustworthiness with widespread downstream effects on automated decision-making and knowledge dissemination. This incident highlights the mounting risks from adversarial attacks targeting AI supply chains. As AI systems increasingly rely on real-time internet data, attackers are innovating new manipulation tactics to poison context and subvert trust. The surge in such TTPs coincides with tighter regulations and industry push towards Responsible AI frameworks.
6 months ago
Kill Chain
Automated Botnet Attacks Surge Against PHP Servers and IoT Devices in 2025
In October 2025, cybersecurity experts reported a significant escalation in automated botnet attacks against PHP servers and IoT devices. Threat actors behind botnets like Mirai, Gafgyt, and Mozi orchestrated large-scale campaigns by exploiting known CVEs and exploiting misconfigured cloud and edge systems. The attacks enabled adversaries to gain unauthorized entry, rapidly compromise vulnerable assets, and expand their botnet infrastructure for malicious activities such as DDoS, credential theft, and lateral movement across network environments. Organizations with exposed PHP servers or poorly secured IoT endpoints experienced elevated risks of disruption and reputational impact. This surge in automated exploitation highlights the persistent evolution of botnet tactics targeting unpatched, internet-facing workloads. As attackers automate vulnerability scanning and weaponize scalable malware, the need for proactive threat detection, segmentation, and rapid response has never been more critical for organizations in all sectors.
6 months ago
Kill Chain
YouTube Ghost Network: 2025 Infostealer Botnets Target Users at Scale
In early 2025, a sophisticated malware operation known as the YouTube Ghost Network leveraged compromised accounts and extensive botnets to deliver highly effective infostealer payloads to unsuspecting users. Attackers exploited both social engineering and automated bot infrastructure to distribute malware at scale via malicious YouTube links and hijacked channels, resulting in a threefold increase in infostealer output within months. The campaign focused on harvesting credentials, session tokens, and other sensitive data through obfuscated lures and persistent infiltration tactics, impacting thousands of users globally and raising significant concerns about platform-based threats. This incident underscores the surging trend of infostealer campaigns utilizing social platforms as distribution vectors, challenging traditional detection and response strategies. Escalating reliance on cloud services and digital identities intensifies the risk, making proactive monitoring and policy enforcement critical as adversaries weaponize trusted channels and automation for rapid expansion.
6 months ago
Kill Chain
What 1,000 Insider Threat Cases Reveal: A Modern Security Wake-Up Call
In 2024, a comprehensive study examining over 1,000 real-world insider threat cases uncovered persistent gaps in how organizations detect, prevent, and respond to malicious or negligent employee actions. Over a 14-month analysis, security researchers highlighted that insiders often bypass security controls using legitimate access, evade traditional perimeter monitoring tools, and exfiltrate sensitive data without raising timely alerts. The analysis found that costly business disruptions, regulatory fines, and reputational damages were common outcomes, especially in sectors with high data sensitivity, including finance, healthcare, and technology. The research underscores growing sophistication among insiders and the limitations of legacy detection models. Insider threats remain acute as remote work widens the digital attack surface and increasingly sophisticated insiders exploit blind spots in technical controls. Regulatory bodies are pressuring organizations to enhance controls and real-time monitoring, highlighting that traditional security models are insufficient as threat actor tactics evolve.
6 months ago
Kill Chain
How Botnets Exploited Cloud Flaws in 2024: A Modern Security Wake-Up Call
In early 2024, security researchers observed an escalating wave of activity from botnets such as Mirai, leveraging vulnerabilities and misconfigurations across cloud environments and Internet-exposed assets. Attackers targeted PHP servers, IoT devices, and cloud gateways, exploiting both known flaws and weak security controls. Once compromised, these assets were co-opted into large-scale botnets used for distributed denial-of-service (DDoS) attacks, cryptomining, and lateral movement into business networks. The campaign underscored gaps in east-west traffic visibility, workload segmentation, and egress filtering, significantly increasing operational and reputational risk for enterprises. This incident is part of a growing trend where botnets and automated threat actors shift focus to cloud and hybrid environments, capitalizing on common misconfigurations. Organizations face mounting pressure to modernize defenses, as attackers rapidly adapt to evolving architectures and compliance expectations.
6 months ago
Kill Chain
Nation-State Supply Chain Attack: Airstalk Malware Targets AirWatch API in 2024
In June 2024, security researchers uncovered a sophisticated supply chain attack leveraging a new Windows-based malware dubbed "Airstalk." This campaign, attributed to a suspected nation-state threat actor, involved the misuse of the AirWatch API to exfiltrate sensitive browser data from targeted organizations. Attackers infiltrated the software ecosystem, enabling wide-scale distribution without initial detection. The breach highlighted the attackers' advanced techniques, including API abuse, stealthy data exfiltration, and lateral movement, severely impacting digital supply chains and putting both direct victims and downstream customers at risk. Airstalk exemplifies the growing threat posed by supply chain attacks, where trusted software platforms may be subverted for espionage or data theft. The attack underscores an urgent industry need for robust east-west traffic controls, zero trust segmentation, and continuous anomaly detection to mitigate evolving adversary tactics targeting critical infrastructure.
6 months ago
Kill Chain
OpenAI Atlas Browser Exposed: LLM Cloaking and Security Weaknesses in 2024
In early 2024, security researchers at SPLX and LayerX exposed significant vulnerabilities in OpenAI’s ChatGPT Atlas browser agent and similar AI-powered web agents. Through cloaking techniques, malicious actors can serve manipulated web content specifically to AI crawlers by altering the user-agent header, causing the agent to process misleading information while human users see normal content. This opens doors for smear campaigns, scam promotions, and manipulation of automated tasks like recruitment screening. Additional flaws in Atlas were discovered, including weak OAuth token storage and susceptibility to memory corruption exploits, raising serious concerns for business and consumer users. These vulnerabilities highlight the pressing need for AI governance and protection as adoption accelerates, with compliance and supply chain risk in sharp focus. With the rapid growth of generative AI in enterprise settings and lagging regulatory frameworks, businesses face mounting risks tied to both intentional adversarial content and platform design oversights.
6 months ago
Kill Chain
BiDi Swap: How Unicode URL Tricks Enable Next-Gen Phishing Attacks
In early 2024, cybersecurity researchers uncovered a wave of phishing campaigns leveraging the 'BiDi Swap' technique, where attackers exploit bidirectional Unicode text in URLs to mask malicious domains as legitimate ones. By inserting special control characters, cybercriminals create deceptive links that appear authentic to end-users and some security tools, increasing the risk of credential thefts and unauthorized access, especially for organizations relying on standard phishing defenses. The attack exploits a decade-old browser flaw now resurfacing with renewed sophistication. This incident highlights a dangerous resurgence of invisible text manipulation tactics, which are rapidly proliferating across phishing kits and social engineering toolkits. As workforces rely on web-based authentication and email, organizations should urgently review their detection capabilities to spot Unicode obfuscation and mitigate emerging URL-based threats.
6 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports