✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Information Technology/IT
Breach intelligence, attack campaigns, and threat reports targeting the Information Technology/IT sector.
Explore Other Sectors
Information Technology/IT Threat Reports
FBI Issues Warning on Kali365 Phishing Kit Targeting Microsoft 365 Accounts
In April 2026, the FBI identified 'Kali365,' a Phishing-as-a-Service (PhaaS) platform that enables attackers to hijack Microsoft 365 accounts by stealing OAuth tokens, effectively bypassing multi-factor authentication (MFA). Distributed primarily via Telegram, Kali365 provides AI-generated phishing lures and automated campaign templates, allowing even low-skilled cybercriminals to gain unauthorized access to services like Outlook, Teams, and OneDrive without needing user credentials. ([ic3.gov](https://www.ic3.gov/PSA/2026/PSA260521?utm_source=openai)) The emergence of Kali365 underscores a significant shift in phishing tactics, highlighting the increasing sophistication and accessibility of PhaaS platforms. This development emphasizes the urgent need for organizations to enhance their security measures beyond traditional MFA, as attackers continue to exploit legitimate authentication workflows to gain unauthorized access.
1 month ago
Kill Chain
Exploiting Google Gemini: The Rise of Prompt Injection Attacks
In June 2026, a security vulnerability was discovered in Google Gemini's voice assistant, allowing attackers to exploit its notification summarization feature through prompt injection techniques. By embedding malicious commands within message notifications, adversaries could manipulate the assistant to perform unauthorized actions such as controlling smart home devices, initiating video streams, conducting social engineering attacks, and compromising the integrity of large language model (LLM) memory. This flaw was identified and responsibly disclosed by SafeBreach, leading Google to implement content classifier updates to mitigate the issue. This incident underscores the evolving threat landscape associated with AI-powered assistants and the critical need for robust security measures to prevent prompt injection attacks. As AI integration in daily applications increases, ensuring the integrity and security of these systems becomes paramount to protect users from sophisticated exploitation methods.
1 month ago
Kill Chain
Critical HTTP/2 Bomb Vulnerability Threatens Major Web Servers
In June 2026, cybersecurity researchers identified a critical remote denial-of-service (DoS) vulnerability, termed 'HTTP/2 Bomb,' affecting major web servers including NGINX, Apache HTTPD, Microsoft IIS, Envoy, and Cloudflare Pingora. This exploit leverages the HPACK header compression scheme in HTTP/2, allowing a single attacker to rapidly exhaust server memory by sending minimal data that results in significant memory allocation. A single client on a standard home internet connection can consume up to 32GB of server memory in approximately 20 seconds, rendering the server inaccessible. The discovery of the HTTP/2 Bomb underscores the evolving nature of cyber threats targeting foundational internet protocols. This incident highlights the necessity for continuous vigilance and prompt patching of server software to mitigate emerging vulnerabilities. Organizations are advised to review and adjust their HTTP/2 configurations to prevent potential exploitation.
1 month ago
Kill Chain
WeedHack Malware Campaign: A Wake-Up Call for Minecraft Players
In early 2026, a large-scale malware campaign named 'WeedHack' targeted Minecraft players by distributing malicious mods, clients, and cheats through platforms like YouTube and SEO poisoning. This Malware-as-a-Service operation infected over 116,000 systems globally, with daily infections ranging between 2,000 and 3,000. The malware harvested sensitive information, including browser credentials, Discord tokens, and cryptocurrency wallets, and offered remote access capabilities to attackers. ([mcafee.com](https://www.mcafee.com/blogs/other-blogs/mcafee-labs/weedhack-minecraft-malware-as-a-service-campaign-research/?utm_source=openai)) The campaign's success underscores the vulnerabilities within gaming communities, particularly among younger users who may lack cybersecurity awareness. The use of popular platforms for distribution and the sophisticated nature of the malware highlight the evolving tactics of cybercriminals targeting the gaming industry. ([mcafee.com](https://www.mcafee.com/blogs/security-news/minecraft-malware-campaign-research-teen-hacker-cyberbullying/?utm_source=openai))
1 month ago
Kill Chain
VS Code Vulnerability Exposes GitHub OAuth Tokens to Attackers
In June 2026, a critical vulnerability was disclosed in Microsoft Visual Studio Code (VS Code) that allowed attackers to steal GitHub OAuth tokens through a single malicious link. Security researcher Ammar Askar demonstrated that by exploiting the webview implementation in VS Code, an attacker could execute malicious JavaScript to install a rogue extension, thereby capturing OAuth tokens with full read and write access to a user's repositories, including private ones. This vulnerability posed significant risks to developers, potentially exposing sensitive code and intellectual property. This incident underscores the growing threat of supply chain attacks targeting development environments. As developers increasingly rely on integrated tools and extensions, the security of these components becomes paramount. Organizations must remain vigilant, ensuring that their development tools are secure and up to date to prevent unauthorized access and data breaches.
1 month ago
Kill Chain
CISA Adds Two Known Exploited Vulnerabilities to Catalog
On June 2, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added two vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog: CVE-2022-0492, a Linux Kernel Improper Authentication Vulnerability, and CVE-2025-48595, an Android Framework Integer Overflow Vulnerability. Both vulnerabilities are actively exploited, posing significant risks to federal enterprises. CVE-2022-0492 allows unauthorized access to Linux systems, while CVE-2025-48595 enables local privilege escalation on Android devices without user interaction. ([nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2025-48595?utm_source=openai)) The inclusion of these vulnerabilities in the KEV Catalog underscores the critical need for organizations to promptly address known security flaws. With active exploitation in the wild, timely remediation is essential to mitigate potential threats and protect sensitive information.
1 month ago
Kill Chain
Trail of Bits Uncovers Critical Flaws in AI Skill Marketplaces
In June 2026, Trail of Bits published an analysis revealing significant vulnerabilities in public AI skill marketplaces, where malicious skills were found to steal credentials, exfiltrate data, and hijack agents. The study demonstrated that existing skill scanners, including those from ClawHub, Cisco, and skills.sh, were ineffective in detecting these threats. The researchers successfully bypassed these scanners using straightforward techniques, highlighting the inadequacy of current defenses against supply chain attacks in AI ecosystems. This incident underscores the urgent need for robust security measures in AI skill distribution channels. As AI agents become integral to various workflows, the proliferation of unvetted skills poses a substantial risk. Organizations must implement stringent governance frameworks, including version control, digital signing, zero-trust access, and centralized repositories, to mitigate these emerging threats.
1 month ago
Kill Chain
CISA Urges Immediate Action on Actively Exploited Oracle WebLogic Vulnerability CVE-2024-21182
In June 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) mandated federal agencies to address a high-severity vulnerability in Oracle WebLogic Server, identified as CVE-2024-21182. This flaw, patched in July 2024, allows unauthenticated attackers to exploit the T3 and IIOP protocols, potentially leading to unauthorized access to critical data. Despite the availability of patches, over 1,500 WebLogic servers remained exposed online, making them susceptible to exploitation. The resurgence of attacks targeting CVE-2024-21182 underscores the persistent threat posed by unpatched vulnerabilities. Organizations are urged to prioritize timely patch management to mitigate risks associated with known exploits, especially those that have been previously addressed but continue to be exploited due to delayed remediation efforts.
1 month ago
Kill Chain
Why the Browser is Now the Front Line for AI Security
In June 2026, a significant cybersecurity incident highlighted the browser as a critical frontline in AI security. Adversaries leveraged AI to rapidly develop and deploy sophisticated phishing kits, outpacing traditional defense mechanisms. Concurrently, employees' unregulated adoption of AI tools, including large language models (LLMs) and AI browser extensions, introduced vulnerabilities by exposing sensitive data and granting unauthorized access. This dual threat underscores the necessity for security platforms with deep visibility into browser sessions to effectively monitor and mitigate AI-driven risks. The incident underscores the evolving threat landscape where AI accelerates both attack capabilities and the proliferation of unvetted tools within organizations. As AI technologies become more integrated into daily operations, the urgency for comprehensive browser security solutions that can adapt to these rapid developments has never been greater.
1 month ago
Kill Chain
Gamaredon Exploits WinRAR Vulnerability to Deploy Malware in Ukraine
In January 2026, the Russian state-sponsored hacking group Gamaredon exploited a path traversal vulnerability in WinRAR (CVE-2025-8088) to target Ukrainian government entities. The attack began with spear-phishing emails containing malicious RAR archives that, when opened, deployed an HTML Application payload named GammaPhish. This payload downloaded a VBScript downloader called GammaLoad, which subsequently installed malware such as GammaWorm and GammaSteel. GammaWorm established persistence and propagated through network shares and USB drives, while GammaSteel exfiltrated sensitive files to attacker-controlled servers. This incident underscores the persistent threat posed by state-sponsored actors leveraging known vulnerabilities to conduct espionage and data theft. The use of legitimate platforms like Telegram for command-and-control communication highlights the evolving tactics employed to evade detection and maintain long-term access to targeted networks.
1 month ago
Kill Chain
Oracle WebLogic CVE-2024-21182: Active Exploitation and Urgent Patch Advisory
In July 2024, Oracle addressed a high-severity vulnerability (CVE-2024-21182) in its WebLogic Server, which allowed unauthenticated attackers to gain unauthorized access via T3 and IIOP protocols, potentially compromising critical data. Despite the patch, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added this vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog in June 2026, indicating active exploitation in the wild. This development underscores the persistent threat posed by unpatched vulnerabilities in widely used enterprise software. Organizations relying on Oracle WebLogic Server must ensure they have applied the necessary patches to mitigate potential risks associated with this flaw.
1 month ago
Kill Chain
Microsoft's Legal Threats Over Zero-Day Disclosures Spark Backlash
In early April 2026, a security researcher known as 'Nightmare-Eclipse' publicly disclosed multiple zero-day vulnerabilities affecting Microsoft products, including 'BlueHammer' (CVE-2026-33825), 'RedSun,' and 'Undefend.' These disclosures were made without prior coordination with Microsoft, leading to active exploitation by threat actors. Microsoft responded by condemning the uncoordinated disclosures and indicated potential legal action against the researcher, citing risks to customer security. This incident underscores the ongoing tension between security researchers and software vendors regarding vulnerability disclosure practices. The situation highlights the critical need for clear and cooperative communication channels to balance the prompt identification of security flaws with the protection of users from potential exploits.
1 month ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports