✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Information Technology/IT
Breach intelligence, attack campaigns, and threat reports targeting the Information Technology/IT sector.
Explore Other Sectors
Information Technology/IT Threat Reports
EtherRAT Campaign: A New Era of Malware Distribution via GitHub and Ethereum
In March 2026, a sophisticated cyber campaign was identified targeting enterprise administrators, DevOps engineers, and security analysts. The attackers employed SEO poisoning to manipulate search engine results, leading victims to GitHub repositories that impersonated legitimate administrative tools. These repositories hosted malicious MSI installers, which, upon execution, deployed EtherRAT—a Node.js-based backdoor. Notably, EtherRAT utilized Ethereum smart contracts to dynamically resolve command-and-control (C2) addresses, enhancing the malware's resilience and evasion capabilities. This incident underscores a strategic shift in cyberattack methodologies, combining social engineering with decentralized technologies to evade detection and maintain persistence. The use of blockchain for C2 infrastructure highlights the evolving tactics of threat actors, necessitating adaptive defense strategies to counter such innovative threats.
3 months ago
Kill Chain
Google Patches Critical RCE Vulnerability in Gemini CLI
In April 2026, Google addressed a critical security vulnerability in the Gemini CLI, specifically affecting the "@google/gemini-cli" npm package and the "google-github-actions/run-gemini-cli" GitHub Actions workflow. This flaw, assigned a CVSS score of 10.0, allowed unprivileged external attackers to execute arbitrary commands on host systems by injecting malicious content into Gemini configuration files. The vulnerability was particularly concerning in Continuous Integration (CI) environments where Gemini CLI operated in headless mode, automatically trusting workspace folders and potentially leading to remote code execution via malicious environment variables in the local .gemini/ directory. ([thehackernews.com](https://thehackernews.com/2026/04/google-fixes-cvss-10-gemini-cli-ci-rce.html?utm_source=openai)) The incident underscores the critical importance of securing CI/CD pipelines against supply chain attacks. As organizations increasingly rely on automated workflows, ensuring that tools like Gemini CLI do not implicitly trust unverified inputs is essential to prevent potential exploitation and maintain the integrity of development environments.
3 months ago
Kill Chain
DEEP#DOOR: Unveiling the Python Backdoor Exploiting Tunneling Services
In April 2026, cybersecurity researchers identified a sophisticated Python-based backdoor framework named DEEP#DOOR targeting Windows systems. The attack initiates with an obfuscated batch script that disables Windows security features and extracts an embedded Python payload, establishing persistence through multiple mechanisms such as startup folder entries, registry run keys, and scheduled tasks. The malware communicates with attacker infrastructure via a public TCP tunneling service, enabling remote command execution and extensive surveillance capabilities, including keylogging, screenshot capture, and credential harvesting from browsers and cloud services. DEEP#DOOR employs advanced evasion techniques, including sandbox and virtual machine detection, to avoid detection and complicate incident response efforts. This incident underscores the evolving sophistication of threat actors who leverage fileless, script-driven intrusion frameworks that utilize native system components and interpreted languages like Python. The use of public tunneling services for command-and-control communications highlights a trend towards minimizing forensic footprints and blending malicious traffic with legitimate network activity, posing significant challenges for traditional detection methods.
3 months ago
Kill Chain
Bishop Fox Unveils AIMap: A New Tool for Securing AI Agent Infrastructures
On April 30, 2026, Bishop Fox introduced AIMap, an open-source tool designed to help organizations discover, analyze, and test their exposed AI agent infrastructure. AIMap enables defenders to identify internet-exposed AI systems, assess their risk levels, and conduct controlled security testing to understand and mitigate real-world attack surfaces. The tool addresses vulnerabilities such as unauthenticated access, tool abuse, and prompt leakage, which are increasingly exploited by attackers. The release of AIMap is particularly relevant as AI systems become more integrated into organizational operations, presenting new attack vectors. By providing visibility into AI agent infrastructures, AIMap empowers organizations to proactively secure their AI deployments against emerging threats.
3 months ago
Kill Chain
RedTail Malware's Exploitation of PHP Vulnerability CVE-2024-4577: A 2026 Cybersecurity Threat
In April 2026, a significant cybersecurity incident was documented involving the exploitation of the PHP-CGI vulnerability CVE-2024-4577 by the RedTail cryptomining malware. Attackers utilized the 'libredtail-http' User-Agent to perform HTTP POST actions, leading to unauthorized command execution and deployment of the RedTail malware. This campaign targeted various systems globally, aiming to hijack computing resources for illicit cryptocurrency mining. The rapid exploitation of this vulnerability underscores the critical need for timely patching and robust security measures to prevent such attacks. Organizations are advised to update their PHP installations promptly and monitor network traffic for indicators of compromise associated with the 'libredtail-http' User-Agent.
3 months ago
Kill Chain
Cordial and Snarky Spider's Rapid Data Theft and Extortion Attacks
In October 2025, two financially motivated threat groups, Cordial Spider and Snarky Spider, affiliated with The Com, initiated a series of rapid data theft and extortion attacks targeting U.S.-based organizations across sectors such as academia, aviation, retail, hospitality, automotive, financial services, legal, and technology. Utilizing voice-phishing and social engineering tactics, these groups directed employees to fraudulent single sign-on (SSO) pages to capture credentials, enabling them to infiltrate identity platforms and traverse SaaS environments. Once inside, they removed existing multi-factor authentication (MFA) devices, established their own, and deleted alerts to conceal their activities, leading to significant data exfiltration and extortion demands, often in the seven-figure range. This incident underscores a growing trend of cybercriminals leveraging sophisticated social engineering techniques to exploit identity systems, highlighting the urgent need for organizations to enhance their security measures against such evolving threats.
3 months ago
Kill Chain
Vercel Breach 2026: Lessons in Third-Party AI Tool Security
In April 2026, Vercel, a cloud development platform, experienced a security breach originating from a compromised third-party AI tool, Context.ai. An attacker exploited this tool to access a Vercel employee's Google Workspace account, subsequently infiltrating Vercel's internal systems. This led to unauthorized access to non-sensitive environment variables, including API keys and database credentials. The breach was traced back to the Lumma Stealer malware, which had infected a Context.ai employee's workstation in February 2026. The malware harvested credentials, enabling the attacker to pivot into Vercel's infrastructure. Vercel has since notified affected customers and recommended immediate credential rotation and enhanced security measures. This incident underscores the escalating risks associated with third-party integrations and the necessity for stringent access controls and continuous monitoring of OAuth permissions. Organizations are urged to reassess their security postures concerning third-party tools to mitigate potential supply chain vulnerabilities.
3 months ago
Kill Chain
Critical cPanel & WHM Authentication Bypass Vulnerability (CVE-2026-41940) Discovered
In April 2026, a critical authentication bypass vulnerability, identified as CVE-2026-41940, was discovered in cPanel and WebHost Manager (WHM) software. This flaw allowed unauthenticated remote attackers to gain administrative access to affected systems by exploiting a weakness in the login flow. The vulnerability impacted all supported versions of cPanel and WHM prior to the patched releases. cPanel promptly released security updates to address the issue, urging administrators to apply the patches immediately to prevent unauthorized access. ([support.cpanel.net](https://support.cpanel.net/hc/en-us/articles/40073787579671-Critical-Vulnerability-with-cPanel-WHM-Login-Authentication?utm_source=openai)) The incident underscores the importance of timely software updates and vigilant monitoring of web hosting environments. With the widespread use of cPanel and WHM in managing web servers, such vulnerabilities pose significant risks to data integrity and system security. Organizations are reminded to maintain up-to-date systems and implement robust security practices to mitigate potential threats.
3 months ago
Kill Chain
Qinglong Task Scheduler Vulnerabilities Lead to Cryptomining Attacks
In early February 2026, attackers began exploiting two authentication bypass vulnerabilities, CVE-2026-3965 and CVE-2026-4047, in the Qinglong open-source task scheduling tool. These flaws allowed unauthenticated access to protected admin endpoints, enabling remote code execution. Threat actors leveraged this access to deploy cryptomining malware on developers' servers, leading to significant CPU resource consumption and operational disruptions. The vulnerabilities were publicly disclosed at the end of February, with initial patches proving insufficient. A comprehensive fix was implemented in early March 2026. This incident underscores the critical importance of promptly addressing security vulnerabilities in widely-used open-source tools. The exploitation of Qinglong's flaws highlights the persistent threat posed by cryptomining attacks and the necessity for developers to maintain up-to-date software and implement robust security measures to protect their systems.
3 months ago
Kill Chain
LiteLLM CVE-2026-42208: Rapid Exploitation of Critical SQL Injection Vulnerability
In April 2026, a critical SQL injection vulnerability (CVE-2026-42208) was discovered in BerriAI's LiteLLM Python package, a widely used AI gateway. This flaw allowed unauthenticated attackers to execute arbitrary SQL commands against the proxy's database, potentially leading to unauthorized access and modification of sensitive data. The vulnerability affected versions >=1.81.16 and <1.83.7. Despite a patch being released on April 19, 2026, exploitation attempts were observed within 36 hours of public disclosure, indicating rapid weaponization by threat actors. ([thehackernews.com](https://thehackernews.com/2026/04/litellm-cve-2026-42208-sql-injection.html?utm_source=openai)) This incident underscores the increasing speed at which cyber adversaries exploit newly disclosed vulnerabilities, particularly in widely adopted open-source software. Organizations relying on such tools must prioritize timely patching and implement robust monitoring to detect and mitigate exploitation attempts promptly.
3 months ago
Kill Chain
Massive WordPress Plugin Backdoor Exposes Thousands of Sites in 2026
In April 2026, a significant supply chain attack compromised over 30 WordPress plugins, collectively known as the 'Essential Plugin' portfolio. An individual operating under the alias 'Kris' purchased these plugins in early 2025 and injected a PHP deserialization backdoor during subsequent updates. This backdoor remained dormant for eight months before activation, allowing the attacker to inject spam content and potentially execute arbitrary code on over 20,000 active WordPress sites. The attack underscores the vulnerabilities inherent in plugin ecosystems, where ownership changes can introduce malicious code without immediate detection. This incident highlights a growing trend in supply chain attacks targeting widely used software components. The strategy of purchasing and compromising trusted plugins poses a significant threat to website security, emphasizing the need for rigorous vetting processes and continuous monitoring of third-party software integrations.
3 months ago
Kill Chain
SAP npm Packages Compromised in 'Mini Shai-Hulud' Supply Chain Attack
On April 29, 2026, a sophisticated supply chain attack targeted SAP's JavaScript and cloud application development ecosystem by compromising several npm packages, including mbt@1.2.48, @cap-js/db-service@2.10.1, @cap-js/postgres@2.2.2, and @cap-js/sqlite@2.2.2. The attackers introduced a preinstall script that downloaded and executed a malicious payload via the Bun JavaScript runtime, enabling the theft of developer credentials, GitHub and npm tokens, and cloud service secrets. The stolen data was exfiltrated to public GitHub repositories created on the victims' accounts, labeled with the description 'A Mini Shai-Hulud has Appeared.' ([thehackernews.com](https://thehackernews.com/2026/04/sap-npm-packages-compromised-by-mini.html?utm_source=openai)) This incident underscores the escalating threat of supply chain attacks targeting development environments, particularly within widely-used frameworks like SAP's CAP model. The attack's sophistication, including its ability to propagate through developer workflows and exploit AI coding agent configurations, highlights the need for enhanced security measures in software development pipelines. ([thehackernews.com](https://thehackernews.com/2026/04/sap-npm-packages-compromised-by-mini.html?utm_source=openai))
3 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports