✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Information Technology/IT
Breach intelligence, attack campaigns, and threat reports targeting the Information Technology/IT sector.
Explore Other Sectors
Information Technology/IT Threat Reports
Over 1,300 Microsoft SharePoint Servers Vulnerable to Ongoing Attacks
In April 2026, Microsoft disclosed a spoofing vulnerability (CVE-2026-32201) in SharePoint Server, affecting versions 2016, 2019, and Subscription Edition. This flaw allows unauthenticated attackers to perform network-based spoofing attacks due to improper input validation. Despite the release of patches on April 14, over 1,300 internet-exposed SharePoint servers remain unpatched, leaving organizations vulnerable to unauthorized access and data manipulation. The continued exploitation of CVE-2026-32201 underscores the critical need for timely patch management. Organizations must prioritize updating their SharePoint servers to mitigate potential breaches and maintain data integrity.
3 months ago
Kill Chain
Critical npm Supply Chain Attack Exposes Developer Credentials
In April 2026, a sophisticated supply chain attack targeted the Node Package Manager (npm) ecosystem, compromising multiple packages from Namastex Labs, a company specializing in AI-based solutions. The attackers injected malicious code into these packages, enabling the theft of developer credentials, API keys, SSH keys, and other sensitive data. The malware exhibited worm-like behavior by identifying npm publishing tokens on compromised systems and propagating itself by injecting malicious code into other packages that the stolen tokens could access, leading to a rapid spread across the npm ecosystem. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/new-npm-supply-chain-attack-self-spreads-to-steal-auth-tokens/?utm_source=openai)) This incident underscores the escalating threat of supply chain attacks within open-source ecosystems. The attackers' ability to compromise trusted packages and leverage them to distribute malware highlights the critical need for enhanced security measures in software development pipelines. Organizations must prioritize the implementation of robust security practices, including regular audits of dependencies, strict access controls, and continuous monitoring, to mitigate the risks associated with such attacks.
3 months ago
Kill Chain
Inside Caller-as-a-Service Fraud: The Scam Economy Has a Hiring Process
In April 2026, cybersecurity researchers uncovered a sophisticated 'Caller-as-a-Service' (CaaS) fraud operation, where cybercriminals have structured their activities to mirror legitimate call centers. These operations involve specialized roles such as malware developers, phishing kit builders, infrastructure operators, and scam callers, all working in concert to execute large-scale social engineering attacks. This professionalization has led to a significant increase in the efficiency and impact of fraudulent phone calls, resulting in substantial financial losses and emotional distress for victims. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/inside-caller-as-a-service-fraud-the-scam-economy-has-a-hiring-process/?utm_source=openai)) The emergence of CaaS highlights a critical evolution in cybercrime, emphasizing the need for enhanced security measures and public awareness. As these fraudulent operations become more organized and effective, individuals and organizations must adopt proactive strategies to detect and prevent such sophisticated social engineering attacks.
3 months ago
Kill Chain
Mirai Botnet Exploits D-Link Router Vulnerability CVE-2025-29635
In March 2026, Akamai's Security Intelligence and Response Team (SIRT) identified active exploitation of CVE-2025-29635, a command injection vulnerability in D-Link DIR-823X routers, by a new Mirai-based malware campaign. Attackers are sending POST requests to the vulnerable endpoint, executing remote commands to download and install a Mirai variant named "tuxnokill," which enables the compromised devices to perform distributed denial-of-service (DDoS) attacks. This marks the first observed in-the-wild exploitation of this vulnerability since its disclosure in March 2025. ([akamai.com](https://www.akamai.com/blog/security-research/cve-2025-29635-mirai-campaign-targets-d-link-devices?utm_source=openai)) The exploitation of end-of-life (EoL) devices underscores the critical need for organizations to replace outdated hardware and apply security patches promptly. The resurgence of Mirai variants targeting unpatched IoT devices highlights the ongoing threat posed by botnets leveraging known vulnerabilities. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/new-mirai-campaign-exploits-rce-flaw-in-eol-d-link-routers/?utm_source=openai))
3 months ago
Kill Chain
Kyber Ransomware's 2026 Attacks: A New Era of Post-Quantum Encryption Threats
In March 2026, the Kyber ransomware group launched attacks targeting Windows systems and VMware ESXi endpoints. The Windows variant, written in Rust, implemented Kyber1024 post-quantum encryption for key protection, while the ESXi variant utilized ChaCha8 for file encryption and RSA-4096 for key wrapping. Both variants shared the same campaign ID and Tor-based ransom infrastructure, indicating coordinated efforts to maximize impact by encrypting all servers simultaneously. The attacks led to significant operational disruptions, particularly affecting a multi-billion-dollar American defense contractor and IT services provider. The adoption of post-quantum cryptographic techniques by ransomware operators marks a significant evolution in cyber threats, highlighting the need for organizations to stay ahead of emerging encryption methods used by adversaries. This incident underscores the importance of robust cybersecurity measures and continuous monitoring to detect and mitigate such sophisticated attacks.
3 months ago
Kill Chain
CanisterWorm: A Self-Propagating Supply Chain Attack on the npm Ecosystem
In April 2026, a sophisticated supply chain attack targeted the npm ecosystem, compromising multiple packages to deploy a self-propagating worm known as CanisterWorm. The attack began with the exploitation of a GitHub Actions misconfiguration in the Trivy vulnerability scanner, allowing the threat group TeamPCP to steal a Personal Access Token (PAT). This token was used to publish malicious versions of Trivy, which, when installed, harvested sensitive credentials including npm authentication tokens. The worm then utilized these stolen tokens to automatically publish infected versions of other packages accessible with the compromised credentials, facilitating rapid and widespread propagation across the npm ecosystem. ([anuragnandi.com](https://www.anuragnandi.com/blog/npm-supply-chain-attack-canisterworm-2026?utm_source=openai)) This incident underscores the escalating threat of supply chain attacks within open-source ecosystems, highlighting the need for enhanced security measures in package management and CI/CD pipelines. The use of decentralized command-and-control infrastructure, as seen with CanisterWorm's utilization of an Internet Computer Protocol (ICP) canister, presents new challenges in threat mitigation and emphasizes the importance of adopting zero-trust principles and robust monitoring practices to safeguard against such evolving threats. ([anuragnandi.com](https://www.anuragnandi.com/blog/npm-supply-chain-attack-canisterworm-2026?utm_source=openai))
3 months ago
Kill Chain
Checkmarx Supply Chain Breach: Malicious KICS Docker Images and VS Code Extensions Detected
In April 2026, Checkmarx's supply chain was compromised when attackers uploaded malicious images to the official 'checkmarx/kics' Docker Hub repository. These images, including versions v2.1.20 and a fraudulent v2.1.21, contained modified KICS binaries with unauthorized data collection and exfiltration capabilities. Additionally, certain Visual Studio Code extensions were altered to execute remote code without user consent. Organizations using these compromised tools to scan infrastructure-as-code files risked exposing sensitive credentials and configurations. ([thehackernews.com](https://thehackernews.com/2026/04/malicious-kics-docker-images-and-vs.html?utm_source=openai)) This incident underscores the escalating threat of supply chain attacks targeting widely-used development tools. It highlights the necessity for organizations to implement stringent security measures, such as verifying the integrity of third-party software and continuously monitoring for unauthorized modifications, to safeguard against similar vulnerabilities.
3 months ago
Kill Chain
Critical Microsoft Defender Zero-Day Exploits: BlueHammer, RedSun, and UnDefend
In April 2026, a security researcher known as Chaotic Eclipse publicly disclosed three zero-day vulnerabilities in Microsoft Defender: BlueHammer, RedSun, and UnDefend. These exploits allow attackers to escalate privileges to SYSTEM level and disable Defender's update mechanism, effectively turning the security tool against its users. Microsoft has patched BlueHammer (CVE-2026-33825), but RedSun and UnDefend remain unpatched as of April 22, 2026. ([tomsguide.com](https://www.tomsguide.com/computing/online-security/over-1-billion-windows-users-at-risk-after-disgruntled-security-researcher-leaks-defender-zero-days?utm_source=openai)) The public release of these exploits has led to active exploitation in the wild, with threat actors leveraging them to gain elevated privileges and disable security defenses. This incident underscores the critical importance of timely vulnerability disclosure and patch management in maintaining organizational security. ([techcrunch.com](https://techcrunch.com/2026/04/17/hackers-are-abusing-unpatched-windows-security-flaws-to-hack-into-organizations?utm_source=openai))
3 months ago
Kill Chain
DPRK's 'Contagious Interview' Campaign: A New Era of Supply Chain Attacks
In April 2026, North Korean threat actors, identified as Void Dokkaebi, escalated their 'Contagious Interview' campaign by compromising developers' repositories to disseminate remote access Trojans (RATs) and other malware. By posing as recruiters, they lured developers into cloning malicious code repositories during fake job interviews. These repositories contained Visual Studio Code tasks that, upon execution, installed malware capable of stealing credentials and propagating further infections. This method transformed individual developer systems into vectors for widespread supply chain attacks, affecting numerous organizations and open-source projects. This incident underscores a significant evolution in cyberattack strategies, highlighting the increasing sophistication of supply chain attacks. The use of trusted development tools and platforms to distribute malware emphasizes the need for heightened vigilance among developers and organizations. As threat actors continue to refine their tactics, the cybersecurity community must adapt by implementing robust security measures and promoting awareness to mitigate such risks.
3 months ago
Kill Chain
Critical Vulnerability in Cohere AI's Terrarium: CVE-2026-5752
In April 2026, a critical vulnerability (CVE-2026-5752) was identified in Cohere AI's Terrarium, a Python-based sandbox environment. This flaw allows attackers to execute arbitrary code with root privileges on the host process by exploiting JavaScript prototype chain traversal. The vulnerability has a CVSS score of 9.3, indicating its severity. ([thehackernews.com](https://thehackernews.com/2026/04/cohere-ai-terrarium-sandbox-flaw.html?utm_source=openai)) The discovery underscores the risks associated with sandbox environments, especially those handling untrusted code. Organizations utilizing Terrarium should assess their deployments and implement recommended mitigations to prevent potential exploits. ([thehackernews.com](https://thehackernews.com/2026/04/cohere-ai-terrarium-sandbox-flaw.html?utm_source=openai))
3 months ago
Kill Chain
Microsoft Releases Critical Patch for ASP.NET Core Vulnerability CVE-2026-40372
On April 21, 2026, Microsoft released an out-of-band security update to address a critical vulnerability in ASP.NET Core, identified as CVE-2026-40372. This flaw, stemming from improper verification of cryptographic signatures, allows unauthorized attackers to escalate privileges over a network. Rated with a CVSS score of 9.1, the vulnerability affects ASP.NET Core versions prior to 10.0.7. Exploitation could lead to unauthorized access and control over application components or data. The release of this patch underscores the importance of timely software updates, especially in widely used frameworks like ASP.NET Core. Organizations are urged to apply the update promptly to mitigate potential risks associated with this vulnerability.
3 months ago
Kill Chain
Moltbook's 2026 Security Breach: A Wake-Up Call for AI Platform Security
In late January 2026, Moltbook, a social network designed exclusively for AI agents, suffered a significant security breach due to an exposed Supabase API key embedded in client-side JavaScript. This vulnerability allowed unauthorized access to the platform's production database, exposing 1.5 million API tokens, 35,000 email addresses, and private messages between agents. The breach was promptly identified and reported by cybersecurity firm Wiz, leading to a swift response from Moltbook to patch the vulnerability and reset all agent API keys. ([techradar.com](https://www.techradar.com/pro/security/ai-agent-social-media-network-moltbook-is-a-security-disaster-millions-of-credentials-and-other-details-left-unsecured?utm_source=openai)) This incident underscores the critical importance of implementing robust security measures, especially in rapidly developed AI-driven platforms. The exposure of sensitive data not only compromises user privacy but also highlights the potential risks associated with 'vibe coding'—developing applications with AI assistance without thorough security oversight. Organizations must prioritize security protocols to prevent similar breaches in the future. ([trustfinance.com](https://www.trustfinance.com/en-US/blog/wiz-finds-major-data-leak-in-moltbook-ai-social-network?utm_source=openai))
3 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports