✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Information Technology/IT
Breach intelligence, attack campaigns, and threat reports targeting the Information Technology/IT sector.
Explore Other Sectors
Information Technology/IT Threat Reports
Vercel's April 2026 Security Breach: Lessons in Third-Party Integration Risks
In April 2026, Vercel, a cloud development platform, experienced a security breach originating from a compromised third-party AI tool, Context.ai. An attacker exploited this tool to gain unauthorized access to a Vercel employee's Google Workspace account, subsequently infiltrating Vercel's internal systems. This intrusion led to the exposure of non-sensitive customer environment variables, including API keys and database credentials. Vercel promptly notified affected customers, recommending immediate credential rotation and enhanced security measures. The company engaged incident response experts and law enforcement to investigate and mitigate the breach, ensuring that core services remained operational throughout the incident. This incident underscores the escalating risks associated with third-party integrations and OAuth permissions in cloud environments. As organizations increasingly adopt AI tools and third-party services, the potential for supply chain attacks grows, emphasizing the need for stringent access controls, regular security audits, and comprehensive monitoring to safeguard sensitive data and maintain trust.
3 months ago
Kill Chain
Understanding the Surge in Identity-Based Cyber Attacks
In early 2026, a significant cybersecurity breach occurred when attackers exploited identity-based vulnerabilities to gain unauthorized access to sensitive systems. By leveraging stolen credentials obtained through sophisticated phishing campaigns and infostealer malware, the threat actors bypassed traditional security measures, including multi-factor authentication (MFA). This breach resulted in the exfiltration of vast amounts of personal and corporate data, leading to substantial financial and reputational damage for the affected organizations. ([helpnetsecurity.com](https://www.helpnetsecurity.com/2026/02/18/identity-based-cyberattacks-compromise/?utm_source=openai)) This incident underscores a growing trend where attackers prefer logging in with stolen credentials over exploiting technical vulnerabilities. The prevalence of identity-based attacks has surged, with reports indicating that 75% of breaches now originate from compromised identities. ([securitytoday.de](https://www.securitytoday.de/en/2026/03/19/identity-attacks-2026-why-hackers-no-longer-break-in-they-log-in/?utm_source=openai))
3 months ago
Kill Chain
Critical Vulnerability in Google's Antigravity IDE Leads to Remote Code Execution
In January 2026, cybersecurity researchers identified a critical vulnerability in Google's AI-powered integrated development environment (IDE), Antigravity. The flaw, stemming from insufficient input sanitization in the 'find_by_name' tool, allowed attackers to execute arbitrary code by exploiting prompt injection techniques. This vulnerability enabled sandbox escape and remote code execution, effectively bypassing Antigravity's Secure Mode protections. Google addressed the issue with a patch released on February 28, 2026. ([cyberscoop.com](https://cyberscoop.com/google-antigravity-pillar-security-agent-sandbox-escape-remote-code-execution/?utm_source=openai)) The incident underscores the growing security challenges associated with AI-driven development tools. As organizations increasingly integrate AI agents into their workflows, ensuring robust input validation and sandboxing mechanisms becomes paramount to prevent similar vulnerabilities.
3 months ago
Kill Chain
Insider Betrayal: Ransomware Negotiator Aids BlackCat Attacks in 2023
In April 2023, Angelo Martino, a 41-year-old ransomware negotiator from Land O'Lakes, Florida, began collaborating with the BlackCat ransomware group to exploit confidential information from his clients. By providing BlackCat attackers with sensitive details such as insurance policy limits and internal negotiation strategies, Martino enabled the cybercriminals to demand higher ransom payments from five U.S. companies. This collusion led to significant financial losses for the affected organizations. ([thehackernews.com](https://thehackernews.com/2026/04/ransomware-negotiator-pleads-guilty-to.html?utm_source=openai)) This case underscores a troubling trend of insiders leveraging their positions to facilitate cyberattacks, highlighting the critical need for robust internal security measures and vigilant monitoring of personnel with access to sensitive information.
3 months ago
Kill Chain
Axios npm Supply Chain Compromise: A 2026 Case Study
On March 31, 2026, attackers compromised the npm account of a lead maintainer of Axios, a widely-used JavaScript HTTP client library, and released two malicious versions: axios@1.14.1 and axios@0.30.4. These versions included a trojanized dependency, plain-crypto-js@4.2.1, which executed a post-install script to deploy a cross-platform Remote Access Trojan (RAT) targeting Windows, macOS, and Linux systems. The malicious packages were available for approximately three hours before being removed, during which time they could have been installed by numerous developers and CI/CD pipelines, potentially leading to widespread system compromises. ([github.com](https://github.com/axios/axios/issues/10636?utm_source=openai)) This incident underscores the growing threat of supply chain attacks in the software development ecosystem. The rapid deployment and removal of the malicious packages highlight the need for developers and organizations to implement stringent security measures, such as verifying package integrity, pinning dependencies to known safe versions, and monitoring for anomalous behavior in development and production environments.
3 months ago
Kill Chain
CISA Adds Eight Exploited Vulnerabilities to KEV Catalog
On April 20, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) expanded its Known Exploited Vulnerabilities (KEV) Catalog by adding eight new vulnerabilities, citing evidence of active exploitation. These vulnerabilities affect a range of products, including PaperCut NG/MF, JetBrains TeamCity, Kentico Xperience, Quest KACE Systems Management Appliance, Synacor Zimbra Collaboration Suite, and Cisco Catalyst SD-WAN Manager. The inclusion of these vulnerabilities underscores the persistent threat posed by unpatched software flaws, which can serve as entry points for malicious actors to compromise systems and exfiltrate sensitive data. The addition of these vulnerabilities to the KEV Catalog highlights the evolving landscape of cyber threats, where attackers continuously exploit both new and longstanding vulnerabilities. Organizations are urged to prioritize the remediation of these vulnerabilities to mitigate potential risks and enhance their cybersecurity posture.
3 months ago
Kill Chain
Change Healthcare Ransomware Attack: A Wake-Up Call for Healthcare Cybersecurity
In February 2024, Change Healthcare, a subsidiary of UnitedHealth Group, suffered a ransomware attack by the ALPHV/BlackCat group. The attackers exploited compromised credentials lacking multi-factor authentication to access the company's systems, exfiltrated sensitive data, and deployed ransomware that severely disrupted operations. This breach halted electronic payments and medical claims processing, forcing patients to pay out-of-pocket for medications and healthcare services. The attack had an unprecedented impact on the U.S. healthcare system, causing widespread disruptions in healthcare delivery. The financial fallout was equally staggering, with UnitedHealth Group incurring approximately $2.87 billion in response costs during 2024. Additionally, the company paid $22 million in ransom to the attackers and provided over $6 billion in assistance to affected healthcare providers. The incident garnered global attention, highlighting the vulnerabilities in healthcare cybersecurity and underscoring the critical need for robust defenses in this sector, where the consequences of cyberattacks extend far beyond financial losses to directly affect patient care and safety. This incident underscores the growing dangers of ransomware attacks targeting healthcare data.
3 months ago
Kill Chain
Vercel's 2026 Security Breach: Lessons in Third-Party Integration Risks
In April 2026, Vercel, a cloud development platform, experienced a security breach originating from a compromised third-party AI tool, Context.ai. An attacker exploited OAuth tokens to access a Vercel employee's Google Workspace account, leading to unauthorized access to certain internal systems and exposure of non-sensitive customer environment variables. Vercel promptly notified affected customers and recommended immediate credential rotation. The company engaged incident response experts and law enforcement to investigate and remediate the incident. ([vercel.com](https://vercel.com/kb/bulletin/vercel-april-2026-security-incident?utm_source=openai)) This incident underscores the growing threat of supply chain attacks targeting interconnected cloud services and the critical importance of securing third-party integrations. Organizations are urged to review their OAuth permissions and implement robust access controls to mitigate similar risks.
3 months ago
Kill Chain
Critical Vulnerability in Google Antigravity IDE Exposes Remote Code Execution Risk
In January 2026, researchers at Pillar Security identified a critical vulnerability in Google's Antigravity IDE, an AI-powered development environment. The flaw allowed attackers to exploit a prompt injection vulnerability in the 'find_by_name' tool, enabling remote code execution (RCE) by bypassing Antigravity's Secure Mode protections. This vulnerability was reported to Google on January 6, 2026, and a patch was released on February 28, 2026. The incident underscores the risks associated with AI-driven development tools and the necessity for rigorous security measures in their design and implementation. The discovery of this vulnerability highlights the growing trend of attackers targeting AI-powered tools through prompt injection techniques. As AI integration in development environments becomes more prevalent, ensuring the security of these systems is paramount to prevent potential exploitation and maintain trust in AI-driven solutions.
3 months ago
Kill Chain
Microsoft Releases Emergency Updates to Resolve Windows Server April 2026 Issues
In April 2026, Microsoft released security updates for Windows Server systems, including KB5082063 for Windows Server 2025. Post-installation, administrators reported installation failures and domain controllers entering restart loops due to Local Security Authority Subsystem Service (LSASS) crashes. These issues disrupted authentication and directory services, potentially rendering domains unavailable. Microsoft responded by releasing out-of-band updates to address these problems across affected Windows Server versions. This incident underscores the critical importance of thorough testing and prompt remediation in software updates. Organizations must remain vigilant, ensuring that security patches do not inadvertently disrupt essential services, and be prepared to implement emergency updates when necessary.
3 months ago
Kill Chain
Scattered Spider Leader Pleads Guilty to Multi-Million Dollar Crypto Theft
In April 2026, Tyler Robert Buchanan, a British national and alleged leader of the Scattered Spider cybercrime group, pleaded guilty in the United States to charges of wire fraud and aggravated identity theft. Between September 2021 and April 2023, Buchanan and his co-conspirators executed SMS phishing attacks targeting employees of various companies across industries such as entertainment, telecommunications, and technology. By impersonating legitimate entities, they obtained confidential information, enabling them to hijack email accounts through SIM swapping and steal over $8 million in cryptocurrency. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/british-scattered-spider-hacker-pleads-guilty-to-crypto-theft-charges/?utm_source=openai)) This case underscores the persistent threat posed by sophisticated social engineering tactics employed by cybercriminal groups like Scattered Spider. Organizations must remain vigilant against such methods, as the group's activities have led to significant financial losses and operational disruptions across multiple sectors. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/fbi-shares-tactics-of-notorious-scattered-spider-hacker-collective/?utm_source=openai))
3 months ago
Kill Chain
Surge in Microsoft Teams Helpdesk Impersonation Attacks in 2026
In April 2026, Microsoft reported a surge in cyberattacks where threat actors impersonated IT helpdesk personnel via Microsoft Teams. These attackers initiated cross-tenant chats, convincing employees to grant remote access under the guise of resolving account issues or performing security updates. Utilizing legitimate tools like Quick Assist and Rclone, they conducted reconnaissance, moved laterally across networks, and exfiltrated sensitive data to external cloud storage, effectively blending malicious activities with routine IT operations. This incident underscores a significant shift in cyberattack strategies, highlighting the exploitation of trusted collaboration platforms for social engineering. The increasing sophistication of such attacks necessitates heightened vigilance and robust security measures to protect against unauthorized access and data breaches.
3 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports