✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Information Technology/IT
Breach intelligence, attack campaigns, and threat reports targeting the Information Technology/IT sector.
Explore Other Sectors
Information Technology/IT Threat Reports
Blackpoint Cyber's 2026 Report: Credential Abuse and RMM Tool Exploitation
In 2026, Blackpoint Cyber's annual threat report highlighted a significant shift in cyberattack methodologies, with a notable increase in the exploitation of legitimate access methods over traditional vulnerability exploits. The report revealed that 32.8% of incidents involved SSL VPN abuse, where attackers utilized valid but compromised credentials to establish seemingly legitimate sessions, facilitating rapid lateral movement within networks. Additionally, 30.3% of incidents featured the misuse of Remote Monitoring and Management (RMM) tools, particularly ScreenConnect, which was present in over 70% of rogue RMM cases. This trend underscores the evolving tactics of threat actors who are leveraging trusted IT tools to gain and maintain unauthorized access, thereby evading conventional security measures. The current relevance of this incident lies in the growing prevalence of identity-driven attacks and the strategic use of legitimate tools for malicious purposes. Organizations must recognize that traditional security controls may be insufficient against such tactics, necessitating enhanced monitoring of credential usage and the implementation of stringent access controls. The rise in these sophisticated methods highlights the urgent need for adaptive security strategies to effectively counteract the evolving threat landscape.
4 months ago
Kill Chain
CrystalX RAT: A New Era of Multifunctional Malware-as-a-Service
In early 2026, a new malware-as-a-service (MaaS) known as CrystalX RAT emerged, offering a comprehensive suite of malicious capabilities including remote access, data theft, keylogging, and clipboard hijacking. Promoted through private Telegram channels and YouTube, CrystalX RAT features a user-friendly control panel and an automated builder tool that supports customization options such as geoblocking and anti-analysis features. Notably, it also includes prankware functionalities designed to disrupt user activities, such as altering display orientation and remapping mouse buttons. The malware's infostealer component targets Chromium-based browsers and desktop applications like Steam, Discord, and Telegram, while its remote access module allows for command execution, file manipulation, and real-time control via VNC. ([securelist.com](https://securelist.com/crystalx-rat-with-prankware-features/119283/?utm_source=openai)) The emergence of CrystalX RAT underscores a growing trend in the cybercriminal ecosystem towards offering multifunctional MaaS platforms that lower the barrier to entry for threat actors. Its combination of traditional malware capabilities with prankware features highlights the evolving nature of cyber threats, emphasizing the need for robust cybersecurity measures and user awareness to mitigate such risks.
4 months ago
Kill Chain
UNC1069's Compromise of Axios npm Package: A 2026 Supply Chain Attack
In late March 2026, the widely used JavaScript library Axios, with approximately 100 million weekly downloads, was compromised in a supply chain attack attributed to the North Korean threat group UNC1069. The attackers gained control of a maintainer's npm account and published two malicious versions of Axios (1.14.1 and 0.30.4) that included a trojanized dependency named 'plain-crypto-js'. This dependency executed a post-installation script to deploy a cross-platform Remote Access Trojan (RAT) targeting Windows, macOS, and Linux systems. The malicious versions were available for about three hours before removal, but the potential impact is significant due to Axios's extensive use across various projects. ([thehackernews.com](https://thehackernews.com/2026/04/google-attributes-axios-npm-supply.html?utm_source=openai)) This incident underscores the growing trend of sophisticated supply chain attacks targeting open-source software, emphasizing the need for enhanced security measures in software development and distribution processes. Organizations are urged to audit their dependency trees, implement strict access controls, and monitor for unusual activities to mitigate such risks.
4 months ago
Kill Chain
CrystalX RAT: The 2026 Malware-as-a-Service Blending Espionage and Prankware
In March 2026, cybersecurity researchers identified an active campaign distributing CrystalX RAT, a novel malware offered as Malware-as-a-Service (MaaS) through private Telegram channels. This Remote Access Trojan (RAT) distinguishes itself by combining traditional espionage capabilities—such as spyware, keylogging, and remote control—with stealer functions and unique prankware features designed to disrupt and annoy victims. The malware's control panel allows third-party actors to build customized implants with options like geoblocking, anti-analysis mechanisms, and various malicious functionalities. Initial infection vectors remain unclear, but the campaign has already affected dozens of victims, primarily in Russia, with potential for global spread due to the service's lack of regional restrictions. The ongoing development and active promotion of CrystalX RAT suggest a significant risk of increased infections in the near future.
4 months ago
Kill Chain
Volt Typhoon 2024: A Case Study in Living Off the Land Cyber Attacks
In 2024, the Chinese state-sponsored hacker group known as Volt Typhoon executed a sophisticated Living Off the Land (LOTL) attack targeting critical infrastructure in the United States. By exploiting legitimate system tools and processes, they infiltrated networks without deploying traditional malware, thereby evading standard detection mechanisms. This approach allowed them to conduct prolonged surveillance and data exfiltration, significantly compromising national security and operational integrity. ([nsa.gov](https://www.nsa.gov/Press-Room/Press-Releases-Statements/Press-Release-View/Article/3669159/combatting-cyber-threat-actors-perpetrating-living-off-the-land-intrusions/?utm_source=openai)) The incident underscores a growing trend among nation-state actors to utilize LOTL techniques, which leverage trusted system utilities to carry out malicious activities. This method not only complicates detection but also challenges traditional cybersecurity defenses, necessitating a shift towards behavior-based monitoring and advanced threat detection strategies.
4 months ago
Kill Chain
Casbaneiro Phishing Campaign Targets Latin America and Europe
In March 2026, a sophisticated phishing campaign orchestrated by the Brazilian cybercrime group Augmented Marauder targeted Spanish-speaking users across Latin America and Europe. The attackers distributed emails with court summons-themed messages containing password-protected PDF attachments. These PDFs directed recipients to malicious links, initiating a multi-stage infection chain that deployed the Horabot malware, which subsequently delivered the Casbaneiro banking trojan. This campaign leveraged dynamic PDF generation and exploited both email and WhatsApp platforms to propagate the malware, resulting in significant financial and data losses for affected organizations. This incident underscores the evolving tactics of cybercriminals who are increasingly using multi-pronged attack vectors and dynamic content to bypass traditional security measures. The use of legitimate communication channels like WhatsApp for malware distribution highlights the need for organizations to implement comprehensive security strategies that address both email and messaging platforms.
4 months ago
Kill Chain
Microsoft Warns of WhatsApp-Delivered VBS Malware Hijacking Windows via UAC Bypass
In late February 2026, Microsoft identified a sophisticated malware campaign leveraging WhatsApp messages to distribute malicious Visual Basic Script (VBS) files. Upon execution, these scripts initiate a multi-stage infection chain, utilizing renamed Windows utilities to download additional payloads from trusted cloud services like AWS, Tencent Cloud, and Backblaze B2. The malware employs User Account Control (UAC) bypass techniques to escalate privileges, establish persistence, and deploy tools such as AnyDesk for remote access, enabling attackers to exfiltrate data or deploy further malware. This campaign underscores the evolving tactics of threat actors who exploit legitimate tools and platforms to evade detection and maintain control over compromised systems. Organizations must remain vigilant against such social engineering attacks and implement robust security measures to mitigate these threats.
4 months ago
Kill Chain
Excessive Permissions in Google Vertex AI: A 2026 Security Wake-Up Call
In March 2026, Palo Alto Networks' Unit 42 identified a critical security vulnerability in Google Cloud's Vertex AI platform. The issue stemmed from the platform's default service accounts, known as Per-Project, Per-Product Service Agents (P4SA), which were granted excessive permissions by default. This misconfiguration allowed attackers to exploit AI agents deployed on Vertex AI, enabling unauthorized access to sensitive data and internal cloud infrastructure. By extracting the service account credentials, malicious actors could escalate privileges, access proprietary container images, and potentially compromise Google's internal storage buckets. ([darkreading.com](https://www.darkreading.com/cyber-risk/googles-vertex-ai-over-privilege-problem?utm_source=openai)) This incident underscores the growing security challenges associated with AI deployments in cloud environments. As organizations increasingly integrate AI agents into their workflows, ensuring proper configuration and adherence to the principle of least privilege becomes paramount to prevent similar vulnerabilities and safeguard sensitive information.
4 months ago
Kill Chain
UNC1069's 2026 Supply Chain Attack on Axios: A Wake-Up Call for Open-Source Security
In late March 2026, the widely-used JavaScript library Axios was compromised through a sophisticated supply chain attack. Attackers gained access to the npm account of a lead maintainer and published two malicious versions: axios@1.14.1 and axios@0.30.4. These versions included a trojanized dependency, 'plain-crypto-js@4.2.1', which executed a cross-platform Remote Access Trojan (RAT) upon installation, targeting Windows, macOS, and Linux systems. The malicious packages were live for approximately three hours before being removed, but the potential impact was significant due to Axios's extensive use in the developer community. ([securitylabs.datadoghq.com](https://securitylabs.datadoghq.com/articles/axios-npm-supply-chain-compromise/?utm_source=openai)) This incident underscores the escalating threat of supply chain attacks, particularly those targeting open-source ecosystems. The attribution to North Korean threat actor UNC1069 highlights the increasing involvement of state-sponsored groups in such attacks, emphasizing the need for enhanced security measures in software development pipelines. ([cyberkendra.com](https://www.cyberkendra.com/2026/04/north-korean-hackers-behind-axios-npm.html?utm_source=openai))
4 months ago
Kill Chain
TeamPCP's 2026 Cloud Breaches: A Wake-Up Call for Supply Chain Security
In March 2026, the threat actor group TeamPCP executed a series of sophisticated supply chain attacks, compromising widely used open-source tools such as Trivy, KICS, LiteLLM, and Telnyx. By injecting malicious code into these trusted software packages, TeamPCP deployed infostealer malware to harvest sensitive credentials, including API keys, SSH keys, and cloud service tokens. Utilizing the stolen credentials, the group swiftly breached cloud environments across AWS, Azure, and various SaaS platforms, conducting extensive reconnaissance and data exfiltration activities. This campaign underscores the critical need for organizations to promptly rotate and revoke compromised credentials to mitigate the risk of unauthorized access and data breaches. The rapid escalation and breadth of TeamPCP's attacks highlight a concerning trend in cyber threats, emphasizing the importance of securing software supply chains and implementing robust monitoring mechanisms to detect and respond to credential misuse promptly.
4 months ago
Kill Chain
AI/ML Security Incidents in 2026: A Wake-Up Call for Enterprises
In 2026, the cybersecurity landscape witnessed a significant surge in incidents involving artificial intelligence (AI) and machine learning (ML) systems. Notably, a report by Zscaler highlighted that 90% of enterprise AI systems could be breached within 90 minutes under adversarial testing conditions, with some systems compromised in under one second. Additionally, 68% of organizations experienced AI-linked data leaks, yet only 23% had formal AI security policies in place. These incidents underscore the critical vulnerabilities in AI and ML deployments, emphasizing the need for robust security measures and governance frameworks. The rapid adoption of AI technologies, coupled with insufficient security protocols, has led to an increase in sophisticated cyberattacks. Threat actors are leveraging AI to enhance the scale, speed, and precision of their attacks, while organizations struggle to keep pace with evolving threats. This trend highlights the urgent need for comprehensive AI security strategies to mitigate emerging risks.
4 months ago
Kill Chain
Venom Stealer: The New Frontier in Automated ClickFix Attacks
In April 2026, a new malware-as-a-service (MaaS) platform named Venom Stealer emerged, automating the creation of persistent information-stealing attacks through ClickFix social engineering techniques. Developed by an individual known as 'VenomStealer,' this platform enables attackers to establish a continuous exfiltration pipeline, harvesting credentials, session cookies, and cryptocurrency wallets from victims. Unlike traditional infostealers, Venom Stealer remains active post-infection, continuously monitoring and exfiltrating new data, thereby undermining standard incident response measures. The commoditization of such advanced attack methods signifies a concerning evolution in cyber threats, making sophisticated social engineering tactics more accessible to a broader range of cybercriminals. Organizations must enhance their security awareness training and implement robust monitoring of outbound traffic to detect and prevent data exfiltration activities associated with these attacks.
4 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports