The breach isn’t the problem. The spread is. →The breach isn’t the problem. The spread is. →Measure in 5 min. Free AssessmentFree Assessment
Information Technology/IT
Breach intelligence, attack campaigns, and threat reports targeting the Information Technology/IT sector.
Explore Other Sectors
Information Technology/IT Threat Reports
Mini Shai Hulud: @antv npm Supply Chain Attack Exposes CI/CD Credentials
In May 2026, a supply chain attack targeted the @antv npm package ecosystem. A threat actor compromised an @antv maintainer account, publishing malicious versions of popular data-visualization packages. This led to widespread impact, as the malicious code propagated through dependencies like echarts-for-react, affecting CI/CD pipelines and cloud workloads. The payload, a 499 KB obfuscated JavaScript file, executed silently during npm install, aiming to steal credentials from GitHub Actions environments. Key features included multi-platform credential theft, process memory scraping, privilege escalation, dual-channel data exfiltration, and SLSA provenance forgery, indicating a sophisticated focus on CI/CD environments. This incident underscores the escalating threat of supply chain attacks, particularly targeting CI/CD environments. The attack's sophistication, including SLSA provenance forgery, highlights the need for enhanced security measures in software development pipelines to prevent unauthorized access and data breaches.
4 months ago
Kill Chain
Trivy Supply Chain Compromise: A Wake-Up Call for Security Tool Integrity
In March 2026, Aqua Security's open-source vulnerability scanner, Trivy, was compromised in a sophisticated supply chain attack. Threat actors injected credential-stealing malware into Trivy's official releases, affecting the core scanner binary and associated GitHub Actions. This breach enabled attackers to harvest sensitive data from organizations relying on Trivy for security assessments. The campaign, attributed to the group TeamPCP, expanded to other security tools, including Checkmarx KICS and LiteLLM, indicating a targeted approach against security infrastructure. ([microsoft.com](https://www.microsoft.com/en-us/security/blog/2026/03/24/detecting-investigating-defending-against-trivy-supply-chain-compromise/?utm_source=openai)) This incident underscores the escalating trend of supply chain attacks targeting security tools, exploiting the trust placed in them by organizations. The compromise of widely used security applications highlights the need for enhanced vigilance and robust security measures within the software supply chain to prevent similar breaches.
4 months ago
Kill Chain
Showboat Linux Malware Targets Middle East Telecoms in 2026
In mid-2022, a telecommunications provider in the Middle East was targeted by a sophisticated cyber espionage campaign involving a new Linux malware named Showboat. This modular post-exploitation framework is capable of spawning remote shells, transferring files, and functioning as a SOCKS5 proxy. The malware's design allows attackers to establish a persistent foothold within compromised systems, facilitating unauthorized access to internal networks and sensitive data. The campaign has been attributed to China-linked threat actors, with command-and-control infrastructure traced back to Chengdu, Sichuan province. The attackers likely exploited vulnerabilities or default remote access accounts to deploy the malware, underscoring the critical need for robust security measures in telecommunications infrastructure. This incident highlights a concerning trend of state-sponsored cyber espionage targeting critical infrastructure sectors, particularly telecommunications. The use of advanced, stealthy malware like Showboat demonstrates the evolving capabilities of threat actors and the importance of proactive defense strategies. Organizations must prioritize the implementation of comprehensive security protocols, regular system audits, and employee training to mitigate the risks posed by such sophisticated attacks.
4 months ago
Kill Chain
GitHub's 2026 Internal Repositories Breach: A Supply Chain Attack by TeamPCP
In May 2026, GitHub experienced a significant security breach when an employee's device was compromised through a malicious Visual Studio Code extension. This intrusion led to the exfiltration of approximately 3,800 internal repositories containing proprietary source code. The threat actor group known as TeamPCP claimed responsibility for the attack, offering the stolen data for sale on cybercrime forums with a starting price of $50,000. GitHub's investigation confirmed the breach but found no evidence that customer data stored outside its internal repositories was affected. This incident underscores the escalating threat of supply chain attacks targeting development environments. The use of compromised development tools to infiltrate organizations highlights the need for enhanced vigilance and security measures within software supply chains. Organizations must prioritize the integrity of their development tools and implement robust monitoring to detect and prevent such sophisticated attacks.
4 months ago
Kill Chain
GitHub's 2026 Breach: Lessons from the TeamPCP VS Code Extension Attack
In May 2026, GitHub confirmed a security breach involving the exfiltration of approximately 3,800 internal repositories. The incident originated when an employee installed a malicious Visual Studio Code (VS Code) extension, which compromised the device and allowed unauthorized access to GitHub's internal code repositories. The threat actor, identified as TeamPCP, claimed responsibility for the attack and attempted to sell the stolen data on cybercrime forums for at least $50,000. GitHub's investigation indicated that the breach was limited to internal repositories, with no evidence suggesting that customer data was affected. This incident underscores the growing threat of supply chain attacks targeting development environments. The use of malicious VS Code extensions as an attack vector highlights the need for heightened vigilance and robust security measures within software development processes. Organizations must reassess their security protocols to mitigate risks associated with third-party tools and extensions.
4 months ago
Kill Chain
PinTheft Vulnerability: Critical Root Escalation Flaw in Arch Linux
In May 2026, a critical privilege escalation vulnerability named 'PinTheft' was identified in the Linux kernel's Reliable Datagram Sockets (RDS) protocol. This flaw allows local attackers to gain root privileges on systems where the RDS module is loaded, notably affecting Arch Linux by default. The vulnerability arises from a double-free error in the RDS zerocopy send path, which can be exploited to overwrite the page cache through io_uring fixed buffers. A proof-of-concept exploit has been publicly released, demonstrating the ease of exploitation under specific conditions. The emergence of 'PinTheft' underscores a concerning trend of privilege escalation vulnerabilities in the Linux kernel, following recent disclosures like 'Copy Fail' (CVE-2026-31431) and 'Pack2TheRoot' (CVE-2026-41651). These incidents highlight the critical need for timely patching and vigilant system monitoring to mitigate the risk of unauthorized access and potential system compromise.
4 months ago
Kill Chain
Grafana Labs Breach: Lessons from the TanStack Supply-Chain Attack
In May 2026, Grafana Labs experienced a security breach stemming from the TanStack npm supply-chain attack orchestrated by the cybercrime group TeamPCP. The attackers published malicious versions of TanStack packages, which, when integrated into Grafana's CI/CD pipeline, executed credential-stealing malware. This led to the exfiltration of GitHub workflow tokens, granting unauthorized access to Grafana's private repositories. Although the company promptly rotated most tokens upon detecting the intrusion, one token was overlooked, enabling the attackers to access and download the company's source code and internal operational information. Importantly, no customer data or production systems were compromised during this incident. ([grafana.com](https://grafana.com/blog/grafana-labs-security-update-latest-on-tanstack-npm-supply-chain-ransomware-incident/?utm_source=openai)) This breach underscores the escalating threat posed by sophisticated supply-chain attacks targeting widely-used open-source packages. Organizations must enhance their vigilance and implement robust security measures within their development pipelines to mitigate such risks. The incident also highlights the critical importance of comprehensive credential management and the necessity for thorough audits to ensure all potential vulnerabilities are addressed promptly.
4 months ago
Kill Chain
Critical Windows Zero-Day Vulnerabilities Uncovered: 'YellowKey' and 'GreenPlasma'
In May 2026, a security researcher known as 'Nightmare Eclipse' disclosed multiple zero-day vulnerabilities affecting Windows systems, including 'YellowKey' and 'GreenPlasma'. 'YellowKey' allows attackers with physical access to bypass BitLocker encryption using a USB device, while 'GreenPlasma' enables local privilege escalation to SYSTEM level by exploiting the Windows CTFMON input service. These vulnerabilities expose critical weaknesses in Windows security mechanisms, potentially leading to unauthorized data access and system control. The rapid disclosure of these zero-days, some of which are actively exploited, underscores the urgency for organizations to implement robust security measures beyond patching, such as enforcing physical security controls, applying the principle of least privilege, and enhancing monitoring for anomalous activities.
4 months ago
Kill Chain
Verizon DBIR 2026 Highlights AI-Driven Surge in Vulnerability Exploitation
In 2026, Verizon's Data Breach Investigations Report (DBIR) revealed a significant shift in cyberattack vectors, with vulnerability exploitation accounting for 31% of breaches, surpassing stolen credentials for the first time. This surge is attributed to threat actors leveraging artificial intelligence (AI) to rapidly identify and exploit software flaws, reducing the window for defense from months to mere hours. ([verizon.com](https://www.verizon.com/about/news/breach-industry-wide-dbir-finds?utm_source=openai)) The report also highlights a concerning decline in vulnerability remediation, with only 26% of critical vulnerabilities in CISA's Known Exploited Vulnerabilities catalog fully addressed in 2025, down from 38% the previous year. This trend underscores the urgent need for organizations to enhance their patch management processes and adopt proactive security measures to mitigate the evolving threat landscape. ([cyberscoop.com](https://cyberscoop.com/verizon-data-breach-investigations-report-2026/?utm_source=openai))
4 months ago
Kill Chain
Grafana Labs GitHub Breach: A Wake-Up Call for Supply Chain Security
In May 2026, Grafana Labs experienced a security breach when attackers exploited a stolen GitHub token to access and download the company's codebase. The breach was detected on May 11, 2026, and the attackers subsequently issued a ransom demand, threatening to release the stolen code. Grafana Labs refused to pay the ransom, emphasizing that no customer data or production systems were compromised. The company has since revoked the compromised credentials and implemented additional security measures to prevent future incidents. This incident underscores the growing threat of supply chain attacks targeting development environments. Organizations are increasingly vulnerable to such breaches, highlighting the need for robust security practices, including regular credential audits and enhanced monitoring of CI/CD pipelines.
4 months ago
Kill Chain
Axios npm Package Compromise: A 2026 Supply Chain Attack
In late March 2026, attackers compromised the npm account of a lead maintainer of Axios, a widely-used JavaScript HTTP client library. They published two malicious versions, `axios@1.14.1` and `axios@0.30.4`, which included a trojanized dependency named `plain-crypto-js`. This dependency executed a `postinstall` script that downloaded and installed a cross-platform Remote Access Trojan (RAT) targeting macOS, Windows, and Linux systems. The malicious packages were available for approximately three hours before being removed by npm. ([tomshardware.com](https://www.tomshardware.com/tech-industry/cyber-security/axios-npm-package-compromised-in-supply-chain-attack-that-deployed-a-cross-platform-rat?utm_source=openai)) This incident underscores the growing threat of supply chain attacks targeting open-source software repositories. The rapid deployment and removal of the malicious packages highlight the need for vigilant monitoring and swift response mechanisms within the software development community.
4 months ago
Kill Chain
Mini Shai-Hulud 2026: Unveiling TeamPCP's npm Supply Chain Attack
In May 2026, the self-replicating malware campaign known as Mini Shai-Hulud resurfaced, compromising hundreds of npm packages. The threat actor, TeamPCP, utilized this campaign to autonomously spread malware, install persistent OS-level backdoors, and harvest sensitive credentials such as GitHub tokens, npm tokens, SSH keys, and cloud provider credentials. The malware executed upon package installation, affecting both local development environments and CI/CD pipelines, and propagated by republishing infected packages under legitimate maintainers' names. ([cyberscoop.com](https://cyberscoop.com/mini-shai-hulud-malware-npm-packages-compromised-again/?utm_source=openai)) This incident underscores the escalating threat of supply chain attacks targeting open-source ecosystems. The ability of such malware to persist beyond standard remediation efforts, like package removal, highlights the need for comprehensive security measures, including thorough auditing of developer tools and CI/CD environments, to prevent unauthorized access and data exfiltration.
4 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports