The breach isn’t the problem. The spread is. →The breach isn’t the problem. The spread is. →Measure in 5 min. Free AssessmentFree Assessment
Information Technology/IT
Breach intelligence, attack campaigns, and threat reports targeting the Information Technology/IT sector.
Explore Other Sectors
Information Technology/IT Threat Reports
Nx Console Extension Compromised: A Wake-Up Call for Developer Security
On May 18, 2026, a compromised version of the Nx Console extension (version 18.95.0) was published to the Microsoft Visual Studio Code Marketplace. This extension, widely used by over 2.2 million developers, was altered to include a credential-stealing payload. Upon opening any workspace, the malicious extension fetched and executed an obfuscated payload from a hidden commit within the official nrwl/nx GitHub repository. This payload harvested sensitive information, including tokens and secrets from platforms such as GitHub, npm, AWS, HashiCorp Vault, Kubernetes, and 1Password, exfiltrating them via multiple channels. ([stepsecurity.io](https://www.stepsecurity.io/blog/nx-console-vs-code-extension-compromised?utm_source=openai)) This incident underscores the escalating threat of supply chain attacks targeting developer tools. The sophisticated method of embedding malicious code within trusted extensions highlights the need for enhanced vigilance and security measures in software development environments. Developers and organizations must prioritize the integrity of their toolchains to prevent similar breaches.
4 months ago
Kill Chain
DirtyDecrypt PoC Released: Immediate Action Required for Linux Kernel CVE-2026-31635
On May 19, 2026, a proof-of-concept (PoC) exploit code was released for a recently patched security flaw in the Linux kernel, identified as CVE-2026-31635 and dubbed 'DirtyDecrypt' or 'DirtyCBC'. This vulnerability, discovered by the Zellic and V12 security team, allows local privilege escalation due to a missing copy-on-write (COW) guard in the rxgk_decrypt_skb() function. The flaw enables unprivileged local users to write arbitrary bytes into the kernel's page cache of read-only files, potentially granting root privileges. Distributions with CONFIG_RXGK enabled, such as Fedora, Arch Linux, and openSUSE Tumbleweed, are affected. ([thehackernews.com](https://thehackernews.com/2026/05/dirtydecrypt-poc-released-for-linux.html?utm_source=openai)) The release of the PoC highlights the urgency for system administrators to apply the available patches promptly. This incident underscores the critical need for timely updates and vigilant monitoring of security advisories to mitigate risks associated with such vulnerabilities.
4 months ago
Kill Chain
EvilTokens Phishing Campaign: A New Threat to Microsoft 365 Security
In February 2026, the phishing-as-a-service platform EvilTokens emerged, compromising over 340 Microsoft 365 organizations across five countries within five weeks. The attack exploited the OAuth device code authentication flow, tricking users into entering a short code at microsoft.com/devicelogin and completing their MFA challenge. Unbeknownst to them, this granted attackers valid refresh tokens with access to emails, files, calendars, and contacts, all without stealing passwords or bypassing MFA. This method effectively bypassed traditional identity defenses, as the OAuth consent screen has become an instinctive click for many users. ([thehackernews.com](https://thehackernews.com/2026/05/the-new-phishing-click-how-oauth.html?utm_source=openai)) The incident underscores a significant shift in phishing tactics, highlighting the exploitation of legitimate authentication processes to gain unauthorized access. As attackers increasingly leverage such methods, organizations must reassess their security protocols to address these evolving threats.
4 months ago
Kill Chain
TeamPCP's Compromise of Checkmarx Jenkins Plugin: A 2026 Supply Chain Attack
In May 2026, the threat group TeamPCP compromised Checkmarx's Jenkins AST plugin by publishing a backdoored version (2026.5.09) to the Jenkins Marketplace. This malicious plugin, assigned CVE-2026-33634 with a CVSS score of 9.4, allowed attackers to execute code within CI/CD pipelines, potentially exposing sensitive credentials and source code. The incident follows previous attacks by TeamPCP on Checkmarx's KICS tool and the Trivy vulnerability scanner, indicating a targeted campaign against developer tools. ([thehackernews.com](https://thehackernews.com/2026/05/teampcp-compromises-checkmarx-jenkins.html?utm_source=openai)) This breach underscores the escalating threat of supply chain attacks targeting CI/CD environments. Organizations must enhance their security measures by verifying the integrity of third-party plugins and implementing robust monitoring to detect unauthorized changes within their development pipelines.
4 months ago
Kill Chain
Pwn2Own Berlin 2026: Unveiling 47 Zero-Day Vulnerabilities
The Pwn2Own Berlin 2026 hacking contest, held from May 14 to May 16, 2026, at the OffensiveCon conference, concluded with security researchers earning $1,298,250 in rewards after successfully exploiting 47 zero-day vulnerabilities. The competition focused on enterprise technologies and artificial intelligence, targeting fully patched products across various categories, including web browsers, enterprise applications, servers, and virtualization platforms. Notably, the DEVCORE Research Team secured the highest reward of $200,000 by chaining three bugs to achieve remote code execution with SYSTEM privileges on Microsoft Exchange. This event underscores the persistent challenges in securing enterprise software and the critical importance of proactive vulnerability management. The exposure of these zero-day vulnerabilities highlights the need for organizations to stay vigilant and prioritize timely patching to mitigate potential exploitation risks.
4 months ago
Kill Chain
Critical 'DirtyDecrypt' Vulnerability in Linux Kernel: Exploit Released
In May 2026, a local privilege escalation vulnerability in the Linux kernel's rxgk module, dubbed 'DirtyDecrypt' (also known as 'DirtyCBC'), was disclosed. This flaw allows attackers to gain root access on certain Linux systems by exploiting a missing Copy-On-Write (COW) guard in the rxgk_decrypt_skb function. The vulnerability, identified as CVE-2026-31635, was patched on April 25, 2026. Successful exploitation requires the CONFIG_RXGK configuration option enabled, affecting distributions like Fedora, Arch Linux, and openSUSE Tumbleweed. A proof-of-concept exploit has been released, demonstrating the ease of exploitation on unpatched systems. This incident underscores a growing trend of privilege escalation vulnerabilities in the Linux kernel, following similar disclosures such as 'Dirty Frag,' 'Fragnesia,' and 'Copy Fail.' The rapid succession of these vulnerabilities highlights the critical need for timely patch management and vigilant system monitoring to mitigate potential security risks.
4 months ago
Kill Chain
Grafana Labs' 2026 Security Breach: A Case Study in Credential-Based Attacks
In May 2026, Grafana Labs, the developer of the popular open-source analytics platform, experienced a security breach when attackers exploited a stolen GitHub access token to download the company's source code. The extortion group known as CoinbaseCartel claimed responsibility, demanding a ransom to prevent the public release of the code. Grafana Labs promptly invalidated the compromised credentials, implemented additional security measures, and, adhering to FBI guidance, refused to pay the ransom. Importantly, the company confirmed that no customer data or personal information was accessed, and customer systems remained unaffected. This incident underscores the growing threat posed by credential-based attacks and the rise of data theft extortion tactics employed by groups like CoinbaseCartel. Organizations are reminded of the critical importance of securing access tokens and implementing robust security protocols to prevent unauthorized access and mitigate potential breaches.
4 months ago
Kill Chain
Leaked Shai-Hulud Malware Sparks New npm Infostealer Campaign
In May 2026, a threat actor using the alias 'deadcode09284814' published four malicious packages on the npm registry, embedding a non-obfuscated version of the Shai-Hulud malware. These packages targeted developer credentials, secrets, cryptocurrency wallet data, and account information. Notably, one package also transformed infected systems into bots for distributed denial-of-service (DDoS) attacks. The malicious packages included 'chalk-tempalte', '@deadcode09284814/axios-util', 'axois-utils', and 'color-style-utils'. Researchers at OXsecurity identified these uploads, highlighting the use of typosquatting techniques to deceive developers. The 'chalk-tempalte' package contained a direct clone of the Shai-Hulud malware, originally attributed to the TeamPCP hacker group, indicating that other actors are now leveraging the leaked source code. This incident underscores the persistent threat of supply chain attacks within the open-source ecosystem, emphasizing the need for developers to exercise caution when integrating third-party packages. The reuse of the Shai-Hulud malware by different threat actors highlights the rapid dissemination and adaptation of malicious tools, posing ongoing risks to software supply chains.
4 months ago
Kill Chain
SHub Reaper: Unveiling the Sophisticated macOS Infostealer
In May 2026, a new variant of the SHub macOS infostealer, dubbed 'Reaper,' emerged, employing sophisticated tactics to compromise systems. The malware masquerades as legitimate applications like WeChat and Miro, hosted on deceptive domains resembling trusted entities. Upon execution, it utilizes AppleScript to display a counterfeit Apple security update, prompting users to grant system access. Once infiltrated, Reaper exfiltrates sensitive browser data, documents containing financial information, and hijacks cryptocurrency wallet applications. Notably, it establishes persistence by installing scripts that mimic Google software updates, ensuring continuous access to the compromised system. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/shub-macos-infostealer-variant-spoofs-apple-security-updates/?utm_source=openai)) This incident underscores a concerning evolution in macOS-targeted malware, highlighting the increasing sophistication of threat actors in circumventing security measures. The use of trusted brand impersonation and legitimate system processes to deploy malware signifies a shift towards more deceptive and effective attack vectors, emphasizing the need for heightened vigilance and advanced security protocols among macOS users.
4 months ago
Kill Chain
Clop Ransomware Targets Cloud Clearway Group in March 2026 Attack
In March 2026, the Clop ransomware group executed a cyberattack on Cloud Clearway Group, a leading IT services firm in Canada. The attackers encrypted sensitive data and threatened to release it unless their ransom demands were met. This incident underscores the persistent threat posed by Clop, which has been responsible for numerous high-profile attacks targeting various sectors globally. The attack on Cloud Clearway Group highlights the evolving tactics of ransomware groups, emphasizing the need for organizations to bolster their cybersecurity defenses. With ransomware attacks becoming more sophisticated and frequent, businesses must prioritize proactive measures to mitigate potential risks and ensure data security.
4 months ago
Kill Chain
Mamont Banking Trojan: A Rising Threat in Q1 2026
In Q1 2026, the Mamont banking Trojan emerged as a significant threat to Android users, accounting for 73.5% of banking Trojan detections. This malware family, including variants like Mamont.jo and Mamont.jx, primarily targets users' financial credentials by masquerading as legitimate applications. The surge in Mamont-related incidents underscores the evolving tactics of cybercriminals in exploiting mobile platforms for financial gain. The proliferation of Mamont banking Trojans highlights the critical need for enhanced mobile security measures. As cyber threats become more sophisticated, users and organizations must adopt proactive strategies to safeguard sensitive financial information from such pervasive malware.
4 months ago
Kill Chain
SHub Reaper: A New macOS Threat Exploiting Trusted Brands
In May 2026, a sophisticated macOS malware variant named SHub Reaper emerged, employing a multi-stage attack chain that impersonates trusted brands such as Apple, Google, and Microsoft. The malware is distributed through fake installers for applications like WeChat and Miro, hosted on typo-squatted domains resembling legitimate Microsoft sites. Upon execution, it masquerades as an Apple security update and establishes persistence via a fake Google Software Update directory. SHub Reaper is designed to steal sensitive information, including passwords, cryptocurrency wallets, and documents, while maintaining a backdoor for ongoing access. This incident underscores a growing trend of malware leveraging brand impersonation and social engineering to bypass traditional security measures. The use of legitimate-looking applications and trusted system processes highlights the need for enhanced vigilance and advanced detection mechanisms to protect against such evolving threats.
4 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports