Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Information Technology/IT

Breach intelligence, attack campaigns, and threat reports targeting the Information Technology/IT sector.

3786 threat reports
Page 110 of 316
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Information Technology/IT Threat Reports

Showing 1309–1320 / 3786 reports
ModHeader Extension Removed by Google and Microsoft Over Security Concerns
Computer Software/Engineering3 months ago

ModHeader Extension Removed by Google and Microsoft Over Security Concerns

In July 2026, Google and Microsoft removed the ModHeader browser extension, which had approximately 1.6 million combined installs across Chrome and Edge, due to the discovery of a dormant data collection module. Security researchers found that version 7.0.18 of ModHeader contained code capable of collecting users' browsing histories and transmitting the encrypted data to an external server. Although the data collection feature was inactive, its presence raised significant privacy concerns, leading to the extension's removal from both browsers. This incident underscores the critical need for rigorous security assessments of browser extensions, especially those with extensive user bases. It highlights the potential risks associated with third-party software components and the importance of continuous monitoring to detect and mitigate hidden threats that could compromise user privacy and security.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Yellow Teams: Defining the Future of AI Security
Computer Software/Engineering3 months ago

Yellow Teams: Defining the Future of AI Security

In 2026, organizations like Anthropic and OpenAI initiated projects such as Project Glasswing and Daybreak, respectively, to explore the integration of advanced AI models like Claude Mythos and GPT-5.5 into cybersecurity operations. These initiatives led to the formation of 'yellow teams'—engineering groups dedicated to developing both offensive and defensive AI tools. These teams collaborated with red (offensive) and blue (defensive) teams to harness AI capabilities for identifying vulnerabilities and enhancing security measures. The collaboration resulted in the discovery of numerous vulnerabilities, including some longstanding ones, and emphasized the necessity of integrating AI into the software development life cycle to proactively mitigate future threats. The emergence of yellow teams underscores a significant shift in cybersecurity strategies, highlighting the critical role of AI in both offensive and defensive operations. As AI technologies continue to evolve, the integration of such teams is essential for organizations aiming to stay ahead of sophisticated cyber threats and to adapt to the rapidly changing threat landscape.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(medium)
IImpact(high)
Read report
CISA's 2026 GitHub Credential Leak: Lessons in Security Oversight
Government Administration3 months ago

CISA's 2026 GitHub Credential Leak: Lessons in Security Oversight

In May 2026, the Cybersecurity and Infrastructure Security Agency (CISA) experienced a significant security lapse when a contractor inadvertently exposed sensitive credentials on a public GitHub repository named 'Private-CISA.' This repository, maintained by an employee of Nightwing—a contractor for CISA—contained approximately 844 MB of internal data, including administrative AWS GovCloud keys, plaintext passwords for internal systems, SSH keys, and SAML certificates. The repository was publicly accessible from November 2025 until its discovery in May 2026 by security researcher Guillaume Valadon of GitGuardian. Upon notification, CISA took steps to remove the repository and revoke the exposed credentials. ([techcrunch.com](https://techcrunch.com/2026/05/19/us-cyber-agency-cisa-exposed-reams-of-passwords-and-cloud-keys-to-the-open-web/?utm_source=openai)) This incident underscores the critical importance of stringent credential management and the need for continuous monitoring of public code repositories to prevent unauthorized data exposure. It also highlights the necessity for organizations, especially those responsible for national cybersecurity, to enforce robust security protocols and ensure that contractors adhere to the same standards to mitigate potential risks.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(low)
IImpact(low)
Read report
Misconfigured Server Exposes Sophisticated Phishing Operations Targeting Microsoft 365
Financial Services3 months ago

Misconfigured Server Exposes Sophisticated Phishing Operations Targeting Microsoft 365

In April 2026, a misconfigured server exposed three active Microsoft 365 phishing operations utilizing customized versions of the Evilginx adversary-in-the-middle (AiTM) proxy. The exposed server, left with directory listing enabled, revealed comprehensive toolkits, including phishing configurations, credential logs, and remote management tools. Analysis traced these operations to an Egyptian actor known as 'codemado,' who cloned and modified public Evilginx repositories to orchestrate sophisticated phishing campaigns targeting corporate mailboxes. The campaigns effectively bypassed multi-factor authentication (MFA) by proxying live login sessions and abusing legitimate Microsoft sign-in flows, allowing attackers to capture session cookies and maintain prolonged access to compromised accounts. This incident underscores the evolving sophistication of phishing-as-a-service platforms and the critical need for organizations to implement robust security measures beyond traditional MFA. The exposure of these operations highlights the importance of continuous monitoring and auditing of authentication processes to detect and mitigate unauthorized access attempts. As attackers refine their techniques to circumvent existing defenses, organizations must stay vigilant and adapt their security strategies accordingly.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Critical Remote Code Execution Vulnerability in iCagenda Joomla Extension (CVE-2026-48939)
Computer Software/Engineering3 months ago

Critical Remote Code Execution Vulnerability in iCagenda Joomla Extension (CVE-2026-48939)

In June 2026, a critical vulnerability (CVE-2026-48939) was identified in the iCagenda extension for Joomla, allowing unauthenticated attackers to upload and execute arbitrary PHP files via the file attachment feature. This flaw, present in versions prior to 3.9.15 and 4.0.8, enables remote code execution, potentially compromising the entire web server. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added this vulnerability to its Known Exploited Vulnerabilities catalog on July 10, 2026, following reports of active exploitation in the wild. ([nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2026-48939?utm_source=openai)) The exploitation of CVE-2026-48939 underscores a broader trend of attackers targeting vulnerabilities in widely used content management system (CMS) extensions. This incident highlights the critical need for organizations to promptly apply security patches and maintain vigilant monitoring of their web applications to prevent unauthorized access and potential data breaches.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
AI-Generated PowerShell Script Used in Active Directory Attack
Financial Services3 months ago

AI-Generated PowerShell Script Used in Active Directory Attack

In early June 2026, cybersecurity researchers identified an intrusion where an unknown threat actor utilized an AI-generated PowerShell script to enumerate an Active Directory (AD) environment. The attacker gained Remote Desktop Protocol (RDP) access to a domain-joined Windows Server using pre-compromised credentials, then executed a PowerShell script titled "100% Working AD Information Gathering Script - FULLY FIXED." This script aggressively mapped users, computers, and domains, creating an AD_Report.html to summarize the enumeration. Following this, the attacker deployed legitimate tools like s5cmd.exe and SharpShares.exe to identify and exfiltrate accessible data repositories. ([itsecurityguru.org](https://www.itsecurityguru.org/2026/07/08/huntress-uncovers-vibe-coded-malware-used-to-map-active-directory-environments/?utm_source=openai)) This incident underscores the evolving threat landscape where AI-generated tools are lowering the barrier to entry for cybercriminals, enabling rapid development of custom, evasive malware. The use of AI in cyberattacks is accelerating, allowing threat actors to execute damaging campaigns more swiftly than ever before. ([infosecurity-magazine.com](https://www.infosecurity-magazine.com/news/vibe-coded-malware-ai-powershell/?utm_source=openai))

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(low)
LMLateral Movement(high)
C&CCommand & Control(low)
EExfiltration(high)
IImpact(low)
Read report
Anubis Ransomware Exploits Citrix Bleed 2 Vulnerability in 2026
Computer Software/Engineering3 months ago

Anubis Ransomware Exploits Citrix Bleed 2 Vulnerability in 2026

In early July 2026, the Anubis ransomware group exploited a critical vulnerability known as Citrix Bleed 2 (CVE-2025-5777) in Citrix NetScaler appliances to gain unauthorized access to enterprise networks. This flaw allowed attackers to bypass multi-factor authentication by stealing session tokens, leading to the compromise of 91 organizations across sectors such as healthcare, financial services, manufacturing, and technology. The attackers utilized legitimate remote management tools to maintain persistence and evade detection, culminating in the deployment of ransomware that encrypted critical data and disrupted operations. This incident underscores the persistent threat posed by unpatched vulnerabilities and the sophisticated tactics employed by ransomware groups. The exploitation of Citrix Bleed 2 highlights the importance of timely patch management and the need for comprehensive monitoring of remote access tools to detect and prevent unauthorized activities.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Urgent Alert: Widespread Scanning Targets MCP Servers and AI Assistant Credentials
Computer Software/Engineering3 months ago

Urgent Alert: Widespread Scanning Targets MCP Servers and AI Assistant Credentials

In July 2026, security researchers identified a widespread scanning campaign targeting Model Context Protocol (MCP) servers and AI assistant credential files. Attackers systematically probed internet-facing systems for exposed MCP endpoints and configuration files associated with AI development tools, aiming to exploit misconfigurations and gain unauthorized access. This reconnaissance activity underscores the critical need for organizations to secure their AI infrastructure against emerging threats. The incident highlights a growing trend of attackers focusing on AI-related assets, exploiting the rapid adoption of AI technologies and potential security oversights. Organizations must proactively implement robust security measures to protect sensitive AI systems and data from evolving cyber threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Hackers Weaponize Balochistan Police Portal in Multi-Group Espionage Campaigns
Law Enforcement4 months ago

Hackers Weaponize Balochistan Police Portal in Multi-Group Espionage Campaigns

Between February 2024 and April 2026, cybersecurity researchers identified sustained cyber espionage activities targeting Pakistani law enforcement agencies, notably the Balochistan Police. These campaigns, attributed to threat actors linked to China and India, involved the compromise of servers hosting sensitive web applications managing police and citizen data. The attackers employed sophisticated techniques, including multi-stage malware deployment and exploitation of unpatched vulnerabilities, to infiltrate and maintain persistent access to these critical systems. The breaches resulted in unauthorized access to confidential information, posing significant risks to national security and public safety. This incident underscores a growing trend of state-sponsored cyber espionage targeting law enforcement and government institutions in South Asia. The convergence of multiple nation-state actors focusing on similar targets highlights the strategic importance of such entities and the escalating cyber threats they face. Organizations must enhance their cybersecurity posture to defend against increasingly sophisticated and persistent adversaries.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
jscrambler npm Package Compromise: A Wake-Up Call for Developer Security
Computer Software/Engineering4 months ago

jscrambler npm Package Compromise: A Wake-Up Call for Developer Security

On July 11, 2026, the jscrambler npm package version 8.14.0 was compromised, introducing a preinstall hook that deployed a Rust-based infostealer upon installation. This malicious code targeted developer environments across Windows, macOS, and Linux platforms, exfiltrating sensitive data such as cloud credentials, cryptocurrency wallets, password manager vaults, and session tokens for various applications. The attack was identified within minutes of the release, but the exact number of affected systems remains undetermined. This incident underscores the escalating threat of supply chain attacks within the software development ecosystem. The rapid detection highlights the importance of vigilant monitoring and swift response mechanisms. Organizations must prioritize securing their development pipelines and implement robust verification processes to mitigate the risks associated with third-party dependencies.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Ghostcommit: Unveiling the AI Code Review Exploit via Image-Based Prompt Injection
Computer Software/Engineering4 months ago

Ghostcommit: Unveiling the AI Code Review Exploit via Image-Based Prompt Injection

In July 2026, researchers from the University of Missouri-Kansas City's ASSET Research Group unveiled 'Ghostcommit,' a sophisticated supply chain attack that exploits AI code reviewers by embedding prompt injections within image files. The attack involves submitting a pull request containing a PNG image with hidden instructions that, when processed by AI agents, extract sensitive information from the repository's environment files and encode them into the source code as innocuous-looking data. This method effectively bypasses traditional code review processes, as images are typically not scrutinized for malicious content. The 'Ghostcommit' attack underscores a critical vulnerability in AI-assisted development workflows, highlighting the need for enhanced scrutiny of non-textual assets in code reviews. As AI integration in software development continues to grow, understanding and mitigating such novel attack vectors becomes imperative to maintain the integrity and security of development pipelines.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
CISA Adds Two Critical Vulnerabilities to Known Exploited Vulnerabilities Catalog
Government Administration4 months ago

CISA Adds Two Critical Vulnerabilities to Known Exploited Vulnerabilities Catalog

On July 10, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added two vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog: CVE-2026-48939 and CVE-2026-56291. CVE-2026-48939 is a critical remote code execution vulnerability in the iCagenda extension for Joomla, allowing unauthenticated attackers to upload and execute arbitrary PHP files on the server. CVE-2026-56291 pertains to the Balbooa Forms extension, enabling similar unauthorized file uploads leading to potential server compromise. Both vulnerabilities have been actively exploited in the wild, posing significant risks to organizations using these Joomla extensions. The inclusion of these vulnerabilities in the KEV Catalog underscores the persistent threat posed by unpatched software components in widely used content management systems. Organizations are urged to prioritize the remediation of these vulnerabilities to prevent potential data breaches and system compromises.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports