Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Information Technology/IT

Breach intelligence, attack campaigns, and threat reports targeting the Information Technology/IT sector.

3786 threat reports
Page 118 of 316
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Information Technology/IT Threat Reports

Showing 1405–1416 / 3786 reports
Persistent Phishing Threats in the Hospitality Industry: A 2026 Case Study
Hospitality4 months ago

Persistent Phishing Threats in the Hospitality Industry: A 2026 Case Study

In April 2026, a sophisticated phishing campaign targeted hospitality organizations across Europe and Asia. Attackers impersonated guests, sending emails with malicious ZIP files disguised as photo attachments. These emails exploited trusted services like Calendly and Google redirects to bypass email authentication checks. Upon opening the ZIP files, victims inadvertently executed a PowerShell script that installed a persistent Node.js-based malware implant, granting attackers long-term access to compromised systems. ([darkreading.com](https://www.darkreading.com/cyberattacks-data-breaches/phishers-persistence-eu-asia-hospitality-orgs?utm_source=openai)) This incident underscores a growing trend of cybercriminals leveraging social engineering and trusted platforms to infiltrate organizations. The use of advanced techniques, such as 'authentication laundering' and blockchain-based command-and-control mechanisms, highlights the evolving nature of cyber threats in the hospitality sector. ([darkreading.com](https://www.darkreading.com/cyberattacks-data-breaches/phishers-persistence-eu-asia-hospitality-orgs?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(low)
Read report
Securing AI Endpoints: Lessons from Recent Exploits
Computer Software/Engineering4 months ago

Securing AI Endpoints: Lessons from Recent Exploits

Between March and May 2026, Zenity researchers identified three distinct campaigns where threat actors exploited exposed AI inference endpoints, such as those of Ollama and LiteLLM, to conduct offensive operations. These attacks did not require full system compromises; attackers merely needed knowledge of the exposed endpoints to leverage them for activities like autonomous penetration testing and web reverse-engineering. The incidents underscore the critical need for securing AI infrastructure against unauthorized access. This trend highlights a growing tactic among cyber adversaries: exploiting misconfigured or exposed AI endpoints to amplify their offensive capabilities. As organizations increasingly integrate AI into their operations, ensuring the security of these systems becomes paramount to prevent their misuse in cyberattacks.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Agentjacking: The Emerging Threat to AI Coding Agents
Computer Software/Engineering4 months ago

Agentjacking: The Emerging Threat to AI Coding Agents

In June 2026, Tenet Security unveiled a novel attack method termed 'agentjacking,' wherein attackers exploit AI coding agents by injecting malicious code through fabricated error reports in public bug tracking services. This technique enables unauthorized code execution on developers' machines, potentially leading to the theft of sensitive credentials and compromise of development environments. The attack leverages the AI agents' inability to distinguish between genuine content and embedded instructions, allowing adversaries to manipulate these agents into executing harmful commands. The significance of this discovery lies in the escalating integration of AI coding agents into software development workflows. As these agents become more prevalent, understanding and mitigating their vulnerabilities is crucial to prevent similar exploitation methods. Organizations must reassess their security protocols to address the unique risks posed by AI-driven development tools.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Phantom Squatting: Unveiling the New AI-Driven Cyber Threat
Computer Software/Engineering4 months ago

Phantom Squatting: Unveiling the New AI-Driven Cyber Threat

In July 2026, cybersecurity researchers identified a new threat vector termed 'phantom squatting,' where attackers exploit AI-generated, non-existent domains associated with legitimate brands. By registering these hallucinated domains, cybercriminals can intercept traffic directed by AI systems, leading to phishing attacks and malware distribution. This method leverages the tendency of large language models (LLMs) to generate plausible yet fictitious web addresses, creating a novel supply chain vulnerability. The emergence of phantom squatting underscores the evolving landscape of AI-driven cyber threats. As organizations increasingly integrate AI assistants into their operations, the risk of such AI-induced vulnerabilities grows, necessitating proactive measures to monitor and secure potential phantom domains before they are weaponized by adversaries.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Unveiling the Evolution of ClickFix: API-Driven Malware Delivery Exposed
Financial Services4 months ago

Unveiling the Evolution of ClickFix: API-Driven Malware Delivery Exposed

In July 2026, security researcher Bert-Jan Pals analyzed approximately 3,000 live ClickFix payloads, uncovering a significant evolution in the malware delivery mechanism. ClickFix, a social engineering technique that deceives users into executing malicious commands, has transitioned to using API-driven servers. These servers dynamically generate unique, obfuscated commands for each visitor, effectively disguising the same underlying malware. Additionally, a new delivery method was identified that bypasses Windows' script scanning by downloading a file to the user's system and executing it through a seemingly innocuous command, thereby evading traditional detection mechanisms. This development underscores the increasing sophistication of social engineering attacks and the continuous adaptation of threat actors to circumvent security measures. Organizations must remain vigilant, updating their security protocols and educating users about emerging threats to mitigate the risks associated with such advanced attack vectors.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Massive Azure CLI Password Spray Attack Compromises 78 Microsoft Accounts
Information Technology/IT4 months ago

Massive Azure CLI Password Spray Attack Compromises 78 Microsoft Accounts

Between June 12 and June 26, 2026, a massive, automated password spray attack targeted Microsoft's Azure command-line interface (CLI), resulting in over 81 million login attempts and the compromise of at least 78 Microsoft accounts across 64 organizations. The attackers exploited a deprecated OAuth 2.0 grant type known as Resource Owner Password Credentials (ROPC) to bypass Conditional Access Policies (CAP) and multi-factor authentication (MFA) in environments where MFA was not enforced for all cloud applications. The attack originated from an IPv6 address range controlled by internet infrastructure provider LSHIY LLC (AS32167). ([thehackernews.com](https://thehackernews.com/2026/07/azure-cli-password-spray-hits-at-least.html?utm_source=openai)) This incident underscores the critical need for organizations to review and properly configure their Conditional Access Policies to enforce MFA across all applications and user groups. The exploitation of legacy authentication methods like ROPC highlights the importance of disabling deprecated protocols and ensuring that security measures are comprehensive and up-to-date. ([thehackernews.com](https://thehackernews.com/2026/07/azure-cli-password-spray-hits-at-least.html?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(low)
IImpact(medium)
Read report
Phantom Squatting: Exploiting AI-Generated Domains for Cyber Attacks
Financial Services4 months ago

Phantom Squatting: Exploiting AI-Generated Domains for Cyber Attacks

In July 2026, Palo Alto Networks' Unit 42 identified a new cyberattack technique termed 'phantom squatting,' where attackers exploit AI-generated, non-existent domains to conduct phishing and malware distribution. By prompting large language models (LLMs) with queries about official websites, attackers collect these hallucinated domains, register them, and create malicious sites that appear legitimate to users and AI tools alike. This method leverages the trust users place in AI-generated content, leading to increased risks of credential theft and malware infections. The emergence of phantom squatting underscores the evolving landscape of cyber threats, particularly as AI tools become more integrated into daily operations. Organizations must recognize the potential for AI-generated misinformation to be weaponized and implement proactive measures to monitor and secure domains that could be exploited through such techniques.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Critical Vulnerability in Schneider Electric's EcoStruxure IT Data Center Expert: CVE-2026-8045
Information Technology/IT4 months ago

Critical Vulnerability in Schneider Electric's EcoStruxure IT Data Center Expert: CVE-2026-8045

In June 2026, Schneider Electric disclosed a vulnerability (CVE-2026-8045) in its EcoStruxure IT Data Center Expert software, versions 9.1.1 and prior. This flaw, identified as an Improper Restriction of XML External Entity Reference (CWE-611), allows authenticated users to submit crafted XML payloads to SOAP service endpoints, potentially leading to unauthorized access and disclosure of sensitive server-side files. ([nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2026-8045?utm_source=openai)) The vulnerability underscores the critical need for robust input validation and secure XML processing in software applications. Organizations utilizing affected versions should promptly apply the vendor-provided patch to mitigate potential risks associated with this security flaw.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Protecting AI Agents from MCP Tool Poisoning Attacks
Financial Services4 months ago

Protecting AI Agents from MCP Tool Poisoning Attacks

In June 2026, Microsoft Incident Response detailed a sophisticated attack pattern targeting enterprise AI agents utilizing the Model Context Protocol (MCP). The attack involved malicious modifications to MCP tool descriptions, leading AI agents to execute unauthorized actions, such as exfiltrating sensitive financial data. This exploitation underscores the vulnerabilities inherent in AI agents that transition from passive content reading to active task execution. The incident highlights the critical need for robust security measures as AI agents become more autonomous and integrated into enterprise workflows. With the projected growth of AI agents in enterprises, securing these systems against such sophisticated attacks is paramount to prevent potential data breaches and operational disruptions.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Critical Vulnerabilities in Cursor AI Code Editor Expose Developers to Remote Code Execution
Computer Software/Engineering4 months ago

Critical Vulnerabilities in Cursor AI Code Editor Expose Developers to Remote Code Execution

In June 2026, two critical vulnerabilities, CVE-2026-50548 and CVE-2026-50549, were discovered in Cursor, an AI-powered code editor. These flaws allowed malicious agents to bypass the application's sandbox protections, enabling unauthorized execution of commands on a developer's machine without user interaction. The vulnerabilities stemmed from improper handling of the working directory and symlink resolution, permitting attackers to write arbitrary files outside the intended workspace, leading to potential remote code execution. ([nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2026-50549?utm_source=openai)) The discovery of these vulnerabilities underscores the growing risks associated with AI-integrated development tools. As AI becomes more embedded in software development, ensuring the security of such tools is paramount to prevent exploitation by threat actors.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Urgent Alert: Ransomware Gangs Exploit Microsoft Defender 'BlueHammer' Vulnerability
Government Administration4 months ago

Urgent Alert: Ransomware Gangs Exploit Microsoft Defender 'BlueHammer' Vulnerability

In early April 2026, a security researcher known as 'Nightmare Eclipse' publicly disclosed a high-severity privilege escalation vulnerability in Microsoft Defender, dubbed 'BlueHammer' (CVE-2026-33825), along with proof-of-concept exploit code. This flaw allows local attackers to access the Security Account Manager (SAM) database, enabling them to escalate privileges to SYSTEM level and potentially take full control of the affected system. Microsoft addressed the vulnerability on April 14, 2026, as part of its Patch Tuesday updates. However, by late June 2026, the Cybersecurity and Infrastructure Security Agency (CISA) confirmed that ransomware gangs had begun exploiting this vulnerability in their attacks, leading to significant security concerns for organizations using unpatched systems. The exploitation of BlueHammer underscores a growing trend where threat actors rapidly weaponize newly disclosed vulnerabilities, particularly those with publicly available exploit code. This incident highlights the critical importance of timely patch management and proactive security measures to mitigate the risks associated with such vulnerabilities.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Beware: Malicious 'Perplexity AI' Chrome Extension Intercepts User Searches
Computer Software/Engineering4 months ago

Beware: Malicious 'Perplexity AI' Chrome Extension Intercepts User Searches

In June 2026, a malicious Chrome extension named "Search for perplexity ai" was discovered impersonating the legitimate Perplexity AI search engine. This extension altered users' default search settings, intercepting all address-bar queries and routing them through attacker-controlled infrastructure before redirecting to legitimate search services. While no credential theft was confirmed, the extension's permissions allowed for extensive data collection, posing significant privacy risks. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/fake-perplexity-extension-on-chrome-web-store-tracked-searches/amp/?utm_source=openai)) This incident underscores the growing trend of cybercriminals exploiting trusted AI brands to distribute malicious software. It highlights the need for enhanced vigilance in verifying browser extensions and the importance of robust security measures to prevent unauthorized data interception.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports