The breach isn’t the problem. The spread is. →The breach isn’t the problem. The spread is. →Measure in 5 min. Free AssessmentFree Assessment
Information Technology/IT
Breach intelligence, attack campaigns, and threat reports targeting the Information Technology/IT sector.
Explore Other Sectors
Information Technology/IT Threat Reports
Understanding the Axios npm Supply Chain Attack and Its Implications
In late March 2026, attackers compromised the npm account of Axios's lead maintainer, publishing malicious versions 1.14.1 and 0.30.4 of the widely-used JavaScript HTTP client library. These versions included a hidden dependency, 'plain-crypto-js@4.2.1', which executed a post-install script to deploy a cross-platform Remote Access Trojan (RAT) targeting Windows, macOS, and Linux systems. The RAT connected to a command-and-control server to download platform-specific payloads, granting attackers remote control over infected machines. The malicious packages were available for approximately three hours before removal, during which they were downloaded and potentially installed by numerous developers and CI/CD pipelines. ([microsoft.com](https://www.microsoft.com/en-us/security/blog/2026/04/01/mitigating-the-axios-npm-supply-chain-compromise/?utm_source=openai)) This incident underscores the escalating threat of supply chain attacks, particularly those targeting widely-used open-source libraries. The rapid deployment and sophisticated nature of the attack highlight the need for enhanced security measures in software development pipelines, including stringent access controls, continuous monitoring, and prompt incident response capabilities. ([infoq.com](https://www.infoq.com/news/2026/04/axios-supply-chain/?utm_source=openai))
5 months ago
Kill Chain
Apple Account Change Alerts Abused in Sophisticated Phishing Scheme
In April 2026, cybercriminals exploited Apple's account change notification system to distribute phishing emails that appeared to originate from Apple's legitimate servers. These emails falsely informed recipients of an $899 iPhone purchase via PayPal and provided a phone number to cancel the transaction. The attackers manipulated the account's personal information fields to embed the phishing message, leading to the dispatch of authentic-looking emails from Apple. This tactic increased the credibility of the scam and enhanced its chances of bypassing spam filters. Victims who called the provided number were at risk of being deceived into installing remote access software or divulging sensitive financial information, potentially resulting in financial theft or data breaches. This incident underscores the evolving sophistication of phishing attacks, where threat actors leverage legitimate system features to enhance the authenticity of their scams. Organizations and individuals must remain vigilant against such tactics, as similar methods have been observed in other platforms, including Microsoft Azure Monitor alerts being abused for callback phishing attacks.
5 months ago
Kill Chain
Vercel Security Breach April 2026: Lessons in Third-Party Integration Security
In April 2026, Vercel, a prominent cloud development platform, disclosed a security incident involving unauthorized access to certain internal systems. The breach was traced back to a compromised third-party AI tool's Google Workspace OAuth application, which allowed attackers to infiltrate Vercel's infrastructure. A threat actor, claiming affiliation with the ShinyHunters group, alleged possession of sensitive data, including access keys, source code, and employee information, and attempted to sell this data for $2 million. Vercel has engaged incident response experts, notified law enforcement, and is actively investigating the incident. The company has advised customers to review and rotate environment variables and secrets as a precautionary measure. This incident underscores the growing risks associated with third-party integrations and the importance of securing OAuth applications. Organizations are reminded to implement robust security measures for all third-party tools and to regularly audit their access permissions to prevent similar breaches.
5 months ago
Kill Chain
Tycoon 2FA Phishers Scatter, Adopt Device Code Phishing
In March 2026, a coordinated law enforcement operation led by Europol and Microsoft dismantled Tycoon 2FA, a prominent phishing-as-a-service (PhaaS) platform responsible for bypassing multi-factor authentication (MFA) and compromising over 96,000 victims globally. Despite the takedown, Tycoon 2FA's techniques and tools have been adopted by other platforms such as Mamba 2FA and EvilProxy, leading to a resurgence in phishing activities. Notably, attackers are increasingly employing device code phishing, exploiting legitimate new-device login flows to deceive victims into granting account access. This shift underscores the adaptability of cybercriminals and the persistent threat posed by sophisticated phishing campaigns.
5 months ago
Kill Chain
McGraw-Hill Salesforce Data Breach: A Wake-Up Call for Cloud Security
In April 2026, McGraw-Hill disclosed a data breach resulting from a misconfiguration in their Salesforce environment, which allowed unauthorized access to internal data hosted on Salesforce web resources. The cybercriminal group ShinyHunters claimed responsibility, alleging possession of up to 45 million records containing personally identifiable information (PII). McGraw-Hill stated that the breach did not impact its Salesforce accounts, customer databases, or internal systems, and described the exposed data as limited and non-sensitive. However, the discrepancy between the company's statement and the attackers' claims has raised concerns about the extent of the data compromised. This incident underscores the critical importance of securing cloud-based platforms and the potential risks associated with misconfigurations. As organizations increasingly rely on SaaS solutions like Salesforce, ensuring proper configuration and access controls is paramount to prevent unauthorized data access and potential breaches.
5 months ago
Kill Chain
Windows Zero-Day Vulnerabilities: Immediate Action Required
In early April 2026, a security researcher known as "Chaotic Eclipse" publicly disclosed proof-of-concept exploits for three Windows vulnerabilities: BlueHammer, RedSun, and UnDefend. These vulnerabilities, primarily affecting Microsoft Defender, enable local privilege escalation and the ability to block Defender updates. Shortly after disclosure, threat actors began exploiting these zero-days in the wild, with incidents reported as early as April 10. Microsoft has since patched BlueHammer (CVE-2026-33825) in the April 2026 security updates; however, RedSun and UnDefend remain unpatched, leaving systems vulnerable to attacks that can grant SYSTEM-level access or disable critical security updates. The rapid exploitation of these vulnerabilities underscores the critical importance of timely patch management and the risks associated with delayed disclosures. Organizations must remain vigilant, ensuring that security measures are up-to-date and that they have incident response plans in place to address potential breaches resulting from unpatched vulnerabilities.
5 months ago
Kill Chain
Payouts King Ransomware Exploits QEMU VMs to Evade Detection
In April 2026, the Payouts King ransomware group employed QEMU virtual machines (VMs) to evade endpoint security measures. By deploying hidden Alpine Linux VMs on compromised systems, they executed malicious payloads and established covert SSH tunnels, effectively bypassing host-based defenses. Initial access was gained through exposed SonicWall VPNs and exploitation of the SolarWinds Web Help Desk vulnerability (CVE-2025-26399). The attackers utilized tools like AdaptixC2, Chisel, BusyBox, and Rclone within the VMs to facilitate their operations. This incident underscores a growing trend where threat actors leverage virtualization technologies to circumvent traditional security controls. The use of QEMU VMs for stealthy operations highlights the need for enhanced monitoring and security measures that can detect and mitigate such sophisticated attack vectors.
5 months ago
Kill Chain
Operation PowerOFF Dismantles 53 DDoS-for-Hire Domains, Exposes 3 Million Criminal Accounts
In April 2026, an international law enforcement operation known as Operation PowerOFF targeted the DDoS-for-hire ecosystem across 21 countries. Authorities seized 53 domains, arrested four individuals, and identified over 75,000 users involved in launching DDoS attacks. The operation disrupted booter services and dismantled infrastructure, including servers and databases, that supported these illicit activities. ([cyberscoop.com](https://cyberscoop.com/ddos-for-hire-takedowns-operation-poweroff/?utm_source=openai)) This crackdown underscores the persistent threat posed by DDoS-for-hire services, which enable individuals with minimal technical expertise to launch significant cyberattacks. The operation highlights the necessity for continuous vigilance and international cooperation to combat evolving cyber threats. ([cyberscoop.com](https://cyberscoop.com/ddos-for-hire-takedowns-operation-poweroff/?utm_source=openai))
5 months ago
Kill Chain
Jaguar Land Rover Cyberattack August 2025: A Comprehensive Analysis
In late August 2025, Jaguar Land Rover (JLR), the UK's largest automotive manufacturer, experienced a significant cyberattack that severely disrupted its operations. The attack, attributed to the cybercriminal group 'Scattered Lapsus$ Hunters,' led to a complete shutdown of JLR's production facilities across the UK, Slovakia, China, India, and Brazil. The company halted production on September 1, 2025, and the disruption extended for over five weeks, with operations resuming in mid-October. This incident resulted in substantial financial losses, with JLR reporting nearly £200 million in direct costs and a 43% decline in vehicle output during the affected period. The attack also had a cascading effect on the broader automotive supply chain, leading to layoffs and economic repercussions across the sector. ([computerweekly.com](https://www.computerweekly.com/news/366630592/Jaguar-Land-Rover-admits-data-has-been-compromised-in-cyber-attack?utm_source=openai)) This incident underscores the escalating threat of ransomware attacks targeting critical infrastructure and large-scale manufacturing operations. The JLR cyberattack highlights the vulnerabilities within interconnected supply chains and the potential for significant economic impact resulting from such breaches. It serves as a stark reminder for organizations to bolster their cybersecurity measures, particularly in the face of increasingly sophisticated cyber threats.
5 months ago
Kill Chain
Critical Nginx UI Vulnerability (CVE-2026-33032) Exposes Servers to Unauthenticated Takeover
In March 2026, a critical vulnerability (CVE-2026-33032) was discovered in Nginx UI versions 2.3.5 and prior, allowing unauthenticated remote attackers to gain full control over Nginx servers. The flaw resides in the /mcp_message endpoint, which lacks proper authentication and, due to an empty default IP whitelist, permits unrestricted access. Exploitation enables attackers to restart Nginx, modify configuration files, and trigger automatic reloads, leading to complete service takeover. ([nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2026-33032?utm_source=openai)) This incident underscores the importance of securing administrative interfaces and implementing robust authentication mechanisms. Organizations using Nginx UI should urgently update to version 2.3.6 or later to mitigate this risk. ([noise.getoto.net](https://noise.getoto.net/2026/04/16/cve-2026-33032-nginx-ui-missing-mcp-authentication/?utm_source=openai))
5 months ago
Kill Chain
North Korea's Sapphire Sleet Exploits ClickFix to Target macOS Users
In April 2026, the North Korean state-sponsored group Sapphire Sleet launched a sophisticated cyber campaign targeting macOS users. Utilizing the 'ClickFix' social engineering technique, attackers posed as recruiters on professional networking platforms, engaging victims with fake job offers. They directed targets to install a malicious 'Zoom SDK Update.scpt' file, which, when executed, initiated a multi-stage payload chain. This chain included credential harvesters, data stealers targeting wallets and keychains, and backdoors for persistence. Notably, the malware bypassed Apple's Transparency, Consent, and Control (TCC) security framework, allowing unauthorized actions without user prompts. The campaign resulted in significant data exfiltration and potential financial losses for affected individuals and organizations. ([darkreading.com](https://www.darkreading.com/application-security/north-korea-clickfix-target-macos-users-data/?utm_source=openai)) This incident underscores the evolving tactics of nation-state actors in targeting macOS platforms, highlighting the need for heightened vigilance against social engineering attacks and the importance of robust endpoint security measures.
5 months ago
Kill Chain
Understanding CVE-2026-26144: The Zero-Click XSS Vulnerability in Microsoft Excel
In March 2026, Microsoft disclosed CVE-2026-26144, a critical cross-site scripting (XSS) vulnerability in Excel. This flaw allows attackers to embed malicious scripts within Excel files, which, when processed by the Copilot Agent, can autonomously exfiltrate data to external servers without user interaction. The vulnerability affects Microsoft 365 Apps for Enterprise versions 16.0.1 and below, posing significant risks to organizations relying on Excel for sensitive data management. ([system.plus](https://system.plus/2026/03/12/zero-click-microsoft-copilot-bug-cve-2026-26144/?utm_source=openai)) The incident underscores the evolving threat landscape where AI integrations can amplify traditional vulnerabilities, leading to zero-click exploits. Organizations must reassess their security postures, especially concerning AI-enabled applications, to mitigate such risks effectively.
5 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports