The breach isn’t the problem. The spread is. →The breach isn’t the problem. The spread is. →Measure in 5 min. Free AssessmentFree Assessment
Information Technology/IT
Breach intelligence, attack campaigns, and threat reports targeting the Information Technology/IT sector.
Explore Other Sectors
Information Technology/IT Threat Reports
New macOS Malware Campaign Exploits Script Editor in ClickFix Attack
In April 2026, a new macOS malware campaign emerged, leveraging the Script Editor application to deliver the Atomic Stealer (AMOS) malware. Attackers employed a variation of the ClickFix technique, directing users to malicious websites that prompted them to open Script Editor via the 'applescript://' URL scheme. This method executed obfuscated commands to download and run AMOS, which exfiltrated sensitive data including Keychain information, browser credentials, and cryptocurrency wallets. This incident underscores the evolving tactics of threat actors targeting macOS systems, particularly through trusted applications like Script Editor. The shift from Terminal-based to Script Editor-based ClickFix attacks highlights the need for continuous vigilance and user education to recognize and avoid such sophisticated social engineering schemes.
5 months ago
Kill Chain
Hims & Hers Data Breach: Lessons in Third-Party Security
In early February 2026, telehealth company Hims & Hers Health experienced a data breach when unauthorized individuals accessed support tickets through their third-party customer service platform, Zendesk. The breach, occurring between February 4 and February 7, exposed personal information such as names and contact details of customers. Importantly, no medical records or doctor communications were compromised. The company promptly secured the platform and initiated an investigation upon discovering the suspicious activity on February 5. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/hims-and-hers-warns-of-data-breach-after-zendesk-support-ticket-breach/?utm_source=openai)) This incident underscores the vulnerabilities associated with third-party service providers and the critical need for robust security measures. As cyber threats targeting support systems increase, organizations must enhance their security protocols to protect sensitive customer data and maintain trust.
5 months ago
Kill Chain
North Korean Hackers Deploy 1,700 Malicious Packages in Unprecedented Supply Chain Attack
In early April 2026, North Korean state-sponsored hackers, identified as the Contagious Interview group, executed a sophisticated supply chain attack by publishing over 1,700 malicious packages across multiple open-source ecosystems, including npm, PyPI, Go, Rust, and PHP. These packages impersonated legitimate developer tools but functioned as malware loaders, deploying platform-specific payloads capable of data theft and remote access. The attack underscores the persistent threat to software supply chains and the need for vigilant security practices among developers and organizations. ([thehackernews.com](https://thehackernews.com/2026/04/n-korean-hackers-spread-1700-malicious.html?utm_source=openai)) This incident highlights a concerning trend of state-sponsored actors targeting open-source ecosystems to infiltrate developer environments. The scale and coordination of this attack demonstrate the evolving tactics of threat actors and the critical importance of securing software supply chains to prevent widespread compromise.
5 months ago
Kill Chain
APT28's PRISMEX Malware Campaign: A 2026 Cyber-Espionage Threat
In early 2026, the Russian state-sponsored group APT28 (also known as Fancy Bear and Pawn Storm) initiated a sophisticated cyber-espionage campaign targeting Ukraine and its NATO allies. The operation employed a newly developed malware suite named PRISMEX, which utilizes advanced steganography, Component Object Model (COM) hijacking, and the exploitation of legitimate cloud services for command-and-control (C2) communications. The campaign began in September 2025 and intensified in January 2026, focusing on sectors such as defense, emergency services, and logistics across multiple countries, including Poland, Romania, Slovenia, Turkey, Slovakia, and the Czech Republic. ([thehackernews.com](https://thehackernews.com/2026/04/apt28-deploys-prismex-malware-in.html?utm_source=openai)) This campaign underscores the rapid weaponization of newly disclosed vulnerabilities by APT28, notably CVE-2026-21509 and CVE-2026-21513, to infiltrate target systems. The use of PRISMEX highlights a strategic shift towards more covert and resilient attack methodologies, posing significant challenges for detection and mitigation. ([thehackernews.com](https://thehackernews.com/2026/04/apt28-deploys-prismex-malware-in.html?utm_source=openai))
5 months ago
Kill Chain
Anthropic's Claude Mythos AI Model Uncovers Critical Software Vulnerabilities
In April 2026, Anthropic unveiled its advanced AI model, Claude Mythos, which autonomously identified thousands of high-severity vulnerabilities across major operating systems and web browsers. This unprecedented capability led to the launch of Project Glasswing, a collaborative initiative with tech giants like Amazon, Apple, and Microsoft, aiming to address these security flaws before potential exploitation. The discovery of such extensive vulnerabilities underscores the critical need for proactive cybersecurity measures in the face of rapidly advancing AI technologies. As AI models become more sophisticated, they present both opportunities for enhancing security and risks of being weaponized by malicious actors. Organizations must stay vigilant and adapt their defenses to counteract these evolving threats.
5 months ago
Kill Chain
Chaos Malware's New Variant Exploits Cloud Misconfigurations in 2026
In March 2026, cybersecurity researchers identified a new variant of the Chaos malware targeting misconfigured cloud deployments, particularly 64-bit Linux servers. Previously known for compromising routers and edge devices, this evolution signifies a strategic shift by attackers to exploit cloud infrastructure vulnerabilities. The malware gains access through misconfigurations, establishes persistence via systemd services, and introduces a SOCKS5 proxy feature, enabling attackers to route malicious traffic through compromised servers. This development underscores the critical need for organizations to secure cloud environments against evolving threats. The inclusion of proxy capabilities in Chaos malware reflects a broader trend of botnets expanding functionalities beyond traditional DDoS attacks, facilitating more complex cybercriminal activities. This shift highlights the importance of robust security configurations and continuous monitoring in cloud deployments to mitigate emerging risks.
5 months ago
Kill Chain
GrafanaGhost: Unveiling the AI Vulnerability Exposing Enterprise Data
In April 2026, a critical vulnerability named 'GrafanaGhost' was discovered in Grafana's AI components, allowing attackers to exfiltrate sensitive enterprise data through indirect prompt injection. By embedding malicious instructions within external web content, attackers could manipulate Grafana's AI to process these prompts as legitimate, leading to unauthorized data exposure without user interaction. This flaw was promptly patched by Grafana following responsible disclosure. The GrafanaGhost incident underscores the growing risks associated with integrating AI into enterprise systems. It highlights the necessity for robust security measures to prevent AI-specific vulnerabilities, as attackers increasingly exploit such weaknesses to access sensitive information.
5 months ago
Kill Chain
Understanding the Rise of Web Shell Attacks in 2026
In early 2026, a significant surge in web shell attacks was observed, targeting vulnerabilities in web servers and applications. Attackers exploited these weaknesses to deploy malicious scripts, enabling remote control over compromised systems. This escalation led to unauthorized data access, service disruptions, and substantial financial losses for affected organizations. The rapid deployment and stealthy nature of web shells posed significant challenges to traditional security measures. ([microsoft.com](https://www.microsoft.com/en-us/security/blog/2026/04/02/cookie-controlled-php-webshells-tradecraft-linux-hosting-environments/?utm_source=openai)) This trend underscores the evolving tactics of cyber adversaries, emphasizing the need for enhanced monitoring and proactive defense strategies. Organizations must prioritize the detection and mitigation of web shell threats to safeguard their digital assets and maintain operational integrity.
5 months ago
Kill Chain
AI-Driven Ransomware Attack 2026: Lessons Learned
In early 2026, a sophisticated AI-driven ransomware attack targeted multiple organizations, exploiting vulnerabilities in AI systems to gain unauthorized access. The attackers utilized autonomous AI agents to conduct reconnaissance, escalate privileges, and deploy ransomware, significantly reducing the time from initial breach to full system encryption. This rapid progression left organizations with minimal time to detect and respond, resulting in substantial operational disruptions and financial losses. This incident underscores the escalating threat posed by AI-enhanced cyberattacks, highlighting the need for organizations to adopt advanced, AI-driven defense mechanisms. The convergence of AI and cybercrime necessitates a proactive approach to cybersecurity, emphasizing rapid detection, response, and recovery strategies to mitigate the impact of such attacks.
5 months ago
Kill Chain
LiteLLM Supply Chain Compromise: A Wake-Up Call for Open-Source Security
In March 2026, the LiteLLM Python package, widely used for routing large language model (LLM) API calls, was compromised through a supply chain attack. Malicious versions 1.82.7 and 1.82.8 were uploaded to the Python Package Index (PyPI) after attackers gained access to the maintainer's credentials via a compromised Trivy security scanner in LiteLLM's CI/CD pipeline. These versions contained a credential-stealing payload that executed automatically on Python startup, exfiltrating sensitive information such as SSH keys, cloud provider credentials, and Kubernetes secrets to an attacker-controlled server. The malicious packages were available for approximately three hours before being removed from PyPI. ([snyk.io](https://snyk.io/blog/poisoned-security-scanner-backdooring-litellm/?utm_source=openai)) This incident underscores the escalating threat of supply chain attacks targeting open-source ecosystems. The rapid propagation of malicious code through widely used packages highlights the need for enhanced security measures in software development pipelines, including stringent credential management, regular security audits, and the implementation of tools like Software Bill of Materials (SBOMs) and SigStore for verifying package integrity. ([ionix.io](https://www.ionix.io/threat-center/litellm-supply-chain-compromise-backdoored-pypi-packages-1-82-7-1-82-8/?utm_source=openai))
5 months ago
Kill Chain
FBI's 2025 Internet Crime Report: A 26% Surge in Cybercrime Losses
In 2025, the FBI's Internet Crime Complaint Center (IC3) reported a significant surge in cybercrime, with total losses reaching $20.9 billion—a 26% increase from the previous year. The center received over one million complaints, marking a 17% rise compared to 2024. Investment-related fraud led to losses of nearly $8.65 billion, while business email compromise accounted for almost $3.05 billion. Phishing remained the most reported cybercrime, followed by extortion and personal data breaches. ([cyberscoop.com](https://cyberscoop.com/fbi-internet-crime-complaint-center-annual-cybercrime-report/?utm_source=openai)) This escalation underscores the growing sophistication of cybercriminals, who are increasingly leveraging artificial intelligence to enhance their attacks. The trend highlights the urgent need for organizations to bolster their cybersecurity measures and stay vigilant against evolving threats. ([forbes.com](https://www.forbes.com/sites/timkeary/2026/04/07/fbi-reports-208-billion-lost-to-cybercrime-as-hackers-turn-to-ai/?utm_source=openai))
5 months ago
Kill Chain
Anthropic's Project Glasswing: Revolutionizing Cybersecurity with AI
In April 2026, Anthropic launched Project Glasswing, a collaborative initiative with major technology companies including Amazon, Apple, Microsoft, and Cisco, to enhance cybersecurity defenses using advanced AI. Central to this project is Claude Mythos Preview, an unreleased AI model that has identified thousands of previously undetected vulnerabilities across critical software systems, including a 27-year-old bug in OpenBSD and a 16-year-old flaw in FFmpeg. To mitigate potential misuse, Anthropic has restricted access to this powerful model to select partners and has committed significant resources to support open-source security organizations. ([anthropic.com](https://www.anthropic.com/project/glasswing?utm_source=openai)) This initiative underscores the growing importance of AI in cybersecurity, highlighting both its potential to fortify defenses and the risks associated with its misuse. As AI capabilities advance, the industry faces the dual challenge of leveraging these tools for protection while preventing their exploitation by malicious actors. ([cyberscoop.com](https://cyberscoop.com/project-glasswing-anthropic-ai-open-source-software-vulnerabilities/?utm_source=openai))
5 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports