Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Information Technology/IT

Breach intelligence, attack campaigns, and threat reports targeting the Information Technology/IT sector.

3786 threat reports
Page 139 of 316
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Information Technology/IT Threat Reports

Showing 1657–1668 / 3786 reports
DentaQuest Data Breach 2026: ShinyHunters Expose 2.6 Million Records
Health Care / Life Sciences5 months ago

DentaQuest Data Breach 2026: ShinyHunters Expose 2.6 Million Records

In May 2026, DentaQuest, a leading dental benefits administrator in the United States, experienced a significant data breach orchestrated by the cybercriminal group ShinyHunters. The attackers infiltrated DentaQuest's network, exfiltrating over 234 GB of sensitive data, which included personal information of approximately 2.6 million individuals. The compromised data encompassed email addresses, full names, phone numbers, government-issued IDs, health insurance details, genders, and dates of birth. Following unsuccessful ransom negotiations, ShinyHunters publicly released the stolen data, amplifying the potential for identity theft and fraud among affected individuals. This incident underscores a troubling trend of cyber extortion targeting healthcare organizations, highlighting the critical need for robust cybersecurity measures and rapid incident response protocols to protect sensitive patient information.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Supply Chain Attack on Hola Browser Leads to Cryptominer Distribution
Computer Software/Engineering5 months ago

Supply Chain Attack on Hola Browser Leads to Cryptominer Distribution

In June 2026, the Windows version of the Hola Browser was compromised through a supply chain attack, leading to the distribution of an unauthorized executable identified as a cryptocurrency miner. This incident was uncovered during routine certification checks by AppEsteem, revealing that the compromised software installed an undeclared file named 'me.exe' in the 'C:\Program Files\Hola\' directory. Further analysis confirmed that this file was a Monero cryptocurrency miner, which added a Windows Defender exclusion rule, copied itself as 'HolaMonitorService.exe,' created an auto-starting Windows service named 'hola_monitor_svc,' and operated when the computer was idle. Hola's CEO, Avi Raz Cohen, acknowledged the breach, stating that approximately 0.1% of users were affected, with no evidence of user data access or theft. In response, Hola rebuilt its distribution pipeline, implemented advanced code-signing verification, and introduced stricter access controls and continuous monitoring across its infrastructure. This incident underscores the persistent threat of supply chain attacks targeting widely used software applications. The compromise of Hola Browser highlights the importance of rigorous security measures in software distribution channels to prevent unauthorized code insertion. Organizations and individual users must remain vigilant, ensuring that software updates and installations come from verified sources and are subjected to thorough security assessments to mitigate the risks associated with such attacks.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(low)
IImpact(high)
Read report
SideCopy's Xeno RAT Attack on Afghan Finance Ministry: A Case Study
Government Administration5 months ago

SideCopy's Xeno RAT Attack on Afghan Finance Ministry: A Case Study

In May 2025, the Pakistan-linked APT group SideCopy initiated a cyberespionage campaign targeting Afghanistan's Ministry of Finance and provincial finance offices. The attackers employed spear-phishing emails containing ZIP archives with malicious LNK files disguised as PDFs. These files, when executed, utilized mshta.exe to fetch an HTA payload from a compromised Afghan education domain, leading to the deployment of Xeno RAT 1.8.7. This malware enabled remote command execution, data exfiltration, and system monitoring, including keystroke logging and screenshot capture. The campaign demonstrated a deliberate approach to defense evasion by leveraging Pashto-language lures and hosting payloads on Afghan government infrastructure to blend malicious traffic with legitimate state communications. ([darkreading.com](https://www.darkreading.com/cyberattacks-data-breaches/pakistan-spies-afghan-finance-ministry-xeno-rat?utm_source=openai)) This incident underscores the persistent threat posed by nation-state actors employing sophisticated social engineering tactics and leveraging local infrastructure to conduct espionage. Organizations, especially governmental entities, must enhance their cybersecurity posture by implementing robust email filtering, user education on phishing threats, and continuous monitoring for indicators of compromise to mitigate such risks.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Prolonged Espionage: Hackers Exploit Stock Exchange Executive's Outlook Mailbox
Capital Markets/Hedge Fund/Private Equity5 months ago

Prolonged Espionage: Hackers Exploit Stock Exchange Executive's Outlook Mailbox

Between October 2025 and March 2026, attackers infiltrated the Outlook mailbox of a senior executive at a major global stock exchange, maintaining undetected access for approximately 150 days. They exfiltrated sensitive data in small, incremental batches using legitimate cloud services like Dropbox and OneDrive, effectively blending malicious activity with normal network traffic. The attackers employed malware disguised as trusted software components and utilized scheduled tasks for persistence, enabling continuous monitoring and extraction of confidential communications, schedules, and potentially market-moving information. ([securityweek.com](https://www.securityweek.com/hackers-target-global-stock-exchange-in-espionage-operation/?utm_source=openai)) This incident underscores the increasing sophistication of cyber-espionage campaigns targeting high-level executives to access sensitive organizational data. The use of legitimate cloud services for data exfiltration highlights the challenges in detecting such stealthy operations, emphasizing the need for enhanced monitoring and security measures to protect executive communications. ([cyberleveling.com](https://cyberleveling.com/blog/stock-exchange-espionage-executive-email-2026?utm_source=openai))

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Beware: Fake Open-Source Tool Sites Spreading Malware via TDS
Computer Software/Engineering5 months ago

Beware: Fake Open-Source Tool Sites Spreading Malware via TDS

In June 2026, cybersecurity researchers identified a large-scale campaign where threat actors created counterfeit websites mimicking popular open-source and freeware tools such as Ghidra, dnSpy, and SpiderFoot. These deceptive sites, designed to appear legitimate, employed a Traffic Distribution System (TDS) to redirect users to malicious payloads, including Remus Stealer, AnimateClipper, and the SessionGate framework. The attackers utilized search engine optimization (SEO) techniques to rank these fake sites prominently on search engines like Google, increasing the likelihood of user engagement and subsequent malware infections. This incident underscores a growing trend where cybercriminals exploit SEO and TDS mechanisms to distribute malware through seemingly trustworthy channels. The sophistication of these attacks highlights the need for heightened vigilance among users and organizations, emphasizing the importance of verifying the authenticity of software download sources to mitigate the risk of malware infections.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Operation FlutterBridge: Unveiling the FlutterShell Backdoor Targeting macOS Users
Marketing/Advertising/Sales5 months ago

Operation FlutterBridge: Unveiling the FlutterShell Backdoor Targeting macOS Users

In June 2026, cybersecurity researchers identified 'Operation FlutterBridge,' a sophisticated malvertising campaign targeting macOS users. This operation distributes a new backdoor named 'FlutterShell,' built using Google's Flutter framework. The campaign employs malicious Google and YouTube advertisements to lure users into downloading seemingly legitimate desktop applications, which, upon execution, install FlutterShell. This malware combines adware functionalities with backdoor capabilities, including shell command execution and file system manipulation. Some variants also exploit AI summarization features for data exfiltration by routing documents through attacker-controlled servers. The campaign is linked to the cybercrime group CL-CRI-1089, previously associated with the JSCoreRunner campaign detected in August 2025. ([unit42.paloaltonetworks.com](https://unit42.paloaltonetworks.com/flutterbridge-new-fluttershell-backdoor/?utm_source=openai)) The use of the Flutter framework in malware development is notable, as it allows attackers to dynamically alter the malware's behavior without recompiling or redistributing the application. This adaptability, combined with the extensive reach of malvertising through trusted platforms like Google and YouTube, underscores the evolving sophistication of cyber threats targeting macOS systems. ([unit42.paloaltonetworks.com](https://unit42.paloaltonetworks.com/flutterbridge-new-fluttershell-backdoor/?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Critical Vulnerability in NAVTOR NavBox Exposes Maritime Operational Data
Maritime5 months ago

Critical Vulnerability in NAVTOR NavBox Exposes Maritime Operational Data

In March 2026, a critical vulnerability (CVE-2026-2754) was identified in NAVTOR's NavBox version 4.12.0.3, a maritime connectivity device widely used for managing navigation data and ship-shore communications. The flaw allowed unauthenticated remote attackers to access sensitive configuration and operational data through exposed HTTP API endpoints on TCP port 8080. Exploitation of this vulnerability could lead to unauthorized retrieval of internal network parameters, including ECDIS and OT information, device identifiers, and service status logs, posing significant risks to vessel operations and security. This incident underscores the growing cybersecurity challenges in the maritime industry, especially as operational technology systems become increasingly interconnected. The exposure of critical navigation and operational data highlights the urgent need for robust security measures and regular vulnerability assessments to protect against potential cyber threats targeting maritime infrastructure.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Critical Vulnerability in Claude Code GitHub Action Leads to Repository Hijacking
Computer Software/Engineering5 months ago

Critical Vulnerability in Claude Code GitHub Action Leads to Repository Hijacking

In June 2026, a critical vulnerability was discovered in Anthropic's Claude Code GitHub Action, allowing attackers to hijack public repositories by exploiting a flaw in the action's workflow permissions. By opening a malicious GitHub issue, attackers could execute arbitrary code, potentially compromising the integrity of affected repositories and their downstream projects. This vulnerability was promptly addressed by Anthropic with the release of claude-code-action v1.0.94. This incident underscores the escalating risks associated with supply chain attacks in software development, particularly those leveraging continuous integration and deployment (CI/CD) pipelines. Organizations must remain vigilant, regularly updating their CI/CD tools and scrutinizing third-party actions to mitigate such vulnerabilities.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Introducing WasmForge: Revolutionizing Offensive Security with WebAssembly
Computer/Network Security5 months ago

Introducing WasmForge: Revolutionizing Offensive Security with WebAssembly

In June 2026, Praetorian introduced WasmForge, a tool designed to compile Go-based offensive security tools like Sliver into WebAssembly (WASM). This approach enables the creation of binaries that can evade traditional Endpoint Detection and Response (EDR) systems by disguising the tool's signature and behavior. WasmForge achieves this by embedding the WASM module into a Go binary, which acts as a loader, effectively obfuscating the tool's presence and functionality. The release of WasmForge highlights a significant advancement in offensive security methodologies, emphasizing the continuous evolution of evasion techniques. This development underscores the necessity for defensive strategies to adapt rapidly, as threat actors increasingly leverage sophisticated tools to bypass conventional security measures.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
Unveiling 'Otto Support': A Deep Dive into MCP Server Security Flaws
Computer Software/Engineering5 months ago

Unveiling 'Otto Support': A Deep Dive into MCP Server Security Flaws

In April 2026, Bishop Fox released 'Otto Support,' a deliberately vulnerable Model Context Protocol (MCP) server designed to expose security flaws in AI agent integrations. This tool demonstrated how AI agents could exploit misconfigurations to escalate privileges and access sensitive data, highlighting critical vulnerabilities in MCP implementations. The project underscored the necessity for robust authentication, authorization, and input validation controls in AI systems. The release of 'Otto Support' is particularly relevant now, as the rapid adoption of AI agents has outpaced the implementation of essential security measures. This initiative serves as a crucial reminder for organizations to proactively assess and fortify their AI infrastructures against emerging threats.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Critical VS Code Zero-Day Exposes GitHub Repositories
Computer Software/Engineering5 months ago

Critical VS Code Zero-Day Exposes GitHub Repositories

In June 2026, security researcher Ammar Askar disclosed a zero-day vulnerability in Visual Studio Code (VS Code) that enables attackers to steal GitHub OAuth tokens by tricking users into clicking a malicious link. The exploit leverages VS Code's sandboxed webview message-passing system to install malicious extensions, allowing unauthorized access to all private repositories accessible by the victim. This vulnerability remains unpatched, posing a significant risk to developers and organizations relying on VS Code for GitHub repository management. The disclosure underscores the critical need for vigilance in software supply chains, especially concerning widely used development tools. As similar supply chain attacks increase, organizations must implement robust security measures, including regular audits of development environments and cautious evaluation of third-party extensions, to mitigate potential threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Critical Vulnerabilities in Acer Wave 7 Routers: CVE-2026-49200 and CVE-2026-49201
Telecommunications5 months ago

Critical Vulnerabilities in Acer Wave 7 Routers: CVE-2026-49200 and CVE-2026-49201

In May 2026, security researcher Gergo Pap identified two critical vulnerabilities in Acer's Wave 7 mesh routers running firmware version T7c_GBL_1.01.000055 or earlier. The first vulnerability (CVE-2026-49200) allows unauthenticated remote access to the 'acer_cgi.log' file via the web interface, exposing cleartext login credentials and enabling unauthorized system access. The second vulnerability (CVE-2026-49201) involves a hardcoded AES encryption key in the 'upload.cgi' binary, permitting attackers to decrypt, modify, and re-encrypt system backups, potentially injecting persistent backdoors into the router. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/acer-warns-of-max-severity-zero-days-affecting-wave-7-routers/?utm_source=openai)) These vulnerabilities underscore the critical importance of securing network infrastructure devices, as they can serve as entry points for attackers to infiltrate organizational networks. The incident highlights the necessity for manufacturers to implement robust security measures, including proper access controls and secure cryptographic practices, to prevent such exposures.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports