Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Information Technology/IT

Breach intelligence, attack campaigns, and threat reports targeting the Information Technology/IT sector.

3786 threat reports
Page 143 of 316
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Information Technology/IT Threat Reports

Showing 1705–1716 / 3786 reports
Google Chrome's New DBSC Feature: A Leap Forward in Browser Security
Banking/Mortgage5 months ago

Google Chrome's New DBSC Feature: A Leap Forward in Browser Security

In May 2026, Google announced the general availability of Device Bound Session Credentials (DBSC) in Chrome, a security feature designed to prevent session cookie theft. DBSC cryptographically binds session cookies to a user's device using hardware-backed security modules like the Trusted Platform Module (TPM) on Windows and the Secure Enclave on macOS. This binding ensures that even if session cookies are exfiltrated, they cannot be used on unauthorized devices, thereby mitigating risks associated with session hijacking and account takeovers. ([developer.chrome.com](https://developer.chrome.com/docs/web-platform/device-bound-session-credentials?hl=en&utm_source=openai)) The introduction of DBSC addresses the growing threat posed by infostealer malware, which has been increasingly used to extract session cookies and bypass multi-factor authentication. By implementing DBSC, Google enhances user security by proactively preventing unauthorized access through stolen session cookies, marking a significant advancement in browser security measures. ([techradar.com](https://www.techradar.com/pro/security/google-chrome-rolls-out-a-new-tool-to-try-and-stop-infostealer-malware-in-its-tracks?utm_source=openai))

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Charter Communications Data Breach 2026: A Case Study in Social Engineering Attacks
Telecommunications5 months ago

Charter Communications Data Breach 2026: A Case Study in Social Engineering Attacks

In early April 2026, Charter Communications, a major U.S. telecommunications provider, experienced a significant data breach orchestrated by the cybercriminal group ShinyHunters. The attackers gained access through a voice phishing (vishing) attack that compromised an employee's Microsoft Entra account, allowing them to infiltrate Charter's Salesforce system. This breach resulted in the exfiltration of personal information from approximately 4.9 million accounts, including names, email addresses, physical addresses, phone numbers, phone types, plan information, support ticket data, and some Customer Proprietary Network Information (CPNI). Charter confirmed the breach but stated that no sensitive personal or CPNI data was exfiltrated. After the company refused to pay the ransom demanded by ShinyHunters, the stolen data was leaked on the dark web. This incident underscores the growing threat posed by sophisticated social engineering attacks targeting employee credentials to access sensitive corporate systems. The breach highlights the critical need for robust security measures, including comprehensive employee training on phishing tactics and the implementation of multi-factor authentication, to prevent unauthorized access and protect customer data.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(high)
IImpact(high)
Read report
Google Engineer Charged with Insider Trading on Polymarket
Information Technology/IT5 months ago

Google Engineer Charged with Insider Trading on Polymarket

In May 2026, Michele Spagnuolo, a 36-year-old Google security engineer, was charged with insider trading after allegedly using confidential company data to place bets on the cryptocurrency-based prediction platform Polymarket, resulting in $1.2 million in gains. Spagnuolo accessed internal Google tools containing nonpublic search trend data and, under the alias "AlphaRaccoon," placed bets on Polymarket regarding Google's top trending search terms for 2025. His actions led to charges including commodities fraud, wire fraud, and money laundering, with potential prison sentences ranging from 10 to 20 years if convicted. This incident underscores the growing concerns over the misuse of proprietary information in emerging financial platforms like prediction markets. It highlights the need for robust internal controls and monitoring mechanisms to prevent insider trading and protect the integrity of both corporate data and financial markets.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Dutch Authorities Dismantle Massive 17 Million-Device Botnet
Telecommunications5 months ago

Dutch Authorities Dismantle Massive 17 Million-Device Botnet

In May 2026, Dutch authorities dismantled a massive botnet comprising 17 million infected devices, including computers, tablets, and smartphones. The operation involved seizing over 200 servers located in the Netherlands that controlled the botnet's infrastructure. This network was utilized for various cyberattacks, such as distributed denial-of-service (DDoS) attacks and malicious traffic proxying. The botnet was linked to a service called Asocks, which offered proxy services using compromised devices without the owners' knowledge. This incident underscores the growing threat posed by botnets leveraging residential devices, highlighting the need for enhanced security measures to protect consumer hardware from unauthorized exploitation.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Addressing Container Security Vulnerabilities: Insights from 2026
Information Technology/IT5 months ago

Addressing Container Security Vulnerabilities: Insights from 2026

In 2026, Kaspersky's research highlighted significant security vulnerabilities within containerized environments, emphasizing the risks associated with outdated software, misconfigurations, and the use of untrusted images. The study revealed that 64 out of 100 analyzed Docker images contained critical vulnerabilities, with only 10% being fully up to date. These vulnerabilities expose organizations to potential attacks, including unauthorized access, data breaches, and system compromises. The findings underscore the necessity for organizations to implement robust security measures, such as regular updates, thorough configuration audits, and the use of trusted container images, to safeguard their containerized infrastructures.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Exploitation of ChatGPT Share Links for Malware Distribution
Computer Software/Engineering5 months ago

Exploitation of ChatGPT Share Links for Malware Distribution

In May 2026, threat actors exploited ChatGPT's content-sharing feature to distribute malware. They created fake outage messages on legitimate ChatGPT URLs, prompting users to download a malicious desktop application. This campaign, known as 'LLMShare,' utilized Google ads to direct users to these deceptive pages, leveraging the trust associated with OpenAI's domain. Upon clicking the download link, users were redirected to a counterfeit OpenAI download portal, delivering malware for both Windows and macOS systems. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/chatgpt-share-links-abused-to-host-fake-outage-pages-to-deliver-malware/?utm_source=openai)) This incident underscores a growing trend where attackers abuse trusted AI platforms to disseminate malware. The use of legitimate domains and sophisticated social engineering tactics highlights the need for heightened vigilance and user education to prevent such deceptive attacks.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
California Attorney General Sues 23andMe Over 2023 Data Breach
Health Care / Life Sciences5 months ago

California Attorney General Sues 23andMe Over 2023 Data Breach

In October 2023, genetic testing company 23andMe experienced a significant data breach affecting approximately 6.9 million users, including 855,541 Californians. Attackers exploited reused passwords through a credential-stuffing attack, initially compromising around 14,000 accounts. Due to the interconnected nature of 23andMe's 'DNA Relatives' feature, the breach expanded, exposing sensitive genetic and personal information such as ancestry reports, health predispositions, and DNA matches. The company faced multiple lawsuits and regulatory fines, ultimately filing for bankruptcy in March 2025. In May 2026, California Attorney General Rob Bonta filed a lawsuit against 23andMe, now known as Chrome Holding Co., alleging failure to implement reasonable safeguards against credential-stuffing attacks and misleading public statements regarding the breach. This incident underscores the critical importance of robust cybersecurity measures, especially in handling sensitive genetic data. The rise in credential-stuffing attacks highlights the need for organizations to enforce strong password policies and multi-factor authentication to protect user information.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(high)
IImpact(high)
Read report
Dutch Authorities' Raid on Russian Bulletproof Host Fails to Disrupt Cyber Activities
Utilities5 months ago

Dutch Authorities' Raid on Russian Bulletproof Host Fails to Disrupt Cyber Activities

In May 2026, Dutch authorities seized over 800 servers and arrested two individuals associated with THE.Hosting, a bulletproof hosting service linked to Russian cybercriminal activities. Despite these efforts, the network's malicious operations, including broad scanning and botnet-building, continued largely unaffected due to the resilience of its infrastructure and the retention of its core IP address space. ([darkreading.com](https://www.darkreading.com/cyber-risk/dutch-raid-russian-bulletproof-host?utm_source=openai)) This incident underscores the challenges law enforcement faces in disrupting sophisticated cybercriminal networks that can rapidly adapt and reconstitute their operations, highlighting the need for coordinated international efforts and more comprehensive strategies to effectively combat such threats.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(high)
Read report
Zapier Exploit Chain Reveals Critical Cloud Security Vulnerabilities
Computer Software/Engineering5 months ago

Zapier Exploit Chain Reveals Critical Cloud Security Vulnerabilities

In May 2026, researchers from Token Security identified a critical vulnerability in Zapier's platform, demonstrating how a series of misconfigurations and over-permissioned roles could lead to a full platform takeover. The exploit chain began with the ability to execute code within Zapier's 'Code by Zapier' feature, allowing attackers to perform sandbox reconnaissance and extract credentials from memory. This access enabled lateral movement to Zapier's private repositories, where a high-privilege NPM token was discovered, potentially allowing the publication of malicious code to all authenticated users. Zapier promptly addressed the issue by revoking the leaked token and tightening IAM roles, with full remediation confirmed by March 2026. This incident underscores the critical importance of securing cloud integrations and managing permissions effectively. As cloud services become increasingly complex, even minor misconfigurations can be exploited to orchestrate significant breaches, highlighting the need for continuous security assessments and robust access controls.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Major Supply Chain Attacks Target Nx Console and GitHub Repositories in 2026
Computer Software/Engineering5 months ago

Major Supply Chain Attacks Target Nx Console and GitHub Repositories in 2026

In May 2026, two significant supply chain attacks targeted the developer ecosystem. The first involved a compromised version of the Nx Console Visual Studio Code extension (v18.95.0), which was live for approximately 18 minutes on May 18, 2026. This malicious extension exfiltrated credentials from developer machines, leading to unauthorized access and exfiltration of approximately 3,800 internal GitHub repositories. The second attack, dubbed 'Megalodon,' occurred on the same day and compromised over 5,500 GitHub repositories by injecting malicious GitHub Actions workflows designed to harvest CI/CD secrets and cloud credentials. These incidents underscore the escalating threat landscape targeting software development pipelines and the critical need for robust security measures in CI/CD environments. The rapid execution and widespread impact of these attacks highlight the urgency for organizations to implement stringent supply chain security practices and continuous monitoring to detect and mitigate such threats promptly.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(high)
IImpact(medium)
Read report
Kimsuky's Advanced Cyber Attacks: A New Era of AI-Driven Threats
Defense/Space5 months ago

Kimsuky's Advanced Cyber Attacks: A New Era of AI-Driven Threats

In March and April 2026, the North Korean state-sponsored threat actor Kimsuky launched sophisticated cyber attacks targeting South Korean military and corporate entities. Utilizing advanced social engineering tactics, they spoofed security software installation pages and crafted fake Webex meeting pages to distribute malware. These campaigns delivered variants of the HTTPSpy remote access trojan, enabling extensive control over compromised systems, including command execution, file manipulation, and data exfiltration. Notably, Kimsuky employed legitimate tools like Visual Studio Code's remote tunneling feature and DWAgent for post-exploitation activities, enhancing their ability to evade detection. The increasing integration of artificial intelligence in cyber attack methodologies, as demonstrated by Kimsuky's use of large language models to develop malware like HelloDoor, signifies a significant evolution in threat actor capabilities. This trend underscores the urgent need for organizations to adopt advanced, behavior-based detection systems and regularly update threat intelligence to effectively counter these sophisticated and rapidly evolving cyber threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(low)
Read report
Malicious Sicoob NuGet Package Compromises Banking Credentials
Banking/Mortgage5 months ago

Malicious Sicoob NuGet Package Compromises Banking Credentials

In May 2026, cybersecurity researchers discovered a malicious NuGet package named 'Sicoob.Sdk' that impersonated a C# software development kit for Sicoob, one of Brazil's largest cooperative financial systems. Versions 2.0.0 through 2.0.4 of this package were found to exfiltrate sensitive information, including client IDs and PFX certificates, which are crucial for secure communications. This incident underscores the growing trend of supply chain attacks targeting software development ecosystems to steal sensitive data. The discovery of 'Sicoob.Sdk' aligns with a series of recent supply chain attacks where malicious packages infiltrate trusted repositories. For instance, the 'TrapDoor' campaign targeted npm, PyPI, and Crates.io ecosystems to distribute credential-stealing malware. These incidents highlight the urgent need for enhanced vigilance and security measures within software supply chains to protect against such threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports