The breach isn’t the problem. The spread is. →The breach isn’t the problem. The spread is. →Measure in 5 min. Free AssessmentFree Assessment
Information Technology/IT
Breach intelligence, attack campaigns, and threat reports targeting the Information Technology/IT sector.
Explore Other Sectors
Information Technology/IT Threat Reports
Device Code Phishing: A New Threat to Microsoft 365 Security in 2026
In early 2026, a sophisticated phishing campaign exploited Microsoft's OAuth 2.0 Device Authorization Grant flow to compromise Microsoft 365 accounts across over 340 organizations in the U.S., Canada, Australia, New Zealand, and Germany. Attackers tricked users into entering device codes on legitimate Microsoft authentication pages, granting unauthorized access without stealing passwords or bypassing multi-factor authentication. This method allowed threat actors to maintain persistent access to compromised accounts, leading to data breaches and potential financial losses. ([cryptika.com](https://www.cryptika.com/attackers-hijack-microsoft-365-accounts-through-oauth-device-code-abuse-without-stealing-passwords/?utm_source=openai)) The incident underscores a significant shift in phishing tactics, with attackers increasingly abusing legitimate authentication workflows to evade detection. Organizations must enhance their security measures to address these evolving threats, including educating users about such sophisticated phishing techniques and implementing stricter controls over device code authentication. ([securitybrief.com.au](https://securitybrief.com.au/story/proofpoint-warns-of-surge-in-microsoft-device-code-phishing?utm_source=openai))
6 months ago
Kill Chain
GlassWorm Malware Exploits Open VSX Extensions to Target macOS Systems
In late January 2026, a sophisticated supply chain attack compromised the Open VSX Registry, a platform for Visual Studio Code extensions. Threat actors gained unauthorized access to the developer account 'oorzc' and published malicious updates to four widely used extensions, collectively downloaded over 22,000 times. These updates embedded the GlassWorm malware loader, which, upon installation, targeted macOS systems to steal credentials, browser data, and cryptocurrency wallet information. The malware employed advanced evasion techniques, including locale-based profiling and utilizing the Solana blockchain for command-and-control communication, complicating detection and mitigation efforts. ([socket.dev](https://socket.dev/blog/glassworm-loader-hits-open-vsx-via-suspected-developer-account-compromise?utm_source=openai)) This incident underscores the escalating risks associated with software supply chain attacks, particularly within trusted development ecosystems. The use of blockchain technology for command-and-control highlights the evolving sophistication of threat actors, necessitating enhanced vigilance and robust security measures in software development and distribution processes.
6 months ago
Kill Chain
Checkmarx KICS Supply Chain Attack: A 2026 Cybersecurity Wake-Up Call
In early 2026, Checkmarx's KICS code scanner was targeted in a sophisticated supply chain attack attributed to the cyber threat group TeamPCP. The attackers exploited vulnerabilities in the software's update mechanism to inject malicious code, compromising the integrity of the tool and potentially exposing users to further exploits. This incident underscores the growing trend of threat actors focusing on software supply chains to distribute malware and gain unauthorized access to systems. Organizations relying on KICS were advised to verify the integrity of their installations and apply security patches promptly to mitigate potential risks. The attack highlights the critical need for robust supply chain security measures and continuous monitoring of software dependencies to prevent similar incidents in the future.
6 months ago
Kill Chain
Palo Alto Networks' 2025 Data Breach: A Supply Chain Attack via Salesloft Drift
In August 2025, Palo Alto Networks experienced a significant data breach resulting from a supply chain attack targeting the Salesloft Drift platform. Attackers exploited stolen OAuth tokens to gain unauthorized access to Salesforce environments, leading to the exfiltration of sensitive data, including business contacts, internal sales records, and support case information. The breach affected hundreds of organizations globally, with Palo Alto Networks among the impacted entities. ([techradar.com](https://www.techradar.com/pro/security/palo-alto-networks-becomes-the-latest-to-confirm-it-was-hit-by-salesloft-drift-attack?utm_source=openai)) This incident underscores the escalating risks associated with third-party integrations and the critical need for robust supply chain security measures. The attack highlights the importance of vigilant monitoring and rapid response strategies to mitigate potential vulnerabilities in interconnected systems. ([breached.company](https://breached.company/major-supply-chain-attack-palo-alto-networks-and-zscaler-hit-by-salesloft-drift-breach/?utm_source=openai))
6 months ago
Kill Chain
AI-Generated Phishing Attacks Surge in 2025
In 2025, cybercriminals significantly escalated their use of AI-generated phishing attacks, with 83% of phishing emails containing AI-generated content. This shift led to a 54% click rate on these emails, compared to 12% for traditional phishing attempts. The enhanced realism and personalization of these AI-driven attacks resulted in a 275% increase in phishing-related losses, totaling $70 billion annually, with small and medium-sized businesses being the primary targets. ([itpro.com](https://www.itpro.com/security/phishing/ai-generated-phishing-became-the-baseline-for-hackers-last-year-kaseya-warns-its-going-to-get-worse-in-2026?utm_source=openai)) The widespread adoption of AI in phishing campaigns underscores the urgent need for organizations to implement advanced, AI-driven email security solutions to detect and mitigate these sophisticated threats effectively.
6 months ago
Kill Chain
Palo Alto Networks 2026 Recruiter Phishing Scam: A Cautionary Tale
Since August 2025, a series of sophisticated phishing campaigns have targeted senior-level professionals by impersonating Palo Alto Networks' talent acquisition staff. Attackers utilized scraped LinkedIn data to craft highly personalized emails, falsely claiming that the recipient's resume failed to meet applicant tracking system (ATS) requirements. They then offered paid services to 'correct' these issues, charging fees ranging from $400 to $800. This social engineering tactic exploited victims' career aspirations and trust in reputable companies. This incident underscores a growing trend of cybercriminals leveraging social engineering and impersonation tactics to exploit individuals' trust and professional ambitions. As remote work and digital communication become more prevalent, such personalized phishing schemes are likely to increase, highlighting the need for heightened vigilance and robust verification processes.
6 months ago
Kill Chain
Aqua Security's Trivy Repository Compromised in AI-Powered Supply Chain Attack
In late February 2026, Aqua Security's Trivy repository was compromised through a sophisticated supply chain attack. Threat actors exploited a misconfigured GitHub Actions workflow to steal a Personal Access Token, enabling them to publish malicious versions (1.8.12 and 1.8.13) of the Trivy VS Code extension on the OpenVSX registry. These versions contained hidden AI prompts designed to hijack local AI coding assistants, such as GitHub Copilot and OpenAI Codex, to perform system reconnaissance and attempt data exfiltration. The malicious extensions were quickly identified and removed, mitigating potential widespread impact. ([awesomeagents.ai](https://awesomeagents.ai/news/hackerbot-claw-trivy-github-actions-compromise/?utm_source=openai)) This incident underscores the escalating threat of AI-powered exploits in software supply chains. As AI tools become more integrated into development environments, they present new vectors for attackers to manipulate and exploit, highlighting the need for enhanced security measures and vigilance in CI/CD pipelines.
6 months ago
Kill Chain
Dutch Ministry of Finance Data Breach: A Wake-Up Call for Government Cybersecurity
In March 2026, the Dutch Ministry of Finance disclosed a significant data breach affecting its systems. The breach, detected in late February, involved unauthorized access to sensitive employee information, including names, addresses, and financial details. The Ministry promptly initiated an investigation, collaborating with cybersecurity experts to assess the scope and impact of the incident. While the exact number of affected individuals remains undisclosed, the breach underscores the persistent threat to governmental institutions and the critical importance of robust cybersecurity measures. This incident highlights a concerning trend of cyberattacks targeting public sector entities, emphasizing the need for enhanced security protocols and vigilance. Organizations are urged to reassess their cybersecurity frameworks to mitigate potential vulnerabilities and protect sensitive data from unauthorized access.
6 months ago
Kill Chain
Yanluowang Ransomware Access Broker Sentenced to 81 Months
In March 2026, Russian national Aleksey Olegovich Volkov was sentenced to 81 months in prison for his role as an initial access broker for the Yanluowang ransomware group. Between July 2021 and November 2022, Volkov infiltrated at least eight U.S. companies' networks, selling access to ransomware operators who demanded ransoms ranging from $300,000 to $15 million. Volkov's activities resulted in significant financial and operational disruptions for the affected organizations. This case underscores the critical role of initial access brokers in the ransomware ecosystem and highlights the importance of robust cybersecurity measures to prevent unauthorized access. The sentencing also reflects increased international cooperation in prosecuting cybercriminals, signaling a stronger stance against such activities.
6 months ago
Kill Chain
Citrix 2025 CVE-2025-5777 Memory Overread Vulnerability
In June 2025, Citrix disclosed a critical vulnerability (CVE-2025-5777) in NetScaler ADC and NetScaler Gateway, characterized by insufficient input validation leading to memory overread. This flaw allows unauthenticated attackers to extract sensitive information, including session tokens, from the memory of affected devices. Exploitation of this vulnerability can result in unauthorized access to systems and potential data breaches. Citrix released patches to address this issue and strongly urged customers to update their appliances promptly. ([support.citrix.com](https://support.citrix.com/external/article/CTX693420/netscaler-adc-and-netscaler-gateway-secu.html?utm_source=openai)) The urgency of addressing CVE-2025-5777 is underscored by active exploitation in the wild, with attackers leveraging this vulnerability to bypass authentication mechanisms. Organizations using affected Citrix products must prioritize patching to mitigate the risk of unauthorized access and data exfiltration. ([darkreading.com](https://www.darkreading.com/vulnerabilities-threats/citrix-patches-vulns-netscaler-adc-gateway?utm_source=openai))
6 months ago
Kill Chain
LiteLLM PyPI Supply Chain Attack: A Wake-Up Call for Open-Source Security
In March 2026, the LiteLLM Python package, a widely used library with over 95 million downloads in the past month, was compromised in a supply chain attack attributed to the TeamPCP hacking group. Malicious versions 1.82.7 and 1.82.8 were uploaded to the Python Package Index (PyPI), embedding an infostealer that harvested sensitive data, including SSH keys, cloud credentials, and Kubernetes secrets, from approximately 500,000 devices. The attack involved injecting base64-encoded payloads into the package, which, upon execution, deployed the 'TeamPCP Cloud Stealer' and established persistence mechanisms to exfiltrate data to attacker-controlled domains. This incident underscores the escalating threat of supply chain attacks targeting open-source ecosystems. The compromise of LiteLLM follows previous breaches by TeamPCP, including the Trivy vulnerability scanner and Checkmarx's KICS project, highlighting a pattern of targeting widely adopted development tools to maximize impact. Organizations are urged to implement stringent security measures, such as regular dependency audits, multi-factor authentication for package maintainers, and prompt rotation of exposed credentials, to mitigate the risks associated with such attacks.
6 months ago
Kill Chain
Yanluowang Ransomware Operator Sentenced to 6.75 Years in U.S. Prison
In March 2026, Russian national Aleksei Olegovich Volkov was sentenced to 6.75 years in U.S. federal prison for his role as an initial access broker for the Yanluowang ransomware group. Between July 2021 and November 2022, Volkov infiltrated at least eight U.S. companies, including financial institutions and engineering firms, providing unauthorized network access to the ransomware operators. This collaboration led to significant financial losses and operational disruptions for the affected organizations. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/yanluowang-initial-access-broker-pleaded-guilty-to-ransomware-attacks/?utm_source=openai)) This case underscores the persistent threat posed by ransomware groups and their affiliates. Despite ongoing efforts to dismantle such operations, the involvement of skilled individuals like Volkov highlights the evolving tactics used to compromise corporate networks. Organizations must remain vigilant, continuously updating their cybersecurity measures to defend against sophisticated attacks.
6 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports