The breach isn’t the problem. The spread is. →The breach isn’t the problem. The spread is. →Measure in 5 min. Free AssessmentFree Assessment
Information Technology/IT
Breach intelligence, attack campaigns, and threat reports targeting the Information Technology/IT sector.
Explore Other Sectors
Information Technology/IT Threat Reports
Aqua Trivy's 2026 AI-Powered Supply Chain Attack: A Wake-Up Call for Developers
In late February 2026, threat actors compromised versions 1.8.12 and 1.8.13 of the Aqua Trivy VS Code extension on the OpenVSX registry. The attackers injected malicious code that exploited local AI coding tools—such as Claude, Codex, Gemini, GitHub Copilot CLI, and Kiro CLI—to perform unauthorized data collection on developers' machines. This code operated silently, leaving no visible alerts, and was removed from OpenVSX on February 28, 2026. ([cryptika.com](https://www.cryptika.com/threat-actors-exploit-openvsx-aqua-trivy-with-malicious-ai-prompts-to-hijack-local-coding-tools/?utm_source=openai)) This incident underscores the evolving nature of supply chain attacks, particularly the novel use of AI tools to facilitate data exfiltration. It highlights the critical need for developers and organizations to implement robust security measures, including regular audits of third-party extensions and vigilant monitoring of development environments.
6 months ago
Kill Chain
Quest KACE SMA Authentication Bypass Exploited in 2026
In March 2026, threat actors exploited a critical authentication bypass vulnerability (CVE-2025-32975) in unpatched Quest KACE Systems Management Appliances (SMA). This flaw, residing in the Single Sign-On (SSO) mechanism, allowed attackers to impersonate legitimate users without valid credentials, leading to potential administrative control over affected systems. The vulnerability was initially identified in June 2025, with patches released shortly thereafter. However, organizations that delayed applying these updates remained susceptible to exploitation. This incident underscores the persistent risk posed by unpatched vulnerabilities, even after fixes are made available. It highlights the importance of timely patch management and continuous monitoring to prevent exploitation of known security flaws.
6 months ago
Kill Chain
North Korean Hackers Exploit VS Code to Infiltrate Developer Systems
In January 2026, North Korean state-sponsored hackers, notably the Lazarus Group, launched a campaign targeting software developers by distributing malicious Visual Studio Code (VS Code) projects. These projects, often shared via platforms like GitHub and GitLab, contained manipulated task configuration files that, upon opening and granting trust in VS Code, executed obfuscated JavaScript code. This code established backdoors on macOS systems, enabling remote code execution, system fingerprinting, and continuous communication with command-and-control servers. The attackers employed social engineering tactics, posing as recruiters offering fake job opportunities to lure developers into cloning and opening these repositories. This method allowed the malware to blend seamlessly into standard development workflows, making detection challenging. The campaign's sophistication underscores the evolving tactics of DPRK-linked threat actors, who consistently adapt their methods to exploit legitimate developer tools and processes. ([securityweek.com](https://www.securityweek.com/north-korean-hackers-target-macos-developers-via-malicious-vs-code-projects/?utm_source=openai))
6 months ago
Kill Chain
CanisterWorm: A 2026 Supply Chain Attack Targeting Iranian Systems
In March 2026, the cybercrime group TeamPCP launched a supply chain attack by compromising Aqua Security's Trivy vulnerability scanner, injecting credential-stealing malware into official releases on GitHub. This malicious code targeted authentication credentials, cloud tokens, and cryptocurrency wallets. Subsequently, TeamPCP deployed 'CanisterWorm,' a self-propagating worm that exploited exposed Docker APIs, Kubernetes clusters, and Redis servers. The worm included a wiper component designed to destroy data on systems set to Iran's time zone or with Farsi as the default language, significantly impacting Iranian organizations. This incident underscores the escalating threat of supply chain attacks and the increasing use of wiper malware by financially motivated groups. Organizations must enhance their security measures, particularly in securing development pipelines and cloud infrastructures, to mitigate such sophisticated threats.
6 months ago
Kill Chain
Scattered Spider's 2025 Voice Phishing Attacks: A New Era of Social Engineering
In 2025, the cybercriminal group Scattered Spider executed a series of sophisticated voice phishing attacks targeting major corporations, including technology firms and critical infrastructure providers. By impersonating employees and IT staff over the phone, they manipulated help desks into resetting credentials, granting them unauthorized access to sensitive systems. This method led to significant data breaches, operational disruptions, and financial losses for the affected organizations. The rise of such interactive phishing techniques underscores a shift in cyberattack strategies, emphasizing the exploitation of human vulnerabilities over technical exploits. As traditional phishing methods decline, the increasing prevalence of voice-based social engineering attacks highlights the need for enhanced security awareness and robust verification processes within organizations.
6 months ago
Kill Chain
VoidStealer Malware Exploits Debugger Trick to Bypass Chrome's Encryption
In March 2026, the VoidStealer malware emerged, employing a novel technique to bypass Google Chrome's Application-Bound Encryption (ABE). By utilizing hardware breakpoints, VoidStealer extracts the v20_master_key directly from the browser's memory during decryption operations, allowing it to access sensitive data such as cookies and stored passwords without requiring privilege escalation or code injection. This method represents a significant advancement in infostealer capabilities, as it circumvents security measures introduced in Chrome 127 to protect user data. The emergence of VoidStealer underscores the continuous evolution of malware tactics in response to browser security enhancements. Organizations must remain vigilant, as threat actors rapidly adapt to new defenses, developing sophisticated methods to access protected information. This incident highlights the importance of implementing comprehensive security strategies that go beyond relying solely on browser-based protections.
6 months ago
Kill Chain
Trivy Supply Chain Attack: A Wake-Up Call for Open-Source Security
In March 2026, the Trivy vulnerability scanner, a widely used open-source security tool, was compromised in a sophisticated supply chain attack orchestrated by the threat actor group known as TeamPCP. The attackers infiltrated Trivy's GitHub repository, replacing legitimate code with malicious versions in the v0.69.4 release and associated GitHub Actions. This breach led to the distribution of credential-stealing malware, which harvested sensitive information from developers' environments, including SSH keys, cloud service credentials, and database passwords. The malicious code was active for approximately three hours, during which it exfiltrated data to attacker-controlled servers. Organizations utilizing the affected versions were advised to treat their environments as fully compromised, necessitating immediate rotation of all secrets and thorough system analysis for additional breaches. This incident underscores the escalating threat posed by supply chain attacks targeting open-source ecosystems. The exploitation of trusted development tools to distribute malware highlights the critical need for enhanced security measures within software supply chains. As attackers increasingly focus on compromising widely adopted tools, organizations must implement rigorous code review processes, continuous monitoring, and robust incident response strategies to mitigate the risks associated with such attacks.
6 months ago
Kill Chain
Exploitation of Microsoft Azure Monitor in Sophisticated Phishing Attack
In March 2026, cybercriminals exploited Microsoft Azure Monitor to send phishing emails that appeared as legitimate security alerts from Microsoft. These emails, originating from azure-noreply@microsoft.com, warned recipients of unauthorized charges and urged them to call a provided phone number. By leveraging Azure Monitor's legitimate alerting system, attackers bypassed standard email security checks, making the phishing attempts more convincing. This method highlights a sophisticated abuse of trusted cloud services to execute social engineering attacks. The incident underscores the evolving tactics of threat actors who manipulate legitimate platforms to enhance the credibility of their phishing campaigns. Organizations must remain vigilant, as such techniques can lead to credential theft, financial fraud, or unauthorized access to sensitive systems.
6 months ago
Kill Chain
Trivy Supply Chain Attack Leads to CanisterWorm Infection in 47 npm Packages
In March 2026, a sophisticated supply chain attack targeted the Trivy vulnerability scanner, leading to the compromise of 47 npm packages through a self-propagating worm named CanisterWorm. The attackers infiltrated Trivy's codebase, embedding malicious code that, upon execution, harvested developer credentials and propagated itself by injecting into other npm packages. This resulted in widespread exposure of sensitive information and potential unauthorized access to numerous development environments. This incident underscores the escalating threat of supply chain attacks within the open-source ecosystem. The use of self-replicating malware like CanisterWorm highlights the need for enhanced security measures, including rigorous code audits, robust access controls, and continuous monitoring of software dependencies to mitigate the risk of similar attacks in the future.
6 months ago
Kill Chain
CISA Flags Critical Vulnerabilities in Apple, Craft CMS, and Laravel Livewire
In March 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added multiple vulnerabilities affecting Apple products, Craft CMS, and Laravel Livewire to its Known Exploited Vulnerabilities (KEV) catalog. Notably, CVE-2025-31277, a memory corruption issue in Apple's WebKit, was exploited by the 'DarkSword' malware, impacting over 220 million iPhones running iOS versions 18.4 through 18.7. Additionally, CVE-2025-23209, a code injection vulnerability in Craft CMS, allowed remote code execution in installations with compromised security keys. CISA mandated federal agencies to patch these vulnerabilities by April 3, 2026. The inclusion of these vulnerabilities in the KEV catalog underscores the increasing sophistication of cyber threats targeting widely-used platforms. Organizations are urged to prioritize patching to mitigate potential exploits and protect sensitive data from unauthorized access.
6 months ago
Kill Chain
Ubiquiti UniFi Access Vulnerability: Unauthenticated API Exposure
In October 2025, Ubiquiti's UniFi Access Application was found to have a critical vulnerability (CVE-2025-52665) that exposed a management API without proper authentication. This flaw, present in versions 3.3.22 through 3.4.31, allowed attackers with access to the management network to gain unauthorized control over door access systems, posing significant risks to physical security. Ubiquiti addressed the issue by releasing version 4.0.21, which rectified the misconfiguration. This incident underscores the importance of promptly updating software to mitigate security vulnerabilities. Organizations are advised to review their access control systems and ensure that all applications are updated to the latest secure versions to prevent unauthorized access and potential breaches.
6 months ago
Kill Chain
North Korean IT Worker Scheme 2026: Unveiling the Insider Threat
Between September 2019 and November 2022, three U.S. nationals—Audricus Phagnasay, Jason Salazar, and Alexander Paul Travis—facilitated a scheme enabling North Korean IT workers to secure remote positions at U.S. companies. By hosting company-provided laptops and installing remote-access software, they allowed these operatives to masquerade as domestic employees. This operation led to approximately $1.28 million in salaries being funneled to North Korea, violating U.S. sanctions and compromising corporate security. ([cyberscoop.com](https://cyberscoop.com/doj-north-korea-it-worker-scheme-cases-crypto-seized/?utm_source=openai)) This incident underscores the evolving tactics of state-sponsored cyber operations, highlighting the critical need for robust identity verification and remote work security protocols to prevent similar breaches.
6 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports