Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Information Technology/IT

Breach intelligence, attack campaigns, and threat reports targeting the Information Technology/IT sector.

3786 threat reports
Page 152 of 316
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Information Technology/IT Threat Reports

Showing 1813–1824 / 3786 reports
Preventing Unauthorized AWS Account Removals: Insights from AWS CIRT
Financial Services5 months ago

Preventing Unauthorized AWS Account Removals: Insights from AWS CIRT

In May 2026, the AWS Customer Incident Response Team (CIRT) identified a tactic where threat actors, upon gaining control of a customer's AWS account, remove it from the AWS Organizations structure. This action bypasses Service Control Policies (SCPs) and other governance controls, leading to potential security risks and loss of centralized management. The attackers exploit permissions like `organizations:LeaveOrganization` to execute this maneuver, resulting in the account operating independently without the protective measures enforced by the organization. This incident underscores the importance of implementing strict IAM policies and SCPs to prevent unauthorized account removals. Organizations should regularly audit permissions, enforce the principle of least privilege, and monitor CloudTrail logs for `organizations:LeaveOrganization` API calls to detect and mitigate such threats promptly.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
CISA Contractor's GitHub Repository Exposes Sensitive AWS Credentials
Government Administration5 months ago

CISA Contractor's GitHub Repository Exposes Sensitive AWS Credentials

In May 2026, a contractor for the Cybersecurity & Infrastructure Security Agency (CISA) inadvertently exposed highly sensitive credentials by maintaining a public GitHub repository named "Private-CISA." This repository contained administrative credentials for three AWS GovCloud accounts, plaintext passwords for numerous internal CISA systems, and detailed internal documentation on software development processes. The exposure persisted for approximately six months before being discovered by a security researcher from GitGuardian, who alerted CISA. The repository was subsequently taken offline, and an investigation was initiated to assess potential impacts. This incident underscores the critical importance of stringent security practices in managing sensitive information, especially within organizations tasked with national cybersecurity. It highlights the risks associated with improper handling of credentials and the necessity for robust oversight and compliance measures to prevent similar exposures in the future.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Claw Chain Vulnerabilities: A Wake-Up Call for AI Agent Security
Computer Software/Engineering5 months ago

Claw Chain Vulnerabilities: A Wake-Up Call for AI Agent Security

In April 2026, security researchers identified four critical vulnerabilities in the OpenClaw AI agent framework, collectively termed 'Claw Chain.' These flaws—CVE-2026-44112, CVE-2026-44113, CVE-2026-44115, and CVE-2026-44118—allowed attackers to exploit race conditions and logic errors to gain unauthorized access, escalate privileges, and establish persistent control over affected systems. The vulnerabilities impacted all OpenClaw versions prior to 2026.4.22, enabling adversaries to manipulate system configurations, exfiltrate sensitive data, and bypass sandbox restrictions. The discovery of 'Claw Chain' underscores the escalating security challenges associated with rapidly adopted AI agent platforms. As organizations increasingly integrate such frameworks into critical workflows, the potential attack surface expands, necessitating vigilant security assessments and prompt patch management to mitigate emerging threats.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Mini Shai-Hulud Attack Compromises AntV npm Packages in 2026
Computer Software/Engineering5 months ago

Mini Shai-Hulud Attack Compromises AntV npm Packages in 2026

In May 2026, the 'Mini Shai-Hulud' supply chain attack compromised over 300 npm packages within the @antv ecosystem by exploiting a maintainer's account. The attackers published 639 malicious versions across 323 packages, embedding malware designed to steal developer credentials and cloud secrets. This breach affected widely used packages like echarts-for-react, impacting millions of weekly downloads. This incident underscores the escalating threat of supply chain attacks targeting open-source ecosystems. The rapid propagation and sophisticated techniques employed highlight the need for enhanced security measures in package management and developer workflows to prevent similar future compromises.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
GitHub Actions Supply Chain Attack Highlights CI/CD Security Vulnerabilities
Computer Software/Engineering5 months ago

GitHub Actions Supply Chain Attack Highlights CI/CD Security Vulnerabilities

In May 2026, threat actors compromised the GitHub Actions workflow 'actions-cool/issues-helper' by redirecting existing tags to an imposter commit containing malicious code. This code, when executed within CI/CD pipelines, harvested sensitive credentials and exfiltrated them to an attacker-controlled server. The attack involved downloading the Bun JavaScript runtime, reading memory from the Runner.Worker process to extract credentials, and transmitting the stolen data to 't.m-kosche[.]com'. GitHub has since disabled access to the affected repository due to violations of its terms of service. This incident underscores the escalating trend of software supply chain attacks targeting CI/CD pipelines. The use of imposter commits to inject malicious code highlights the need for organizations to implement stringent security measures, such as pinning dependencies to known-good commit SHAs and continuously monitoring for unauthorized changes in their development workflows.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Nx Console Extension Compromised: A Wake-Up Call for Developer Security
Computer Software/Engineering5 months ago

Nx Console Extension Compromised: A Wake-Up Call for Developer Security

On May 18, 2026, a compromised version of the Nx Console extension (version 18.95.0) was published to the Microsoft Visual Studio Code Marketplace. This extension, widely used by over 2.2 million developers, was altered to include a credential-stealing payload. Upon opening any workspace, the malicious extension fetched and executed an obfuscated payload from a hidden commit within the official nrwl/nx GitHub repository. This payload harvested sensitive information, including tokens and secrets from platforms such as GitHub, npm, AWS, HashiCorp Vault, Kubernetes, and 1Password, exfiltrating them via multiple channels. ([stepsecurity.io](https://www.stepsecurity.io/blog/nx-console-vs-code-extension-compromised?utm_source=openai)) This incident underscores the escalating threat of supply chain attacks targeting developer tools. The sophisticated method of embedding malicious code within trusted extensions highlights the need for enhanced vigilance and security measures in software development environments. Developers and organizations must prioritize the integrity of their toolchains to prevent similar breaches.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
DirtyDecrypt PoC Released: Immediate Action Required for Linux Kernel CVE-2026-31635
Information Technology/IT5 months ago

DirtyDecrypt PoC Released: Immediate Action Required for Linux Kernel CVE-2026-31635

On May 19, 2026, a proof-of-concept (PoC) exploit code was released for a recently patched security flaw in the Linux kernel, identified as CVE-2026-31635 and dubbed 'DirtyDecrypt' or 'DirtyCBC'. This vulnerability, discovered by the Zellic and V12 security team, allows local privilege escalation due to a missing copy-on-write (COW) guard in the rxgk_decrypt_skb() function. The flaw enables unprivileged local users to write arbitrary bytes into the kernel's page cache of read-only files, potentially granting root privileges. Distributions with CONFIG_RXGK enabled, such as Fedora, Arch Linux, and openSUSE Tumbleweed, are affected. ([thehackernews.com](https://thehackernews.com/2026/05/dirtydecrypt-poc-released-for-linux.html?utm_source=openai)) The release of the PoC highlights the urgency for system administrators to apply the available patches promptly. This incident underscores the critical need for timely updates and vigilant monitoring of security advisories to mitigate risks associated with such vulnerabilities.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
EvilTokens Phishing Campaign: A New Threat to Microsoft 365 Security
Financial Services5 months ago

EvilTokens Phishing Campaign: A New Threat to Microsoft 365 Security

In February 2026, the phishing-as-a-service platform EvilTokens emerged, compromising over 340 Microsoft 365 organizations across five countries within five weeks. The attack exploited the OAuth device code authentication flow, tricking users into entering a short code at microsoft.com/devicelogin and completing their MFA challenge. Unbeknownst to them, this granted attackers valid refresh tokens with access to emails, files, calendars, and contacts, all without stealing passwords or bypassing MFA. This method effectively bypassed traditional identity defenses, as the OAuth consent screen has become an instinctive click for many users. ([thehackernews.com](https://thehackernews.com/2026/05/the-new-phishing-click-how-oauth.html?utm_source=openai)) The incident underscores a significant shift in phishing tactics, highlighting the exploitation of legitimate authentication processes to gain unauthorized access. As attackers increasingly leverage such methods, organizations must reassess their security protocols to address these evolving threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
TeamPCP's Compromise of Checkmarx Jenkins Plugin: A 2026 Supply Chain Attack
Computer Software/Engineering5 months ago

TeamPCP's Compromise of Checkmarx Jenkins Plugin: A 2026 Supply Chain Attack

In May 2026, the threat group TeamPCP compromised Checkmarx's Jenkins AST plugin by publishing a backdoored version (2026.5.09) to the Jenkins Marketplace. This malicious plugin, assigned CVE-2026-33634 with a CVSS score of 9.4, allowed attackers to execute code within CI/CD pipelines, potentially exposing sensitive credentials and source code. The incident follows previous attacks by TeamPCP on Checkmarx's KICS tool and the Trivy vulnerability scanner, indicating a targeted campaign against developer tools. ([thehackernews.com](https://thehackernews.com/2026/05/teampcp-compromises-checkmarx-jenkins.html?utm_source=openai)) This breach underscores the escalating threat of supply chain attacks targeting CI/CD environments. Organizations must enhance their security measures by verifying the integrity of third-party plugins and implementing robust monitoring to detect unauthorized changes within their development pipelines.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Pwn2Own Berlin 2026: Unveiling 47 Zero-Day Vulnerabilities
Computer Software/Engineering5 months ago

Pwn2Own Berlin 2026: Unveiling 47 Zero-Day Vulnerabilities

The Pwn2Own Berlin 2026 hacking contest, held from May 14 to May 16, 2026, at the OffensiveCon conference, concluded with security researchers earning $1,298,250 in rewards after successfully exploiting 47 zero-day vulnerabilities. The competition focused on enterprise technologies and artificial intelligence, targeting fully patched products across various categories, including web browsers, enterprise applications, servers, and virtualization platforms. Notably, the DEVCORE Research Team secured the highest reward of $200,000 by chaining three bugs to achieve remote code execution with SYSTEM privileges on Microsoft Exchange. This event underscores the persistent challenges in securing enterprise software and the critical importance of proactive vulnerability management. The exposure of these zero-day vulnerabilities highlights the need for organizations to stay vigilant and prioritize timely patching to mitigate potential exploitation risks.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Critical 'DirtyDecrypt' Vulnerability in Linux Kernel: Exploit Released
Information Technology/IT5 months ago

Critical 'DirtyDecrypt' Vulnerability in Linux Kernel: Exploit Released

In May 2026, a local privilege escalation vulnerability in the Linux kernel's rxgk module, dubbed 'DirtyDecrypt' (also known as 'DirtyCBC'), was disclosed. This flaw allows attackers to gain root access on certain Linux systems by exploiting a missing Copy-On-Write (COW) guard in the rxgk_decrypt_skb function. The vulnerability, identified as CVE-2026-31635, was patched on April 25, 2026. Successful exploitation requires the CONFIG_RXGK configuration option enabled, affecting distributions like Fedora, Arch Linux, and openSUSE Tumbleweed. A proof-of-concept exploit has been released, demonstrating the ease of exploitation on unpatched systems. This incident underscores a growing trend of privilege escalation vulnerabilities in the Linux kernel, following similar disclosures such as 'Dirty Frag,' 'Fragnesia,' and 'Copy Fail.' The rapid succession of these vulnerabilities highlights the critical need for timely patch management and vigilant system monitoring to mitigate potential security risks.

High impact

Kill Chain

ICInitial Compromise(low)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Grafana Labs' 2026 Security Breach: A Case Study in Credential-Based Attacks
Computer Software/Engineering5 months ago

Grafana Labs' 2026 Security Breach: A Case Study in Credential-Based Attacks

In May 2026, Grafana Labs, the developer of the popular open-source analytics platform, experienced a security breach when attackers exploited a stolen GitHub access token to download the company's source code. The extortion group known as CoinbaseCartel claimed responsibility, demanding a ransom to prevent the public release of the code. Grafana Labs promptly invalidated the compromised credentials, implemented additional security measures, and, adhering to FBI guidance, refused to pay the ransom. Importantly, the company confirmed that no customer data or personal information was accessed, and customer systems remained unaffected. This incident underscores the growing threat posed by credential-based attacks and the rise of data theft extortion tactics employed by groups like CoinbaseCartel. Organizations are reminded of the critical importance of securing access tokens and implementing robust security protocols to prevent unauthorized access and mitigate potential breaches.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(high)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports