Information Technology/IT
Breach intelligence, attack campaigns, and threat reports targeting the Information Technology/IT sector.
Explore Other Sectors
Information Technology/IT Threat Reports
Faronics Deploy Platform Exploited in Sophisticated ScreenConnect RAT Campaign
Between July and August 2026, cybercriminals exploited the legitimate Faronics Deploy endpoint management platform to gain unauthorized administrative control over victim computers. The attackers used phishing emails disguised as invoices and tax documents to trick users into downloading a legitimate but malicious Faronics Deploy installer. Once installed, the threat actors remotely executed PowerShell scripts to deploy ConnectWise ScreenConnect remote access software, establishing persistent backdoor access to over 457 endpoints across multiple organizations. This incident highlights the growing trend of Living-off-the-Land (LotL) attacks where cybercriminals abuse legitimate administrative tools to bypass traditional security controls and establish covert command-and-control channels.
2 weeks ago
Kill Chain
Breeze Comet's Sophisticated Attack on Brazilian Payment Systems Exposes Critical Infrastructure Vulnerabilities
Since 2024, the financially motivated threat actor Breeze Comet (formerly UNC5669) has targeted Brazilian financial services, retail, and e-commerce organizations through sophisticated payment system manipulation attacks. The group gains initial access via password spraying and social engineering calls impersonating IT support to install remote access tools like AnyDesk, then deploys custom malware including COBALTSPIN, LIGHTPAINT, and MILDFROST to maintain persistence and lateral movement. Successfully executing hundreds of fraudulent transactions worth tens of thousands of dollars, the group specifically targets entities with access to Brazil's National Financial System Network and payment platforms like Pix, STR, and Boleto. This campaign represents a significant evolution in Latin American cybercrime from opportunistic retail fraud to direct targeting of core financial infrastructure. The threat actor's use of AI-assisted malware development and expansion into other Latin American and African countries signals a new model for financially motivated attacks that defenders must prepare for as interconnected payment ecosystems become increasingly vulnerable.
2 weeks ago
Kill Chain
How Mirage Kitten's NodeRabbit Malware Exploited Developer Trust in 2024
In 2024, Iranian APT group Mirage Kitten launched sophisticated social engineering campaigns targeting aviation and fintech sectors across the Middle East and Africa using two new cross-platform malware families: NodeRabbit and PollCat. The threat actors posed as recruiters on LinkedIn, delivering trojanized coding challenges that contained Node.js-based remote access trojans capable of running on Windows, Linux, and macOS. The malware established persistence through multiple mechanisms and communicated with command-and-control infrastructure hosted on Azure and Cloudflare, affecting organizations in Egypt, Ethiopia, and Afghanistan. This campaign represents a significant evolution in nation-state tactics, showcasing how APT groups are adapting to target developer communities through increasingly sophisticated supply chain attacks and social engineering techniques that exploit trust in professional recruitment processes.
2 weeks ago
Kill Chain
Critical JFrog Artifactory Vulnerability Exploited Days After Disclosure
On August 28, 2026, JFrog patched CVE-2026-82329, a critical authentication bypass vulnerability in Artifactory with a CVSS score of 9.8. Within days of disclosure, threat actors began actively exploiting the flaw to mint administrative tokens and gain unauthorized access to software repositories. The vulnerability affects default configurations across multiple Artifactory versions and requires no authentication or user interaction. Attackers can forge access credentials through a phantom join key mechanism in JFrog Access, enabling them to enumerate users, compromise build pipelines, and potentially poison the entire software supply chain. This incident represents another example of the accelerating timeline from vulnerability disclosure to active exploitation, particularly targeting critical infrastructure components. The rapid weaponization of supply chain vulnerabilities highlights the growing sophistication of threat actors and their focus on high-impact targets that can compromise multiple downstream organizations.
2 weeks ago
Kill Chain
TerminalFix Campaign Exposes Enterprise Vulnerability to PowerShell Social Engineering
The TerminalFix campaign represents a sophisticated evolution of ClickFix social engineering attacks, targeting enterprise networks through fake Cloudflare CAPTCHA overlays that trick users into executing malicious PowerShell commands. First documented by Microsoft researchers in August 2026, this multistage attack establishes persistent access through DLL sideloading, steganographic payloads hidden in PNG images, and Python-based reverse tunnels that provide direct access to internal networks. The campaign has successfully compromised organizations across multiple industries, with attackers leveraging this access for privilege escalation, security control bypass, data exfiltration, and ransomware deployment. This incident highlights the growing sophistication of social engineering attacks that bypass traditional security controls by manipulating user trust and exploiting legitimate system tools like PowerShell for malicious purposes.
2 weeks ago
Kill Chain
Critical Langflow and Rails Vulnerabilities Enable Widespread Credential Harvesting Campaign
In August 2026, threat actors launched widespread exploitation campaigns targeting two critical vulnerabilities: CVE-2026-0768 in Langflow (CVSS 9.8) enabling arbitrary Python code execution as root, and CVE-2026-66066 in Ruby on Rails (CVSS 9.5) allowing file disclosure and remote code execution through Active Storage image processing flaws. VulnCheck recorded over 360 detections within days, with attackers primarily originating from Russia conducting credential harvesting, environment variable enumeration, and deploying cryptocurrency miners and remote access tools across vulnerable AI development platforms. This incident highlights the growing threat landscape targeting AI infrastructure and development platforms, as organizations increasingly deploy AI applications without proper security controls, creating new attack surfaces that threat actors are rapidly exploiting for credential theft and lateral movement.
2 weeks ago
Kill Chain
METR Breach Exposes New AI Infrastructure Attack Vectors Worth $600K
In March 2026, attackers exploited a fail-open authentication vulnerability in METR's publicly accessible AI research infrastructure to steal API keys and consume approximately $600,000 worth of AI model credits. The breach occurred when a researcher's EC2 instance running agent orchestration software inadvertently exposed authentication-protected endpoints to the public internet for several days. Attackers likely discovered the vulnerable system through certificate transparency monitoring and automated scanning for AI-related infrastructure, then directly prompted the exposed AI agent to reveal its API credentials before establishing persistent access. A second incident in May 2026 involved sustained probing of METR's infrastructure and exploitation of an inadvertently exposed SQL query endpoint that could have provided access to sensitive AI evaluation data. This incident highlights the emerging attack surface created by AI research infrastructure and the growing threat of credential harvesting targeting AI model providers. As organizations increasingly deploy AI agents and automated systems, the combination of high-value API access, complex authentication chains, and rapid development cycles creates new opportunities for financially motivated attackers to exploit cloud misconfigurations for significant monetary gain.
2 weeks ago
Kill Chain
The Rise of Repeatable Cybercrime: How ClickFix Became 2026's Dominant Attack Vector
In 2026, cybercriminals have shifted from developing sophisticated new attack methods to perfecting repeatable, scalable procedures that work consistently across targets. Microsoft's threat intelligence team identified ClickFix as the most common initial access method, accounting for 47% of observed attacks. This social engineering technique tricks users into executing malicious commands by placing them on their clipboard through deceptive web pages. Bitdefender's analysis of 700,000 security incidents revealed that 84% of high-severity breaches involved legitimate administrative tools already present on victim systems, demonstrating the widespread adoption of 'living off the land' tactics. This trend represents a fundamental evolution in cybercrime business models, where threat actors prioritize operational efficiency over technical innovation. The shift coincides with declining ransom payments and increased victim volumes, forcing attackers to optimize for cost-effectiveness and repeatability rather than sophistication.
2 weeks ago
Kill Chain
The Coding Agent Trap: How Rogue AI Endpoints Became the New Supply Chain Threat
In August 2024, security researchers documented a novel supply chain attack where threat actors discovered exposed LLM inference endpoints, relabeled them with popular model names like DeepSeek, and distributed them as 'free' alternatives to attract AI coding agents. A honeypot captured a real coding agent session from China that transmitted 88 messages containing filesystem data, PowerShell command outputs, and tool manifests to an untrusted endpoint. The malicious endpoint operator could have responded with tool calls to execute arbitrary commands, read sensitive files, or exfiltrate data from the victim's machine without exploiting vulnerabilities. This represents a new attack vector where AI agents voluntarily connect to rogue infrastructure, exposing their capabilities and local environment data through normal inference requests with tools enabled and permissive configurations. This incident highlights the emerging risks as AI coding agents become mainstream development tools, with threat actors adapting traditional supply chain tactics to target autonomous systems that can execute code and access filesystems based on remote model responses.
2 weeks ago
Kill Chain
Iranian State Hackers Exploit Tech Job Market to Deploy Advanced Cross-Platform Malware
Iranian threat group Nimbus Manticore (also known as Mirage Kitten) has expanded their attack methodology by deploying cross-platform remote access trojans (RATs) through sophisticated social engineering campaigns targeting software engineers. The group poses as recruiters from major technology companies on LinkedIn and other job platforms, delivering trojanized coding challenges containing NodeRabbit and PollCat malware. These Node.js and JavaScript-based RATs can infect Windows, Linux, and macOS systems, representing a significant evolution from their traditional C/C++ toolset. The campaign has been observed targeting victims across Afghanistan, Egypt, and Ethiopia, demonstrating the group's expanded geographic reach and technical capabilities. This incident highlights the growing trend of state-sponsored actors adopting cross-platform development frameworks to maximize their attack surface while leveraging legitimate recruitment processes as attack vectors. The sophisticated nature of these fake coding challenges and the pressure tactics employed demonstrate how threat actors are increasingly exploiting the competitive job market in the technology sector.
2 weeks ago
Kill Chain
Guildma (Astaroth) Malware Evolves with Advanced Geofencing and Evasion Techniques
In August 2026, a sophisticated Guildma (Astaroth) malware campaign targeted Brazilian users through geofenced phishing emails written in Brazilian Portuguese. The attack required victims to access malicious links from Brazil-based IP addresses with Brazilian Portuguese language and regional settings, demonstrating advanced evasion techniques. The malware was delivered via a zip archive containing a Windows shortcut that utilized alternate data streams to deploy a 64-bit DLL, which subsequently installed an AutoIt-compiled Guildma payload for credential theft and information stealing. This campaign represents the continued evolution of Brazilian-origin banking trojans that have expanded globally, leveraging sophisticated geofencing and language-based targeting to evade detection and analysis. The use of legitimate cloud infrastructure like Azure websites and advanced evasion techniques demonstrates how threat actors are adapting to modern security controls while maintaining persistence through alternate data streams and AutoIt compilation.
2 weeks ago
Kill Chain
Critical Traefik Proxy Vulnerability Exposes HTTP/3 Timeout Bypass
In December 2024, Bishop Fox disclosed a critical vulnerability in Traefik proxy versions through 3.7.11, identified as CVE-2024-45410. The vulnerability stemmed from Traefik's request read timeout mechanism failing to apply to HTTP/3 connections, despite being enabled by default and documented as universally applied. This gap existed across four years of releases, allowing potential denial-of-service attacks and resource exhaustion through prolonged HTTP/3 connections. Upon responsible disclosure, Traefik maintainers issued a patch within twelve days, addressing the timeout enforcement inconsistency. This vulnerability highlights the growing security challenges in HTTP/3 implementations as organizations rapidly adopt the protocol for performance benefits. With HTTP/3 gaining widespread enterprise adoption and edge proxy deployments increasing, implementation gaps like these represent significant attack surfaces that threat actors are beginning to exploit more frequently.
2 weeks ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports