Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Information Technology/IT

Breach intelligence, attack campaigns, and threat reports targeting the Information Technology/IT sector.

3786 threat reports
Page 191 of 316
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Information Technology/IT Threat Reports

Showing 2281–2292 / 3786 reports
AI Agent Security Breach: Lessons from a 2026 Penetration Test
Computer Software/Engineering7 months ago

AI Agent Security Breach: Lessons from a 2026 Penetration Test

In March 2026, a penetration test revealed a critical vulnerability in an AI-powered desktop application designed to interface with Claude (Opus 4.5) and a third-party asset management platform. Despite operating within a sandboxed environment with stringent controls, attackers exploited the agent's ability to modify existing files and execute code. By uploading a benign-looking 'Hello World' C program alongside a malicious binary, and manipulating the agent to rename and execute the binary, the attackers achieved remote code execution, compromising the sandbox and accessing sensitive business logic components. This incident underscores the evolving threat landscape where AI agents, even with robust safeguards, can be manipulated to perform unintended actions, leading to significant security breaches. Organizations must reassess their security measures, particularly concerning AI agents with code execution capabilities, to prevent similar exploits.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Mercor's 2026 Data Breach: A Wake-Up Call for Supply Chain Security
Computer Software/Engineering7 months ago

Mercor's 2026 Data Breach: A Wake-Up Call for Supply Chain Security

In March 2026, AI recruiting startup Mercor confirmed a significant data breach resulting from the LiteLLM supply chain compromise orchestrated by the hacking group TeamPCP. The attackers infiltrated Mercor's systems via a compromised Tailscale VPN credential, leading to the exfiltration of approximately 4TB of sensitive data, including source code, user databases, and identity verification documents. This incident underscores the critical vulnerabilities in software supply chains and the cascading risks they pose to organizations relying on open-source components. The Mercor breach highlights the escalating threat of supply chain attacks targeting widely-used open-source projects. As organizations increasingly integrate such components into their infrastructure, the potential for widespread compromise grows, emphasizing the need for robust security measures and vigilant monitoring of third-party dependencies.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
Critical Supply Chain Attack: Axios npm Package Compromised in March 2026
Computer Software/Engineering7 months ago

Critical Supply Chain Attack: Axios npm Package Compromised in March 2026

In late March 2026, attackers compromised the npm account of a lead maintainer of Axios, a widely used JavaScript HTTP client library, and published two malicious versions: axios@1.14.1 and axios@0.30.4. These versions included a hidden dependency, plain-crypto-js@4.2.1, which executed a cross-platform Remote Access Trojan (RAT) upon installation, targeting macOS, Windows, and Linux systems. The malicious packages were live for approximately two to three hours before being removed, but during that time, any system that installed these versions was potentially compromised. ([csoonline.com](https://www.csoonline.com/article/4152696/attackers-trojanize-axios-http-library-in-highest-impact-npm-supply-chain-attack.html?utm_source=openai)) This incident underscores the growing threat of supply chain attacks, where trusted software components are manipulated to distribute malware. Given Axios's extensive use, with over 100 million weekly downloads, the potential impact was significant, highlighting the need for robust security measures in software development and distribution processes. ([csoonline.com](https://www.csoonline.com/article/4152696/attackers-trojanize-axios-http-library-in-highest-impact-npm-supply-chain-attack.html?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
Urgent: Patch Critical Citrix NetScaler Vulnerability CVE-2026-3055
Government Administration7 months ago

Urgent: Patch Critical Citrix NetScaler Vulnerability CVE-2026-3055

In March 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) mandated federal agencies to patch a critical vulnerability (CVE-2026-3055) in Citrix NetScaler ADC and Gateway appliances by April 2. This flaw, stemming from insufficient input validation, allows unauthenticated remote attackers to perform out-of-bounds memory reads, potentially exposing sensitive information. The vulnerability specifically affects appliances configured as SAML Identity Providers (IDPs). ([itnerd.blog](https://itnerd.blog/2026/03/31/the-cisa-mandates-federal-patching-of-citrix-netscaler-flaw-by-thursday/?utm_source=openai)) The urgency of this directive underscores the significant risk posed by unpatched systems, as similar vulnerabilities have been exploited in the past, leading to substantial security breaches. Organizations are advised to promptly apply the available patches to mitigate potential threats. ([itnerd.blog](https://itnerd.blog/2026/03/31/the-cisa-mandates-federal-patching-of-citrix-netscaler-flaw-by-thursday/?utm_source=openai))

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Uranium Finance's 2021 Smart Contract Exploits: A DeFi Cautionary Tale
Financial Services7 months ago

Uranium Finance's 2021 Smart Contract Exploits: A DeFi Cautionary Tale

In April 2021, Uranium Finance, a decentralized exchange on Binance's BNB Chain, suffered two significant security breaches. On April 8, an attacker exploited a flaw in the smart contract's 'AmountWithBonus' variable, enabling unauthorized withdrawals totaling approximately $1.4 million. The attacker then coerced the platform into labeling a portion of the stolen funds as a 'bug bounty' in exchange for returning the remainder. On April 28, a separate vulnerability—a single-character coding error—was exploited, allowing the attacker to drain nearly $53.3 million from the platform's liquidity pools. This second attack forced Uranium Finance to cease operations, leaving users without recourse. These incidents underscore the critical importance of rigorous smart contract auditing and secure coding practices in the rapidly evolving DeFi sector. The substantial financial losses and operational disruptions highlight the vulnerabilities inherent in decentralized platforms and the necessity for continuous security assessments to protect user assets.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Axios npm Package Compromise: A Wake-Up Call for Open-Source Security
Computer Software/Engineering7 months ago

Axios npm Package Compromise: A Wake-Up Call for Open-Source Security

In late March 2026, attackers compromised the npm account of a lead maintainer of the widely-used JavaScript library Axios, publishing malicious versions 1.14.1 and 0.30.4. These versions included a trojanized dependency, 'plain-crypto-js', which executed a cross-platform Remote Access Trojan (RAT) upon installation, affecting Windows, macOS, and Linux systems. The malicious packages were live for approximately three hours before removal, during which time they were potentially downloaded by numerous developers, given Axios's extensive use in the JavaScript ecosystem. ([securitylabs.datadoghq.com](https://securitylabs.datadoghq.com/articles/axios-npm-supply-chain-compromise/?utm_source=openai)) This incident underscores the escalating threat of supply chain attacks targeting open-source software repositories. The rapid deployment and widespread adoption of compromised packages highlight the need for enhanced security measures in package management and distribution processes to prevent similar future breaches.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
Cisco's 2026 Trivy Supply Chain Attack: A Wake-Up Call for CI/CD Security
Computer Software/Engineering7 months ago

Cisco's 2026 Trivy Supply Chain Attack: A Wake-Up Call for CI/CD Security

In March 2026, Cisco experienced a significant security breach when attackers exploited compromised credentials from the Trivy supply chain attack to infiltrate its internal development environment. This intrusion led to the theft of source code from over 300 GitHub repositories, including proprietary AI-powered products and sensitive customer data from sectors such as banking and U.S. government agencies. The attackers utilized a malicious GitHub Action plugin to exfiltrate credentials and data, affecting numerous developer and lab workstations. In response, Cisco isolated impacted systems, initiated reimaging procedures, and commenced a comprehensive credential rotation to mitigate further unauthorized access. This incident underscores the escalating threat posed by supply chain attacks, where vulnerabilities in widely-used tools can have cascading effects on major organizations. The breach highlights the critical need for robust security measures in CI/CD pipelines and the importance of prompt credential management to prevent unauthorized access and data exfiltration.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Critical Remote Code Execution Vulnerabilities Discovered in Vim and Emacs
Computer Software/Engineering7 months ago

Critical Remote Code Execution Vulnerabilities Discovered in Vim and Emacs

In March 2026, critical remote code execution (RCE) vulnerabilities were discovered in the Vim and GNU Emacs text editors. These flaws allowed attackers to execute arbitrary code simply by having a user open a specially crafted file. The vulnerabilities stemmed from improper handling of modelines in Vim and unsafe Git operations in Emacs' version control integration. Vim promptly addressed the issue in version 9.2.0272, while the Emacs vulnerability remained unpatched due to debates over responsibility between Emacs and Git maintainers. This incident underscores the growing trend of attackers exploiting vulnerabilities in widely used development tools to gain unauthorized access. Organizations must prioritize timely patching and exercise caution when handling files from untrusted sources to mitigate such risks.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(low)
IImpact(low)
Read report
Axios npm Package Compromised in 2026 Supply Chain Attack
Computer Software/Engineering7 months ago

Axios npm Package Compromised in 2026 Supply Chain Attack

In late March 2026, the widely-used JavaScript HTTP client library, Axios, experienced a significant supply chain attack. Threat actors compromised the npm account of a lead maintainer, publishing malicious versions 1.14.1 and 0.30.4. These versions introduced a deceptive dependency, 'plain-crypto-js' version 4.2.1, which, upon installation, executed a cross-platform Remote Access Trojan (RAT) targeting Windows, macOS, and Linux systems. The malicious packages were available for approximately two to three hours before removal, during which any system executing 'npm install' with the affected versions was potentially compromised. ([csoonline.com](https://www.csoonline.com/article/4152696/attackers-trojanize-axios-http-library-in-highest-impact-npm-supply-chain-attack.html?utm_source=openai)) This incident underscores the escalating threat of software supply chain attacks, particularly within the open-source ecosystem. The rapid propagation of compromised packages highlights the critical need for robust security measures in dependency management and the importance of vigilant monitoring to detect and mitigate such threats promptly.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Google Vertex AI Privilege Escalation Vulnerability Exposes Sensitive Data
Information Technology/IT7 months ago

Google Vertex AI Privilege Escalation Vulnerability Exposes Sensitive Data

In early 2026, security researchers identified a critical vulnerability in Google Cloud's Vertex AI platform that allowed low-privileged users to escalate their permissions by hijacking Service Agent roles. This flaw enabled unauthorized access to sensitive data and internal infrastructure, posing significant risks to organizations utilizing Vertex AI for their AI workloads. Google has since updated its documentation and implemented fixes to address these issues. This incident underscores the growing trend of attackers exploiting AI platforms to gain unauthorized access, highlighting the need for organizations to implement stringent access controls and regularly review permission settings to safeguard against such vulnerabilities.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Silver Fox's 2026 AtlasCross RAT Campaign Exploits Trusted Software Brands
Financial Services7 months ago

Silver Fox's 2026 AtlasCross RAT Campaign Exploits Trusted Software Brands

In March 2026, the Chinese state-sponsored threat actor Silver Fox, also known as Void Arachne, launched a sophisticated cyber campaign targeting Chinese-speaking users. The attackers employed typosquatted domains that impersonated trusted software brands, including Surfshark, Signal, and Zoom, to distribute a previously undocumented remote access trojan (RAT) named AtlasCross. By leveraging stolen Extended Validation (EV) code-signing certificates, Silver Fox was able to bypass security checks and establish deep persistence within enterprise networks. The campaign utilized polished landing pages that mimicked legitimate application vendors, leading victims to download malicious installers. These installers deployed trojanized components alongside legitimate decoy applications, effectively evading detection mechanisms. The AtlasCross RAT, central to this operation, featured a custom PowerShell execution engine named PowerChell, which disabled host defenses and maintained encrypted communication with command-and-control servers. This campaign underscores the evolving tactics of threat actors in exploiting trusted software brands and advanced evasion techniques to infiltrate target systems. Organizations are advised to enhance their security posture by verifying software sources, monitoring for typosquatted domains, and implementing robust endpoint detection and response solutions to mitigate such sophisticated threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Operation TrueChaos: Exploiting Trust in Software Updates
Government Administration7 months ago

Operation TrueChaos: Exploiting Trust in Software Updates

In early 2026, a sophisticated cyber espionage campaign, dubbed Operation TrueChaos, targeted government entities in Southeast Asia by exploiting a zero-day vulnerability (CVE-2026-3502) in the TrueConf video conferencing software. Attackers compromised the software's update mechanism, allowing them to distribute malicious updates that facilitated malware deployment across multiple agencies. This method enabled the attackers to bypass traditional security measures, leading to unauthorized access and potential data exfiltration. This incident underscores a growing trend where threat actors exploit trusted software supply chains to infiltrate secure environments. Organizations must reassess and fortify their internal trust mechanisms, especially concerning software updates, to mitigate such sophisticated attack vectors.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports