Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Information Technology/IT

Breach intelligence, attack campaigns, and threat reports targeting the Information Technology/IT sector.

3797 threat reports
Page 217 of 317
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Information Technology/IT Threat Reports

Showing 2593–2604 / 3797 reports
Cline 2026 Supply Chain Attack: Lessons Learned
Computer Software/Engineering8 months ago

Cline 2026 Supply Chain Attack: Lessons Learned

In February 2026, the Cline CLI npm package, a widely used AI coding assistant, was compromised through a supply chain attack. An unauthorized party exploited a stolen npm publish token to release version 2.3.0, which included a postinstall script that silently installed the OpenClaw package globally on users' machines. This malicious version was available for approximately eight hours before being deprecated, during which it was downloaded over 4,000 times. While OpenClaw itself is not malicious, its unauthorized installation raised significant security concerns. This incident underscores the escalating threat of supply chain attacks targeting developer tools and the necessity for robust security measures in software distribution pipelines.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
OpenClaw 2026 Infostealer Malware Attack: A Wake-Up Call for AI Security
Computer Software/Engineering8 months ago

OpenClaw 2026 Infostealer Malware Attack: A Wake-Up Call for AI Security

In February 2026, OpenClaw, an open-source AI assistant formerly known as Clawdbot and Moltbot, became the target of infostealer malware. Cybersecurity firm Hudson Rock reported that attackers exploited OpenClaw's configuration, which stores sensitive information like API keys and authentication tokens, to extract valuable data. The malware accessed these configurations during standard data-grabbing operations, leading to potential exposure of user credentials and other sensitive information. This incident underscores the growing vulnerability of AI assistant tools as they become more integrated into professional workflows. ([techradar.com](https://www.techradar.com/pro/security/openclaw-ai-agents-targeted-by-infostealer-malware-for-the-first-time?utm_source=openai)) The attack highlights a significant shift in malware trends, with cybercriminals developing specialized modules to target AI agent configurations. As AI assistants like OpenClaw gain popularity, they present new attack surfaces for threat actors, emphasizing the need for robust security measures and vigilant monitoring to protect sensitive data.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
OpenClaw 2026: Critical Supply Chain Vulnerabilities Uncovered
Computer Software/Engineering8 months ago

OpenClaw 2026: Critical Supply Chain Vulnerabilities Uncovered

In early 2026, multiple critical vulnerabilities were discovered in OpenClaw, an open-source AI assistant platform. These included CVE-2026-25253, allowing remote code execution via crafted URLs, and CVE-2026-24763, enabling command injection through unsafe handling of environment variables. Exploitation of these flaws could grant attackers unauthorized access to systems, leading to data breaches and system compromises. OpenClaw has since released patches to address these issues. ([smarttech247.com](https://www.smarttech247.com/threat-intel-reports/critical-openclaw-vulnerability-allows-1-click-remote-code-execution?utm_source=openai)) The rapid adoption of AI assistant tools like OpenClaw underscores the importance of securing software supply chains. Organizations must remain vigilant, ensuring timely updates and thorough vetting of third-party extensions to mitigate emerging threats in AI ecosystems.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
BeyondTrust's Critical RCE Vulnerability: A 2026 Cybersecurity Wake-Up Call
Information Technology/IT8 months ago

BeyondTrust's Critical RCE Vulnerability: A 2026 Cybersecurity Wake-Up Call

In February 2026, BeyondTrust disclosed a critical pre-authentication remote code execution (RCE) vulnerability, CVE-2026-1731, affecting its Remote Support (RS) and Privileged Remote Access (PRA) products. This flaw allows unauthenticated attackers to execute operating system commands remotely, potentially leading to full system compromise, unauthorized access, data exfiltration, and service disruption. The vulnerability impacts Remote Support versions 25.3.1 and prior, and Privileged Remote Access versions 24.3.4 and prior. BeyondTrust applied patches for SaaS customers on February 2, 2026, but self-hosted customers must manually apply updates to mitigate the risk. ([helpnetsecurity.com](https://www.helpnetsecurity.com/2026/02/09/beyondtrust-remote-access-vulnerability-cve-2026-1731/?utm_source=openai)) The rapid exploitation of CVE-2026-1731 underscores the increasing speed at which threat actors leverage newly disclosed vulnerabilities. Within 24 hours of a proof-of-concept exploit being released, attackers began targeting vulnerable systems. This incident highlights the critical importance of timely patch management and proactive security measures to defend against emerging threats. ([helpnetsecurity.com](https://www.helpnetsecurity.com/2026/02/13/beyondtrust-cve-2026-1731-poc-exploit-activity/?utm_source=openai))

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Salt Typhoon 2024: A Wake-Up Call for Cybersecurity in Telecommunications
Telecommunications8 months ago

Salt Typhoon 2024: A Wake-Up Call for Cybersecurity in Telecommunications

In 2024, the Chinese state-sponsored hacking group known as Salt Typhoon orchestrated a comprehensive cyber espionage campaign targeting U.S. telecommunications infrastructure. By exploiting vulnerabilities in network devices, the group infiltrated major telecom networks, gaining persistent access to sensitive data, including call logs and private communications of high-profile individuals. This breach compromised critical infrastructure and posed significant national security risks. ([en.wikipedia.org](https://en.wikipedia.org/wiki/Salt_Typhoon?utm_source=openai)) The incident underscores the evolving sophistication of state-sponsored cyber threats and highlights the urgent need for robust cybersecurity measures. Organizations must prioritize fundamental practices such as zero trust architectures, least-privilege access, and end-to-end encryption to mitigate similar threats. ([en.wikipedia.org](https://en.wikipedia.org/wiki/Salt_Typhoon?utm_source=openai))

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Change Healthcare's 2024 Ransomware Attack: A Wake-Up Call for Healthcare Cybersecurity
Health Care / Life Sciences8 months ago

Change Healthcare's 2024 Ransomware Attack: A Wake-Up Call for Healthcare Cybersecurity

In February 2024, Change Healthcare, a subsidiary of UnitedHealth Group, suffered a significant ransomware attack orchestrated by the Russian group ALPHV (BlackCat). The attackers exploited a server lacking multifactor authentication, gaining unauthorized access and encrypting critical systems. This breach disrupted essential healthcare operations nationwide, including insurance eligibility verification, prescription processing, and claims management, affecting approximately 190 million individuals. The incident underscored the vulnerabilities in third-party service providers within the healthcare sector, prompting the Department of Health and Human Services to intensify efforts in identifying and mitigating such risks. The attack's magnitude and impact have led to increased regulatory scrutiny and a reevaluation of cybersecurity practices across the industry.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Ukrainian National Sentenced for Facilitating North Korean IT Worker Scheme
Information Technology/IT8 months ago

Ukrainian National Sentenced for Facilitating North Korean IT Worker Scheme

In February 2026, Ukrainian national Oleksandr Didenko was sentenced to five years in U.S. federal prison for orchestrating a scheme that enabled North Korean IT workers to fraudulently secure employment at 40 American companies. Didenko operated the website upworksell.com, through which he sold stolen U.S. citizens' identities, facilitating the creation of over 2,500 fraudulent accounts on various platforms. These actions allowed North Korean operatives to infiltrate U.S. businesses, diverting hundreds of thousands of dollars to the North Korean regime, thereby supporting its munitions programs. This case underscores the persistent threat posed by state-sponsored cyber operations and the exploitation of identity theft to circumvent international sanctions. The incident highlights the critical need for robust identity verification processes and vigilant monitoring of remote workforces to prevent unauthorized access and protect national security interests.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
ShinyHunters' 2026 Attack: Exploiting OAuth Device Code Flow in Microsoft Entra
Information Technology/IT8 months ago

ShinyHunters' 2026 Attack: Exploiting OAuth Device Code Flow in Microsoft Entra

In early 2026, the cybercriminal group ShinyHunters orchestrated a sophisticated attack targeting Microsoft Entra accounts. By combining device code phishing with voice phishing (vishing), they exploited the OAuth 2.0 Device Authorization flow. Attackers generated legitimate device codes and, through impersonation of IT staff, convinced employees to enter these codes on authentic Microsoft login pages. This manipulation granted the attackers valid authentication tokens, enabling unauthorized access to victims' accounts and associated Single Sign-On (SSO) applications, including Microsoft 365, Salesforce, and Google Workspace. The breach led to significant data exfiltration and subsequent extortion attempts. This incident underscores a concerning evolution in phishing tactics, moving beyond traditional credential theft to the exploitation of trusted authentication processes. The success of such attacks highlights the pressing need for organizations to adopt phishing-resistant multi-factor authentication (MFA) methods and to enhance employee awareness regarding emerging social engineering techniques.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Nigerian Hacker Sentenced for Tax Firm Breach Using Warzone RAT
Accounting8 months ago

Nigerian Hacker Sentenced for Tax Firm Breach Using Warzone RAT

Between June 2016 and June 2021, Nigerian national Matthew Abiodun Akande orchestrated a sophisticated cyber intrusion targeting multiple tax preparation firms in Massachusetts. Utilizing phishing emails that impersonated a CEO, Akande deployed the Warzone remote-access trojan (RAT) to infiltrate the firms' networks. This allowed him to steal clients' personal information, leading to the filing of over 1,000 fraudulent tax returns and the illicit collection of more than $1.3 million in refunds. Akande was arrested in October 2024 at London's Heathrow Airport, extradited to the United States in March 2025, and sentenced to eight years in prison in February 2026. ([justice.gov](https://www.justice.gov/usao-ma/pr/nigerian-man-sentenced-eight-years-prison-computer-intrusion-and-theft?utm_source=openai)) This incident underscores the persistent threat posed by sophisticated phishing campaigns and the use of advanced malware like RATs in financial fraud schemes. It highlights the critical need for organizations, especially those handling sensitive client data, to implement robust cybersecurity measures and employee training to prevent such breaches.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Infostealer Credential Theft Surges 800% in 2025
Financial Services8 months ago

Infostealer Credential Theft Surges 800% in 2025

In 2025, cybercriminals escalated their use of infostealer malware, leading to the theft of 1.8 billion credentials—a staggering 800% increase compared to the previous year. These infostealers infiltrated 5.8 million devices, extracting sensitive data such as login credentials, cookies, and financial information. The stolen credentials were subsequently sold on dark web marketplaces, facilitating further cyberattacks including ransomware and data breaches. Notably, major organizations like Deloitte, KPMG, and Samsung fell victim to these attacks due to inadequate enforcement of multi-factor authentication (MFA), underscoring the critical need for robust security measures. ([infosecurity-magazine.com](https://www.infosecurity-magazine.com/news/staggering-800-rise-infostealer/?utm_source=openai)) This surge in credential theft highlights a significant shift in cybercriminal tactics, emphasizing the exploitation of identity-based vulnerabilities. The convergence of infostealers and ransomware has created rapid extortion chains, where stolen credentials are quickly leveraged to deploy ransomware within organizations. This trend underscores the urgency for businesses to implement comprehensive security strategies, including the enforcement of MFA, regular credential monitoring, and employee education on phishing and malware threats. ([cyfirma.com](https://www.cyfirma.com/research/the-convergence-of-infostealers-and-ransomware-from-credential-harvesting-to-rapid-extortion-chains/?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
Microsoft Patches Critical Privilege Escalation Vulnerability in Windows Admin Center
Information Technology/IT8 months ago

Microsoft Patches Critical Privilege Escalation Vulnerability in Windows Admin Center

In February 2026, Microsoft disclosed a critical security vulnerability (CVE-2026-26119) in Windows Admin Center, a browser-based management tool for Windows environments. This flaw, rated with a CVSS score of 8.8, stemmed from improper authentication mechanisms, allowing authorized attackers to escalate their privileges over a network. The vulnerability was patched in Windows Admin Center version 2511, released in December 2025. While no active exploitation was reported at the time, Microsoft assessed the likelihood of exploitation as high. This incident underscores the importance of timely software updates and robust authentication protocols. Organizations relying on Windows Admin Center should ensure they have applied the latest patches to mitigate potential risks associated with privilege escalation vulnerabilities.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
AI-Powered Cyberattacks Surge in 2026: A New Era of Cyber Threats
Financial Services8 months ago

AI-Powered Cyberattacks Surge in 2026: A New Era of Cyber Threats

In 2026, the cybersecurity landscape witnessed a significant escalation in AI-powered cyberattacks. Threat actors, including state-sponsored groups from Russia, China, Iran, and North Korea, increasingly leveraged artificial intelligence to automate and enhance their cyber operations. This resulted in a dramatic surge in attack frequency and sophistication, with automated scans reaching 36,000 per second globally. Notably, the ShinyHunters group orchestrated a series of social engineering campaigns targeting enterprise single sign-on (SSO) environments, leading to data breaches at major organizations. Additionally, the first known AI-orchestrated cyberattack was reported by Anthropic, involving a Chinese state-sponsored group using a jailbroken AI tool to conduct a sophisticated cyber-espionage campaign targeting multiple institutions. ([apnews.com](https://apnews.com/article/ad678e5192dd747834edf4de03ac84ee?utm_source=openai)) The current relevance of these incidents is underscored by the rapid evolution of AI-driven cyber threats. The integration of AI into cyberattack methodologies has not only increased the speed and scale of attacks but also introduced new attack vectors, such as AI-generated deepfakes and autonomous agent-driven attacks. This trend highlights the urgent need for organizations to adopt AI-enhanced defensive strategies and continuous threat exposure management to effectively counter these emerging threats. ([apnews.com](https://apnews.com/article/846847536f6feb2bbb423943fd96e1f1?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports