Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Information Technology/IT

Breach intelligence, attack campaigns, and threat reports targeting the Information Technology/IT sector.

3797 threat reports
Page 231 of 317
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Information Technology/IT Threat Reports

Showing 2761–2772 / 3797 reports
Exposed Security Testing Apps Used to Breach Fortune 500 Cloud Environments (2026)
Computer/Network Security9 months ago

Exposed Security Testing Apps Used to Breach Fortune 500 Cloud Environments (2026)

In January 2026, threat actors exploited misconfigured web applications used for security testing and internal penetration testing—such as DVWA, OWASP Juice Shop, Hackazon, and bWAPP—publicly exposed by Fortune 500 companies and major security vendors. By targeting these intentionally vulnerable apps tied to overly privileged cloud accounts in AWS, GCP, and Azure, attackers gained unauthorized access, deployed Monero (XMR) crypto miners, planted persistent webshells, and pivoted to sensitive cloud assets. Over 1,900 instances were found online, many with default credentials and excessive permissions, exposing secrets and allowing full access to cloud resources including storage buckets and Secrets Manager. Victim organizations remediated after being notified. This incident highlights a growing attack pattern where "friendly" security test and training tools become high-risk assets when mismanaged in cloud environments. Their exploitation underscores pressing gaps in cloud inventory management, IAM least-privilege enforcement, and secret sprawl, at a time of escalating attacks exploiting cloud misconfiguration and supply chain weaknesses.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(high)
Read report
Phishing Campaign Exploits LastPass Users with Fake Vault Backup Alerts
Financial Services9 months ago

Phishing Campaign Exploits LastPass Users with Fake Vault Backup Alerts

In January 2026, LastPass warned users of a sophisticated phishing campaign impersonating official maintenance notifications, urging recipients to back up their password vaults within 24 hours. Attackers crafted convincing emails from spoofed senders with subjects stressing urgency, redirecting victims to a phishing site designed to harvest master passwords or hijack accounts. The campaign coincided with a U.S. holiday weekend, likely aiming to exploit periods of reduced staffing for more effective compromise. The prompt and widespread phishing attempt risked exposure of highly sensitive personal and business credentials, threatening downstream impacts and increased support demand for affected users and organizations. This incident highlights the ongoing evolution of credential harvesting campaigns and demonstrates how adversaries exploit times of operational vulnerability. The use of realistic messages and urgency tactics exemplifies broader trends in social engineering, reinforcing the necessity for user education, resilient authentication practices, and rapid response protocols to counteract increasingly common and dangerous phishing threats targeting password managers.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Credential Stuffing Attempt at PcComponentes: 2024 Incident Overview
Retail Industry9 months ago

Credential Stuffing Attempt at PcComponentes: 2024 Incident Overview

In June 2024, Spanish online retailer PcComponentes confirmed that its systems were targeted by a large-scale credential stuffing attack. While the company denied reports of a data breach affecting 16 million customers, it acknowledged that threat actors attempted to use previously leaked credentials to gain unauthorized access to customer accounts. No evidence of infrastructure compromise or mass data exfiltration was found, and PcComponentes’ internal investigation revealed that protective measures limited the attack’s impact. This incident highlights the ongoing challenges facing retailers from credential-based attacks, emphasizing the importance of stronger identity and access controls. The surge in credential stuffing campaigns reflects broader trends in attacker automation and customer credential reuse across online services.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(medium)
IImpact(high)
Read report
Phishing Campaign Impersonates LastPass, Targets Master Passwords in 2026
Financial Services9 months ago

Phishing Campaign Impersonates LastPass, Targets Master Passwords in 2026

In January 2026, LastPass alerted its users to an active and sophisticated phishing campaign impersonating the company, which sought to trick users into revealing their master passwords. Attackers sent urgent emails—claiming to be scheduled maintenance reminders—directing recipients to phishing sites designed to harvest their credentials. The emails originated from deceptive domains and included subject lines urging immediate backup of password vaults. LastPass emphasized to its users that it does not request master passwords and worked swiftly with partners to dismantle the malicious infrastructure, mitigating immediate risk. This incident highlights the persistent evolution of phishing tactics, particularly those exploiting brand trust and sense of urgency. As password manager adoption grows, attackers increasingly target such platforms, intensifying the need for user vigilance and robust email security controls.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
VoidLink: The First AI-Generated Linux Malware Framework Exposes New Cybersecurity Risks
Information Technology/IT9 months ago

VoidLink: The First AI-Generated Linux Malware Framework Exposes New Cybersecurity Risks

In late 2025, cybersecurity researchers uncovered VoidLink, a sophisticated Linux malware framework reportedly developed primarily by a single actor leveraging artificial intelligence. Analyses by Check Point Research and Sysdig identified operational artifacts and systematic code features—like consistent formatting, template-based responses, and AI-generated debug logs—suggesting heavy use of large language models in the malware’s rapid development. The threat actor, operating in a Chinese-language environment, utilized AI tools such as TRAE SOLO to expedite Spec Driven Development, producing 88,000 lines of attack-ready code in less than a week. While no real-world infections have been reported to date, VoidLink’s capabilities are significant, aiming at stealthy, long-term access to Linux-based cloud infrastructure. The emergence of AI-generated attack frameworks like VoidLink signals a pivotal change in cybercrime. Advanced threat creation, once limited to state actors or skilled teams, can now be accomplished rapidly by individuals utilizing off-the-shelf AI tools. This trend increases the urgency for organizations to adapt AI-enhanced defenses and revisit zero trust, segmentation, and cloud security controls.

Low impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Zoom & GitLab Issue Critical Security Patches for RCE, DoS, and 2FA Bypass—January 2026
Computer Software/Engineering9 months ago

Zoom & GitLab Issue Critical Security Patches for RCE, DoS, and 2FA Bypass—January 2026

In January 2026, Zoom and GitLab simultaneously released critical security updates to mitigate multiple high-severity vulnerabilities uncovered in their respective platforms. Zoom's most impactful flaw, CVE-2026-22844 (CVSS 9.9), affected its Node Multimedia Routers (MMRs), potentially enabling a meeting participant to perform remote code execution via a command injection. GitLab, meanwhile, addressed several vulnerabilities including two denial-of-service (DoS) issues and a two-factor authentication (2FA) bypass flaw (CVE-2026-0723), which could let malicious actors disrupt services or compromise user accounts if they knew credential IDs. While no active exploitation was reported, organizations using Zoom’s Node MMR module and GitLab’s CE/EE deployments were urged to patch immediately to avoid significant business disruption or data compromise. The disclosure of these vulnerabilities highlights the increasing sophistication and severity of threats targeting software supply chains and critical collaboration platforms. With attackers frequently seeking novel vectors for RCE, DoS, and authentication bypass, timely patching and robust segmentation remain crucial.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(low)
IImpact(medium)
Read report
Chainlit AI Framework Flaws Expose Sensitive Data: What Organizations Need to Know
Computer Software/Engineering9 months ago

Chainlit AI Framework Flaws Expose Sensitive Data: What Organizations Need to Know

In January 2026, serious security flaws were disclosed in the popular open-source Chainlit artificial intelligence (AI) framework, exposing organizations to substantial data theft and privilege escalation risks. The vulnerabilities—CVE-2026-22218 (arbitrary file read) and CVE-2026-22219 (server-side request forgery/SSRF)—allowed authenticated attackers to steal sensitive files, such as API keys and credentials, and leverage SSRF to access internal or cloud network services. Exploiting these flaws, attackers could combine vectors for lateral movement across environments, potentially leading to broader compromise of AI-powered systems and cloud infrastructures. Both issues were patched in version 2.9.4 following responsible disclosure. This breach is highly relevant as adoption of AI frameworks accelerates and attackers increasingly target embedded infrastructure weaknesses, combining known vulnerabilities with emerging AI application risks. The incident underscores why organizations must adapt security controls and continuously monitor new technology stacks for widely exploitable flaws.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
North Korean PurpleBravo Fakes Job Interviews to Breach Global Firms: 2026 Incident Analysis
Computer Software/Engineering9 months ago

North Korean PurpleBravo Fakes Job Interviews to Breach Global Firms: 2026 Incident Analysis

In January 2026, the North Korean-aligned PurpleBravo threat group orchestrated a sophisticated social engineering campaign targeting more than 3,000 unique IP addresses. The attackers posed as recruiters from leading firms to lure victims, primarily within AI, cryptocurrency, financial services, IT, marketing, and software development, into fake job interviews. Exploiting trust through convincing communications, PurpleBravo gained access to targeted organizations across Europe, South Asia, the Middle East, and Central America, compromising data and exposing confidential operational environments. This campaign underscores the evolution of nation-state social engineering methods, leveraging supply chain trust and exploiting interest in career mobility. As geopolitical tensions rise and attackers continually refine techniques, organizations must double down on identity-centric security and awareness to mitigate evolving social engineering risks.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(low)
Read report
PurpleBravo’s North Korean Supply-Chain Attack Exposes Hidden Risks to IT Outsourcing in 2025
Computer Software/Engineering9 months ago

PurpleBravo’s North Korean Supply-Chain Attack Exposes Hidden Risks to IT Outsourcing in 2025

Between August 2024 and September 2025, North Korean state-backed group PurpleBravo orchestrated a software supply-chain campaign targeting IT services and software development firms worldwide. Posing as recruiters or fictitious brands, the attackers lured victims—often developers and job seekers—into executing malicious code on corporate endpoints. Through malware like BeaverTail, PyLangGhost, and GolangGhost, PurpleBravo exfiltrated browser credentials and cryptocurrency wallet data while leveraging GitHub, fake websites, and VPN-based command-and-control infrastructure. Over 3,100 IP addresses and 20 organizations in South Asia, Europe, the Middle East, and Central America were exposed as probable victims, amplifying downstream risk to clients of affected IT service providers. This incident underscores a growing trend of sophisticated, targeted software supply-chain attacks exploiting developer trust and recruitment platforms. The campaign’s overlap with other North Korean IT worker operations and its focus on outsourcing regions highlight urgent risks to organizations relying on distributed and third-party development partners.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
CrashFix Browser Scam: How Malicious Extensions Opened the Door to RATs in 2024
Banking/Mortgage9 months ago

CrashFix Browser Scam: How Malicious Extensions Opened the Door to RATs in 2024

In early 2024, security researchers identified a sophisticated malware campaign dubbed the 'CrashFix' scam, which leveraged malicious browser extensions—specifically the NexShield extension—to crash users' browsers via social engineering popups and prompt them to install phony fixes. Victims, lured into installing the extension and then a Python-based remote access trojan (RAT), unknowingly granted attackers deep access to their systems. Once compromised, the RAT enabled persistent monitoring, exfiltration of sensitive data, and possible lateral movement within corporate environments, posing a significant risk to both individuals and organizations. The campaign demonstrated a streamlined chain from initial compromise via engineered browser crashes, through privilege escalation and persistent command-and-control using a multi-stage malware deployment. This incident underscores the growing sophistication of social engineering in malware delivery, the risks of malicious browser extensions, and evolving techniques in drive-by compromise and post-infection control. Increased reliance on browsers for daily business functions and the persistence of endpoint threats make such campaigns highly relevant amid surging attacks targeting remote access and user trust.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
How 'Damn Vulnerable' Training Apps Exposed Security Vendor Clouds in 2024
Computer/Network Security9 months ago

How 'Damn Vulnerable' Training Apps Exposed Security Vendor Clouds in 2024

In early 2024, cybersecurity researchers discovered that widely used 'Damn Vulnerable' training applications, deployed by several prominent security vendors, had been left exposed due to cloud misconfigurations. Hackers exploited over-permissioned cloud environments and insufficient network segmentation to access sensitive IT infrastructure, including internal management consoles and production environments. The attack vector primarily leveraged misconfigured network access and default credentials, enabling lateral movement and potential data exfiltration. The impact included unauthorized access to vendor systems, reputational damage, and concerns over customer data exposure. This incident is particularly relevant today as organizations increasingly adopt cloud-based apps and training environments without adequate security controls. Similar misconfiguration-driven breaches are on the rise, highlighting the urgent need for robust cloud security posture management and Zero Trust strategies to minimize risk.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(high)
IImpact(medium)
Read report
VoidLink: AI-Generated Linux Malware Breaks New Ground in 2024 Hybrid Cloud Attack
Computer Software/Engineering9 months ago

VoidLink: AI-Generated Linux Malware Breaks New Ground in 2024 Hybrid Cloud Attack

In early 2024, security researchers uncovered VoidLink, a sophisticated Linux malware framework developed almost entirely by autonomous AI agents. The attack chain involved highly original code and TTPs that bypassed standard detection, enabling attackers to move laterally within targeted cloud and hybrid environments. Exploiting gaps in east-west segmentation and encrypted data exfiltration, VoidLink established resilient command-and-control channels and evaded traditional intrusion prevention measures, exposing sensitive internal traffic and critical workloads to theft and disruption. Operational impacts included potential data loss, regulatory exposure, and interruptions to secure network functions across multiple organizations. The emergence of AI-generated malware like VoidLink signals a paradigm shift in cyber threats, where autonomous code can outpace conventional defenses and rapidly adapt to security controls. This incident underlines the urgent need for organizations to evolve their security posture with advanced segmentation, visibility, and automation to counter the accelerating threat of agentic and AI-enabled attacks.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports