Information Technology/IT
Breach intelligence, attack campaigns, and threat reports targeting the Information Technology/IT sector.
Explore Other Sectors
Information Technology/IT Threat Reports
Operation FlutterBridge: Unveiling the FlutterShell Backdoor Targeting macOS Users
In June 2026, cybersecurity researchers identified 'Operation FlutterBridge,' a sophisticated malvertising campaign targeting macOS users. This operation distributes a new backdoor named 'FlutterShell,' built using Google's Flutter framework. The campaign employs malicious Google and YouTube advertisements to lure users into downloading seemingly legitimate desktop applications, which, upon execution, install FlutterShell. This malware combines adware functionalities with backdoor capabilities, including shell command execution and file system manipulation. Some variants also exploit AI summarization features for data exfiltration by routing documents through attacker-controlled servers. The campaign is linked to the cybercrime group CL-CRI-1089, previously associated with the JSCoreRunner campaign detected in August 2025. ([unit42.paloaltonetworks.com](https://unit42.paloaltonetworks.com/flutterbridge-new-fluttershell-backdoor/?utm_source=openai)) The use of the Flutter framework in malware development is notable, as it allows attackers to dynamically alter the malware's behavior without recompiling or redistributing the application. This adaptability, combined with the extensive reach of malvertising through trusted platforms like Google and YouTube, underscores the evolving sophistication of cyber threats targeting macOS systems. ([unit42.paloaltonetworks.com](https://unit42.paloaltonetworks.com/flutterbridge-new-fluttershell-backdoor/?utm_source=openai))
3 months ago
Kill Chain
Critical Vulnerability in NAVTOR NavBox Exposes Maritime Operational Data
In March 2026, a critical vulnerability (CVE-2026-2754) was identified in NAVTOR's NavBox version 4.12.0.3, a maritime connectivity device widely used for managing navigation data and ship-shore communications. The flaw allowed unauthenticated remote attackers to access sensitive configuration and operational data through exposed HTTP API endpoints on TCP port 8080. Exploitation of this vulnerability could lead to unauthorized retrieval of internal network parameters, including ECDIS and OT information, device identifiers, and service status logs, posing significant risks to vessel operations and security. This incident underscores the growing cybersecurity challenges in the maritime industry, especially as operational technology systems become increasingly interconnected. The exposure of critical navigation and operational data highlights the urgent need for robust security measures and regular vulnerability assessments to protect against potential cyber threats targeting maritime infrastructure.
3 months ago
Kill Chain
Critical Vulnerability in Claude Code GitHub Action Leads to Repository Hijacking
In June 2026, a critical vulnerability was discovered in Anthropic's Claude Code GitHub Action, allowing attackers to hijack public repositories by exploiting a flaw in the action's workflow permissions. By opening a malicious GitHub issue, attackers could execute arbitrary code, potentially compromising the integrity of affected repositories and their downstream projects. This vulnerability was promptly addressed by Anthropic with the release of claude-code-action v1.0.94. This incident underscores the escalating risks associated with supply chain attacks in software development, particularly those leveraging continuous integration and deployment (CI/CD) pipelines. Organizations must remain vigilant, regularly updating their CI/CD tools and scrutinizing third-party actions to mitigate such vulnerabilities.
3 months ago
Kill Chain
Introducing WasmForge: Revolutionizing Offensive Security with WebAssembly
In June 2026, Praetorian introduced WasmForge, a tool designed to compile Go-based offensive security tools like Sliver into WebAssembly (WASM). This approach enables the creation of binaries that can evade traditional Endpoint Detection and Response (EDR) systems by disguising the tool's signature and behavior. WasmForge achieves this by embedding the WASM module into a Go binary, which acts as a loader, effectively obfuscating the tool's presence and functionality. The release of WasmForge highlights a significant advancement in offensive security methodologies, emphasizing the continuous evolution of evasion techniques. This development underscores the necessity for defensive strategies to adapt rapidly, as threat actors increasingly leverage sophisticated tools to bypass conventional security measures.
3 months ago
Kill Chain
Unveiling 'Otto Support': A Deep Dive into MCP Server Security Flaws
In April 2026, Bishop Fox released 'Otto Support,' a deliberately vulnerable Model Context Protocol (MCP) server designed to expose security flaws in AI agent integrations. This tool demonstrated how AI agents could exploit misconfigurations to escalate privileges and access sensitive data, highlighting critical vulnerabilities in MCP implementations. The project underscored the necessity for robust authentication, authorization, and input validation controls in AI systems. The release of 'Otto Support' is particularly relevant now, as the rapid adoption of AI agents has outpaced the implementation of essential security measures. This initiative serves as a crucial reminder for organizations to proactively assess and fortify their AI infrastructures against emerging threats.
3 months ago
Kill Chain
Critical VS Code Zero-Day Exposes GitHub Repositories
In June 2026, security researcher Ammar Askar disclosed a zero-day vulnerability in Visual Studio Code (VS Code) that enables attackers to steal GitHub OAuth tokens by tricking users into clicking a malicious link. The exploit leverages VS Code's sandboxed webview message-passing system to install malicious extensions, allowing unauthorized access to all private repositories accessible by the victim. This vulnerability remains unpatched, posing a significant risk to developers and organizations relying on VS Code for GitHub repository management. The disclosure underscores the critical need for vigilance in software supply chains, especially concerning widely used development tools. As similar supply chain attacks increase, organizations must implement robust security measures, including regular audits of development environments and cautious evaluation of third-party extensions, to mitigate potential threats.
3 months ago
Kill Chain
Critical Vulnerabilities in Acer Wave 7 Routers: CVE-2026-49200 and CVE-2026-49201
In May 2026, security researcher Gergo Pap identified two critical vulnerabilities in Acer's Wave 7 mesh routers running firmware version T7c_GBL_1.01.000055 or earlier. The first vulnerability (CVE-2026-49200) allows unauthenticated remote access to the 'acer_cgi.log' file via the web interface, exposing cleartext login credentials and enabling unauthorized system access. The second vulnerability (CVE-2026-49201) involves a hardcoded AES encryption key in the 'upload.cgi' binary, permitting attackers to decrypt, modify, and re-encrypt system backups, potentially injecting persistent backdoors into the router. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/acer-warns-of-max-severity-zero-days-affecting-wave-7-routers/?utm_source=openai)) These vulnerabilities underscore the critical importance of securing network infrastructure devices, as they can serve as entry points for attackers to infiltrate organizational networks. The incident highlights the necessity for manufacturers to implement robust security measures, including proper access controls and secure cryptographic practices, to prevent such exposures.
3 months ago
Kill Chain
Marquis Software 2025 Ransomware Breach: A Wake-Up Call for Third-Party Risk Management
In August 2025, Marquis Software Solutions, a fintech firm serving over 70 banks and credit unions, suffered a ransomware attack that compromised sensitive personal and financial data of more than 1.3 million individuals. The breach was attributed to a vulnerability in SonicWall's firewall backup service, which allowed attackers to access Marquis's internal network. Exposed information included names, addresses, Social Security numbers, and financial account details. This incident underscores the critical importance of securing third-party services and the potential cascading effects of supply chain vulnerabilities. ([claimdepot.com](https://www.claimdepot.com/data-breach/marquis-software-solutions-2025?utm_source=openai)) The Marquis breach highlights the escalating risks associated with third-party service providers in the financial sector. As cyberattacks become more sophisticated and supply chain vulnerabilities more prevalent, organizations must adopt comprehensive security measures, including continuous monitoring and regular penetration testing, to safeguard sensitive data and maintain regulatory compliance.
3 months ago
Kill Chain
CISA Alerts on Active Exploitation of Android and Linux Vulnerabilities
In June 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added two critical vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: CVE-2025-48595 and CVE-2022-0492. CVE-2025-48595 is a high-severity integer overflow vulnerability in the Android Framework affecting versions 14 through 16, allowing local privilege escalation without user interaction. CVE-2022-0492 is a privilege escalation flaw in the Linux kernel's cgroups v1 subsystem, enabling attackers to bypass namespace isolation and potentially gain root access on host systems. Both vulnerabilities have been actively exploited in the wild, prompting immediate patching and mitigation efforts. The inclusion of these vulnerabilities in the KEV catalog underscores the persistent threat posed by privilege escalation flaws in widely used operating systems. Organizations are urged to prioritize the application of security updates to mitigate potential exploitation risks and protect their systems from unauthorized access and control.
3 months ago
Kill Chain
Chinese Hackers Deploy Atlas RAT in European Cyberattacks
In early 2026, the Chinese-speaking cybercrime group TA4922 expanded its operations to Europe, targeting organizations in Germany, Italy, the United Kingdom, and South Africa. Utilizing sophisticated phishing campaigns, the group deployed the previously undocumented Atlas RAT malware to gain unauthorized access to networks for financial fraud, data theft, and potential sale of access. The malware's capabilities include system reconnaissance, targeted file theft, keylogging, and audio and webcam recording. This incident underscores a significant shift in TA4922's targeting strategy and highlights the evolving threat landscape where financially motivated cybercriminals employ advanced tools and tactics. Organizations must remain vigilant against such threats, emphasizing the need for robust cybersecurity measures and continuous monitoring to detect and mitigate potential breaches.
3 months ago
Kill Chain
Argamal RAT: A New Threat Hidden in Hentai Games
In April 2026, Kaspersky researchers identified a malware campaign targeting players of hentai games. The attackers distributed trojanized versions of these games, which, upon execution, installed a previously unknown Remote Access Trojan (RAT) named 'Argamal' on the victim's machine. This malware utilized COM hijacking for persistence and, after a few days, downloaded and executed a secondary Trojan, granting attackers full control over the compromised system. The campaign primarily affected users in Russia, Brazil, Germany, and Vietnam. This incident underscores the evolving tactics of cybercriminals who exploit niche user interests to distribute malware. The use of COM hijacking and delayed payload execution highlights the increasing sophistication of such attacks, emphasizing the need for robust cybersecurity measures and user vigilance.
3 months ago
Kill Chain
AI Uncovers Critical Redis Vulnerability: CVE-2026-23479
In June 2026, an autonomous AI tool identified a critical use-after-free vulnerability in Redis, designated as CVE-2026-23479. This flaw, present since version 7.2.0 released in January 2023, allows authenticated users to execute arbitrary OS commands on the host machine. The vulnerability arises from improper error handling in the unblock client flow during blocked command re-execution, potentially leading to remote code execution. Redis addressed this issue with a patch released on May 5, 2026. The discovery underscores the growing role of AI in cybersecurity, particularly in identifying complex vulnerabilities that may evade traditional detection methods. Organizations are urged to update their Redis instances to version 8.6.3 or later to mitigate this risk and to implement robust authentication measures to prevent unauthorized access.
3 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports