Information Technology/IT
Breach intelligence, attack campaigns, and threat reports targeting the Information Technology/IT sector.
Explore Other Sectors
Information Technology/IT Threat Reports
ShinyHunters' 2026 Data Breaches: A Wake-Up Call for Cybersecurity
In May 2026, the cybercriminal group ShinyHunters executed a series of data breaches targeting multiple organizations, including DentaQuest, a prominent dental benefits administrator in the United States. The attackers employed sophisticated social engineering techniques, such as voice phishing, to compromise employee credentials and gain unauthorized access to sensitive systems. This led to the exfiltration of substantial volumes of personal and proprietary data, which ShinyHunters subsequently threatened to release unless ransom demands were met. The breaches have raised significant concerns regarding data security practices and the effectiveness of current defensive measures against such targeted attacks. The recent surge in ShinyHunters' activities underscores a troubling trend in cybercrime, where threat actors increasingly leverage social engineering to bypass technical defenses. Organizations across various sectors are now facing heightened risks of data breaches, emphasizing the urgent need for enhanced security protocols, employee training, and robust incident response strategies to mitigate the impact of such sophisticated cyber threats.
3 months ago
Kill Chain
Malicious npm Package 'codexui-android' Compromises OpenAI Codex Tokens
In May 2026, a malicious supply chain attack targeted developers using OpenAI Codex through a seemingly legitimate npm package named 'codexui-android'. This package, advertised as a remote web UI for OpenAI Codex, amassed over 29,000 weekly downloads. Approximately a month after its initial release, the package began exfiltrating users' Codex authentication tokens to an attacker-controlled server, granting unauthorized access to developers' accounts. The malicious code was embedded into a functional npm package that had undergone active development, making it particularly insidious. The associated GitHub repository remained clean, further complicating detection. ([thehackernews.com](https://thehackernews.com/2026/06/openai-codex-authentication-tokens.html?utm_source=openai)) This incident underscores the growing sophistication of supply chain attacks, where threat actors leverage trusted development tools to infiltrate systems. The use of a functional and actively developed package to distribute malicious code highlights the need for heightened vigilance in the software development community. Developers are urged to scrutinize third-party packages, even those with established reputations, to mitigate the risk of credential theft and unauthorized access.
3 months ago
Kill Chain
Operation Dragon Weave: Unveiling a Sophisticated Cyber Espionage Campaign
Operation Dragon Weave is a cyber espionage campaign identified in May 2026, targeting officials and citizens in the Czech Republic and Taiwan. The attackers employed spear-phishing emails with ZIP attachments to initiate an infection chain that utilized a Rust-based loader to deploy the AdaptixC2 agent, known as AZUREVEIL. This agent facilitated data exfiltration and remote control by leveraging Microsoft Azure Blob Storage for command-and-control communications, effectively blending malicious traffic with legitimate cloud activity. The campaign specifically targeted sectors such as government, research, academia, technology, and financial services, indicating a strategic focus on sensitive information. The use of AdaptixC2 in this campaign underscores a growing trend where open-source penetration testing tools are repurposed by threat actors for malicious activities. This incident highlights the need for organizations to enhance their detection capabilities and adopt proactive defense measures to counter sophisticated attack vectors that exploit legitimate cloud services for covert operations.
3 months ago
Kill Chain
SmartApeSG Campaign's Multi-Stage Attack Delivers Unidentified RAT and NetSupport RAT
In late May 2026, the SmartApeSG campaign employed a ClickFix-style fake CAPTCHA page to deliver an unidentified Remote Access Trojan (RAT) to Windows systems. This initial RAT established a connection to a command and control server at 89.110.110[.]119 over TCP port 443, facilitating the subsequent download and installation of the NetSupport Manager RAT. The infection chain involved multiple stages, including the execution of malicious scripts and the deployment of various files to ensure persistence on the compromised host. This incident underscores the evolving tactics of threat actors who leverage social engineering techniques, such as fake verification pages, to deceive users into executing malicious code. The use of legitimate tools like NetSupport Manager for malicious purposes highlights the challenges in detecting and mitigating such threats, emphasizing the need for continuous monitoring and advanced threat detection mechanisms.
3 months ago
Kill Chain
Dutch Authorities Dismantle Massive 17 Million-Device Botnet
In May 2026, Dutch authorities dismantled a massive botnet comprising over 17 million infected devices, including computers, smartphones, and IoT devices. The operation, conducted by the Dutch National Police and the National Cyber Security Centre (NCSC), involved seizing more than 200 servers located in the Netherlands that controlled the botnet's infrastructure. The botnet was reportedly linked to Asocks, a company offering residential proxy services, which had been exploited for various cybercriminal activities such as DDoS attacks, phishing, and malware distribution. ([arstechnica.com](https://arstechnica.com/security/2026/05/botnet-of-more-than-17-million-devices-dismantled/?utm_source=openai)) This incident underscores the growing threat posed by large-scale botnets leveraging residential proxy networks to mask malicious activities. The takedown highlights the importance of international cooperation in combating cybercrime and the need for robust security measures to protect consumer devices from being co-opted into such networks.
3 months ago
Kill Chain
CIFSwitch Vulnerability: A Critical Threat to Linux Systems
In May 2026, a critical local privilege escalation vulnerability named 'CIFSwitch' was discovered in the Linux kernel's CIFS subsystem. This flaw allows unprivileged users to forge CIFS authentication key descriptions, exploit the kernel's key request mechanism, and gain root privileges. The vulnerability affects multiple Linux distributions, including Linux Mint, CentOS Stream 9, Rocky Linux 9, AlmaLinux 9, Kali Linux, and SLES 15 SP7, particularly those with cifs-utils versions 6.14 and higher. The issue arises from the kernel's failure to verify that cifs.spnego key requests originate from its CIFS client, enabling attackers to manipulate the authentication workflow and execute arbitrary code with root privileges. The discovery of CIFSwitch underscores the persistent risks associated with longstanding vulnerabilities in widely used systems. Its exploitation highlights the necessity for organizations to promptly apply security patches, review system configurations, and implement robust monitoring to detect and mitigate potential threats arising from such vulnerabilities.
3 months ago
Kill Chain
Urgent: PAN-OS GlobalProtect Authentication Bypass Vulnerability (CVE-2026-0257) Exploited in the Wild
In May 2026, Palo Alto Networks disclosed an authentication bypass vulnerability (CVE-2026-0257) in its PAN-OS software, affecting GlobalProtect portals and gateways. This flaw allows unauthenticated attackers to establish unauthorized VPN connections, potentially exposing internal networks. The vulnerability impacts specific PAN-OS versions and configurations where authentication override cookies are enabled. Exploitation was observed as early as May 17, 2026, with attackers gaining VPN access to internal networks. While no lateral movement was detected, the unauthorized access poses significant security risks. Organizations are urged to apply patches or mitigations promptly to prevent potential breaches.
3 months ago
Kill Chain
Google Chrome's New DBSC Feature: A Leap Forward in Browser Security
In May 2026, Google announced the general availability of Device Bound Session Credentials (DBSC) in Chrome, a security feature designed to prevent session cookie theft. DBSC cryptographically binds session cookies to a user's device using hardware-backed security modules like the Trusted Platform Module (TPM) on Windows and the Secure Enclave on macOS. This binding ensures that even if session cookies are exfiltrated, they cannot be used on unauthorized devices, thereby mitigating risks associated with session hijacking and account takeovers. ([developer.chrome.com](https://developer.chrome.com/docs/web-platform/device-bound-session-credentials?hl=en&utm_source=openai)) The introduction of DBSC addresses the growing threat posed by infostealer malware, which has been increasingly used to extract session cookies and bypass multi-factor authentication. By implementing DBSC, Google enhances user security by proactively preventing unauthorized access through stolen session cookies, marking a significant advancement in browser security measures. ([techradar.com](https://www.techradar.com/pro/security/google-chrome-rolls-out-a-new-tool-to-try-and-stop-infostealer-malware-in-its-tracks?utm_source=openai))
3 months ago
Kill Chain
Charter Communications Data Breach 2026: A Case Study in Social Engineering Attacks
In early April 2026, Charter Communications, a major U.S. telecommunications provider, experienced a significant data breach orchestrated by the cybercriminal group ShinyHunters. The attackers gained access through a voice phishing (vishing) attack that compromised an employee's Microsoft Entra account, allowing them to infiltrate Charter's Salesforce system. This breach resulted in the exfiltration of personal information from approximately 4.9 million accounts, including names, email addresses, physical addresses, phone numbers, phone types, plan information, support ticket data, and some Customer Proprietary Network Information (CPNI). Charter confirmed the breach but stated that no sensitive personal or CPNI data was exfiltrated. After the company refused to pay the ransom demanded by ShinyHunters, the stolen data was leaked on the dark web. This incident underscores the growing threat posed by sophisticated social engineering attacks targeting employee credentials to access sensitive corporate systems. The breach highlights the critical need for robust security measures, including comprehensive employee training on phishing tactics and the implementation of multi-factor authentication, to prevent unauthorized access and protect customer data.
3 months ago
Kill Chain
Google Engineer Charged with Insider Trading on Polymarket
In May 2026, Michele Spagnuolo, a 36-year-old Google security engineer, was charged with insider trading after allegedly using confidential company data to place bets on the cryptocurrency-based prediction platform Polymarket, resulting in $1.2 million in gains. Spagnuolo accessed internal Google tools containing nonpublic search trend data and, under the alias "AlphaRaccoon," placed bets on Polymarket regarding Google's top trending search terms for 2025. His actions led to charges including commodities fraud, wire fraud, and money laundering, with potential prison sentences ranging from 10 to 20 years if convicted. This incident underscores the growing concerns over the misuse of proprietary information in emerging financial platforms like prediction markets. It highlights the need for robust internal controls and monitoring mechanisms to prevent insider trading and protect the integrity of both corporate data and financial markets.
3 months ago
Kill Chain
Dutch Authorities Dismantle Massive 17 Million-Device Botnet
In May 2026, Dutch authorities dismantled a massive botnet comprising 17 million infected devices, including computers, tablets, and smartphones. The operation involved seizing over 200 servers located in the Netherlands that controlled the botnet's infrastructure. This network was utilized for various cyberattacks, such as distributed denial-of-service (DDoS) attacks and malicious traffic proxying. The botnet was linked to a service called Asocks, which offered proxy services using compromised devices without the owners' knowledge. This incident underscores the growing threat posed by botnets leveraging residential devices, highlighting the need for enhanced security measures to protect consumer hardware from unauthorized exploitation.
3 months ago
Kill Chain
Addressing Container Security Vulnerabilities: Insights from 2026
In 2026, Kaspersky's research highlighted significant security vulnerabilities within containerized environments, emphasizing the risks associated with outdated software, misconfigurations, and the use of untrusted images. The study revealed that 64 out of 100 analyzed Docker images contained critical vulnerabilities, with only 10% being fully up to date. These vulnerabilities expose organizations to potential attacks, including unauthorized access, data breaches, and system compromises. The findings underscore the necessity for organizations to implement robust security measures, such as regular updates, thorough configuration audits, and the use of trusted container images, to safeguard their containerized infrastructures.
3 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports