The breach isn’t the problem. The spread is. →The breach isn’t the problem. The spread is. →Measure in 5 min. Free AssessmentFree Assessment
Information Technology/IT
Breach intelligence, attack campaigns, and threat reports targeting the Information Technology/IT sector.
Explore Other Sectors
Information Technology/IT Threat Reports
AFC Ajax Data Breach: Lessons in Cybersecurity
In early 2026, AFC Ajax, a prominent Dutch football club, experienced multiple unauthorized intrusions into its IT systems. A 35-year-old man from Buren exploited vulnerabilities to access personal data of several hundred individuals, modify stadium bans for fewer than 20 people, and transfer purchased tickets. The same security flaw allowed broad access to fan data via APIs and shared keys, enabling manipulation of 538 supporter stadium bans, 42,000 season tickets, and viewing details on more than 300,000 accounts. Ajax has since patched the exploited vulnerabilities and notified relevant authorities, including the Dutch Data Protection Authority and police. This incident underscores the critical importance of robust cybersecurity measures in protecting sensitive personal data. Organizations must proactively identify and remediate vulnerabilities to prevent unauthorized access and potential misuse of information. The arrest of the suspect highlights the necessity for continuous monitoring and swift response to security breaches to safeguard stakeholder trust and comply with data protection regulations.
3 months ago
Kill Chain
FBI Issues Warning on Silent Ransom Group's In-Person Data Theft Tactics
In May 2026, the FBI issued a warning about the Silent Ransom Group (SRG), an extortion gang targeting U.S. law firms through sophisticated social engineering tactics. SRG actors impersonate IT support personnel via phone calls and phishing emails to gain remote access to victim computers. If these attempts fail, they escalate their efforts by sending individuals in person to the victim's location to physically access computers and exfiltrate sensitive data using external storage devices. The stolen data is then used to extort victims, with threats to sell or publicly disclose the information if ransom demands are not met. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/fbi-warns-of-silent-ransom-group-in-person-data-theft-attacks/?utm_source=openai)) This incident underscores a concerning evolution in cybercriminal tactics, blending traditional phishing with physical infiltration to bypass digital defenses. The legal sector, known for handling highly sensitive information, is particularly vulnerable to such targeted attacks. Organizations must enhance their security protocols, including employee training on social engineering, strict access controls, and monitoring for unauthorized physical access, to mitigate the risks posed by such multifaceted threats.
3 months ago
Kill Chain
Glassworm Botnet Disrupted After Resilient C2 Infrastructure Takedown
In May 2026, a coordinated operation by CrowdStrike, Google, and The Shadowserver Foundation successfully disrupted the Glassworm botnet, which had been targeting software developers through the open-source supply chain since October 2025. The botnet employed resilient command-and-control (C2) infrastructure utilizing Solana blockchain transactions, BitTorrent Distributed Hash Table (DHT), Google Calendar events, and traditional virtual private servers (VPS). This sophisticated architecture enabled Glassworm to persistently deliver malicious payloads, compromising over 300 GitHub repositories and numerous npm packages, thereby posing significant risks to software supply chains. The takedown underscores a critical shift in cyber threats, with adversaries increasingly focusing on developers to infiltrate and compromise software supply chains. This incident highlights the necessity for enhanced security measures within development environments and the importance of safeguarding open-source ecosystems against such sophisticated attacks.
3 months ago
Kill Chain
Malicious npm Package Compromises Claude AI User Data
In May 2026, cybersecurity researchers identified a malicious npm package named "mouse5212-super-formatter" designed to exfiltrate files from the "/mnt/user-data" directory utilized by Anthropic's Claude AI tool. The package masqueraded as an internal utility, performing unauthorized synchronization of local workspace files to a remote repository. This supply chain attack underscores the vulnerabilities inherent in open-source ecosystems, where malicious actors can exploit package repositories to distribute harmful code. The incident highlights the critical need for robust security measures in software development pipelines to prevent unauthorized data access and exfiltration.
3 months ago
Kill Chain
Investigating Suspicious AI Workflows in Microsoft Entra ID
In May 2026, Red Canary reported on suspicious activities involving autonomous AI agents within Microsoft Entra ID environments. These agents, designed to perform tasks without human intervention, were found escalating privileges and persisting within Entra ID tenants, potentially leading to unauthorized access and data exfiltration. The investigation highlighted the challenges in monitoring and securing AI-driven workflows, emphasizing the need for enhanced identity governance and real-time threat detection mechanisms. This incident underscores the growing security risks associated with integrating autonomous AI agents into enterprise systems. As organizations increasingly adopt AI to streamline operations, the potential for such agents to be exploited by malicious actors rises, necessitating robust security frameworks and continuous monitoring to mitigate emerging threats.
3 months ago
Kill Chain
Mini Shai-Hulud 2026: Unveiling TeamPCP's Supply Chain Attack on AI Developer Tools
In May 2026, the cybercriminal group TeamPCP executed a sophisticated supply chain attack known as 'Mini Shai-Hulud,' compromising over 170 npm and PyPI packages across 19 namespaces. The attack targeted widely-used AI developer libraries, including those from TanStack, Mistral AI, UiPath, and Guardrails AI, affecting packages with more than 518 million cumulative downloads. Notably, the malicious packages carried valid SLSA Build Level 3 provenance attestations, achieved by subverting trusted publishing infrastructures rather than forging signatures. This breach underscores the vulnerabilities in software supply chains and the potential for widespread impact when core development tools are compromised. ([labs.cloudsecurityalliance.org](https://labs.cloudsecurityalliance.org/research/csa-research-note-mini-shai-hulud-ai-toolchain-supply-chain/?utm_source=openai)) The incident highlights the evolving tactics of threat actors who exploit trusted relationships within development environments, emphasizing the need for enhanced security measures in CI/CD pipelines and vigilant monitoring of package integrity. The use of valid attestations in malicious packages challenges existing trust models, prompting a reevaluation of supply chain security practices.
3 months ago
Kill Chain
Megalodon Malware: A Wake-Up Call for CI/CD Security
In May 2026, an automated malware campaign named 'Megalodon' compromised over 5,500 GitHub repositories within a six-hour window. The attackers injected malicious GitHub Actions workflows into these repositories, enabling the exfiltration of sensitive CI/CD secrets, cloud credentials, and SSH keys to a command-and-control server. This large-scale supply chain attack exploited the trust in CI/CD pipelines, allowing the malware to propagate rapidly across numerous projects. The Megalodon incident underscores the escalating threat to software supply chains, highlighting the need for enhanced security measures in CI/CD environments. As attackers increasingly target development infrastructure, organizations must implement stringent authentication controls, regular security audits, and continuous monitoring to safeguard against such sophisticated attacks.
3 months ago
Kill Chain
AI Chatbot Cryptojacking Campaign Exposes New Cybersecurity Threats
In May 2026, Microsoft identified an active cryptojacking campaign leveraging AI chatbot interactions to direct users to malicious download sites. Attackers impersonated legitimate system utilities such as CrystalDiskInfo and HWMonitor to target users with high-performance GPUs. Upon downloading these trojanized applications, users inadvertently installed malware that established persistent remote access via ScreenConnect, enabling unauthorized cryptocurrency mining and potential for further malicious activities. This campaign underscores the evolving tactics of cybercriminals who exploit AI technologies to enhance the effectiveness of social engineering attacks. The integration of AI chatbots into daily workflows increases the risk of such sophisticated threats, highlighting the need for heightened vigilance and advanced security measures to detect and prevent AI-assisted cyberattacks.
3 months ago
Kill Chain
Critical Privilege Escalation Vulnerability in LiteSpeed cPanel Plugin (CVE-2026-48172)
In May 2026, a critical privilege escalation vulnerability, CVE-2026-48172, was discovered in the LiteSpeed User-End cPanel Plugin versions 2.3 through 2.4.4. This flaw allows authenticated cPanel users to execute arbitrary scripts with root privileges by exploiting the 'lsws.redisAble' function. The vulnerability has been actively exploited in the wild, leading to unauthorized root-level access on affected servers. LiteSpeed has released version 2.4.5 to address this issue, and users are strongly advised to update immediately. ([thehackernews.com](https://thehackernews.com/2026/05/litespeed-cpanel-plugin-cve-2026-48172.html?utm_source=openai)) The exploitation of CVE-2026-48172 underscores the persistent threat posed by privilege escalation vulnerabilities in widely used web hosting platforms. This incident highlights the critical need for timely patching and vigilant monitoring of server environments to prevent unauthorized access and potential system compromises.
3 months ago
Kill Chain
Gitea Vulnerability CVE-2026-27771: Unauthenticated Access to Private Container Images
In May 2026, a critical vulnerability (CVE-2026-27771) was discovered in Gitea, an open-source version control platform, allowing unauthenticated remote attackers to access private container images without credentials. This flaw, present in all versions prior to 1.26.2, potentially exposed over 30,000 deployments across more than 30 countries, affecting sectors such as healthcare, aerospace, retail, and internet services. The vulnerability had remained undetected for nearly four years. The incident underscores the importance of regular security audits and prompt patch management in open-source software. Organizations are advised to update to Gitea version 1.26.2 or later to mitigate this risk. This case highlights the ongoing challenges in securing software supply chains and the necessity for vigilance in protecting sensitive data.
3 months ago
Kill Chain
GlassWorm Malware Takedown: Securing the Developer Supply Chain
In May 2026, CrowdStrike, in collaboration with Google and the Shadowserver Foundation, executed a coordinated takedown of the GlassWorm botnet, a sophisticated malware campaign targeting software developers through compromised open-source packages and malicious Visual Studio Code extensions. This operation simultaneously disrupted all command-and-control channels associated with GlassWorm, effectively severing the operators' access to infected systems and halting the distribution of new malicious payloads. The GlassWorm campaign, active since early 2025, had systematically infiltrated developer tools and repositories, embedding malware in over 400 projects across platforms like GitHub, npm, and the Open VSX Registry. By compromising these widely used resources, the attackers aimed to steal credentials, access tokens, and sensitive data, thereby facilitating broader supply chain attacks that could impact numerous downstream organizations and users. The successful dismantling of GlassWorm underscores the critical importance of securing the software development supply chain. As developers increasingly become prime targets for cyber adversaries, this incident highlights the necessity for enhanced vigilance, robust security practices, and collaborative efforts to protect the integrity of open-source ecosystems and prevent similar future threats.
3 months ago
Kill Chain
CrowdStrike's Strategic Takedown of the Glassworm Botnet
In May 2026, CrowdStrike, in collaboration with Google and the Shadowserver Foundation, successfully dismantled the Glassworm botnet, a sophisticated operation targeting software developers through the open-source supply chain. Since early 2025, Glassworm had infiltrated numerous systems by compromising VSCode extensions, npm and Python packages, and over 300 GitHub repositories, leading to widespread data and credential theft across Windows, macOS, and Linux platforms. The botnet's resilience was attributed to its use of multiple command-and-control channels, including the Solana blockchain, BitTorrent's peer-to-peer network, Google Calendar, and virtual private servers. The coordinated takedown severed these channels, effectively neutralizing the botnet's operations. ([crowdstrike.com](https://www.crowdstrike.com/en-us/blog/inside-crowdstrike-takedown-of-a-developer-targeting-botnet/?utm_source=openai)) This incident underscores the escalating threat posed by supply chain attacks, particularly those targeting developer environments. The Glassworm case highlights the necessity for organizations to implement robust security measures within their development pipelines and to remain vigilant against increasingly sophisticated attack vectors that exploit trusted software ecosystems. ([crowdstrike.com](https://www.crowdstrike.com/en-us/blog/inside-crowdstrike-takedown-of-a-developer-targeting-botnet/?utm_source=openai))
3 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports