✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Internet
Breach intelligence, attack campaigns, and threat reports targeting the Internet sector.
Explore Other Sectors
Internet Threat Reports
Unveiling the 2026 Fake CAPTCHA IRSF Scam
In April 2026, cybersecurity researchers uncovered a sophisticated telecommunications fraud campaign leveraging fake CAPTCHA verifications to deceive users into sending international SMS messages. This scheme, active since at least June 2020, exploits social engineering tactics and browser vulnerabilities to generate illicit revenue through International Revenue Share Fraud (IRSF). Victims, believing they are completing standard CAPTCHA tests, unknowingly send multiple SMS messages to premium-rate international numbers, incurring significant charges on their mobile bills. This incident highlights the evolving nature of cyber threats, where attackers combine traditional social engineering with technical exploitation to achieve financial gain. The use of familiar web elements like CAPTCHAs in fraudulent schemes underscores the need for heightened user awareness and robust security measures to detect and prevent such deceptive practices.
2 months ago
Kill Chain
Inside an OPSEC Playbook: How Threat Actors Evade Detection
In April 2026, cybersecurity researchers uncovered a detailed operational security (OPSEC) playbook authored by a threat actor specializing in high-volume carding operations. This playbook outlines a three-tier infrastructure model designed to evade detection: a public layer utilizing clean devices and rotating residential IPs, an operational layer with encrypted containers and dedicated infrastructure, and an extraction layer focused on isolated, air-gapped systems for monetization. The document also highlights common OPSEC failures, such as identity reuse and inadequate digital fingerprinting countermeasures, and recommends advanced techniques like time-delayed triggers and behavioral randomization to enhance operational resilience. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/inside-an-opsec-playbook-how-threat-actors-evade-detection/amp/?utm_source=openai)) This revelation underscores a significant shift in cybercriminal strategies towards more structured and methodical approaches to maintain long-term operational security. For defenders, understanding these sophisticated OPSEC frameworks is crucial to developing more effective detection and mitigation strategies against evolving cyber threats.
2 months ago
Kill Chain
Vercel Security Breach 2026: Context.ai OAuth Compromise
In April 2026, Vercel, a cloud development platform, experienced a security breach originating from a compromised third-party AI tool, Context.ai. An attacker exploited this tool to gain unauthorized access to a Vercel employee's Google Workspace account, subsequently infiltrating Vercel's internal systems. This intrusion led to the exposure of non-sensitive environment variables, including API keys and database credentials. The threat actor, identifying as ShinyHunters, has demanded a $2 million ransom for the stolen data. Vercel has engaged incident response experts, notified law enforcement, and advised affected customers to rotate credentials and audit deployments. The company's open-source projects, such as Next.js and Turbopack, remain unaffected. This incident underscores the critical importance of stringent third-party application security and the potential risks associated with OAuth permissions. Organizations are urged to review and tighten their third-party integrations and access controls to prevent similar supply chain attacks.
3 months ago
Kill Chain
Vercel's 2026 Security Breach: Lessons in Third-Party Integration Risks
In April 2026, Vercel, a prominent web infrastructure provider, experienced a security breach originating from a compromised third-party AI tool, Context.ai. An attacker exploited this vulnerability to gain unauthorized access to a Vercel employee's Google Workspace account, subsequently infiltrating Vercel's internal systems. This intrusion led to the exposure of certain environment variables not marked as 'sensitive,' potentially affecting a limited subset of customers. Vercel has since engaged incident response experts and notified law enforcement to address the situation. ([vercel.com](https://vercel.com/kb/bulletin/vercel-april-2026-security-incident?utm_source=openai)) This incident underscores the escalating risks associated with third-party integrations and the necessity for robust security measures. The breach highlights the importance of vigilant monitoring and management of OAuth applications to prevent unauthorized access and protect sensitive data.
3 months ago
Kill Chain
Vercel Security Breach April 2026: Lessons in Third-Party Integration Security
In April 2026, Vercel, a prominent cloud development platform, disclosed a security incident involving unauthorized access to certain internal systems. The breach was traced back to a compromised third-party AI tool's Google Workspace OAuth application, which allowed attackers to infiltrate Vercel's infrastructure. A threat actor, claiming affiliation with the ShinyHunters group, alleged possession of sensitive data, including access keys, source code, and employee information, and attempted to sell this data for $2 million. Vercel has engaged incident response experts, notified law enforcement, and is actively investigating the incident. The company has advised customers to review and rotate environment variables and secrets as a precautionary measure. This incident underscores the growing risks associated with third-party integrations and the importance of securing OAuth applications. Organizations are reminded to implement robust security measures for all third-party tools and to regularly audit their access permissions to prevent similar breaches.
3 months ago
Kill Chain
Operation PowerOFF 2026: A Major Blow to DDoS-for-Hire Services
In April 2026, a coordinated international law enforcement effort known as Operation PowerOFF led to the seizure of 53 domains associated with DDoS-for-hire services and the arrest of four individuals allegedly involved in these operations. Authorities from 21 countries, including the United States, United Kingdom, and Germany, dismantled infrastructure supporting these services, which had been utilized by over 75,000 cybercriminals to launch distributed denial-of-service (DDoS) attacks. The operation also resulted in the identification of more than 3 million user accounts linked to these illegal activities. ([cyberscoop.com](https://cyberscoop.com/ddos-for-hire-takedowns-operation-poweroff/?utm_source=openai)) This crackdown underscores the persistent threat posed by DDoS-for-hire services, which enable individuals with minimal technical expertise to disrupt online services across various sectors. The operation highlights the necessity for organizations to bolster their cybersecurity defenses against such attacks and the importance of international collaboration in combating cybercrime.
3 months ago
Kill Chain
Google's 2025 Gemini AI Initiative: A New Era in Combating Malvertising
In 2025, Google intensified its efforts to combat malvertising by integrating its Gemini AI models into ad detection systems. This initiative led to the blocking or removal of 8.3 billion ads and the suspension of 24.9 million advertiser accounts, including 602 million ads linked to scams. Malvertising campaigns often impersonate legitimate brands to distribute malware or lead users to phishing sites. By leveraging Gemini AI, Google enhanced its ability to analyze vast datasets, including advertiser behavior and campaign patterns, to identify and block malicious ads before they reach users. ([apnews.com](https://apnews.com/article/06d9ef869958555884989e8ec25974be?utm_source=openai)) The urgency of addressing malvertising has grown as cybercriminals increasingly use generative AI to create deceptive ads at scale. Google's proactive measures with Gemini AI have not only improved ad filtering efficiency but also reduced incorrect advertiser suspensions by 80%. This underscores the critical need for advanced AI-driven defenses to maintain the integrity of digital advertising platforms. ([apnews.com](https://apnews.com/article/06d9ef869958555884989e8ec25974be?utm_source=openai))
3 months ago
Kill Chain
Critical Nginx UI Vulnerability (CVE-2026-33032) Enables Unauthenticated Server Takeover
In March 2026, a critical vulnerability (CVE-2026-33032) was discovered in Nginx UI, a web-based management interface for the Nginx web server. This flaw allowed unauthenticated remote attackers to invoke Model Context Protocol (MCP) tools without credentials, enabling actions such as restarting Nginx, and creating, modifying, or deleting configuration files. The root cause was an unprotected '/mcp_message' endpoint that, due to an empty default IP whitelist treated as 'allow all,' permitted unrestricted access. Exploitation of this vulnerability could lead to complete server takeover, allowing attackers to intercept traffic, harvest credentials, and disrupt services. ([nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2026-33032?utm_source=openai)) The vulnerability was actively exploited in the wild, with approximately 2,600 publicly exposed instances identified, primarily in China, the United States, Indonesia, Germany, and Hong Kong. ([thehackernews.com](https://thehackernews.com/2026/04/critical-nginx-ui-vulnerability-cve.html?utm_source=openai)) A patch was released in version 2.3.4 on March 15, 2026, addressing the issue by adding the missing authentication check to the '/mcp_message' endpoint. ([securityaffairs.com](https://securityaffairs.com/190841/hacking/cve-2026-33032-severe-nginx-ui-bug-grants-unauthenticated-server-access.html?utm_source=openai))
3 months ago
Kill Chain
Critical Vulnerability in wolfSSL: CVE-2026-5194 Allows ECDSA Certificate Authentication Bypass
In April 2026, a critical vulnerability identified as CVE-2026-5194 was discovered in the wolfSSL library, a widely used SSL/TLS implementation designed for embedded systems and IoT devices. This flaw arises from missing hash/digest size and Object Identifier (OID) checks during the verification of ECDSA certificates, allowing the acceptance of improperly small digests. Consequently, attackers could exploit this weakness to bypass ECDSA certificate-based authentication, potentially leading to unauthorized access and man-in-the-middle attacks. The issue affects configurations where both ECC and EdDSA or ML-DSA are enabled. wolfSSL addressed this vulnerability in version 5.9.1, released on April 8, 2026. The discovery of CVE-2026-5194 underscores the critical importance of rigorous certificate validation processes in cryptographic libraries. As wolfSSL is utilized in over 5 billion devices across various sectors, including industrial control systems, automotive, and aerospace, the potential impact of this vulnerability is extensive. Organizations relying on wolfSSL are urged to promptly update to the patched version to mitigate security risks.
3 months ago
Kill Chain
Masjesu Botnet: A New Era of DDoS-for-Hire Targeting IoT Devices
In April 2026, cybersecurity researchers identified 'Masjesu,' a sophisticated botnet operating as a DDoS-for-hire service. Masjesu has been active since 2023, primarily targeting a wide array of IoT devices, including routers and gateways, across multiple architectures. The botnet employs advanced evasion techniques, such as randomizing packet headers and payloads, to mimic legitimate traffic and avoid detection. It propagates by exploiting known vulnerabilities in devices from manufacturers like D-Link, GPON, and Netgear, and by brute-forcing weak or default passwords. Masjesu's operators advertise their services via Telegram, offering clients the ability to launch large-scale DDoS attacks on demand. ([trellix.com](https://www.trellix.com/blogs/research/masjesu-rising-stealth-iot-botnet-ddos-evasion/?utm_source=openai)) The emergence of Masjesu underscores the escalating threat posed by IoT-based botnets. With the proliferation of unsecured IoT devices, attackers can easily amass vast networks capable of launching devastating DDoS attacks. This trend highlights the urgent need for enhanced security measures, including regular firmware updates, strong password policies, and network monitoring, to protect against such evolving threats.
3 months ago
Kill Chain
Understanding the Rise of Web Shell Attacks in 2026
In early 2026, a significant surge in web shell attacks was observed, targeting vulnerabilities in web servers and applications. Attackers exploited these weaknesses to deploy malicious scripts, enabling remote control over compromised systems. This escalation led to unauthorized data access, service disruptions, and substantial financial losses for affected organizations. The rapid deployment and stealthy nature of web shells posed significant challenges to traditional security measures. ([microsoft.com](https://www.microsoft.com/en-us/security/blog/2026/04/02/cookie-controlled-php-webshells-tradecraft-linux-hosting-environments/?utm_source=openai)) This trend underscores the evolving tactics of cyber adversaries, emphasizing the need for enhanced monitoring and proactive defense strategies. Organizations must prioritize the detection and mitigation of web shell threats to safeguard their digital assets and maintain operational integrity.
3 months ago
Kill Chain
React2Shell Exploitation Leads to Massive Credential Harvesting in 2026
In early 2026, a large-scale credential harvesting operation exploited the React2Shell vulnerability (CVE-2025-55182) to compromise 766 Next.js hosts. Attackers leveraged this critical remote code execution flaw in React Server Components to gain unauthorized access to sensitive data, including database credentials, SSH private keys, AWS secrets, shell command history, Stripe API keys, and GitHub tokens. The breach underscores the severe risks associated with unpatched vulnerabilities in widely used web frameworks. The React2Shell vulnerability, disclosed in December 2025, has been actively exploited by threat actors, leading to significant data breaches and system compromises. This incident highlights the urgent need for organizations to promptly apply security patches and implement robust monitoring to detect and mitigate exploitation attempts.
3 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports