✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Marketing/Advertising/Sales
Breach intelligence, attack campaigns, and threat reports targeting the Marketing/Advertising/Sales sector.
Explore Other Sectors
Marketing/Advertising/Sales Threat Reports
wp2shell: Critical WordPress Core Vulnerability Exposes Sites to Unauthenticated RCE
In July 2026, a critical vulnerability known as 'wp2shell' was discovered in WordPress core versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1. This flaw allowed unauthenticated remote code execution (RCE) via anonymous HTTP requests, making even default installations without plugins susceptible. The vulnerability was identified by Adam Kues of Searchlight Cyber and reported through WordPress's HackerOne program. In response, WordPress released emergency security updates—versions 6.9.5 and 7.0.2—on July 17, 2026, and initiated forced auto-updates to mitigate the risk. ([thehackernews.com](https://thehackernews.com/2026/07/new-wp2shell-wordpress-core-flaw-lets.html?utm_source=openai)) The 'wp2shell' incident underscores the persistent threat of unauthenticated RCE vulnerabilities in widely used platforms. It highlights the critical importance of timely software updates and proactive security measures to protect against emerging exploits targeting core system functionalities.
23 hours ago
Kill Chain
Critical Remote Code Execution Vulnerability in iCagenda Joomla Extension (CVE-2026-48939)
In June 2026, a critical vulnerability (CVE-2026-48939) was identified in the iCagenda extension for Joomla, allowing unauthenticated attackers to upload and execute arbitrary PHP files via the file attachment feature. This flaw, present in versions prior to 3.9.15 and 4.0.8, enables remote code execution, potentially compromising the entire web server. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added this vulnerability to its Known Exploited Vulnerabilities catalog on July 10, 2026, following reports of active exploitation in the wild. ([nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2026-48939?utm_source=openai)) The exploitation of CVE-2026-48939 underscores a broader trend of attackers targeting vulnerabilities in widely used content management system (CMS) extensions. This incident highlights the critical need for organizations to promptly apply security patches and maintain vigilant monitoring of their web applications to prevent unauthorized access and potential data breaches.
5 days ago
Kill Chain
Global CMS Exploitation Campaign: Protect Your Website Now
In July 2026, the Australian Cyber Security Centre (ACSC) issued an alert regarding a global exploitation campaign targeting vulnerabilities in content management systems (CMS) and associated plugins. Threat actors are actively scanning websites to deploy webshells, leveraging flaws in platforms such as WordPress, Craft CMS, MaxSite CMS, MetInfo CMS, and Joomla JCE. This campaign has significantly impacted small to medium-sized Australian businesses, leading to service disruptions, credential theft, malware deployment, and potential lateral movement within networks. The ACSC highlighted that the campaign might be supported by artificial intelligence, enabling threat actors to accelerate attacks and scale the exploitation of emerging vulnerabilities. Website administrators are urged to apply the latest security updates, remove unused components, enable automatic updates where possible, and implement additional security measures to mitigate the risk of compromise.
6 days ago
Kill Chain
Major Brands Impersonated in Phishing Scam Targeting Marketing Professionals
In July 2026, a sophisticated phishing campaign targeted marketing professionals by impersonating recruiters from renowned companies such as Netflix, Coca-Cola, and FIFA. Attackers utilized legitimate platforms like PeopleForce and Salesforce's ExactTarget to send personalized emails, leading recipients through nested redirects to a fake Google sign-in page designed to harvest credentials. This method effectively evaded traditional detection mechanisms, posing significant risks to individuals and organizations. ([darkreading.com](https://www.darkreading.com/cyberattacks-data-breaches/big-brand-jobs-scam-marketing-pros-google-accounts?utm_source=openai)) The incident underscores a growing trend of cybercriminals exploiting trusted services and personalized lures to deceive professionals. As the job market becomes increasingly competitive and AI-generated content enhances the realism of such scams, organizations must bolster their defenses against these evolving threats. ([malwarebytes.com](https://www.malwarebytes.com/blog/scams/2026/07/fake-netflix-coca-cola-and-fifa-job-scams-target-marketers?utm_source=openai))
1 week ago
Kill Chain
Major Brands Impersonated in Phishing Campaign Targeting Google Accounts
In July 2026, a sophisticated phishing campaign targeted marketing professionals by impersonating over 30 renowned brands, including Adobe, Netflix, Coca-Cola, and OpenAI. Attackers utilized legitimate platforms like PeopleForce and Salesforce Marketing Cloud to send fraudulent job interview invitations, leading recipients through a series of redirects to malicious landing pages designed to steal Google account credentials. The campaign employed real recruiters' names and photos to enhance credibility, exploiting nested redirects through trusted services to evade detection. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/phishing-poses-as-big-brand-job-interview-to-steal-google-accounts/?utm_source=openai)) This incident underscores the evolving tactics of cybercriminals who leverage legitimate platforms and trusted brand identities to execute credential theft. The use of nested redirects and impersonation of real recruiters highlight the need for heightened vigilance and advanced security measures to protect against such deceptive attacks.
1 week ago
Kill Chain
Adobe Issues Urgent Patches for Critical ColdFusion and Campaign Classic Vulnerabilities
In July 2026, Adobe released critical security patches addressing seven maximum-severity vulnerabilities in its ColdFusion and Campaign Classic platforms. These flaws, identified as CVE-2026-48276 through CVE-2026-48282 and CVE-2026-48286, could allow unauthenticated attackers to execute arbitrary code on unpatched systems without user interaction. Affected versions include ColdFusion 2025.9, 2023.20, and earlier, as well as Campaign Classic 7.4.3 build 9396 and earlier. Adobe has urged administrators to apply these updates within 72 hours to mitigate potential exploitation risks. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/adobe-patches-seven-max-severity-coldfusion-campaign-flaws/?utm_source=openai)) This incident underscores the increasing frequency and severity of vulnerabilities in widely-used enterprise software, highlighting the critical need for organizations to maintain rigorous patch management practices. The rapid identification and remediation of such flaws are essential to safeguard systems against potential exploits that could lead to significant operational disruptions and data breaches.
2 weeks ago
Kill Chain
Microsoft Eliminates 119 Malicious Edge Extensions Concealing Malware
In June 2026, Microsoft identified and removed 119 malicious extensions from the Edge Add-ons store, collectively known as 'StegoAd.' These extensions, active since at least 2021, utilized steganography to conceal malware within image and font files. After installation, the malware remained dormant, later activating to steal user credentials and conduct ad fraud. The affected extensions, including ad blockers, VPNs, translators, and video downloaders, amassed up to 2.6 million installations. The exact number of compromised users remains undetermined. This incident underscores the evolving sophistication of cyber threats, particularly in the realm of browser extensions. The use of steganography to evade detection highlights the need for enhanced security measures and vigilant monitoring of third-party add-ons. Organizations must prioritize the implementation of robust security protocols to mitigate such risks.
2 weeks ago
Kill Chain
Critical Vulnerability in Popular Chrome Extension Puts Millions at Risk
In June 2026, security researchers discovered that the popular Chrome extension 'Adblock for YouTube' (ID: cmedhionkhpnakcndndgjdbohmhepckk), with over 11 million installs, contained a dormant capability to execute arbitrary JavaScript code on any website. This vulnerability could be activated remotely by a server-side configuration change, potentially allowing attackers to read user data, steal sensitive information, and perform actions on behalf of the user across various web applications. The extension's permissions and architecture facilitated this exploit without requiring an update or user intervention, posing a significant security risk to its extensive user base. This incident underscores the growing threat posed by malicious or compromised browser extensions, especially those with large user bases and extensive permissions. As browser ecosystems evolve, the potential for such extensions to be weaponized increases, highlighting the need for rigorous security assessments, continuous monitoring, and user education to mitigate risks associated with third-party extensions.
3 weeks ago
Kill Chain
LastPass Data Breach via Klue Supply Chain Attack in 2026
In June 2026, LastPass experienced a data breach resulting from a supply chain attack on Klue, a third-party market intelligence platform integrated with LastPass's Salesforce environment. Attackers exploited compromised OAuth tokens obtained from Klue to access LastPass customer data, including names, phone numbers, email addresses, physical addresses, support case information, and sales-related data. Importantly, LastPass's core products, services, and customer vaults remained unaffected. ([blog.lastpass.com](https://blog.lastpass.com/posts/klue-supply-chain-incident-and-lastpass-response?utm_source=openai)) This incident underscores the escalating risks associated with third-party integrations and supply chain vulnerabilities. Organizations must reassess their security postures, particularly concerning external partnerships, to mitigate potential threats arising from interconnected systems.
3 weeks ago
Kill Chain
ShapedPlugin WordPress Pro Plugins Compromised in Supply Chain Attack
In June 2026, ShapedPlugin, a developer of premium WordPress plugins, experienced a supply chain attack where attackers compromised the company's update infrastructure. This breach led to the distribution of backdoored versions of several plugins, including Product Slider Pro for WooCommerce, Real Testimonials Pro, and Smart Post Show Pro. The malicious code, activated upon administrator access to the WordPress dashboard, connected to a command-and-control server to download additional payloads, resulting in unauthorized access and data exfiltration. ([thaicert.or.th](https://www.thaicert.or.th/en/2026/06/19/supply-chain-attack-through-shapedplugin-update-system-impacts-wordpress-websites/?utm_source=openai)) This incident underscores the growing threat of supply chain attacks targeting trusted software vendors. It highlights the critical need for organizations to implement robust security measures, including regular code audits and monitoring of update channels, to prevent similar compromises.
3 weeks ago
Kill Chain
OXLOADER Exploits Google Ads to Distribute CastleStealer Malware
In June 2026, cybersecurity researchers identified a new malware loader named OXLOADER, which is being used to distribute the CastleStealer infostealer. The campaign begins with malicious Google Ads that redirect users searching for 'lts version of node.js' to a counterfeit website. This site delivers a batch script hosted on Storj, which, when executed, downloads and runs OXLOADER. OXLOADER employs advanced obfuscation techniques and anti-analysis measures to evade detection, ultimately deploying CastleStealer to exfiltrate sensitive information from infected systems. This incident underscores the evolving tactics of threat actors who exploit legitimate services like Google Ads and Storj to distribute malware. The sophisticated obfuscation and anti-analysis methods used by OXLOADER highlight the increasing complexity of malware designed to bypass traditional security measures, posing significant challenges for detection and mitigation.
3 weeks ago
Kill Chain
Critical Vulnerability in Gravity SMTP Plugin Exposes API Keys
In June 2026, a significant security vulnerability (CVE-2026-4020) was discovered in the Gravity SMTP WordPress plugin, affecting approximately 100,000 websites. This flaw allowed unauthenticated attackers to access sensitive information, including API keys and configuration data, through an improperly secured REST API endpoint. Exploitation of this vulnerability enabled threat actors to harvest credentials and gain insights into the site's software stack, potentially facilitating further attacks. The incident underscores the critical importance of promptly updating plugins and securing REST API endpoints to prevent unauthorized data exposure. It also highlights the need for website administrators to regularly audit and monitor their systems for vulnerabilities to mitigate the risk of exploitation.
4 weeks ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports