✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Marketing/Advertising/Sales
Breach intelligence, attack campaigns, and threat reports targeting the Marketing/Advertising/Sales sector.
Explore Other Sectors
Marketing/Advertising/Sales Threat Reports
Salesloft Drift Supply Chain Breach: How Okta and Zscaler Responded in 2023
In August 2023, a sophisticated supply chain attack targeting Salesloft and Drift exposed the vulnerabilities of OAuth token management in SaaS integrations. Threat actor group UNC6395 compromised Salesloft's GitHub and later leveraged compromised OAuth tokens from the Drift platform, affecting over 700 customers—including security leaders Okta and Zscaler. While Okta’s proactive use of IP restrictions blocked malicious API requests and prevented data loss, Zscaler experienced a significant breach, exposing both customer and internal data. The campaign unfolded rapidly, relying on automated scripts for widespread data extraction via legitimate channels before defenses were activated. This incident underscores the growing pipeline threat of API- and token-driven attacks across integrated SaaS ecosystems. As organizations increasingly rely on third-party applications, traditional security mechanisms and risk due diligence are proving insufficient against lateral supply-chain intrusion tactics and the automated exploitation of tokenized access.
6 months ago
Kill Chain
Adobe Analytics 2025 Bug Exposes Cross-Tenant Tracking Data
In September 2025, an ingestion bug in Adobe Analytics caused cross-tenant data exposure, allowing customer tracking data from some organizations to appear in the analytics reports of others for nearly a day. The incident began on September 17 due to a performance optimization update that led to incorrect data values surfacing in Analysis Workspace reports. Approximately 3-5% of collected data—across Data Feeds, Live Stream, and scheduled reports—was impacted, with some fields being overwritten by data from other tenants. Adobe promptly reverted the change on September 18 and undertook remediation to cleanse datasets, advising customers to purge affected data from systems and backups to prevent further exposure. This incident underscores the risk posed by inadvertent data exposure within multi-tenant SaaS platforms and the criticality of robust data segregation and validation controls. With regulatory scrutiny over data privacy at an all-time high, such events illustrate how operational changes, even absent malicious intent, can have significant compliance and business ramifications for all affected customers.
6 months ago
Kill Chain
Harrods Suffers Major Supply Chain Breach: 430,000 Customer Records Exposed in 2025
In September 2025, UK luxury retailer Harrods disclosed a major cybersecurity incident after attackers exploited a vulnerability in a third-party supplier, leading to the exposure of 430,000 e-commerce customer records. The breach, unrelated to earlier attacks by Scattered Spider, leveraged a supply chain vector similar to the widespread Salesloft OAuth attack, allowing data exfiltration from connected Salesforce environments. Compromised data included names, contact information, and internal marketing labels, but excluded financial data and passwords. Harrods responded by promptly notifying affected customers and authorities, while refusing to engage with extortion attempts by the threat actor. This incident illustrates the growing risk of supply chain compromise in the retail and e-commerce sector, where attackers increasingly exploit third-party platforms for large-scale data theft. As regulatory scrutiny intensifies and similar attacks proliferate, organizations must reevaluate supply chain security controls and customer notification protocols.
6 months ago
Kill Chain
Salesforce Agentforce 2024: ForcedLeak AI Prompt Injection Breach Exposes CRM Data
In June 2024, researchers at Noma Security identified a severe vulnerability in Salesforce's Agentforce AI agents, termed 'ForcedLeak'. By exploiting prompt injection via web-to-lead forms, attackers were able to manipulate Agentforce into exfiltrating sensitive CRM data, including PII, corporate secrets, and transactional details, to unauthorized locations. The vulnerability hinged on whitelist misconfigurations of trusted domains and the agent’s overly broad prompt interpretation, leading to an attacker-controlled data leak chain. Salesforce addressed data exfiltration by patching URL restrictions and acquiring an expired trusted domain but ongoing risks persist with agentic AI’s prompt processing logic. The incident underscores the growing challenges as mainstream SaaS platforms rapidly integrate autonomous GenAI features, often lacking robust input validation and security boundaries. High CVSS-scored issues like ForcedLeak exemplify the urgent need for zero trust guardrails and more resilient AI security frameworks given the increasing velocity and sophistication of prompt injection attacks.
6 months ago
Kill Chain
Salesforce AI Prompt Injection Bug Exposes CRM Data in 2025 Breach
In September 2025, security researchers at Noma Security identified a critical vulnerability, termed ForcedLeak (CVSS 9.4), in Salesforce Agentforce, an AI-powered platform for constructing automation agents. The flaw allowed threat actors to launch indirect prompt injection attacks against Agentforce’s integration with Salesforce’s CRM, opening avenues for exfiltration of sensitive customer relationship data. The attack leveraged manipulated AI prompts that bypassed input validation, ultimately resulting in confidential business and customer information being at risk of exposure until Salesforce deployed a rapid patch. This incident highlights the growing risks stemming from AI prompt injection vulnerabilities as more enterprises embrace AI-integrated SaaS for customer-facing processes. The Salesforce episode underscores regulatory and security urgency to address trust boundaries around rapidly-evolving AI within business-critical platforms.
6 months ago
Kill Chain
Vane Viper Powers 1 Trillion DNS Queries in 2025 Malvertising Mega-Breach
In September 2025, the threat actor group known as Vane Viper was revealed to be operating a vast and covert ad fraud and malvertising network, leveraging a staggering one trillion DNS queries to enable malware distribution globally. According to a detailed Infoblox technical report, Vane Viper manipulated core internet infrastructure using shell companies and complex ownership structures to obfuscate responsibility and perpetuate malicious adtech practices. Their operations enabled widespread malvertising campaigns, significantly impacting advertising platforms and exposing users worldwide to illicit downloads and credential theft. This breach underscores a recent surge in the use of advanced DNS tunneling and obfuscation tactics in cybercrime, particularly within ad fraud and malvertising schemes. The incident exemplifies how attackers increasingly exploit foundational internet protocols, challenging traditional detection and defense measures while prompting urgent regulatory attention and industry-wide response.
6 months ago
Kill Chain
Operation Rewrite: Chinese SEO Poisoning Surges in 2024, Compromising Trusted Web Servers
In early 2024, security researchers identified 'Operation Rewrite,' a sophisticated SEO poisoning campaign linked to a suspected Chinese threat actor. The attackers compromised numerous legitimate web servers, injecting malicious content designed to boost the search ranking of infected sites for financial gain. Unsuspecting users were redirected from popular search results to websites hosting malware or phishing content. The campaign leveraged legitimate server infrastructure to evade traditional detection, complicating mitigation and exposing visitors to potential credential theft, malware infections, and broader data compromise. The attackers’ tactics allowed them to rapidly spread harmful payloads while remaining concealed among normal web traffic. This incident underscores a sharp increase in SEO poisoning and supply chain abuse, as adversaries prioritize techniques that abuse trust in widely visited websites and search engines. With web browsing essential to daily business operations, organizations face mounting risks from threats that bypass perimeter defenses by posing as reputable content.
6 months ago
Kill Chain
Fake Madgicx Plus & SocialMetrics Browser Extensions Hijack Meta Business Accounts in 2025
In September 2025, cybersecurity researchers reported a targeted infostealer campaign involving fake browser extensions, notably "Madgicx Plus" and "SocialMetrics Pro." Threat actors distributed these malicious extensions via malvertising and fraudulent websites, tricking users into installing them under the guise of gaining Meta Verified blue checkmarks on Facebook and Instagram. Once installed, the extensions stole business account credentials and session tokens, enabling attackers to hijack and monetize Meta Business accounts, potentially leading to widespread financial and reputational harm for affected organizations and individuals. This incident exemplifies the evolution of social engineering and supply-chain abuse targeting digital marketing and social media tools. The ongoing rise in sophisticated browser-based infostealers underscores the urgent need for organizations to monitor for fraudulent browser plugins, enforce software controls, and educate employees about new methods of business account compromise.
6 months ago
Kill Chain
HiddenGh0st, Winos & kkRAT Malware: How SEO & Cloud Hosting Fueled a 2025 Chinese-Focused Attack
In September 2025, a sophisticated malware campaign targeted Chinese-speaking users through SEO poisoning and fake software sites, resulting in the widespread distribution of HiddenGh0st, Winos, and kkRAT malware. Attackers manipulated search results using SEO plugins, registered lookalike domains, and leveraged GitHub Pages to host malicious files. Unsuspecting users, believing they were downloading legitimate utilities, instead installed remote access trojans that enabled full compromise of their systems, data theft, and prolonged adversary presence. The campaign demonstrates coordinated threat actor use of both social engineering and modern cloud hosting platforms to bypass traditional security controls. This incident highlights an escalating trend of threat actors combining SEO manipulation with cloud-native infrastructure to launch convincing malware campaigns at scale. The use of popular developer tools like GitHub Pages for payload delivery complicates traditional egress controls, detection, and response, requiring organizations to bolster threat intelligence, web filtering, and zero-trust segmentation strategies.
6 months ago
Kill Chain
SlopAds: How 224 Android Apps Fueled a $Billion Ad Fraud Scam in 2025
In late 2025, the SlopAds ad fraud ring was exposed running a sophisticated scheme across 224 Android applications, amassing more than 38 million downloads globally. The attackers covertly embedded steganography-based payloads within these apps, enabling them to generate hidden WebViews and surreptitiously route ad clicks and impressions to threat actor-controlled cashout sites. This campaign resulted in a staggering 2.3 billion daily fraudulent ad bids, undermining advertiser spending and trust in mobile advertising. Investigations revealed that the fraud operated across 228 countries and leveraged advanced techniques to evade security controls and detection. This incident highlights a growing trend in large-scale, automated digital ad fraud utilizing supply chain infiltration and advanced evasion. With mobile devices as primary attack surfaces and threat actors exploiting application distribution ecosystems, organizations face heightened regulatory scrutiny, financial risk, and an urgent need for granular visibility, segmentation, and anomaly detection capabilities.
6 months ago
Kill Chain
FBI Alert: UNC6040 & UNC6395 Target Salesforce Customers with Cloud Attacks (2024)
In early 2024, the FBI’s Internet Crime Complaint Center (IC3) issued an alert detailing active campaigns by threat groups UNC6040 and UNC6395 targeting Salesforce customer environments. The attackers leveraged phishing and social engineering to obtain valid Salesforce credentials, subsequently exploiting misconfigurations and inadequate security controls in customer cloud instances. This enabled unauthorized access to sensitive data, including customer information and corporate records, leading to multiple data theft and extortion attempts. Salesforce itself was not breached, but its customers suffered direct operational impacts due to data compromise and disruption. This incident underscores a rising trend of advanced threat actors targeting supply chain and SaaS ecosystems, exploiting both human and technical gaps in cloud security. As cloud adoption accelerates, enterprises must address credential hygiene, proper configuration, and real-time anomaly detection to thwart similar attacks.
6 months ago
Kill Chain
'Vane Viper': PropellerAds Tied to 2025’s Largest Malvertising & Cybercrime Network
In September 2025, cybersecurity researchers uncovered that the 'Vane Viper' threat group had leveraged the commercial adtech platform PropellerAds to orchestrate one of the largest malvertising and cybercrime operations observed in recent years. The threat actor, active for over a decade, used compromised websites and malicious ads to funnel internet users through complex redirection chains—culminating in exploit kits, malware, ransomware, and scam campaigns. Investigations tied PropellerAds and its parent AdTech Holding, via shared infrastructure and business links, to a sprawling web of entities facilitating the operation and exposing untold numbers of enterprise and consumer users to cyber risk. This incident is particularly significant because it demonstrates the co-mingling of legitimate commercial digital ad infrastructure with cybercriminal activity, challenging the line between victimized platforms and complicit actors. The case spotlights growing regulatory and enterprise security concerns around malvertising, supply chain integrity, and weaponized ad ecosystems.
6 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports