✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Marketing/Advertising/Sales
Breach intelligence, attack campaigns, and threat reports targeting the Marketing/Advertising/Sales sector.
Explore Other Sectors
Marketing/Advertising/Sales Threat Reports
Major Brands Impersonated in Phishing Campaign Targeting Google Accounts
In July 2026, a sophisticated phishing campaign targeted marketing professionals by impersonating over 30 renowned brands, including Adobe, Netflix, Coca-Cola, and OpenAI. Attackers utilized legitimate platforms like PeopleForce and Salesforce Marketing Cloud to send fraudulent job interview invitations, leading recipients through a series of redirects to malicious landing pages designed to steal Google account credentials. The campaign employed real recruiters' names and photos to enhance credibility, exploiting nested redirects through trusted services to evade detection. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/phishing-poses-as-big-brand-job-interview-to-steal-google-accounts/?utm_source=openai)) This incident underscores the evolving tactics of cybercriminals who leverage legitimate platforms and trusted brand identities to execute credential theft. The use of nested redirects and impersonation of real recruiters highlight the need for heightened vigilance and advanced security measures to protect against such deceptive attacks.
2 weeks ago
Kill Chain
Adobe Issues Urgent Patches for Critical ColdFusion and Campaign Classic Vulnerabilities
In July 2026, Adobe released critical security patches addressing seven maximum-severity vulnerabilities in its ColdFusion and Campaign Classic platforms. These flaws, identified as CVE-2026-48276 through CVE-2026-48282 and CVE-2026-48286, could allow unauthenticated attackers to execute arbitrary code on unpatched systems without user interaction. Affected versions include ColdFusion 2025.9, 2023.20, and earlier, as well as Campaign Classic 7.4.3 build 9396 and earlier. Adobe has urged administrators to apply these updates within 72 hours to mitigate potential exploitation risks. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/adobe-patches-seven-max-severity-coldfusion-campaign-flaws/?utm_source=openai)) This incident underscores the increasing frequency and severity of vulnerabilities in widely-used enterprise software, highlighting the critical need for organizations to maintain rigorous patch management practices. The rapid identification and remediation of such flaws are essential to safeguard systems against potential exploits that could lead to significant operational disruptions and data breaches.
3 weeks ago
Kill Chain
Microsoft Eliminates 119 Malicious Edge Extensions Concealing Malware
In June 2026, Microsoft identified and removed 119 malicious extensions from the Edge Add-ons store, collectively known as 'StegoAd.' These extensions, active since at least 2021, utilized steganography to conceal malware within image and font files. After installation, the malware remained dormant, later activating to steal user credentials and conduct ad fraud. The affected extensions, including ad blockers, VPNs, translators, and video downloaders, amassed up to 2.6 million installations. The exact number of compromised users remains undetermined. This incident underscores the evolving sophistication of cyber threats, particularly in the realm of browser extensions. The use of steganography to evade detection highlights the need for enhanced security measures and vigilant monitoring of third-party add-ons. Organizations must prioritize the implementation of robust security protocols to mitigate such risks.
3 weeks ago
Kill Chain
Critical Vulnerability in Popular Chrome Extension Puts Millions at Risk
In June 2026, security researchers discovered that the popular Chrome extension 'Adblock for YouTube' (ID: cmedhionkhpnakcndndgjdbohmhepckk), with over 11 million installs, contained a dormant capability to execute arbitrary JavaScript code on any website. This vulnerability could be activated remotely by a server-side configuration change, potentially allowing attackers to read user data, steal sensitive information, and perform actions on behalf of the user across various web applications. The extension's permissions and architecture facilitated this exploit without requiring an update or user intervention, posing a significant security risk to its extensive user base. This incident underscores the growing threat posed by malicious or compromised browser extensions, especially those with large user bases and extensive permissions. As browser ecosystems evolve, the potential for such extensions to be weaponized increases, highlighting the need for rigorous security assessments, continuous monitoring, and user education to mitigate risks associated with third-party extensions.
1 month ago
Kill Chain
LastPass Data Breach via Klue Supply Chain Attack in 2026
In June 2026, LastPass experienced a data breach resulting from a supply chain attack on Klue, a third-party market intelligence platform integrated with LastPass's Salesforce environment. Attackers exploited compromised OAuth tokens obtained from Klue to access LastPass customer data, including names, phone numbers, email addresses, physical addresses, support case information, and sales-related data. Importantly, LastPass's core products, services, and customer vaults remained unaffected. ([blog.lastpass.com](https://blog.lastpass.com/posts/klue-supply-chain-incident-and-lastpass-response?utm_source=openai)) This incident underscores the escalating risks associated with third-party integrations and supply chain vulnerabilities. Organizations must reassess their security postures, particularly concerning external partnerships, to mitigate potential threats arising from interconnected systems.
1 month ago
Kill Chain
ShapedPlugin WordPress Pro Plugins Compromised in Supply Chain Attack
In June 2026, ShapedPlugin, a developer of premium WordPress plugins, experienced a supply chain attack where attackers compromised the company's update infrastructure. This breach led to the distribution of backdoored versions of several plugins, including Product Slider Pro for WooCommerce, Real Testimonials Pro, and Smart Post Show Pro. The malicious code, activated upon administrator access to the WordPress dashboard, connected to a command-and-control server to download additional payloads, resulting in unauthorized access and data exfiltration. ([thaicert.or.th](https://www.thaicert.or.th/en/2026/06/19/supply-chain-attack-through-shapedplugin-update-system-impacts-wordpress-websites/?utm_source=openai)) This incident underscores the growing threat of supply chain attacks targeting trusted software vendors. It highlights the critical need for organizations to implement robust security measures, including regular code audits and monitoring of update channels, to prevent similar compromises.
1 month ago
Kill Chain
OXLOADER Exploits Google Ads to Distribute CastleStealer Malware
In June 2026, cybersecurity researchers identified a new malware loader named OXLOADER, which is being used to distribute the CastleStealer infostealer. The campaign begins with malicious Google Ads that redirect users searching for 'lts version of node.js' to a counterfeit website. This site delivers a batch script hosted on Storj, which, when executed, downloads and runs OXLOADER. OXLOADER employs advanced obfuscation techniques and anti-analysis measures to evade detection, ultimately deploying CastleStealer to exfiltrate sensitive information from infected systems. This incident underscores the evolving tactics of threat actors who exploit legitimate services like Google Ads and Storj to distribute malware. The sophisticated obfuscation and anti-analysis methods used by OXLOADER highlight the increasing complexity of malware designed to bypass traditional security measures, posing significant challenges for detection and mitigation.
1 month ago
Kill Chain
Critical Vulnerability in Gravity SMTP Plugin Exposes API Keys
In June 2026, a significant security vulnerability (CVE-2026-4020) was discovered in the Gravity SMTP WordPress plugin, affecting approximately 100,000 websites. This flaw allowed unauthenticated attackers to access sensitive information, including API keys and configuration data, through an improperly secured REST API endpoint. Exploitation of this vulnerability enabled threat actors to harvest credentials and gain insights into the site's software stack, potentially facilitating further attacks. The incident underscores the critical importance of promptly updating plugins and securing REST API endpoints to prevent unauthorized data exposure. It also highlights the need for website administrators to regularly audit and monitor their systems for vulnerabilities to mitigate the risk of exploitation.
1 month ago
Kill Chain
Klue OAuth Breach 2026: Lessons in Third-Party Integration Security
In June 2026, Klue, a market intelligence platform, experienced a security breach where attackers exploited a compromised legacy credential to access Klue's integration infrastructure. This allowed them to steal OAuth tokens used to connect Klue with third-party platforms, notably Salesforce. Utilizing these tokens, the attackers accessed and exfiltrated data from multiple customer Salesforce environments. The incident was publicly claimed by the 'Icarus' extortion group, which pressured affected organizations to contact them to prevent the leaking of stolen data. This breach underscores the critical vulnerabilities associated with third-party integrations and the OAuth protocol. It highlights the necessity for organizations to rigorously monitor and manage third-party access, regularly audit integration credentials, and implement robust security measures to prevent unauthorized access through supply chain vectors.
1 month ago
Kill Chain
Critical Vulnerability in Gravity SMTP Plugin: CVE-2026-4020 Exploited
In June 2026, an unauthenticated information disclosure vulnerability (CVE-2026-4020) was discovered in the Gravity SMTP WordPress plugin, affecting versions up to 2.1.4. This flaw exposed sensitive data, including API keys, email service credentials, and system configuration details, to unauthenticated users via an improperly secured REST API endpoint. Exploitation of this vulnerability could lead to unauthorized access and control over affected websites. The incident underscores the critical importance of promptly updating plugins and implementing robust security measures to protect against emerging threats. Organizations must remain vigilant, as attackers continue to exploit such vulnerabilities to gain unauthorized access and compromise sensitive information.
1 month ago
Kill Chain
Salesforce Disables Klue App Integration Following OAuth Token Abuse Incident
In June 2026, Salesforce detected unauthorized access to customer data through the Klue Battlecards app integration. Threat actors exploited OAuth tokens associated with the app to gain access to sensitive information within Salesforce instances. Upon discovery, Salesforce promptly disabled the Klue app integration to prevent further data exposure and initiated a comprehensive investigation into the breach. This incident underscores the escalating threat posed by OAuth token abuse, a technique increasingly leveraged by cybercriminals to bypass traditional authentication mechanisms. Organizations must remain vigilant and implement robust security measures to safeguard against such sophisticated attacks.
1 month ago
Kill Chain
ShapedPlugin Supply Chain Attack: A Wake-Up Call for WordPress Security
In May 2026, ShapedPlugin, a WordPress plugin vendor, experienced a supply chain attack where malicious code was injected into their update system. This breach affected three paid plugins—Product Slider Pro, Real Testimonials Pro, and Smart Post Show Pro—leading to the installation of fake plugins that impersonated WooCommerce components. These malicious plugins stole credentials and granted attackers remote file-writing capabilities. The compromise was identified in June 2026, prompting ShapedPlugin to initiate an investigation and release updated, secure versions of the affected plugins. This incident underscores the growing trend of supply chain attacks targeting software vendors to distribute malware through legitimate update channels. It highlights the critical need for robust security measures in software development and distribution processes to prevent such breaches.
1 month ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports