✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Marketing/Advertising/Sales
Breach intelligence, attack campaigns, and threat reports targeting the Marketing/Advertising/Sales sector.
Explore Other Sectors
Marketing/Advertising/Sales Threat Reports
Exploiting AI: The 2026 Instagram Account Takeover Incident
In late May 2026, attackers exploited a vulnerability in Meta's AI support assistant to hijack high-profile Instagram accounts, including those of the Obama White House and the Chief Master Sergeant of the U.S. Space Force. By manipulating the AI bot into adding a new email address during the password reset process, they gained unauthorized access and defaced these accounts with pro-Iranian content. Meta responded by deploying an emergency patch to address the flaw. This incident underscores the emerging risks associated with AI-driven customer support systems. As organizations increasingly integrate AI into sensitive processes, ensuring robust security measures and implementing multi-factor authentication (MFA) become imperative to prevent similar exploits.
1 month ago
Kill Chain
Zapier Vulnerabilities Exposed: Potential Account Takeover Risks
In May 2026, security researchers from Token Security identified a chain of five vulnerabilities within Zapier, a widely-used workflow automation service. Exploiting these flaws required only a free Zapier account and could have allowed attackers to impersonate any signed-in user, potentially accessing millions of user accounts and their connected applications. The attack vector involved manipulating user-generated code, retrieving discarded login credentials, and accessing internal storage systems containing private software images. One such image included a publishing key for code running in every logged-in user's browser, enabling attackers to create or alter automations and interact with connected services as legitimate users. ([cyberscoop.com](https://cyberscoop.com/zapier-bug-chain-account-takeover-patched/?utm_source=openai)) This incident underscores the critical importance of securing automation platforms, especially as they gain increased authority to act on behalf of users across multiple services. The vulnerabilities were promptly reported and patched, with no evidence of exploitation. However, organizations are advised to review their automation logs for unauthorized activities and reauthorize connections to sensitive systems to mitigate potential risks. ([cyberscoop.com](https://cyberscoop.com/zapier-bug-chain-account-takeover-patched/?utm_source=openai))
1 month ago
Kill Chain
Ghost CMS Vulnerability Leads to Massive ClickFix Attack Campaign
In May 2026, threat actors exploited a critical SQL injection vulnerability (CVE-2026-26980) in Ghost CMS, affecting versions 3.24.0 through 6.19.0. This flaw allowed unauthenticated attackers to read arbitrary data from the database, including admin API keys. Utilizing these keys, attackers injected malicious JavaScript into over 700 websites, including those of Harvard University, Oxford University, and DuckDuckGo. The injected scripts facilitated ClickFix attacks, deceiving visitors into executing harmful commands via fake CAPTCHA verification prompts. ([thehackernews.com](https://thehackernews.com/2026/05/ghost-cms-cve-2026-26980-exploited-to.html?utm_source=openai)) This incident underscores the urgency of timely patch management, as the vulnerability had been addressed in version 6.19.1 released in February 2026. The widespread exploitation highlights the evolving sophistication of social engineering tactics and the critical need for organizations to maintain up-to-date security measures to protect their digital assets. ([sentinelone.com](https://www.sentinelone.com/vulnerability-database/cve-2026-26980/?utm_source=openai))
2 months ago
Kill Chain
Critical ExifTool Vulnerability on macOS: CVE-2026-3102 Analysis
In February 2026, a critical vulnerability identified as CVE-2026-3102 was discovered in ExifTool versions up to 13.49 on macOS. This flaw allows attackers to execute arbitrary commands by embedding malicious shell commands within the metadata of image files. When a vulnerable version of ExifTool processes such a file, the embedded commands are executed, potentially leading to unauthorized actions on the system. The vulnerability specifically affects the SetMacOSTags function in the MacOS.pm module, where improper handling of the DateTimeOriginal metadata field enables command injection. ([kaspersky.com](https://www.kaspersky.com/blog/exiftool-macos-picture-vulnerability-mitigation-cve-2026-3102/55362/?utm_source=openai)) The exploitation of this vulnerability underscores the risks associated with processing untrusted files, especially in automated workflows. Given ExifTool's widespread use in various applications, including digital asset management and forensic analysis, the potential for widespread impact is significant. Organizations are urged to update to ExifTool version 13.50 or later to mitigate this risk. ([kaspersky.com](https://www.kaspersky.com/blog/exiftool-macos-picture-vulnerability-mitigation-cve-2026-3102/55362/?utm_source=openai))
2 months ago
Kill Chain
Unveiling Trapdoor: The 2026 Android Ad Fraud Scheme
In May 2026, cybersecurity researchers uncovered 'Trapdoor,' a sophisticated ad fraud and malvertising operation targeting Android users. The scheme involved 455 malicious apps and 183 command-and-control domains, creating a self-sustaining cycle of fraud. Users unknowingly downloaded utility-style apps, which then initiated malvertising campaigns, coercing them into installing additional malicious apps. These secondary apps launched hidden WebViews, loaded threat actor-controlled HTML5 domains, and requested ads, leading to 659 million daily bid requests and over 24 million app downloads, primarily affecting users in the U.S. ([thehackernews.com](https://thehackernews.com/2026/05/trapdoor-android-ad-fraud-scheme-hit.html?utm_source=openai)) This incident highlights the evolving tactics of cybercriminals who blend legitimate tools with malicious intent, emphasizing the need for continuous vigilance and advanced detection mechanisms to protect users from such deceptive schemes.
2 months ago
Kill Chain
Critical Vulnerability in Funnel Builder Plugin Leads to Credit Card Theft
In May 2026, a critical vulnerability in the Funnel Builder plugin for WordPress was actively exploited to inject malicious JavaScript into WooCommerce checkout pages. This flaw, present in versions prior to 3.15.0.3, allowed unauthenticated attackers to modify the plugin's global settings via an unprotected checkout endpoint, leading to the execution of malicious code on checkout pages. The injected code facilitated a payment card skimmer that stole sensitive customer information, including credit card numbers, CVVs, billing addresses, and other personal data. FunnelKit addressed the vulnerability by releasing version 3.15.0.3, urging users to update immediately and review their settings for any unauthorized scripts. This incident underscores the persistent threat posed by vulnerabilities in widely-used plugins, emphasizing the need for regular updates and vigilant monitoring of third-party components in web applications. The exploitation of such vulnerabilities can lead to significant data breaches, financial loss, and reputational damage for businesses, highlighting the critical importance of proactive cybersecurity measures.
2 months ago
Kill Chain
Critical Authentication Bypass Vulnerability in Burst Statistics WordPress Plugin (CVE-2026-8181)
In May 2026, a critical authentication bypass vulnerability, CVE-2026-8181, was discovered in the Burst Statistics WordPress plugin, affecting versions 3.4.0 and 3.4.1. This flaw allowed unauthenticated attackers to impersonate administrator accounts by exploiting improper handling of authentication functions, potentially leading to full site compromise. The vulnerability was actively exploited shortly after disclosure, with over 7,400 attacks recorded within 24 hours. This incident underscores the persistent threat posed by vulnerabilities in widely used WordPress plugins. It highlights the importance of prompt patching and vigilant monitoring, as attackers rapidly exploit such flaws to gain unauthorized access and control over websites.
2 months ago
Kill Chain
Cybercriminals Exploit Google Ads and Claude.ai to Target Mac Users
In May 2026, attackers exploited Google Ads and legitimate Claude.ai shared chats to distribute malware targeting macOS users. By searching for 'Claude mac download,' users encountered sponsored search results that appeared to link to the official Claude.ai website but redirected them to malicious instructions. These instructions guided users to execute terminal commands that downloaded and ran malware on their systems, leading to unauthorized access and potential data exfiltration. This incident underscores a growing trend where cybercriminals leverage trusted platforms and search engine advertisements to disseminate malware. The use of legitimate AI-generated content to host malicious instructions highlights the evolving sophistication of social engineering tactics, emphasizing the need for heightened vigilance and robust security measures among users and organizations.
2 months ago
Kill Chain
Massive Phishing Campaign Exploits Google AppSheet to Hack 30,000 Facebook Accounts
In May 2026, a Vietnamese-linked cyber operation, dubbed 'AccountDumpling' by Guardio, exploited Google's AppSheet platform to distribute phishing emails impersonating Meta Support. These emails targeted Facebook Business account owners, urging them to submit appeals to avoid account deletion. The phishing campaign successfully compromised approximately 30,000 Facebook accounts, which were subsequently sold through illicit channels. The attackers utilized AppSheet's legitimate 'noreply@appsheet.com' email address to bypass spam filters, enhancing the credibility of their fraudulent messages. This incident underscores a growing trend where cybercriminals leverage trusted platforms to execute sophisticated phishing attacks. The exploitation of legitimate services like Google AppSheet highlights the need for enhanced vigilance and adaptive security measures to counteract evolving threat vectors.
2 months ago
Kill Chain
Massive WordPress Plugin Backdoor Exposes Thousands of Sites in 2026
In April 2026, a significant supply chain attack compromised over 30 WordPress plugins, collectively known as the 'Essential Plugin' portfolio. An individual operating under the alias 'Kris' purchased these plugins in early 2025 and injected a PHP deserialization backdoor during subsequent updates. This backdoor remained dormant for eight months before activation, allowing the attacker to inject spam content and potentially execute arbitrary code on over 20,000 active WordPress sites. The attack underscores the vulnerabilities inherent in plugin ecosystems, where ownership changes can introduce malicious code without immediate detection. This incident highlights a growing trend in supply chain attacks targeting widely used software components. The strategy of purchasing and compromising trusted plugins poses a significant threat to website security, emphasizing the need for rigorous vetting processes and continuous monitoring of third-party software integrations.
2 months ago
Kill Chain
Unveiling the 2026 Fake CAPTCHA IRSF Scam
In April 2026, cybersecurity researchers uncovered a sophisticated telecommunications fraud campaign leveraging fake CAPTCHA verifications to deceive users into sending international SMS messages. This scheme, active since at least June 2020, exploits social engineering tactics and browser vulnerabilities to generate illicit revenue through International Revenue Share Fraud (IRSF). Victims, believing they are completing standard CAPTCHA tests, unknowingly send multiple SMS messages to premium-rate international numbers, incurring significant charges on their mobile bills. This incident highlights the evolving nature of cyber threats, where attackers combine traditional social engineering with technical exploitation to achieve financial gain. The use of familiar web elements like CAPTCHAs in fraudulent schemes underscores the need for heightened user awareness and robust security measures to detect and prevent such deceptive practices.
2 months ago
Kill Chain
Critical Vulnerability in Breeze Cache WordPress Plugin (CVE-2026-3844)
In April 2026, a critical vulnerability (CVE-2026-3844) was discovered in the Breeze Cache WordPress plugin, affecting versions up to 2.4.4. This flaw allows unauthenticated attackers to upload arbitrary files via the 'fetch_gravatar_from_remote' function, potentially leading to remote code execution and full site compromise. The issue is exploitable only when the 'Host Files Locally - Gravatars' feature is enabled, which is disabled by default. Cloudways, the plugin's developer, released version 2.4.5 to address this vulnerability. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/hackers-exploit-file-upload-bug-in-breeze-cache-wordpress-plugin/?utm_source=openai)) The active exploitation of this vulnerability underscores the persistent targeting of WordPress plugins by threat actors. Website administrators are urged to promptly update to the latest plugin version or disable the affected feature to mitigate risks. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/hackers-exploit-file-upload-bug-in-breeze-cache-wordpress-plugin/?utm_source=openai))
3 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports