✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Marketing/Advertising/Sales
Breach intelligence, attack campaigns, and threat reports targeting the Marketing/Advertising/Sales sector.
Explore Other Sectors
Marketing/Advertising/Sales Threat Reports
TikTok Business Accounts Compromised in 2026 AiTM Phishing Attack
In March 2026, TikTok for Business accounts were targeted by adversary-in-the-middle (AiTM) phishing attacks. Cybercriminals employed sophisticated techniques to intercept user credentials and session cookies, effectively bypassing multi-factor authentication (MFA) measures. This allowed unauthorized access to business accounts, which were then exploited for malicious activities such as distributing malware and conducting fraudulent advertising campaigns. The attackers utilized deceptive emails and messages, directing users to counterfeit login pages that closely mimicked TikTok's official interface, thereby harvesting sensitive information. This incident underscores a growing trend in cyber threats where attackers leverage AiTM tactics to circumvent traditional security protocols, including MFA. The increasing prevalence of such sophisticated phishing methods highlights the need for organizations to adopt advanced security measures and continuous monitoring to protect against evolving cyber threats.
4 months ago
Kill Chain
Phishing Campaign Targets TikTok Business Accounts in 2026
In March 2026, a sophisticated phishing campaign targeted TikTok for Business accounts, exploiting their extensive reach and credibility. Attackers employed Cloudflare-hosted phishing pages, registered via NiceNIC, to impersonate TikTok's business services. Victims were lured through legitimate Google Storage URLs, which redirected them to malicious sites after bypassing security bots using Cloudflare Turnstile checks. These sites mimicked TikTok's 'Schedule a Call' pages, prompting users to enter business email addresses and login credentials. The attackers utilized reverse proxy techniques to capture credentials and session cookies, effectively bypassing two-factor authentication and enabling unauthorized access to accounts. This incident underscores the evolving tactics of cybercriminals in targeting high-profile business accounts for malicious activities. The campaign's sophistication, including the use of legitimate services to mask malicious intent and the ability to circumvent multi-factor authentication, highlights the need for enhanced vigilance and security measures among businesses utilizing social media platforms for marketing and outreach.
4 months ago
Kill Chain
AppsFlyer Web SDK Hijacked: A 2026 Supply Chain Attack Analysis
In March 2026, the AppsFlyer Web SDK, utilized by over 100,000 applications for marketing analytics, was compromised in a supply chain attack. Malicious JavaScript code was injected into the SDK, enabling attackers to intercept and replace cryptocurrency wallet addresses entered by users on affected websites, diverting funds to attacker-controlled wallets. The attack targeted major cryptocurrencies, including Bitcoin, Ethereum, Solana, Ripple, and TRON, potentially impacting a vast number of end users. The incident underscores the critical vulnerabilities inherent in widely deployed third-party SDKs and the significant risks they pose to downstream applications and their users. Organizations relying on such SDKs must implement rigorous security measures and maintain vigilant monitoring to detect and mitigate potential compromises promptly.
4 months ago
Kill Chain
Critical SQL Injection Vulnerability in Elementor Ally Plugin Puts Over 250,000 WordPress Sites at Risk
In March 2026, a critical SQL injection vulnerability (CVE-2026-2313) was discovered in the Ally – Web Accessibility & Usability plugin for WordPress, affecting versions up to 4.0.3. This flaw allows unauthenticated attackers to inject malicious SQL queries via the URL path, potentially leading to unauthorized access to sensitive database information. The vulnerability arises from insufficient escaping of user-supplied URL parameters in the `get_global_remediations()` method, which are directly concatenated into SQL JOIN clauses without proper sanitization. Exploitation is possible when the plugin is connected to an Elementor account with the Remediation module active. Despite the release of a patched version (4.1.0) on February 23, 2026, data indicates that only about 36% of the affected websites have updated, leaving over 250,000 sites vulnerable. This incident underscores the persistent threat posed by SQL injection vulnerabilities in web applications, emphasizing the need for developers to implement robust input validation and sanitization practices. Website administrators are urged to promptly update plugins and maintain regular security audits to mitigate such risks.
4 months ago
Kill Chain
LLM-Assisted Deanonymization: A New Era of Online Privacy Challenges
In February 2026, researchers from ETH Zurich and Anthropic demonstrated that large language models (LLMs) can effectively deanonymize pseudonymous online users by analyzing unstructured text data. Their method involved extracting identity-relevant features from anonymous posts, searching for candidate matches via semantic embeddings, and reasoning over top candidates to verify matches. This approach achieved up to 68% recall at 90% precision, significantly outperforming traditional methods. The study highlights the diminishing effectiveness of online pseudonymity and raises concerns about privacy and data protection in the digital age. ([arxiv.org](https://arxiv.org/abs/2602.16800?utm_source=openai)) This research underscores the urgent need for enhanced privacy measures and regulatory frameworks to protect individuals' online identities. As LLMs become more sophisticated, the potential for misuse in deanonymizing users poses significant risks, necessitating proactive strategies to safeguard personal information.
4 months ago
Kill Chain
1Campaign: The Cloaking Service Fueling Malicious Google Ads
In February 2026, cybersecurity researchers uncovered '1Campaign,' a sophisticated cloaking service that enables threat actors to run malicious Google Ads while evading detection. Managed by a developer known as 'DuppyMeister,' 1Campaign has been active for at least three years. The platform allows attackers to display benign content to security researchers and automated scanners, while serving malicious content to real users. This technique prolongs the lifespan of malicious ads, facilitating phishing and crypto-draining campaigns. The service offers a user-friendly dashboard for real-time visitor filtering based on geography, ISP, and device characteristics, effectively blocking over 99% of non-targeted traffic. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/1campaign-platform-helps-malicious-google-ads-evade-detection/?utm_source=openai)) The emergence of 1Campaign highlights a growing trend in cybercrime where attackers leverage advanced cloaking techniques to bypass traditional security measures. This development underscores the need for enhanced detection capabilities and adaptive security strategies to counteract increasingly sophisticated malvertising campaigns.
5 months ago
Kill Chain
Optimizely's 2026 Data Breach: A Case Study in Vishing Attacks
In February 2026, Optimizely, a New York-based ad tech company, experienced a data breach initiated through a sophisticated voice phishing (vishing) attack. The attackers, identified as the ShinyHunters group, impersonated internal IT staff to deceive employees into divulging single sign-on (SSO) credentials and multi-factor authentication (MFA) codes. This social engineering tactic granted unauthorized access to Optimizely's systems, leading to the exfiltration of basic business contact information. The breach was confined to certain internal business systems, records in the customer relationship management (CRM) platform, and a limited set of internal documents used for back-office operations. There is no evidence that sensitive customer data or personal information beyond basic business contact information was accessed. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/ad-tech-firm-optimizely-confirms-data-breach-after-vishing-attack/?utm_source=openai)) This incident underscores a significant escalation in the operations of the ShinyHunters group, which has been actively targeting organizations through vishing attacks to compromise SSO credentials. The group's tactics have evolved to include harassment of victim personnel and other aggressive measures. ([itpro.com](https://www.itpro.com/security/google-issues-warning-over-shinyhunters-branded-vishing-campaigns?utm_source=openai))
5 months ago
Kill Chain
Keenadu Malware: A 2026 Android Supply Chain Attack
In early 2026, security researchers discovered 'Keenadu,' a sophisticated malware embedded within the firmware of various Android devices. This malware, introduced through a supply chain attack, integrates into the Android 'Zygote' process, allowing it to infect every application on the device. Once active, Keenadu grants attackers extensive control, enabling actions such as hijacking browser searches, committing ad fraud, and potentially accessing sensitive user data. The malware was found pre-installed on devices from multiple manufacturers, including the Alldocube iPlay 50 mini Pro tablet, and was also distributed through compromised applications on official app stores. As of February 2026, approximately 13,000 devices across countries like Russia, Japan, Germany, Brazil, and the Netherlands have been affected. ([darkreading.com](https://www.darkreading.com/mobile-security/supply-chain-attack-embeds-malware-android-devices?utm_source=openai)) This incident underscores the escalating threat of supply chain attacks targeting firmware, highlighting the need for rigorous security measures throughout the manufacturing and software development processes. The ability of Keenadu to operate at the firmware level makes detection and removal particularly challenging, emphasizing the importance of proactive security practices and the use of trusted devices and software sources.
5 months ago
Kill Chain
Microsoft Uncovers AI Recommendation Poisoning Threat
In February 2026, Microsoft disclosed a new cyber threat termed 'AI Recommendation Poisoning,' where businesses embed hidden instructions within 'Summarize with AI' buttons on their websites. When users click these buttons, the AI assistant's memory is manipulated via URL prompt parameters to favor certain companies or products in future recommendations. Over a 60-day period, Microsoft identified over 50 unique prompts from 31 companies across 14 industries, raising concerns about the integrity of AI-driven insights. This technique mirrors traditional search engine optimization (SEO) manipulation but targets AI systems directly, potentially leading to biased recommendations in critical areas such as health, finance, and security without user awareness. The emergence of AI Recommendation Poisoning underscores the evolving landscape of cyber threats targeting artificial intelligence systems. As AI becomes increasingly integrated into decision-making processes, ensuring the neutrality and reliability of AI outputs is paramount. Organizations must implement robust security measures to detect and prevent such manipulations to maintain trust in AI-driven recommendations.
5 months ago
Kill Chain
Flickr's 2026 Data Breach: A Wake-Up Call for Third-Party Security
In early February 2026, Flickr, a prominent photo-sharing platform, identified a security vulnerability within a third-party email service provider's system. This flaw potentially exposed user data, including names, email addresses, usernames, account types, IP addresses, general locations, and Flickr activity. Importantly, passwords and payment card information remained secure. Upon discovery on February 5, Flickr promptly disabled access to the compromised system and initiated a comprehensive investigation to assess the breach's scope and impact. ([forbes.com](https://www.forbes.com/sites/daveywinder/2026/02/06/photo-sharing-platform-flickr-issues-data-breach-warning/?utm_source=openai)) This incident underscores the critical importance of robust security measures and vigilant monitoring of third-party service providers. As organizations increasingly rely on external vendors, ensuring these partners adhere to stringent security protocols is essential to safeguard sensitive user information and maintain trust.
5 months ago
Kill Chain
Substack's 2025 Data Breach: A Wake-Up Call for Security Monitoring
In October 2025, Substack, a prominent newsletter platform, experienced a data breach where an unauthorized third party accessed user data, including email addresses, phone numbers, and internal metadata. The breach was not detected until February 3, 2026, leading to a four-month delay in notification. Importantly, sensitive information such as passwords, credit card numbers, and financial data remained secure. ([techcrunch.com](https://techcrunch.com/2026/02/05/substack-confirms-data-breach-affecting-email-addresses-and-phone-numbers/?utm_source=openai)) This incident underscores the critical need for robust security monitoring and rapid breach detection mechanisms. The prolonged detection period highlights potential vulnerabilities in Substack's security infrastructure, emphasizing the importance of timely incident response to protect user data and maintain trust.
5 months ago
Kill Chain
Iron Mountain's 2026 Data Breach: A Closer Look
In February 2026, Iron Mountain, a global leader in information management services, experienced a security incident involving unauthorized access to a single folder on a public-facing file-sharing site. The Everest ransomware group claimed responsibility, alleging the theft of 1.4 TB of internal documents containing client information. However, Iron Mountain clarified that the breach was limited to marketing materials, accessed through a compromised login credential, with no evidence of ransomware deployment or further system compromise. This incident underscores the persistent threat posed by ransomware groups like Everest, which have increasingly targeted organizations across various sectors. Their tactics often involve exploiting compromised credentials to gain unauthorized access, emphasizing the need for robust access controls and vigilant monitoring to prevent such breaches.
5 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports