The breach isn’t the problem. The spread is. →The breach isn’t the problem. The spread is. →Measure in 5 min. Free AssessmentFree Assessment
Marketing/Advertising/Sales
Breach intelligence, attack campaigns, and threat reports targeting the Marketing/Advertising/Sales sector.
Explore Other Sectors
Marketing/Advertising/Sales Threat Reports
Researchers Hijack StealC Malware Operators: 2026's XSS-Driven Counterattack
In January 2026, cybersecurity researchers uncovered and exploited a cross-site scripting (XSS) vulnerability in the web administration panel of the infamous StealC infostealer malware. By leveraging this flaw, the researchers were able to hijack malware operator sessions, collect hardware and geographic fingerprints, observe live threat actor activities, and even seize control of the attackers' own administration panels. One notable instance involved tracking a StealC affiliate operating as 'YouTubeTA', who stole credentials via malicious YouTube links that resulted in over 5,000 compromised devices and the theft of nearly 390,000 passwords and 30 million cookies. The research highlights critical operational risks inherent in the malware-as-a-service (MaaS) model, particularly as platforms surge in popularity and complexity. This incident is especially relevant as the MaaS cybercrime landscape continues to expand, driving rapid adoption of infostealer toolkits like StealC. Security teams must remain vigilant to emerging attacker tradecraft and vulnerabilities, as both operators and defenders look to exploit weaknesses in rival infrastructure.
8 months ago
Kill Chain
Modular DS WordPress Plugin Flaw Grants Attackers Admin Access in Widespread 2026 Breach
In January 2026, a critical authentication bypass vulnerability (CVE-2026-23550) was discovered and exploited in the Modular DS WordPress plugin. With over 40,000 installations, the plugin allowed central management of multiple WordPress sites. The flaw enabled unauthenticated attackers to remotely access admin-level privileges by exploiting flawed logic in the plugin’s direct request mode, resulting in privileged access without cryptographic checks. Attackers were able to select or auto-enroll themselves as site administrators, exposing affected sites to full compromise and potential downstream attacks. A patch was quickly released in version 2.5.2, closing the immediate vulnerability. This incident stands out as attackers increasingly target plugin ecosystems in widely-used CMS platforms, exploiting software supply chain vectors for rapid, broad impact. The case illustrates the urgency for continuous code review and rapid patch management in response to emergent threats.
8 months ago
Kill Chain
Browser-in-Browser Phishing Surge: Facebook Credential Thefts Expose New Risks in 2024
In early 2024, cybercriminals dramatically escalated the use of the 'browser-in-browser' (BitB) attack technique to steal Facebook login credentials. This method mimics a legitimate browser popup within the user's real window, tricking individuals into entering their login details on phishing sites that look identical to authentic Facebook authentication dialogs. Attackers lure victims through targeted ads, social engineering, and cleverly crafted phishing emails. The impact includes widespread account compromise, enabling follow-on fraud, spam campaigns, and potential data exfiltration from the compromised users' profiles. Facebook, along with the wider cybersecurity community, is warning users and rolling out alerts in response, but overall threat exposure remains high. The BitB phishing approach reflects a concerning trend of attackers using more advanced visual deceptions to bypass user awareness and established security controls. Its prevalence highlights a widening capability gap in traditional anti-phishing technologies, reinforcing the need for robust anomaly response and continuous education amid shifting adversary tactics.
8 months ago
Kill Chain
n8n npm Supply Chain Attack: OAuth Tokens Stolen via Malicious Community Nodes
In early January 2026, threat actors targeted the n8n workflow automation ecosystem by publishing eight malicious npm packages that mimicked legitimate integrations. These packages prompted unsuspecting users to connect OAuth-protected services like Google Ads, Stripe, and Salesforce. Once installed as community nodes, the malware exfiltrated encrypted OAuth tokens from the n8n credential store by decrypting them with n8n's own master key and sending them to attacker-controlled servers. The campaign exploited developer trust in community packages and highlighted a dangerous new avenue for credential theft at scale. This incident reflects the increasing sophistication and frequency of supply chain attacks, particularly against workflow automation tools that centralize sensitive credentials. With open-source ecosystems growing rapidly, businesses face heightened urgency to scrutinize third-party integrations and adopt least-privilege, zero trust security practices.
8 months ago
Kill Chain
Instagram 2026: Data Scraping Leak Exposes 17 Million Accounts
In January 2026, security researchers and several hacking forums circulated claims that data for over 17 million Instagram accounts was leaked online. The incident is believed to stem from large-scale data scraping leveraging a password reset email bug, combined potentially with prior years' API vulnerabilities. The leaked dataset included a variety of personal information such as usernames, phone numbers, email addresses, and physical addresses. No passwords were exposed, and Meta (Instagram's parent company) denies that a system breach or new API compromise occurred, noting existing issues were promptly addressed and account security remains uncompromised. This case underscores the ongoing threat of data scraping and API abuse, where publicly accessible or insufficiently protected endpoints are targeted by cybercriminals. With the proliferation of social engineering attacks using scraped personal data and the repeated emergence of similar incidents across major platforms, the need for robust API security and user vigilance has never been greater.
8 months ago
Kill Chain
DoJ Takes Down Fraud Domain Powering $14.6M Account Takeover Scheme
In December 2025, the U.S. Department of Justice (DoJ), working with international partners, seized the domain web3adspanels[.]org at the heart of a large-scale bank account takeover scheme. The criminal group exploited fraudulent search ads to trick users into accessing spoofed bank login portals, harvesting credentials through malicious site components. These stolen credentials enabled attackers to infiltrate legitimate banking sites, drain victim accounts, and inflict confirmed losses of $14.6 million across 19 U.S. victims, including two companies. The backend database hosted by the seized domain contained thousands of login credentials and operated through November 2025. This incident is part of a broader surge in credential-based financial fraud, leveraging sophisticated phishing infrastructure and real-time abuse of search advertising. With attackers refining techniques to bypass user suspicion, enforcement agencies are increasing pressure on such online infrastructure in response to rising losses and evolving digital fraud tactics.
8 months ago
Kill Chain
Nomani Scam Exposes AI Deepfake Threats to Social Media in 2025
In 2025, the Nomani investment scam surged by 62%, leveraging sophisticated AI-based deepfake advertisements across major social media platforms including Facebook and YouTube. The scheme utilized convincing fake endorsements and manipulated video content to lure unsuspecting individuals into fraudulent investment schemes. Security firm ESET recorded over 64,000 unique URLs distributing the fraudulent campaign, indicating an expansion both in scale and reach. The attackers exploited trust in familiar faces, rapidly spreading the scam and leading to substantial financial losses and reputational risks for victims and targeted brands. This incident highlights the growing threat of AI-enabled social engineering, with deepfakes enabling unprecedented scale and believability. As identity manipulation technologies proliferate, organizations and regulators face increased pressure to combat fraud, educate users, and adapt security controls to counter the evolving landscape of digital deception.
8 months ago
Kill Chain
AI Advertising Firm Doublespeed Breached: Over 1,000 Smartphones Compromised in 2025 Attack
In October 2025, AI advertising startup Doublespeed suffered a major security breach when a hacker exploited a vulnerability in the company’s backend systems to gain unauthorized access to its phone farm managing over 1,000 AI-generated social media accounts. The attacker was able to both extract confidential data about undisclosed advertising campaigns and seize remote control of the smartphones used to operate the accounts. This exposure illuminated the company’s covert promotion practices and presented significant risks of both data exfiltration and operational compromise. Despite being notified on October 31, the company had not fully remediated access at the time of reporting, heightening concerns about internal controls and disclosure procedures. The breach underscores growing vulnerabilities in companies that use automation at scale, especially in the context of AI-driven influence operations and digital marketing. It reflects broader industry trends: increasing use of phone farms, sophisticated identity evasion, and regulatory scrutiny around undeclared digital ads, all contributing to a shifting cyber threat landscape.
8 months ago
Kill Chain
GhostPoster Malware Infects 17 Firefox Extensions: Supply Chain Risks Hit 50,000+ Users
In late 2025, cybersecurity researchers discovered a campaign named GhostPoster, which compromised the supply chain of Mozilla Firefox by infiltrating 17 browser add-ons with malicious JavaScript. These extensions, collectively downloaded over 50,000 times, were found to hijack affiliate links, inject tracking scripts, and facilitate click and ad fraud. Threat actors used logo image files within the add-ons to conceal the payload and persist across infected hosts. The extensions were promptly removed from the Mozilla add-ons marketplace upon disclosure, but impacted users may have experienced privacy violations and fraudulent activity. This incident highlights continued escalation in browser extension-based supply chain attacks and the increased sophistication of threat actors at targeting trusted ecosystem channels. With organizations relying on browser tools for productivity, ongoing diligence is required to detect, respond to, and prevent similar infiltrations leveraging obfuscated techniques.
8 months ago
Kill Chain
Sneeit WordPress Plugin Hit by Critical RCE: 2025 Exploitation Wave
In August 2025, a critical remote code execution (RCE) vulnerability (CVE-2025-6389) in the widely used Sneeit Framework WordPress plugin (versions <=8.3) was discovered to be actively exploited in the wild. Attackers leveraged this flaw—scoring 9.8 on CVSS—to gain remote access to vulnerable sites, potentially executing arbitrary code, deploying malware, and further compromising user data or site integrity. The vendor responded by releasing version 8.4 with an urgent security patch, but over 1,700 active installations remain at risk. The Sneeit incident underscores a broader trend of rapid weaponization of WordPress plugin flaws by opportunistic threat actors, intensifying risk for websites lacking prompt patching and robust security controls. As attackers increasingly target web applications and supply chain components, organizations must reinforce visibility, detection, and vulnerability management strategies.
8 months ago
Kill Chain
Critical King Addons Elementor Plugin Flaw Exploited in WordPress Sites (CVE-2025-8489)
In early 2025, attackers began actively exploiting a critical privilege escalation flaw (CVE-2025-8489) in the King Addons for Elementor plugin on WordPress sites. By abusing an insecure registration process, threat actors were able to escalate privileges and gain administrative control over vulnerable sites without authorization. This access could be used to manipulate website content, add malicious backdoors, or exfiltrate sensitive data, impacting website owners' security and reputation. The attacks have been widespread due to the plugin's popularity and ease of exploitation, highlighting the persistent risks present in third-party WordPress extensions. This incident is particularly relevant as it exemplifies an ongoing wave of attacks targeting web application vulnerabilities in widely used CMS platforms. The proliferation of such zero-day exploits magnifies risk for organizations, especially as adversaries move quickly to weaponize flaws before patches are broadly applied.
8 months ago
Kill Chain
2025 WordPress King Addons Breach: Unauthenticated Admin Access & Website Takeover
In December 2025, attackers actively exploited a critical vulnerability (CVE-2025-8489, CVSS 9.8) in the popular King Addons for Elementor WordPress plugin. The flaw allowed unauthenticated individuals to escalate privileges by specifying the 'administrator' user role at registration, instantly granting themselves administrative access. Threat actors leveraged this zero-day to seize complete control of vulnerable sites, install malicious content, and potentially exfiltrate sensitive data or deploy further attacks. Affected organizations risked significant operational disruption, data compromise, reputational harm, and potential compliance violations due to unauthorized admin creation and persistence. This incident highlights the increasing trend of exploiting supply-chain and plugin vulnerabilities in widely used CMS platforms. The rapid weaponization of unauthenticated privilege escalation flaws underscores the need for continuous patch management, threat detection, and segmentation controls to counter evolving web application and identity-focused attack techniques.
8 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports