Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Marketing/Advertising/Sales

Breach intelligence, attack campaigns, and threat reports targeting the Marketing/Advertising/Sales sector.

191 threat reports
Page 2 of 16
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Marketing/Advertising/Sales Threat Reports

Showing 13–24 / 191 reports
Adception Attack: When Trusted Platforms Become Malware Delivery Vectors
Marketing/Advertising/Sales1 month ago

Adception Attack: When Trusted Platforms Become Malware Delivery Vectors

In October 2026, cybercriminals launched a sophisticated malvertising campaign dubbed 'Adception' targeting macOS users searching for Claude AI software. The attackers exploited Google Ads and Bing's click-tracking redirects to bypass security measures, directing victims through compromised WordPress sites to fake Claude download pages. The campaign used multi-layered cloaking and clipboard hijacking techniques, substituting legitimate installation commands with malicious Base64-encoded scripts that downloaded unknown payloads from attacker-controlled servers. This incident highlights the evolving sophistication of AI-themed social engineering attacks and the exploitation of trusted advertising platforms. As AI tools become mainstream business applications, attackers increasingly target these popular services to deliver malware while exploiting user trust in legitimate domains and installation processes.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(low)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(low)
Read report
Fake Brand Partnerships Target YouTube Creators in Sophisticated Google Account Takeover Scam
Fake Brand Partnerships Target YouTube Creators in Sophisticated Google Account Takeover Scam
Entertainment/Movie Production1 month ago

Fake Brand Partnerships Target YouTube Creators in Sophisticated Google Account Takeover Scam

A sophisticated social engineering campaign targeting YouTube content creators impersonates legitimate brands like Hollyland, Nike, and Spotify to steal Google account credentials. The attack begins with personalized sponsorship emails referencing specific channel content, leading victims through a fake collaboration platform that appears legitimate with income calculators and contract features. The scheme culminates in a credential harvesting page disguised as Google OAuth authentication, allowing attackers to fully compromise accounts by changing recovery methods and backup codes. Once successful, attackers can access Gmail, Google Drive, and YouTube channels to spread malicious content or conduct further social engineering attacks against the creator's network. This incident highlights the growing trend of business email compromise targeting the creator economy, where attackers exploit the legitimate sponsorship process that content creators rely on for revenue. As social media influence becomes increasingly monetized, threat actors are adapting their tactics to exploit trust relationships between brands and creators.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Fake AI Sites Steal Ad Accounts: The 2026 ChatGPT Phishing Campaign That Bypassed MFA
Fake AI Sites Steal Ad Accounts: The 2026 ChatGPT Phishing Campaign That Bypassed MFA
Marketing/Advertising/Sales1 month ago

Fake AI Sites Steal Ad Accounts: The 2026 ChatGPT Phishing Campaign That Bypassed MFA

In October 2026, cybercriminals launched a sophisticated phishing campaign targeting advertising account managers using fake AI assistant sites impersonating ChatGPT, Gemini, Claude, and Perplexity. The attackers leveraged browser-in-browser (BitB) attacks to steal login credentials and multi-factor authentication codes from agency staff and media buyers with access to multiple client accounts. The campaign exploited Meta's recent Muse AI agent launch as a lure, with human operators dynamically controlling the phishing flow to bypass MFA protections and potentially compromise hundreds of high-value advertising accounts. This incident highlights the escalating threat of AI-themed phishing attacks as cybercriminals exploit the rapid adoption of AI tools in business workflows. The campaign's sophisticated use of real-time operator control and adaptive interfaces across multiple platforms demonstrates how threat actors are evolving their tactics to target high-value accounts with significant financial exposure.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Sophisticated Phishing Campaign Targets AI Advertising Professionals Through Fake ChatGPT and Gemini Portals
Sophisticated Phishing Campaign Targets AI Advertising Professionals Through Fake ChatGPT and Gemini Portals
Marketing/Advertising/Sales1 month ago

Sophisticated Phishing Campaign Targets AI Advertising Professionals Through Fake ChatGPT and Gemini Portals

In September 2026, cybersecurity researchers disclosed a sophisticated phishing platform targeting AI advertising professionals through fake portals impersonating ChatGPT, Google Gemini, Anthropic Claude, Perplexity, Meta Muse, and other AI chatbot advertising services. The attackers employed browser-in-the-browser (BitB) techniques to create convincing spoofed login windows displaying trusted domains like accounts.google.com while capturing credentials and multi-factor authentication codes in real-time. The campaign specifically targeted agency staff, media buyers, and manager-account administrators with the goal of monetizing compromised advertising accounts or selling them in underground markets. This incident highlights the growing sophistication of AI-themed phishing campaigns as threat actors rapidly adapt to emerging technologies and capitalize on the widespread adoption of AI tools in business environments.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(high)
Read report
Microsoft's X Account Hijacked for Cryptocurrency Fraud: A Wake-Up Call for Social Media Security
Microsoft's X Account Hijacked for Cryptocurrency Fraud: A Wake-Up Call for Social Media Security
Computer Software/Engineering1 month ago

Microsoft's X Account Hijacked for Cryptocurrency Fraud: A Wake-Up Call for Social Media Security

In October 2026, threat actors compromised Microsoft's official X account, which has over 13 million followers, to execute a cryptocurrency pump-and-dump scheme promoting a fraudulent $Clippy token. The attackers hijacked the account to follow and repost content from impersonation accounts claiming the token had liquidity paired with Microsoft stock. Microsoft confirmed the unauthorized access, removed the malicious posts, secured the account, and disavowed any connection to cryptocurrency projects while threatening legal action against the perpetrators. This incident highlights the escalating trend of social media account takeovers targeting high-profile organizations for cryptocurrency fraud, following similar attacks on Microsoft India's account and the SEC's official X account that manipulated Bitcoin prices.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
WordPress Under Siege: How the SC Backdoor's Self-Healing Architecture Redefines Web Malware
WordPress Under Siege: How the SC Backdoor's Self-Healing Architecture Redefines Web Malware
Computer Software/Engineering1 month ago

WordPress Under Siege: How the SC Backdoor's Self-Healing Architecture Redefines Web Malware

In October 2026, cybersecurity researchers discovered a sophisticated WordPress malware campaign featuring the 'SC' backdoor, a self-healing persistence mechanism that deploys across eight different locations including files, database entries, and shared memory segments. The malware creates a circular reinfection system where each component can rebuild all others, making traditional cleanup methods ineffective. The backdoor communicates with command-and-control servers via the Ethereum blockchain, creates hidden administrator accounts, and can inject malicious JavaScript to target site visitors with skimmers and other malware. This incident highlights the evolution of web application malware toward distributed, blockchain-controlled persistence mechanisms that challenge conventional security approaches. As threat actors increasingly adopt self-healing architectures and leverage legitimate infrastructure like blockchain networks for covert communications, organizations face more resilient and sophisticated web-based threats.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(high)
Read report
Critical Elementor CSRF Flaw Exposes 2 Million WordPress Sites to Admin Takeover
Critical Elementor CSRF Flaw Exposes 2 Million WordPress Sites to Admin Takeover
Computer Software/Engineering1 month ago

Critical Elementor CSRF Flaw Exposes 2 Million WordPress Sites to Admin Takeover

A critical cross-site request forgery (CSRF) vulnerability in the Elementor Website Builder WordPress plugin versions 4.3.0 and 4.3.1 allowed unauthenticated attackers to create rogue administrator accounts and take complete control of affected websites. The flaw, scoring 8.8 on the CVSS scale, affected over 2 million WordPress sites and required only that an administrator click a specially crafted link. The vulnerability stemmed from the Editor Events module bypassing CSRF protection for REST API requests containing the string 'elementor/v1/events/' anywhere in the URI, effectively disabling security controls for the entire WordPress REST API surface. This incident highlights the growing sophistication of web application attacks targeting content management systems and the critical importance of secure development practices in widely-deployed plugins. With WordPress powering over 40% of websites globally, vulnerabilities in popular plugins present massive attack surfaces that threat actors increasingly exploit.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Elementor WordPress Plugin CSRF Vulnerability Exposes 2 Million Sites to Admin Account Takeover
Elementor WordPress Plugin CSRF Vulnerability Exposes 2 Million Sites to Admin Account Takeover
Computer Software/Engineering1 month ago

Elementor WordPress Plugin CSRF Vulnerability Exposes 2 Million Sites to Admin Account Takeover

A critical Cross-Site Request Forgery (CSRF) vulnerability in the Elementor WordPress plugin affected versions 4.3.0 and 4.3.1, impacting up to 2 million websites. The flaw allowed unauthenticated attackers to create administrator accounts by tricking logged-in administrators into clicking malicious links. The vulnerability exploited Elementor's Editor Events module, which bypassed WordPress's REST nonce validation when specific URI paths were present, enabling one-click privilege escalation attacks. Security firm Patchstack disclosed the vulnerability on September 22, 2026, and Elementor released a patch in version 4.3.2 within two days. This incident highlights the growing sophistication of web application attacks targeting popular content management systems and the critical importance of secure API design patterns in preventing privilege escalation vulnerabilities.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Salesbleed Attack: How AI Agents Became the New Phishing Vector
Salesbleed Attack: How AI Agents Became the New Phishing Vector
Computer Software/Engineering1 month ago

Salesbleed Attack: How AI Agents Became the New Phishing Vector

The 'Salesbleed' vulnerabilities discovered in September 2026 by Zenity researchers exploit Salesforce Agentforce AI agents to enable sophisticated phishing attacks through trusted internal Slack channels. Attackers inject malicious prompts via Web-to-lead forms, leveraging AI agents' permissions to exfiltrate data and send phishing messages that appear to originate from legitimate employees or IT help desk personnel. This attack chain demonstrates how agentic AI platforms create new attack vectors by combining legitimate business processes with inadequate security controls, particularly around URL filtering and message attribution. This incident highlights the growing security challenges posed by autonomous AI agents in enterprise environments, as organizations rapidly deploy agentic systems without adequate visibility and control mechanisms. The vulnerability underscores the critical need for comprehensive AI governance frameworks as businesses increasingly rely on AI agents with elevated permissions across interconnected cloud platforms.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
WordPress CVE-2026-87902: Critical RCE Vulnerability Exploited Within Hours
WordPress CVE-2026-87902: Critical RCE Vulnerability Exploited Within Hours
Computer Software/Engineering1 month ago

WordPress CVE-2026-87902: Critical RCE Vulnerability Exploited Within Hours

Within hours of WordPress releasing patches for CVE-2026-87902 on September 22, 2026, threat actors began actively exploiting this critical remote code execution vulnerability affecting WordPress sites. The flaw allows unauthenticated attackers to include arbitrary PHP files and achieve RCE when specific preconditions are met, including the presence of page- directories in active themes and readable PHP files like pearcmd.php. Security researchers observed 68 exploitation attempts originating from multiple countries, with attackers deploying web shells and writing malicious PHP files to compromised systems. This incident exemplifies the increasingly rapid weaponization of disclosed vulnerabilities, with attackers now exploiting critical flaws within the same day of patch releases. The WordPress ecosystem's massive attack surface combined with automated exploit frameworks enables threat actors to achieve widespread reconnaissance and compromise attempts at unprecedented speed.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
WordPress Under Siege: CVE-2026-87902 Exploitation Analysis
WordPress Under Siege: CVE-2026-87902 Exploitation Analysis
Computer Software/Engineering1 month ago

WordPress Under Siege: CVE-2026-87902 Exploitation Analysis

Threat actors began exploiting CVE-2026-87902, a critical WordPress path traversal vulnerability with a CVSS score of 9.2, within hours of patch release on September 22, 2026. The unauthenticated flaw allows remote code execution through path traversal attacks targeting the get_page_template() function, enabling attackers to include malicious PHP files outside theme directories. Initial reconnaissance activity escalated to active payload delivery within 24 hours, with attackers writing executable shell commands to /tmp directories on vulnerable WordPress installations running versions before 7.1.2. This incident highlights the accelerating weaponization timeline for critical web application vulnerabilities, as attackers now exploit high-severity flaws within hours rather than days or weeks. The widespread nature of WordPress deployments and the unauthenticated attack vector amplify the risk landscape significantly.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
WordPress Comment2Shell: When Anonymous Comments Become Server Backdoors
WordPress Comment2Shell: When Anonymous Comments Become Server Backdoors
Computer Software/Engineering1 month ago

WordPress Comment2Shell: When Anonymous Comments Become Server Backdoors

In September 2026, WordPress patched a critical vulnerability (CVE-2026-93485) dubbed 'Comment2Shell' that allowed anonymous attackers to inject malicious scripts through comments. The flaw exploited a gap in WordPress's comment processing, where line breaks in HTML attributes could bypass sanitization and execute JavaScript when pages loaded. If an administrator viewed a compromised page, the script could leverage their elevated privileges to upload web shells and achieve remote code execution on the server. This vulnerability highlights the evolving sophistication of web application attacks targeting content management systems. As WordPress powers over 40% of websites globally, such zero-click exploits represent a significant threat vector for cybercriminals seeking to compromise web infrastructure at scale.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports