Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Marketing/Advertising/Sales

Breach intelligence, attack campaigns, and threat reports targeting the Marketing/Advertising/Sales sector.

191 threat reports
Page 3 of 16
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Marketing/Advertising/Sales Threat Reports

Showing 25–36 / 191 reports
WordPress CVE-2026-87902: Critical Unauthenticated RCE Vulnerability Demands Immediate Action
WordPress CVE-2026-87902: Critical Unauthenticated RCE Vulnerability Demands Immediate Action
Computer Software/Engineering1 month ago

WordPress CVE-2026-87902: Critical Unauthenticated RCE Vulnerability Demands Immediate Action

WordPress released an emergency security patch on September 22, 2026, addressing CVE-2026-87902, a critical path traversal vulnerability affecting versions 4.7.0 through 7.1.1. The flaw allows unauthenticated attackers to force WordPress sites to load arbitrary PHP files from outside theme directories through manipulated URL parameters. On servers with specific configurations, particularly those running older PHP versions with register_argc_argv enabled and themes containing page- prefixed directories, this vulnerability can escalate to remote code execution. The vulnerability bypassed WordPress's built-in directory traversal protections in the template selection mechanism. This incident highlights the persistent threat of web application vulnerabilities in widely-deployed platforms, with WordPress powering over 40% of websites globally. The timing coincides with increased scrutiny of supply chain security and the growing sophistication of automated vulnerability exploitation frameworks targeting content management systems.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
WordPress Click2Shell: How a CSRF Flaw Became a Critical RCE Threat
WordPress Click2Shell: How a CSRF Flaw Became a Critical RCE Threat
Computer Software/Engineering1 month ago

WordPress Click2Shell: How a CSRF Flaw Became a Critical RCE Threat

In September 2026, security researcher Paulos Yibelo discovered a critical WordPress Core vulnerability dubbed 'Click2Shell' affecting versions 7.1.0 and earlier. This cross-site request forgery (CSRF) flaw enables pre-authenticated remote code execution by allowing attackers to force-install vulnerable themes from the WordPress catalog and execute arbitrary PHP code during theme preview. The exploit requires a logged-in administrator to visit a crafted URL, making it particularly dangerous via phishing campaigns or existing XSS vulnerabilities. WordPress addressed the flaw in version 7.1.1 by implementing proper input escaping and restricting theme selectors. This vulnerability highlights the growing sophistication of web application attacks targeting content management systems that power over 40% of websites globally. With complete technical details and proof-of-concept exploits now public, organizations face immediate risk from automated exploitation attempts targeting unpatched WordPress installations.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
WordPress Click2Shell Vulnerability: How a Simple Link Click Leads to Server Compromise
WordPress Click2Shell Vulnerability: How a Simple Link Click Leads to Server Compromise
Computer Software/Engineering1 month ago

WordPress Click2Shell Vulnerability: How a Simple Link Click Leads to Server Compromise

WordPress patched a critical vulnerability called Click2Shell in September 2026 that allows attackers to force automatic theme installation through specially crafted URLs. The flaw exploits differences in how WordPress.org directory and administrator browsers parse the same link, enabling attackers to trigger theme installations when logged-in administrators click malicious links. When chained with secondary vulnerabilities in installed themes, the attack escalates to remote code execution with a CVSS score of 9.6. The vulnerability affects WordPress versions 6.0 through 7.1.0, with fixes released in version 7.1.1 across all supported branches back to 4.7. This incident highlights the growing trend of attackers targeting content management system vulnerabilities that can be chained together for maximum impact, particularly as WordPress powers over 40% of websites globally and remains a high-value target.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Gyazo Breach Exposes 23.6 Million Users: Server Vulnerability Leads to Massive Data Theft
Gyazo Breach Exposes 23.6 Million Users: Server Vulnerability Leads to Massive Data Theft
Computer Games1 month ago

Gyazo Breach Exposes 23.6 Million Users: Server Vulnerability Leads to Massive Data Theft

On September 11, 2026, attackers exploited a server vulnerability in Gyazo's image-sharing platform to steal 23.6 million user records and 490 million image metadata entries. The breach exposed names, email addresses, password hashes, session IDs, and private image metadata including EXIF location data and OCR-extracted text. Gyazo detected the intrusion on September 12 and took the platform offline for maintenance, but the damage was already done with attackers potentially accessing private images and sensitive user information. This incident highlights the growing trend of attackers targeting cloud-based media platforms and the critical importance of server hardening as organizations increasingly rely on image-sharing services for business communications and collaboration.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Brevo Supply-Chain Attack Exposes CDN Security Gaps Through ClickFix Campaign
Marketing/Advertising/Sales1 month ago

Brevo Supply-Chain Attack Exposes CDN Security Gaps Through ClickFix Campaign

In September 2026, attackers compromised Brevo's Cloudflare API key and deployed malicious Workers that injected ClickFix scripts into the company's websites and customer-embedded JavaScript components for approximately 5.5 hours. The attack affected brevo.com, sendinblue.com, and customer sites using Brevo forms, conversation widgets, and SDK loaders, potentially impacting up to 100,000 websites. Victims were presented with fake Cloudflare verification pages prompting them to execute malicious commands, while WordPress administrators faced additional risks through backdoor plugin installations that created persistent access points with hardcoded authentication bypasses. This incident highlights the growing sophistication of supply-chain attacks targeting content delivery networks and the increasing prevalence of ClickFix social engineering tactics that exploit user trust in legitimate cloud services to distribute malware at scale.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Gyazo Breach Exposes Critical Gaps in Upload Security and Data Protection
Gyazo Breach Exposes Critical Gaps in Upload Security and Data Protection
Information Technology/IT1 month ago

Gyazo Breach Exposes Critical Gaps in Upload Security and Data Protection

In September 2026, Japanese image-sharing service Gyazo suffered a critical security breach that exposed 23.62 million user records and 490 million image metadata records. Attackers exploited a vulnerability in Gyazo's image upload server to execute arbitrary commands and access the company's database, compromising email addresses, password hashes, and sensitive image metadata including IDs that could be used to view private images without authorization. The breach primarily affected data from January 2019 or earlier, with Helpfeel temporarily disabling access to some images and forcing all users to reset their passwords. This incident highlights the growing threat to cloud-based content platforms and demonstrates how legacy vulnerabilities in upload systems can lead to massive data exposure. With increasing regulatory scrutiny on data protection and the rise of AI-driven attacks targeting user-generated content platforms, organizations must prioritize securing file upload mechanisms and implementing comprehensive data loss prevention strategies.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Critical WordPress Plugin Flaw Enables Mass Web Shell Deployment Campaign
Critical WordPress Plugin Flaw Enables Mass Web Shell Deployment Campaign
Retail Industry1 month ago

Critical WordPress Plugin Flaw Enables Mass Web Shell Deployment Campaign

Threat actors are actively exploiting CVE-2026-27540, a critical vulnerability in the WooCommerce Wholesale Lead Capture WordPress plugin with over 6,000 installations. The flaw allows unauthenticated attackers to upload arbitrary PHP files through missing file type validation in the wwlc_file_upload_handler AJAX action. Wordfence has blocked over 100,000 exploit attempts since June 2026, with attackers successfully deploying web shells that enable remote code execution and complete site takeover. The vulnerability affects all plugin versions up to 2.0.3.1 and demonstrates how supply chain weaknesses in popular plugins can create widespread attack surfaces. This incident reflects the growing threat to WordPress ecosystems as attackers increasingly target plugin vulnerabilities to achieve mass compromise across thousands of websites simultaneously, highlighting the urgent need for better third-party component security.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
WordPress Under Fire: CVE-2026-27540 Plugin Flaw Enables Mass Webshell Attacks
Retail Industry1 month ago

WordPress Under Fire: CVE-2026-27540 Plugin Flaw Enables Mass Webshell Attacks

In September 2026, security researchers identified active exploitation of CVE-2026-27540, a critical vulnerability in the WooCommerce Wholesale Lead Capture WordPress plugin. The flaw allows unauthenticated attackers to upload PHP webshells through an exposed AJAX action, enabling complete site compromise. Wordfence reported blocking over 100,000 exploitation attempts, with attack spikes occurring between June and August 2026. The vulnerability affects versions 2.0.3.1 and older of the premium plugin, which was patched in version 2.0.3.2 released in February 2026. This incident highlights the ongoing threat landscape targeting WordPress ecosystems, where third-party plugin vulnerabilities continue to provide attack vectors for cybercriminals seeking to establish persistent access to websites for malicious purposes including data theft and further payload deployment.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(low)
Read report
Supply Chain Attack Compromises Admin Menu Editor Pro Plugin, Backdoors 1,500+ WordPress Sites
Computer Software/Engineering1 month ago

Supply Chain Attack Compromises Admin Menu Editor Pro Plugin, Backdoors 1,500+ WordPress Sites

In September 2026, threat actors compromised the Admin Menu Editor Pro WordPress plugin distribution infrastructure, affecting over 1,500 websites across 230+ customers. The attackers gained root-level access to adminmenueditor.com and injected malicious code into plugin versions 2.35 and 2.36, creating backdoor access through hidden user accounts and web shells. The compromise lasted approximately seven hours before detection, with the malicious payload (wp-user-consent.php) establishing persistent access on victim sites. Developer Janis Elsts took the distribution site offline and recommended customers restore from pre-September 14 backups to ensure complete remediation. This incident highlights the growing sophistication of supply chain attacks targeting WordPress ecosystems, where attackers increasingly focus on plugin distribution networks to achieve mass compromise. With WordPress powering over 40% of websites globally, such attacks represent a critical threat vector that organizations must address through enhanced vendor security assessments and plugin management practices.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(high)
Read report
How a Malicious Twitch Extension Stole 30,000 Users' OAuth Tokens
How a Malicious Twitch Extension Stole 30,000 Users' OAuth Tokens
Entertainment/Movie Production1 month ago

How a Malicious Twitch Extension Stole 30,000 Users' OAuth Tokens

In September 2026, security researchers discovered that the 'Twitch Enhanced Viewer | JeetBot' browser extension, installed by over 30,000 users across Chrome and Firefox stores, was secretly harvesting users' OAuth authentication tokens. The extension, marketed as a legitimate Twitch enhancement tool for ad-blocking and quality improvements, redirected users' streaming requests through Russian-operated proxy servers while embedding authentication credentials in URL parameters, making them easily accessible in server logs. This supply-chain attack demonstrates the persistent risk of malicious browser extensions infiltrating official app stores despite security reviews. This incident highlights the growing trend of credential theft through seemingly legitimate browser extensions, coinciding with increased regulatory scrutiny of third-party software supply chains and the need for enhanced OAuth token security practices.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
JeetBot Extension Compromises 31,000 Twitch Users in Massive OAuth Token Theft
JeetBot Extension Compromises 31,000 Twitch Users in Massive OAuth Token Theft
Entertainment/Movie Production1 month ago

JeetBot Extension Compromises 31,000 Twitch Users in Massive OAuth Token Theft

In September 2026, a malicious Twitch browser extension called 'Twitch Enhanced Viewer | JeetBot' was discovered exposing OAuth tokens from nearly 31,000 users across Chrome and Firefox platforms. The extension, developed by HISHIMIRO/jeetbot.cc and operated by Cyprus-based developer Aleksandr Popov, routed users' authenticated Twitch sessions through operator-controlled proxy servers while claiming to provide ad-free viewing and region-unlocked content. The OAuth tokens were transmitted in cleartext as URL query parameters, enabling unauthorized access to users' chat, private messages, and account settings. Interestingly, the token forwarding mechanism excluded a hardcoded list of ten Russian streamer channels with large followings. This incident highlights the growing threat of supply chain attacks targeting browser extensions and the critical importance of OAuth token security in modern web applications. As streaming platforms and social media continue to expand globally, malicious actors are increasingly exploiting trusted software distribution channels to harvest user credentials at scale.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Google Play Early Access Exploited: How Thousands of Deceptive Apps Bypassed Security
Google Play Early Access Exploited: How Thousands of Deceptive Apps Bypassed Security
Computer Games2 months ago

Google Play Early Access Exploited: How Thousands of Deceptive Apps Bypassed Security

In September 2026, cybersecurity researchers discovered threat actors systematically abusing Google Play's Early Access program to distribute thousands of deceptive Android applications. These malicious apps promised financial rewards, casino winnings, and premium content while exploiting the program's feature that prevents user reviews and ratings. Notable examples included fake casino games and a Grand Theft Auto imitator called "Vice Streets: Open World" with over 1 million downloads. The attackers promoted these apps through social media platforms using AI-generated celebrity deepfakes, ultimately generating revenue through excessive advertising while never delivering promised payouts to users. This incident highlights the growing sophistication of mobile malware campaigns that exploit legitimate platform features to bypass traditional security mechanisms. The abuse of Early Access programs represents an emerging trend where attackers leverage regulatory gaps and user trust mechanisms to distribute deceptive applications at scale.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports