The breach isn’t the problem. The spread is. →The breach isn’t the problem. The spread is. →Measure in 5 min. Free AssessmentFree Assessment
Marketing/Advertising/Sales
Breach intelligence, attack campaigns, and threat reports targeting the Marketing/Advertising/Sales sector.
Explore Other Sectors
Marketing/Advertising/Sales Threat Reports
Meta AI Support Exploit Leads to Massive Instagram Account Hijack
In May 2026, attackers exploited a vulnerability in Meta's AI-powered High Touch Support (HTS) system to hijack over 20,000 Instagram accounts. The flaw allowed unauthorized individuals to request password reset links be sent to email addresses not associated with the target accounts, bypassing standard verification processes. This oversight enabled attackers to reset passwords and gain control of accounts lacking two-factor authentication (2FA). High-profile accounts, including those of former President Barack Obama and the U.S. Space Force, were among those compromised. Meta has since patched the vulnerability and is working to secure affected accounts. This incident underscores the risks associated with deploying AI-driven support systems without robust security measures. It highlights the necessity for continuous monitoring and validation of AI functionalities to prevent exploitation. Organizations are urged to implement comprehensive security protocols, including mandatory 2FA, to mitigate similar threats in the future.
3 months ago
Kill Chain
Critical Vulnerability in Everest Forms Pro Exploited to Hijack WordPress Sites
In June 2026, a critical vulnerability (CVE-2026-3300) in the Everest Forms Pro plugin for WordPress was actively exploited by attackers to gain unauthorized control over websites. The flaw, present in versions up to and including 1.9.12, resided in the plugin's Complex Calculation feature, which improperly handled user input, allowing unauthenticated remote code execution. Exploiting this, attackers created rogue administrator accounts, enabling them to modify content, install malicious plugins, and access sensitive data. The vulnerability was patched on March 18, 2026, but exploitation began on April 13, 2026, with over 29,300 attempts blocked by security tools. This incident underscores the persistent threat posed by vulnerabilities in widely-used WordPress plugins. Website administrators are urged to promptly update plugins and monitor for unauthorized access to mitigate such risks.
3 months ago
Kill Chain
Hackers Exploit Critical Everest Forms Pro Plugin Flaw
In March 2026, a critical vulnerability (CVE-2026-3300) was discovered in the Everest Forms Pro WordPress plugin, affecting versions up to 1.9.12. This flaw allowed unauthenticated attackers to execute arbitrary PHP code via the plugin's 'Complex Calculation' feature, leading to full site compromise. Despite a patch released on March 18, 2026, exploitation began on April 13, 2026, with over 29,300 attempts recorded, including the creation of rogue administrator accounts named 'diksimarina'. This incident underscores the persistent threat posed by vulnerabilities in widely-used WordPress plugins. The rapid exploitation following disclosure highlights the critical need for timely patching and robust security measures to protect web assets from emerging threats.
3 months ago
Kill Chain
Operation FlutterBridge: Unveiling the FlutterShell Backdoor Targeting macOS Users
In June 2026, cybersecurity researchers identified 'Operation FlutterBridge,' a sophisticated malvertising campaign targeting macOS users. This operation distributes a new backdoor named 'FlutterShell,' built using Google's Flutter framework. The campaign employs malicious Google and YouTube advertisements to lure users into downloading seemingly legitimate desktop applications, which, upon execution, install FlutterShell. This malware combines adware functionalities with backdoor capabilities, including shell command execution and file system manipulation. Some variants also exploit AI summarization features for data exfiltration by routing documents through attacker-controlled servers. The campaign is linked to the cybercrime group CL-CRI-1089, previously associated with the JSCoreRunner campaign detected in August 2025. ([unit42.paloaltonetworks.com](https://unit42.paloaltonetworks.com/flutterbridge-new-fluttershell-backdoor/?utm_source=openai)) The use of the Flutter framework in malware development is notable, as it allows attackers to dynamically alter the malware's behavior without recompiling or redistributing the application. This adaptability, combined with the extensive reach of malvertising through trusted platforms like Google and YouTube, underscores the evolving sophistication of cyber threats targeting macOS systems. ([unit42.paloaltonetworks.com](https://unit42.paloaltonetworks.com/flutterbridge-new-fluttershell-backdoor/?utm_source=openai))
3 months ago
Kill Chain
Google DoubleClick Abused in Malspam Campaign Delivering DesckVB RAT
In June 2026, cybersecurity researchers identified a sophisticated malspam campaign exploiting Google's DoubleClick domain to distribute the DesckVB RAT, a .NET-based remote access trojan active since February 2026. The attack initiates with a phishing email containing an HTML attachment that redirects the victim through DoubleClick to a personalized landing page. This page prompts the user to download a ZIP archive, which, upon execution, deploys a JavaScript loader. The loader retrieves and runs a PowerShell script that downloads the DesckVB RAT, establishing persistence and granting attackers full control over the compromised system. The malware employs advanced evasion techniques, including process hollowing and disabling security controls, to avoid detection. This incident underscores the evolving tactics of threat actors who leverage legitimate services to bypass security measures, highlighting the necessity for organizations to implement comprehensive email security protocols, user education, and robust endpoint defenses to mitigate such threats.
3 months ago
Kill Chain
Meta AI Exploited in High-Profile Instagram Account Hijackings
In June 2026, attackers exploited Meta's AI-powered support chatbot to hijack multiple high-profile Instagram accounts. By manipulating the chatbot into changing account email addresses without proper verification, they bypassed two-factor authentication and gained unauthorized access. Notable accounts affected included those previously associated with the Obama White House and app researcher Jane Manchun Wong. The attackers utilized AI-generated videos to deceive the system's facial recognition, highlighting significant vulnerabilities in automated support mechanisms. This incident underscores the growing risks associated with AI-driven customer support systems, especially when they lack robust identity verification processes. As cybercriminals increasingly exploit such technologies, organizations must reassess and fortify their security protocols to prevent similar breaches.
3 months ago
Kill Chain
Critical Kirki Plugin Vulnerability (CVE-2026-8206) Exploited in WordPress Sites
In early June 2026, a critical privilege escalation vulnerability (CVE-2026-8206) was discovered in the Kirki WordPress plugin, affecting versions 6.0.0 through 6.0.6. This flaw allows unauthenticated attackers to reset passwords for any user account, including administrators, by exploiting the plugin's password reset function, which improperly handles email addresses. As a result, attackers can gain full control over affected websites, enabling them to install malicious plugins, alter content, and access sensitive data. The vulnerability was actively exploited, with over 222 attack attempts detected within a 24-hour period. A patch was released on May 18, 2026, in version 6.0.7, and users are strongly advised to update immediately to mitigate the risk. This incident underscores the ongoing risks associated with third-party plugins in widely used platforms like WordPress. It highlights the importance of prompt vulnerability management and the need for website administrators to stay vigilant about security updates to protect their sites from emerging threats.
3 months ago
Kill Chain
Exploiting AI: The 2026 Instagram Account Takeover Incident
In late May 2026, attackers exploited a vulnerability in Meta's AI support assistant to hijack high-profile Instagram accounts, including those of the Obama White House and the Chief Master Sergeant of the U.S. Space Force. By manipulating the AI bot into adding a new email address during the password reset process, they gained unauthorized access and defaced these accounts with pro-Iranian content. Meta responded by deploying an emergency patch to address the flaw. This incident underscores the emerging risks associated with AI-driven customer support systems. As organizations increasingly integrate AI into sensitive processes, ensuring robust security measures and implementing multi-factor authentication (MFA) become imperative to prevent similar exploits.
3 months ago
Kill Chain
Zapier Vulnerabilities Exposed: Potential Account Takeover Risks
In May 2026, security researchers from Token Security identified a chain of five vulnerabilities within Zapier, a widely-used workflow automation service. Exploiting these flaws required only a free Zapier account and could have allowed attackers to impersonate any signed-in user, potentially accessing millions of user accounts and their connected applications. The attack vector involved manipulating user-generated code, retrieving discarded login credentials, and accessing internal storage systems containing private software images. One such image included a publishing key for code running in every logged-in user's browser, enabling attackers to create or alter automations and interact with connected services as legitimate users. ([cyberscoop.com](https://cyberscoop.com/zapier-bug-chain-account-takeover-patched/?utm_source=openai)) This incident underscores the critical importance of securing automation platforms, especially as they gain increased authority to act on behalf of users across multiple services. The vulnerabilities were promptly reported and patched, with no evidence of exploitation. However, organizations are advised to review their automation logs for unauthorized activities and reauthorize connections to sensitive systems to mitigate potential risks. ([cyberscoop.com](https://cyberscoop.com/zapier-bug-chain-account-takeover-patched/?utm_source=openai))
4 months ago
Kill Chain
Ghost CMS Vulnerability Leads to Massive ClickFix Attack Campaign
In May 2026, threat actors exploited a critical SQL injection vulnerability (CVE-2026-26980) in Ghost CMS, affecting versions 3.24.0 through 6.19.0. This flaw allowed unauthenticated attackers to read arbitrary data from the database, including admin API keys. Utilizing these keys, attackers injected malicious JavaScript into over 700 websites, including those of Harvard University, Oxford University, and DuckDuckGo. The injected scripts facilitated ClickFix attacks, deceiving visitors into executing harmful commands via fake CAPTCHA verification prompts. ([thehackernews.com](https://thehackernews.com/2026/05/ghost-cms-cve-2026-26980-exploited-to.html?utm_source=openai)) This incident underscores the urgency of timely patch management, as the vulnerability had been addressed in version 6.19.1 released in February 2026. The widespread exploitation highlights the evolving sophistication of social engineering tactics and the critical need for organizations to maintain up-to-date security measures to protect their digital assets. ([sentinelone.com](https://www.sentinelone.com/vulnerability-database/cve-2026-26980/?utm_source=openai))
4 months ago
Kill Chain
Critical ExifTool Vulnerability on macOS: CVE-2026-3102 Analysis
In February 2026, a critical vulnerability identified as CVE-2026-3102 was discovered in ExifTool versions up to 13.49 on macOS. This flaw allows attackers to execute arbitrary commands by embedding malicious shell commands within the metadata of image files. When a vulnerable version of ExifTool processes such a file, the embedded commands are executed, potentially leading to unauthorized actions on the system. The vulnerability specifically affects the SetMacOSTags function in the MacOS.pm module, where improper handling of the DateTimeOriginal metadata field enables command injection. ([kaspersky.com](https://www.kaspersky.com/blog/exiftool-macos-picture-vulnerability-mitigation-cve-2026-3102/55362/?utm_source=openai)) The exploitation of this vulnerability underscores the risks associated with processing untrusted files, especially in automated workflows. Given ExifTool's widespread use in various applications, including digital asset management and forensic analysis, the potential for widespread impact is significant. Organizations are urged to update to ExifTool version 13.50 or later to mitigate this risk. ([kaspersky.com](https://www.kaspersky.com/blog/exiftool-macos-picture-vulnerability-mitigation-cve-2026-3102/55362/?utm_source=openai))
4 months ago
Kill Chain
Unveiling Trapdoor: The 2026 Android Ad Fraud Scheme
In May 2026, cybersecurity researchers uncovered 'Trapdoor,' a sophisticated ad fraud and malvertising operation targeting Android users. The scheme involved 455 malicious apps and 183 command-and-control domains, creating a self-sustaining cycle of fraud. Users unknowingly downloaded utility-style apps, which then initiated malvertising campaigns, coercing them into installing additional malicious apps. These secondary apps launched hidden WebViews, loaded threat actor-controlled HTML5 domains, and requested ads, leading to 659 million daily bid requests and over 24 million app downloads, primarily affecting users in the U.S. ([thehackernews.com](https://thehackernews.com/2026/05/trapdoor-android-ad-fraud-scheme-hit.html?utm_source=openai)) This incident highlights the evolving tactics of cybercriminals who blend legitimate tools with malicious intent, emphasizing the need for continuous vigilance and advanced detection mechanisms to protect users from such deceptive schemes.
4 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports