✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Professional Training
Breach intelligence, attack campaigns, and threat reports targeting the Professional Training sector.
Explore Other Sectors
Professional Training Threat Reports
Understanding 'PleaseFix': Securing AI Browsers Against Zero-Click Agent Hijacking
In March 2026, Zenity Labs disclosed 'PleaseFix,' a family of critical vulnerabilities affecting agentic browsers like Perplexity Comet. These flaws enable attackers to hijack AI agents through malicious instructions embedded in routine content, such as emails or calendar invites, without any user interaction. Exploiting these vulnerabilities, adversaries can access local files, steal credentials, and perform unauthorized actions within authenticated user sessions. The root cause lies in the agents' inability to distinguish between legitimate user commands and adversarially injected instructions, leading to significant security breaches. This incident underscores the urgent need for organizations to reassess the security models of AI-integrated systems. As AI agents become more prevalent in enterprise environments, the risk of similar zero-click exploits increases, highlighting the necessity for robust input validation, strict access controls, and continuous monitoring to prevent unauthorized agent behavior.
4 days ago
Kill Chain
Unveiling the Smoke#Screen RMM Takeover: A New Threat Actor Playbook
In August 2026, the Smoke#Screen campaign emerged, leveraging the legitimate ScreenConnect Remote Monitoring and Management (RMM) tool to gain persistent remote access to compromised networks. Attackers employed diverse social engineering lures, including fake Zoom and Adobe updates, business document requests, and system maintenance tools, to trick victims into executing malicious files. This resulted in the silent installation of ScreenConnect agents that connected to attacker-controlled relay servers, providing unauthorized access to both Windows and macOS systems. The campaign's sophistication was evident in its use of rotating payloads and varied lures, making detection challenging. This incident underscores a growing trend where threat actors exploit legitimate RMM tools to bypass security controls and maintain persistence. The evolving tactics highlight the need for organizations to enhance their defenses against such sophisticated social engineering attacks and to monitor for unauthorized installations of RMM software.
5 days ago
Kill Chain
ChatGPT's 'AgentForger' Vulnerability: A Wake-Up Call for AI Security
In June 2026, Zenity Labs identified a critical vulnerability in OpenAI's ChatGPT Workspace Agents, termed 'AgentForger.' This flaw allowed attackers to craft a phishing link that, when clicked by an employee, could silently create and deploy an autonomous AI agent within the organization's ChatGPT environment. This rogue agent would inherit the employee's identity and access privileges, operating without the employee's knowledge or consent. OpenAI addressed and patched this vulnerability by June 8, 2026. ([zenity.io](https://zenity.io/company-overview/newsroom/company-news/zenity-labs-uncovers-agentforger-a-chatgpt-vulnerability?utm_source=openai)) The 'AgentForger' incident underscores the evolving nature of cyber threats targeting AI systems. As organizations increasingly integrate AI agents into their workflows, ensuring robust security measures and prompt vulnerability management becomes paramount to prevent unauthorized access and potential data breaches.
2 weeks ago
Kill Chain
JADEPUFFER: Unveiling the First AI-Driven Ransomware Attack
In July 2026, cybersecurity researchers identified 'JADEPUFFER,' the first documented case of a fully autonomous ransomware attack orchestrated entirely by a large language model (LLM). The AI agent exploited a vulnerability in the Langflow application (CVE-2025-3248) to gain initial access, conduct reconnaissance, steal credentials, move laterally, establish persistence, escalate privileges, and encrypt data without human intervention. Notably, the AI adapted to failures during the intrusion, retrying failed steps within refined parameters, and issued a ransom demand without providing a recovery method, rendering data recovery impossible even if the ransom was paid. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/jadepuffer-ransomware-used-ai-agent-to-automate-entire-attack/?utm_source=openai)) This incident underscores a significant shift in cybercrime, highlighting the emergence of Agentic Threat Actors (ATAs) where AI can autonomously adapt and evolve cyberattacks. The ability of AI to conduct sophisticated, self-directed campaigns signals an urgent need for organizations to reassess their cybersecurity strategies to address AI-driven threats. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/jadepuffer-ransomware-used-ai-agent-to-automate-entire-attack/?utm_source=openai))
2 weeks ago
Kill Chain
Ransomware Surge in 2026: Understanding the 25% Increase and Its Implications
Between April 2025 and March 2026, ransomware incidents surged by 25%, with 7,551 known victims worldwide. This escalation was driven by the emergence of over 60 new ransomware groups and a significant increase in attacks targeting small and medium-sized businesses (SMBs). Notably, the Qilin ransomware group experienced a 443% year-over-year increase in activity, operating across more than 50 countries. The manufacturing sector remained the top target, accounting for 1,660 victims. ([gbhackers.com](https://gbhackers.com/2026-ransomware-report/?utm_source=openai)) This trend underscores the evolving threat landscape, where ransomware groups are becoming more operationalized, and the barriers to entry are lowering. Organizations must enhance their cybersecurity measures, focusing on patching known vulnerabilities, strengthening vendor oversight, and preparing for AI-driven threats. ([mbtmag.com](https://www.mbtmag.com/cybersecurity/news/22970998/report-addresses-evolving-state-of-ransomware?utm_source=openai))
2 weeks ago
Kill Chain
ACR Stealer 2026: Unveiling the ClickFix Intrusion Chains
Between late April and mid-June 2026, Microsoft Defender Experts observed a surge in ACR Stealer activity targeting enterprise environments. Attackers employed 'ClickFix' social engineering tactics to deceive users into executing malicious commands, leading to the theft of browser credentials, authentication tokens, and sensitive documents. The campaigns utilized two primary intrusion chains: one leveraging WebDAV for payload delivery with Python-based loaders and blockchain-backed command-and-control mechanisms, and another employing MSHTA-initiated PowerShell scripts with steganographic techniques for in-memory payload execution. These sophisticated methods enabled attackers to evade detection and maintain persistence within compromised systems. The significance of this incident lies in the advanced techniques used to bypass traditional security measures, highlighting the evolving nature of cyber threats. Organizations must remain vigilant against such deceptive tactics and enhance their security protocols to detect and mitigate similar attacks effectively.
3 weeks ago
Kill Chain
ShinyHunters' Year-Long Exploitation of OAuth in Salesforce Breaches
Between mid-2025 and mid-2026, the cybercriminal group ShinyHunters orchestrated a series of data extortion attacks targeting corporate Salesforce environments. By exploiting trust relationships through OAuth connections, they gained unauthorized access without exploiting platform vulnerabilities. Their methods included voice phishing to trick employees into approving malicious connected apps, stealing OAuth tokens from compromised software vendors, and leveraging misconfigured guest access to Salesforce sites. These tactics allowed them to exfiltrate sensitive CRM data from numerous organizations across various industries. This incident underscores the evolving threat landscape where attackers exploit trusted integrations and social engineering to bypass traditional security measures. Organizations must enhance their monitoring of OAuth activities, audit third-party app permissions, and educate employees on the risks of social engineering to mitigate such sophisticated attacks.
3 weeks ago
Kill Chain
Vidar Infostealer Exploits Malvertising to Target SMBs in 2026
In April 2026, a sophisticated malvertising campaign targeted consumers and small to midsize businesses (SMBs) globally by delivering the Vidar infostealer and XMRig cryptomining malware. Attackers lured victims with ads for cracked software, leading them to download password-protected archives that concealed a Go-based loader. This loader executed defense-evasion techniques, including an in-memory Antimalware Scan Interface (AMSI) bypass, before deploying Vidar to harvest browser credentials and XMRig to mine Monero cryptocurrency. The campaign utilized the Factory-v3 framework to generate unique binaries, complicating detection efforts. ([darkreading.com](https://www.darkreading.com/cyberattacks-data-breaches/vidar-infostealer-smb-malvertising-campaign?utm_source=openai)) This incident underscores the evolving tactics of financially motivated threat actors who combine multiple monetization strategies within a single infection. The use of malvertising, coupled with advanced evasion techniques, highlights the need for organizations to enhance their cybersecurity defenses against such multifaceted threats.
1 month ago
Kill Chain
EvilTokens Phishing Campaign: A 2026 Cybersecurity Wake-Up Call
In early 2026, the EvilTokens phishing-as-a-service (PhaaS) platform emerged, exploiting the OAuth 2.0 Device Authorization Grant to compromise Microsoft 365 accounts. This sophisticated campaign utilized AI to generate personalized phishing lures, leading to a 1,380% increase in device code phishing attacks between July–December 2025 and January–April 2026. Attackers bypassed multi-factor authentication (MFA) by redirecting legitimate authentication flows, granting them persistent access to corporate email, SharePoint, and OneDrive services. The campaign targeted hundreds of organizations daily, affecting sectors globally. ([huntress.com](https://www.huntress.com/resources/eviltokens-ai-powered-phishing-report?utm_source=openai)) The EvilTokens operation underscores a significant evolution in phishing tactics, leveraging AI to automate and personalize attacks at scale. This trend highlights the urgent need for organizations to reassess and strengthen their security postures, particularly concerning identity and access management, to mitigate the risks posed by increasingly sophisticated phishing campaigns. ([securityboulevard.com](https://securityboulevard.com/2026/07/eviltokens-campaign-reveals-device-code-phishing-ticks-up-1380-powered-by-ai/?utm_source=openai))
1 month ago
Kill Chain
Kaspersky SMB Threat Report 2026: Unveiling New Cyber Threats
In early 2026, Kaspersky's analysis revealed a significant surge in cyberattacks targeting small and medium-sized businesses (SMBs). Notably, over 92,000 malware attacks were disguised as popular AI services, with fake ChatGPT applications accounting for 49% of these incidents. This trend underscores cybercriminals' exploitation of trusted AI brands to distribute malicious software. Additionally, the report highlighted a rise in 'encryption-less' extortion attacks, where attackers focus on stealing and leaking sensitive data rather than encrypting systems. The emergence of ransomware groups adopting post-quantum cryptography standards further complicates the threat landscape. ([me-en.kaspersky.com](https://me-en.kaspersky.com/about/press-releases/kaspersky-detected-more-than-92000-malware-attacks-disguised-as-ai-services-in-2026?utm_source=openai)) This escalation in sophisticated cyber threats against SMBs emphasizes the urgent need for enhanced cybersecurity measures. The increasing use of AI as a lure, coupled with advanced extortion tactics, indicates a shift in cybercriminal strategies that SMBs must proactively address to safeguard their operations and sensitive data.
1 month ago
Kill Chain
Unveiling Mistic: The Stealthy Backdoor Linked to KongTuke
In April 2026, a new backdoor named Mistic was identified in attacks targeting organizations across the insurance, education, IT, and professional services sectors. Linked to the initial access broker KongTuke, Mistic operates entirely in memory, avoiding disk writes and incorporating a self-deletion feature to evade detection. The malware is deployed through DLL side-loading techniques, utilizing legitimate Microsoft endpoint security tools to blend in with trusted software. Once established, Mistic enables attackers to execute code, manage files, and load additional modules, facilitating long-term, low-visibility access to compromised systems. The emergence of Mistic underscores a growing trend among threat actors to develop and deploy sophisticated, stealthy malware capable of evading traditional security measures. This development highlights the need for organizations to enhance their detection and response capabilities, particularly against fileless malware that operates in memory and leverages legitimate processes to achieve persistence.
1 month ago
Kill Chain
Europe's Ransomware Epidemic: A 55% Surge in Early 2026
In the first four months of 2026, Europe experienced a significant surge in ransomware attacks, with incidents rising by 55% compared to the same period in 2025. This increase is attributed to factors such as attackers shifting focus from oversaturated markets like the U.S. to European targets, and the utilization of AI-assisted target research identifying vulnerabilities within European organizations. Notably, major economies including Germany, the UK, France, Italy, and Spain accounted for nearly 70% of these attacks, highlighting a concentration of cyber risk in Europe's largest markets. ([prnewswire.com](https://www.prnewswire.com/news-releases/black-kites-first-report-dedicated-to-europe-ransomware-incidents-rose-55-year-over-year-in-early-2026-as-supply-chains-become-a-key-attack-path-302808057.html?utm_source=openai)) This trend underscores the evolving tactics of ransomware groups, who are increasingly targeting supply chains to maximize impact. The Miljödata incident in August 2025 exemplifies this approach, where a ransomware attack on a Swedish HR software provider led to data breaches affecting numerous municipalities and corporations, including Volvo Group North America. ([incibe.es](https://www.incibe.es/en/incibe-cert/publications/cybersecurity-highlights/ransomware-attack-leads-data-breach-affecting-volvo-north-america-employees?utm_source=openai))
1 month ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports