✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Professional Training
Breach intelligence, attack campaigns, and threat reports targeting the Professional Training sector.
Explore Other Sectors
Professional Training Threat Reports
ACR Stealer 2026: Unveiling the ClickFix Intrusion Chains
Between late April and mid-June 2026, Microsoft Defender Experts observed a surge in ACR Stealer activity targeting enterprise environments. Attackers employed 'ClickFix' social engineering tactics to deceive users into executing malicious commands, leading to the theft of browser credentials, authentication tokens, and sensitive documents. The campaigns utilized two primary intrusion chains: one leveraging WebDAV for payload delivery with Python-based loaders and blockchain-backed command-and-control mechanisms, and another employing MSHTA-initiated PowerShell scripts with steganographic techniques for in-memory payload execution. These sophisticated methods enabled attackers to evade detection and maintain persistence within compromised systems. The significance of this incident lies in the advanced techniques used to bypass traditional security measures, highlighting the evolving nature of cyber threats. Organizations must remain vigilant against such deceptive tactics and enhance their security protocols to detect and mitigate similar attacks effectively.
3 days ago
Kill Chain
ShinyHunters' Year-Long Exploitation of OAuth in Salesforce Breaches
Between mid-2025 and mid-2026, the cybercriminal group ShinyHunters orchestrated a series of data extortion attacks targeting corporate Salesforce environments. By exploiting trust relationships through OAuth connections, they gained unauthorized access without exploiting platform vulnerabilities. Their methods included voice phishing to trick employees into approving malicious connected apps, stealing OAuth tokens from compromised software vendors, and leveraging misconfigured guest access to Salesforce sites. These tactics allowed them to exfiltrate sensitive CRM data from numerous organizations across various industries. This incident underscores the evolving threat landscape where attackers exploit trusted integrations and social engineering to bypass traditional security measures. Organizations must enhance their monitoring of OAuth activities, audit third-party app permissions, and educate employees on the risks of social engineering to mitigate such sophisticated attacks.
6 days ago
Kill Chain
Vidar Infostealer Exploits Malvertising to Target SMBs in 2026
In April 2026, a sophisticated malvertising campaign targeted consumers and small to midsize businesses (SMBs) globally by delivering the Vidar infostealer and XMRig cryptomining malware. Attackers lured victims with ads for cracked software, leading them to download password-protected archives that concealed a Go-based loader. This loader executed defense-evasion techniques, including an in-memory Antimalware Scan Interface (AMSI) bypass, before deploying Vidar to harvest browser credentials and XMRig to mine Monero cryptocurrency. The campaign utilized the Factory-v3 framework to generate unique binaries, complicating detection efforts. ([darkreading.com](https://www.darkreading.com/cyberattacks-data-breaches/vidar-infostealer-smb-malvertising-campaign?utm_source=openai)) This incident underscores the evolving tactics of financially motivated threat actors who combine multiple monetization strategies within a single infection. The use of malvertising, coupled with advanced evasion techniques, highlights the need for organizations to enhance their cybersecurity defenses against such multifaceted threats.
1 week ago
Kill Chain
EvilTokens Phishing Campaign: A 2026 Cybersecurity Wake-Up Call
In early 2026, the EvilTokens phishing-as-a-service (PhaaS) platform emerged, exploiting the OAuth 2.0 Device Authorization Grant to compromise Microsoft 365 accounts. This sophisticated campaign utilized AI to generate personalized phishing lures, leading to a 1,380% increase in device code phishing attacks between July–December 2025 and January–April 2026. Attackers bypassed multi-factor authentication (MFA) by redirecting legitimate authentication flows, granting them persistent access to corporate email, SharePoint, and OneDrive services. The campaign targeted hundreds of organizations daily, affecting sectors globally. ([huntress.com](https://www.huntress.com/resources/eviltokens-ai-powered-phishing-report?utm_source=openai)) The EvilTokens operation underscores a significant evolution in phishing tactics, leveraging AI to automate and personalize attacks at scale. This trend highlights the urgent need for organizations to reassess and strengthen their security postures, particularly concerning identity and access management, to mitigate the risks posed by increasingly sophisticated phishing campaigns. ([securityboulevard.com](https://securityboulevard.com/2026/07/eviltokens-campaign-reveals-device-code-phishing-ticks-up-1380-powered-by-ai/?utm_source=openai))
1 week ago
Kill Chain
Kaspersky SMB Threat Report 2026: Unveiling New Cyber Threats
In early 2026, Kaspersky's analysis revealed a significant surge in cyberattacks targeting small and medium-sized businesses (SMBs). Notably, over 92,000 malware attacks were disguised as popular AI services, with fake ChatGPT applications accounting for 49% of these incidents. This trend underscores cybercriminals' exploitation of trusted AI brands to distribute malicious software. Additionally, the report highlighted a rise in 'encryption-less' extortion attacks, where attackers focus on stealing and leaking sensitive data rather than encrypting systems. The emergence of ransomware groups adopting post-quantum cryptography standards further complicates the threat landscape. ([me-en.kaspersky.com](https://me-en.kaspersky.com/about/press-releases/kaspersky-detected-more-than-92000-malware-attacks-disguised-as-ai-services-in-2026?utm_source=openai)) This escalation in sophisticated cyber threats against SMBs emphasizes the urgent need for enhanced cybersecurity measures. The increasing use of AI as a lure, coupled with advanced extortion tactics, indicates a shift in cybercriminal strategies that SMBs must proactively address to safeguard their operations and sensitive data.
3 weeks ago
Kill Chain
Unveiling Mistic: The Stealthy Backdoor Linked to KongTuke
In April 2026, a new backdoor named Mistic was identified in attacks targeting organizations across the insurance, education, IT, and professional services sectors. Linked to the initial access broker KongTuke, Mistic operates entirely in memory, avoiding disk writes and incorporating a self-deletion feature to evade detection. The malware is deployed through DLL side-loading techniques, utilizing legitimate Microsoft endpoint security tools to blend in with trusted software. Once established, Mistic enables attackers to execute code, manage files, and load additional modules, facilitating long-term, low-visibility access to compromised systems. The emergence of Mistic underscores a growing trend among threat actors to develop and deploy sophisticated, stealthy malware capable of evading traditional security measures. This development highlights the need for organizations to enhance their detection and response capabilities, particularly against fileless malware that operates in memory and leverages legitimate processes to achieve persistence.
3 weeks ago
Kill Chain
Europe's Ransomware Epidemic: A 55% Surge in Early 2026
In the first four months of 2026, Europe experienced a significant surge in ransomware attacks, with incidents rising by 55% compared to the same period in 2025. This increase is attributed to factors such as attackers shifting focus from oversaturated markets like the U.S. to European targets, and the utilization of AI-assisted target research identifying vulnerabilities within European organizations. Notably, major economies including Germany, the UK, France, Italy, and Spain accounted for nearly 70% of these attacks, highlighting a concentration of cyber risk in Europe's largest markets. ([prnewswire.com](https://www.prnewswire.com/news-releases/black-kites-first-report-dedicated-to-europe-ransomware-incidents-rose-55-year-over-year-in-early-2026-as-supply-chains-become-a-key-attack-path-302808057.html?utm_source=openai)) This trend underscores the evolving tactics of ransomware groups, who are increasingly targeting supply chains to maximize impact. The Miljödata incident in August 2025 exemplifies this approach, where a ransomware attack on a Swedish HR software provider led to data breaches affecting numerous municipalities and corporations, including Volvo Group North America. ([incibe.es](https://www.incibe.es/en/incibe-cert/publications/cybersecurity-highlights/ransomware-attack-leads-data-breach-affecting-volvo-north-america-employees?utm_source=openai))
3 weeks ago
Kill Chain
SonicWall Vulnerability CVE-2024-40766: A Ransomware Exploitation Case Study
In August 2024, SonicWall disclosed CVE-2024-40766, a critical improper access control vulnerability in SonicOS affecting Gen 5, Gen 6, and Gen 7 firewalls. Despite the availability of patches, ransomware groups such as Akira and Fog have been actively exploiting this vulnerability since September 2024, leading to unauthorized access and rapid encryption of organizational data. By December 2024, approximately 48,933 devices remained unpatched and publicly exposed, with attacks escalating in mid-2025, particularly targeting Gen 7 firewalls. In some cases, attackers achieved data encryption within 55 minutes of initial access. The continued exploitation of CVE-2024-40766 underscores the critical importance of not only applying security patches but also addressing post-patch configurations. Organizations must ensure comprehensive remediation, including password resets, account audits, and proper configuration of security settings, to prevent exploitation by threat actors leveraging known vulnerabilities.
3 weeks ago
Kill Chain
ShapedPlugin WordPress Pro Plugins Compromised in Supply Chain Attack
In June 2026, ShapedPlugin, a developer of premium WordPress plugins, experienced a supply chain attack where attackers compromised the company's update infrastructure. This breach led to the distribution of backdoored versions of several plugins, including Product Slider Pro for WooCommerce, Real Testimonials Pro, and Smart Post Show Pro. The malicious code, activated upon administrator access to the WordPress dashboard, connected to a command-and-control server to download additional payloads, resulting in unauthorized access and data exfiltration. ([thaicert.or.th](https://www.thaicert.or.th/en/2026/06/19/supply-chain-attack-through-shapedplugin-update-system-impacts-wordpress-websites/?utm_source=openai)) This incident underscores the growing threat of supply chain attacks targeting trusted software vendors. It highlights the critical need for organizations to implement robust security measures, including regular code audits and monitoring of update channels, to prevent similar compromises.
4 weeks ago
Kill Chain
Critical Vulnerability in Gravity SMTP Plugin Exposes API Keys
In June 2026, a significant security vulnerability (CVE-2026-4020) was discovered in the Gravity SMTP WordPress plugin, affecting approximately 100,000 websites. This flaw allowed unauthenticated attackers to access sensitive information, including API keys and configuration data, through an improperly secured REST API endpoint. Exploitation of this vulnerability enabled threat actors to harvest credentials and gain insights into the site's software stack, potentially facilitating further attacks. The incident underscores the critical importance of promptly updating plugins and securing REST API endpoints to prevent unauthorized data exposure. It also highlights the need for website administrators to regularly audit and monitor their systems for vulnerabilities to mitigate the risk of exploitation.
1 month ago
Kill Chain
DragonForce Ransomware's Stealthy Exploitation of Microsoft Teams
In December 2025, the DragonForce ransomware group infiltrated a major U.S. services firm by exploiting an SQL-related vulnerability. They deployed a custom Go-based remote access trojan (RAT) named Backdoor.Turn, which concealed command-and-control (C2) traffic within Microsoft Teams' TURN relay infrastructure. This method allowed the attackers to remain undetected for one to two months, as the malicious traffic appeared as legitimate Teams communication. ([helpnetsecurity.com](https://www.helpnetsecurity.com/2026/06/16/dragonforce-microsoft-teams-malware-backdoor-turn/?utm_source=openai)) This incident underscores a significant evolution in cyberattack methodologies, highlighting the increasing sophistication of threat actors in leveraging trusted communication platforms to evade detection. Organizations must reassess their security postures to address such advanced persistent threats.
1 month ago
Kill Chain
Silent Ransom Group's Bold Tactics: A Wake-Up Call for Law Firms
Between January and May 2026, the Silent Ransom Group (SRG), also known as UNC3753, targeted numerous U.S. law firms through a sophisticated data theft extortion campaign. The attackers employed a combination of voice phishing (vishing), social engineering, and physical office intrusions. Initially, they contacted employees via phone calls or phishing emails, posing as IT support to gain remote access. If these attempts failed, SRG operatives visited offices in person, impersonating IT staff to physically access systems and exfiltrate sensitive data using USB drives or external hard drives. The stolen data included contracts, personal information, and financial records, which were then used to extort victims under the threat of public disclosure. ([darkreading.com](https://www.darkreading.com/cyberattacks-data-breaches/silent-ransom-us-law-firms-extortion-attacks?utm_source=openai)) This incident underscores a concerning evolution in cybercriminal tactics, blending traditional social engineering with physical infiltration. The legal sector, handling highly sensitive client information, remains a prime target. Organizations must enhance their security protocols, including employee training on social engineering, stringent verification processes for IT support requests, and robust physical security measures to prevent unauthorized access.
1 month ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports