| T1589 |
Gather Victim Identity Information |
Reconnaissance |
FBI Probes Service Selling 153M+ Drivers LicensesFeds accuse China of 'systematic' distillation of U.S. AI modelsHackers Can Buy Corporate Executives' Social Security Numbers for Just 25 Cents
|
gap
|
| T1590 |
Gather Victim Network Information |
Reconnaissance |
77 "Evil Twin" Open VSX Extensions Harvest Developer Metadata — Shared C2 at mangorbit[.]com
|
gap
|
| T1592 |
Gather Victim Host Information |
Reconnaissance |
77 "Evil Twin" Open VSX Extensions Harvest Developer Metadata — Shared C2 at mangorbit[.]comReuters: OpenAI's agents probed Hugging Face for weaknesses two months before major hackFake OpenAI, Anthropic and DeepSeek Crawlers Target .env Files and Cloud Credentials
|
gap
|
| T1593 |
Search Open Websites/Domains |
Reconnaissance |
WeedHack Malware Spreads Through SEO-Poisoned Minecraft Sites Despite C2 DisruptionResearchers observe first 'near-autonomous' AI attack on government target in TaiwanHackers Use Chameleon SEO Poisoning to Hide Banking Phishing Pages From Security Scanners
|
gap
|
| T1595 |
Active Scanning |
Reconnaissance |
FBI Warns Chinese Hackers Use Automated Tools and Botnets to Steal Sensitive DataTIKTOUK WordPress Toolkit Could Enable AWS, SMTP and API Credential Theft AttacksPakistani IP Chains CVE-2017-9841 and CVE-2021-41773 in Active ExploitationOpenAI’s Systems Meddled With U.S. Government SitesDOJ, FBI seize Flax Typhoon-linked hacking tools Microscan, FishHubRAVEN Tool Steals Entire Elasticsearch Databases and Rebuilds Deleted BackdoorsReuters: OpenAI's agents probed Hugging Face for weaknesses two months before major hackBGP Hijack Diverts Softaculous Traffic to Deliver Malicious Virtualizor UpdatePoeLLM malware infects exposed AI servers in cryptomining attacksCISA AA26-231A Active Threat to Siemens S7 Series PLCsFBI Disables China-Linked Hacking Tools (QTFY) Used Against US AgenciesChinese Hacker Uses DeepSeek AI to Automate Vulnerability ExploitationChinese-Speaking Hackers Use Claude, Qwen and DeepSeek AI Agents to Attack Government SystemsOpenAI agent 'infiltrated' Australian government website, PM says https://www.bbc.co.uk/news/articles/c6vgy0333dppo?at_medium=RSS&at_campaigUS warns of AI-powered attacks on Siemens PLCs in critical infrastructureGentlemen Ransomware Affiliate Uses MCP as C2 Channel in Live CyberattacksOpenAI AI agents access Australian government systemsNSA and CISA Warn of Active Cyber Threat Targeting Siemens S7 PLCsFake OpenAI, Anthropic and DeepSeek Crawlers Target .env Files and Cloud CredentialsSouth Korea orders emergency probe after bank breaches
|
3/20
|
| T1596 |
Search Open Technical Databases |
Reconnaissance |
Researchers observe first 'near-autonomous' AI attack on government target in Taiwan
|
gap
|
| T1597 |
Search Closed Sources |
Reconnaissance |
153 Million Driver License Images Offered on Dark WebFBI Probes Service Selling 153M+ Drivers Licenses
|
gap
|
| T1598 |
Phishing for Information |
Reconnaissance |
Operation ASTERIX Uses Vishing and Fake Crypto Wallet Apps to Steal Seed PhrasesBalonx Sistema PhaaS Targets 20+ Mexican Banks With AI Vishing and Android RATRussian Hackers Trick Academics and Diplomats Into Giving Them Access to Email and WhatsApp
|
gap
|
| T1682 |
Query Public AI Services |
Reconnaissance |
Feds accuse China of 'systematic' distillation of U.S. AI models
|
gap
|
| T1028 |
Windows Remote Management |
Execution |
Critical RCE Flaw in Windows IKE Extension Now Actively Exploited
|
gap
|
| T1053 |
Scheduled Task/Job |
Execution |
Russian APT Star Blizzard Uses ‘RedFlick’ Infection Chain in Recent AttacksChinese Hackers Deploy PackClient RAT via Tax-Themed Phishing AttacksGryxa Toolkit Uses AI-Built Persistence to Fight Back Against Security TeamsINJ3CTOR3's FreePBX JOMANGY Campaign — Six-Layer Self-Healing Persistence on VoIP InfrastructureBlueDelta (APT28) HOOKEDGE Campaign Targets European Government and Diplomatic OrganizationsBambooToken Linux implant uses MQTT protocol for remote shell and file exfiltration C2CrowdStrike 'FalconFlank' zero-day grants SYSTEM privilegesSynkLoader Malware Spreads Through Microsoft Teams Phishing and Steals Windows PasswordsCustom ChatGPTs push ClickFix attacks to deploy RAT malwareRussian Hackers Deploy New HOOKEDGE Backdoor in Espionage Attacks Across EuropeKonni Hackers Target Ukraine With Malicious LNK Files and VelvetCake PowerShell MalwareRedis cryptomining botnet compromised 3,562 servers via rogue replicationClosedQuorum Windows malware uses commercial AI models for autonomous tactical C2 decisionsHackers Turn an Open-Source AI Agent Into a Tool for Controlling Compromised Docker ServersASEC July 2026 APT Attack Report (South Korea)Suspected Chinese Hackers Turn VMware vCenter RCE Into Root Backdoors and ESXi RansomwareSectopRAT Malware Hides in Legitimate Software to Steal Browser Credentials and Crypto WalletsStar Blizzard refines phishing and malware delivery with the RedFlick techniqueTASK#STOMP PowerShell Backdoor Steals Business Documents and Executes Remote CommandsCyberPanel Pre-Auth RCE Flaws Let Attackers Gain Remote Server AccessPsychedelic Stealer spread via fake CAPTCHA prompts on Ukrainian company sitesGroup Policy hijacked: PAYLOAD ransomware weaponizes Active Directory GPOCarbonato malware uses AI agents to hijack exposed Docker hostsMicrosoft Defender 'ShieldBreak' zero-day grants SYSTEM privilegesJadePuffer Agentic Ransomware — First Documented AI-Agent-Driven Extortion OperationThreat actors abuse ChatGPT custom GPTs to deliver RAT payloads via ClickFix-style attacks
|
17/26
|
| T1059 |
Command and Scripting Interpreter |
Execution |
OpenAI agents behind May hacking campaign targeting RubyGemsBlinder Tunnel Campaign Targets Iraqi InfrastructureAttackers abusing trusted AI platforms to make malicious downloads look legitimateHacktron AI researchers used Claude to exploit a HEIF image-processing flaw in Discourse, pivoting from OpenAI community forum to employee account and GitHub resourcesMALFEX Supply Chain Campaign Targets npm and GitHubChef Automate Critical Vulnerability CVE-2026-80462 (CVSS 10.0)ClickFix Campaign Abuses Google Sheets C2 to Inject Malicious JavaScript Into ChromeWindows 10/11 September 2026 Patch Tuesday and Microsoft Defender ShieldCrash SYSTEM access zero-dayNew PamStealer macOS variant adds live C2 payload decryption and multi-layer persistenceImpersonating IT support: how threat actors turn a remote session into enterprise-wide accessCisco patched 18 Secure Firewall vulnerabilities in FMC, ASA, and FTDRussian APT Star Blizzard Uses ‘RedFlick’ Infection Chain in Recent AttacksShadow hVNC Lets Hackers Operate a Second Windows Desktop Invisible to the VictimRussia-aligned UAC-0099 weaponized AI safety guardrails with GuardBreakerUnsloth Fixes Arbitrary Code Execution Flaw Triggered by Malicious Hugging Face ModelsRuby RCE Gadget Chain Turns Unsafe Marshal.load Into Command ExecutionC2Looper v2 Uses GitHub Repositories as Full Command-and-Control InfrastructureSETTRA Ransomware Uses MeshAgent RMM and BYOVD to Encrypt Windows SystemsSloppyRAT Malware Uses ClickFix and Blockchain C2 to Help Ransomware HackersPaperCut Flaws Exploited in AI-Powered AttacksProofpoint identified BlueMoon, an exploit kit chaining two Chrome/V8 flaws with a Windows privilege escalationCritical WordPress Pods Flaw (CVE-2026-19598) Lets Unauthenticated Attackers Gain Admin AccessGlassWorm Supply Chain Attack Hides Malware Inside VS Code Color ThemesChinese Hackers Deploy PackClient RAT via Tax-Themed Phishing AttacksF5 BIG-IP APM in-memory PHP web shell rootkitVidar Adds Virtual Machine and Custom Stream Ciphers For String ObfuscationHackers Exploit PaperCut NG/MF Flaws to Steal Credentials and Deploy MeterpreterKREMLIN Banking Malware Installs Chrome Extensions Users Never Approved to Steal Banking DataCisco Security Advisory AV26-921: Critical SQL Injection in Secure Email Gateway (CVE-2026-76461)Metasploit Adds Exploit for PaperCut MF/NG Zero-Day RCE VulnerabilitiesAI-assisted malware rewrites itself via Gemini and Hugging Face APIs to evade detectionIvanti September 2026 security advisory: EPMM, ITSM, Sentry vulnerabilitiesSonicWall Patches Critical Vulnerabilities in Discontinued GMS PlatformThreat Actors Use Claude Code, Codex and DeepSeek AI to Power CyberattacksThreat actor compiles cryptominer on endpoint via Samsung MagicINFO flawMalicious Exodus Installer Steals Browser Credentials and Turns PCs Into SOCKS Proxies700 OpenAI Agents Coordinate Attack on Hugging Face and Gain Remote Code ExecutionBlueDelta (APT28) HOOKEDGE Campaign Targets European Government and Diplomatic OrganizationsBambooToken Linux implant uses MQTT protocol for remote shell and file exfiltration C2CVE-2026-78159 Critical RCE in The Events Calendar WordPress PluginHackers Compromise Coder Module Registry to Serve Malicious Packages and Steal CredentialsHackers exploit Tencent app flaw to deploy GrayRabbit malwareCritical HPE Fabric Composer Flaw Lets Unauthenticated Attackers Execute Commands as Privileged UserBitget Critical Breach: $387.5M Stolen via Zero-Days in Security AppliancesAgent Tesla Malware Campaign Uses Emoji Obfuscation to Steal CredentialsHackers Exploit Critical Cisco Secure Email Gateway Flaw to Execute Commands as RootSonicWall SMA1000 — Two Zero-Day Flaws Under Active Exploitation, CVSS 10.0, Added to CISA KEVTraderTraitor Weaponizes Terraform Lock Files to Deploy macOS BackdoorsSynkLoader Malware Spreads Through Microsoft Teams Phishing and Steals Windows PasswordsPrompt Injection in Claude Code Opus 5 Auto Mode Enables Malicious Code ExecutionNintendo Switch Vulnerability Lets Nearby Attackers Run Unauthorized Code via QR CodesChina-Linked Hackers Chain Chrome Zero-Day With Windows Kernel FlawGitea RCE (CVE-2026-60004) Added to CISA KEVConfigServer Firewall Remote Code Execution CVE-2026-65638Custom ChatGPTs push ClickFix attacks to deploy RAT malwareBlind Eagle-Linked Loader Uses GitHub, VBScript, PowerShell and InstallUtil to Deploy AsyncRATCore Werewolf Hackers Deploy New CoreRAT Malware Against Russian Government and Defense OrganizationsAI-powered attack exploited PaperCut flaws to hack 395 organizationsSplunk Fixes 17 Vulnerabilities Including Critical MCP Server RCEMacSync malware uses public iCloud calendars to deliver new payloadsAmnesiaStealer macOS Malware Steals Data, Controls Browser SessionsCritical Elementor Pro bug exposes WordPress sites to RCE attacksChina-Nexus Hackers Target Myanmar Diplomats With Government-Themed QUICAgent Malware AttacksWordPress Click2Shell pre-auth RCE chain via CSRF in CoreCisco FMC Exploits Fuel Ransomware, APT AttacksAI-Powered BraZetsu Malware Turns Compromised Corporate PCs Into Tradable AssetsHackers Abuse ChatGPT Shared Links and Fake Cloudflare CAPTCHA to Deploy NetSupport RATAI-Orchestrated Campaign Against PaperCut NG/MF Exploiting CVE-2026-81578 and CVE-2026-82078Hackers Target LiteLLM, RAGFlow and Kestra AI Infrastructure to Steal API Keys and Mine CryptoWordlistLoader Hides Shellcode in Plain English Words to Deliver Amatera StealerChina-Nexus SilkParasite APT Deploys Five New RATs Against Central Asian GovernmentsWordPress Click2Shell RCE Chain via Theme Preview InjectionJFrog Artifactory Vulnerabilities Actively Exploited in the Wild to Gain Administrative ControlPowerShell Malware Abuses Registry and DNS TXT Records to Deploy XMRig Crypto MinerCritical Orkes Conductor Vulnerability Exploited in AttacksOpenAI Agents Flood RubyGems With 2,000 Packages and Exploit Build SystemGitSpawn Flaw Enables Arbitrary Code Execution in Claude Code, Codex, Cursor and GrokHackers Target Zimbra Servers in Active Exploitation CampaignHugging Face Transformers CVE-2026-80047 Allows Code Execution Before User ConsentSteam Client Service BrokenPipe local privilege escalation to SYSTEMCritical Zimbra RCE flaw now actively exploited in attacksCVE-2026-108540: Critical OS command injection in OpenSpug Spug 3.0 to 4.0.1Russian Hackers Deploy New HOOKEDGE Backdoor in Espionage Attacks Across EuropeSangoma Switchvox RCE Flaw Actively Exploited in Wild via Unauthenticated SQL InjectionFive Venezuelans Plead Guilty to ATM Jackpotting Attacks in USCERT-UA: 100+ websites compromised to spread Lunex Stealer via fake Cloudflare checks (UAC-0277)Cisco Patches Critical Zero-Day in Secure Email Gateway (CVE-2026-76461)Critical Cisco Nexus 9000 Flaw Lets Unauthenticated Attackers Execute Code as RootActive exploitation of Cisco Secure Firewall Management Center vulnerabilitiesGrok Zero-Click Attack Steals Chat History Through Encrypted Prompt InjectionLong-Running NPM Malware Campaign Accumulates 40,000 DownloadsThe Events Calendar Plugin Critical RCE Vulnerabilities (CVE-2026-78159, CVE-2026-78006)North Korean WaterPlum campaign uses fake recruitment interviews to deploy malware and steal cryptoBDThemes WordPress Supply Chain Attack Creates Rogue Admins and Deploys WebshellsAI Shopping Assistant Vulnerabilities Enable Remote Code Execution on Retailer's ServersScreenConnect critical CVE-2026-84869 allows file transfer and execution via active sessionsFake Claude Install Guide Steals Mac Passwords and Turns Trusted Crypto Wallet Apps Into Phishing TrapsAnthropic Claude models compromised 3 real organizations during safety evaluationsClaude AI Develops Working RCE Exploit Against WAGO PLC With Researcher AssistanceSolarWinds patches CVE-2026-28326 in Access Rights Manager - unauthenticated RCE via hard-coded keyNightEagle targets Russian companiesNorth Korean WaterPlum hackers infected 30,000 devices worldwideSAP Patches Critical Code Injection, Memory Corruption VulnerabilitiesCheck Point login flaw CVE-2026-91843 allows unauthenticated remote accessHEIF Heist Image Processing Flaws Enable RCE Across Meta, Slack, GitHub EnterpriseClosedQuorum Windows malware uses commercial AI models for autonomous tactical C2 decisionsPlaceholder domain used in dev docs now serves ClickFix attacksVulnerability Attack Case: Installation of a Web Shell and Execution of a Scanner by Exploiting a Telerik UI VulnerabilityCISA: WatchGuard RCE flaw now exploited in ransomware attacksAI-Powered RatHat Android Trojan Steals Bank Credentials, PINs and MFA CodesCISA KEV update: five actively exploited Artifactory, ScreenConnect, and RouterOS flaws addedGo Loader Uses Anti-Sandbox Checks and SNOWLIGHT to Execute Fileless VShell RAT in MemoryIssabel PBX remote code execution exploited in active attacksTotolink A3002MU Critical Command Injection CVE-2026-93742ASEC June 2026 APT Attack Report (South Korea)Infostealer Malware Steals Claude Session Cookies to Hijack Accounts and Bypass 2FAWordPress Authenticated RCE via Imagick Ghostscript CVE-2026-65640RatHat Android Banking Trojan Uses AI to Navigate Banking AppsSpain Reports First Cyberattack Carried Out with an AI AgentDPRK-Linked Hackers Add HashHiding to Blockchain C2 Network for Takedown-Resistant MalwareCISA AA26-231A Active Threat to Siemens S7 Series PLCsChina-Linked UNC3569 Exploited Sogou Input Method to Deploy GRAYRABBIT BackdoorNginx Cache Key Injection Enables Access Control Bypass and Stored XSSASEC July 2026 APT Attack Report (South Korea)Critical VMware vCenter Directory Traversal Flaw Used in Global AttacksSharePoint CVE-2026-65660 misclassified as spoofing actually enables fileless authenticated RCEOperation QUICSILVER: China-Nexus Actor Targets Myanmar Diplomats via VHD-Delivered Go BackdoorChinese Hacker Uses DeepSeek AI to Automate Vulnerability ExploitationRoundcube Fixes 12 Security Flaws Including Zero-Click XSS and SSRF BypassMantax OTAX Combines Android Ransomware and Spyware for Double-Extortion AttacksFake Google Gemini installer distributes Vidar stealer via Google ColabTwo Alleged TeamPCP Hackers Arrested in AustraliaTwo OpenAI Codex Desktop Sandbox Escape Techniques DisclosedAeternum Botnet Hides C2 Infrastructure in Polygon Smart Contracts to Evade TakedownsMedusa ransomware tallies hundreds of new victims, says updated advisory on groups tacticsSuspected TraderTraitor Group Uses Trojanized Terraform Provider to Deliver Cross-Platform MalwarePhishing Campaign Abuses Windows Mshta.exe to Steal Credentials and SecretsOracle PeopleSoft CVE-2026-35273 (CVSS 9.8) — Mitigations Released, Mandiant/GTIG Confirm ShinyHunters Targeting 100+ Organizations, Primarily Higher EducationMALFEX: eight malicious npm packages deliver Overlord RAT, 40,767 downloadsHackers Can Use PEEP Chrome Extension to Steal Credentials and Execute Shell CommandsBlueMoon Exploit Kit Targets Chrome and WindowsCisco FMC Zero-Day Exploited by Three Threat Clusters Including Sandworm and QilinChinese-Speaking Hackers Use Claude, Qwen and DeepSeek AI Agents to Attack Government Systemsindexed-btree npm Package Executes Malware at Runtime via BTree.set()BambooToken Malware Uses MQTT to Control Windows and Linux SystemsSAP warns of maximum severity OVERPASS kernel vulnerability (CVE-2026-44756)TASK#STOMP PowerShell Backdoor Steals Business Documents and Executes Remote CommandsAWS AI Agent Vulnerabilities Let Attackers Bypass Authentication and Steal CredentialsSilver Fox Hackers Target China-Based Organizations With Counterfeit Software InstallersHackers Compromise TanStack Query npm Package to Steal Developer CredentialsFamousSparrow deploys SparroWocky backdoor targeting Latin American governmentsChainDrop npm Worm Hijacks GitHub Actions OIDC to Poison 444 Packages With Valid SLSA ProvenanceCyberPanel Pre-Auth RCE Flaws Let Attackers Gain Remote Server AccessProgress Kemp LoadMaster Joins CISA KEV — Unauthenticated Command Injection Under AttackCisco ISE zero-days CVE-2026-76460 and CVE-2026-20192 enable unauthenticated root accessCritical Microsoft UFO MCP Flaw Lets Unauthenticated Attackers Remotely Control Android DevicesPsychedelic Stealer spread via fake CAPTCHA prompts on Ukrainian company sitesGroup Policy hijacked: PAYLOAD ransomware weaponizes Active Directory GPOD-Link DWR-M961 Router Hit by 15 Command Injection and Buffer Overflow VulnerabilitiesWeaselBiscuit npm stealer targets Chrome extension storage, linked to DPRK ContagiousUnauthenticated RCE Flaws Could Expose 200,000+ WordPress Sites to TakeoverTrueConf security advisory (AV26-835)Researchers Execute Code Inside Fortune 500 Companies via AI Agent llms.txt FilesAI-automated exploitation of PaperCut NG/MF vulnerabilities (CVE-2026-81578, CVE-2026-82078)FortiGate CVE-2025-25249 now delivering PivotC2 RATHackers infect Android car head units with proxy botnet malwareGhostJacking Attacks Hijack AI Agents to Bypass Firewalls and Steal Cloud CredentialsMacSync: The Evasive macOS Stealer Exploiting ClickFix LuresChinese-speaking APT exploits wp2shell WordPress and ZyXEL switch flaws affecting 996 devices across 49 organizationsKimsuky deploys AI-generated decoys in evolving GitHub PAT-based LNK attack campaignnpm Supply Chain Worm Returns After Four-Month Dormancy With Same Malicious PayloadKimsuky Moves AI-Assisted Development Into Local Environment With Operation GitPowerwp2shell — CISA Adds to KEV; Wiz Details Webshell Installation at ScaleHackers Use Fake Cloudflare CAPTCHA to Deploy TerminalFix Reverse TunnelUS warns of AI-powered attacks on Siemens PLCs in critical infrastructureMagento and Adobe Commerce StyleSmuggler 0-Day RCE Actively Exploited in AttacksGentlemen Ransomware Affiliate Uses MCP as C2 Channel in Live CyberattacksJadePuffer Agentic Ransomware — First Documented AI-Agent-Driven Extortion OperationGemini Hacked Three Companies in First Known Breakout by Google's AIAndroid Banking Trojan GigaPlay/VWork Exploits Work Profiles in IndonesiaNSA and CISA Warn of Active Cyber Threat Targeting Siemens S7 PLCsToxicPanda 2.0 Steals PINs From 140+ Banking and Cryptocurrency Apps Using Invisible OverlaysMicrosoft Links 30+ Domains to MacSync Stealer's Credential-Theft and Data-Exfiltration InfrastructurePavinLoader Multi-Stage Malware Abuses MSBuild and Trojanized .NET DLLsCISA Urges Immediate Patching of Exploited Progress LoadMaster VulnerabilityClickFix Campaigns Targeting End Users via Legitimate ServicesBragJack attacks hijack AI browser agents through malicious extensionsMuddyWater-Linked Dindoor Backdoor Abuses Deno Runtime for EvasionWooCommerce Wholesale Lead Capture Plugin Actively ExploitedLinux kernel ZcopyReaper vulnerability CVE-2026-43502 - RDS zerocopy local privilege escalationThreat actors abuse ChatGPT custom GPTs to deliver RAT payloads via ClickFix-style attacks
|
60/191
|
| T1086 |
PowerShell |
Execution |
Custom ChatGPTs push ClickFix attacks to deploy RAT malwareBlind Eagle-Linked Loader Uses GitHub, VBScript, PowerShell and InstallUtil to Deploy AsyncRATPowerShell Malware Abuses Registry and DNS TXT Records to Deploy XMRig Crypto MinerKonni Hackers Target Ukraine With Malicious LNK Files and VelvetCake PowerShell MalwareThreat actors abuse ChatGPT custom GPTs to deliver RAT payloads via ClickFix-style attacks
|
5/5
|
| T1106 |
Native API |
Execution |
SectopRAT Malware Hides in Legitimate Software to Steal Browser Credentials and Crypto Wallets
|
1/1
|
| T1203 |
Exploitation for Client Execution |
Execution |
Legcord Discord client sandbox escape CVE-2026-105293 and CVE-2026-105294Windows 10/11 September 2026 Patch Tuesday and Microsoft Defender ShieldCrash SYSTEM access zero-dayAdobe Acrobat and Reader Security Alert (APSB26-141)Proofpoint identified BlueMoon, an exploit kit chaining two Chrome/V8 flaws with a Windows privilege escalationTwo VLC media player vulnerabilities (CVE-2026-56711, CVE-2026-73324) allow heap corruption — no patch availableDocker Sandboxes TOCTOU vulnerabilities allow guest-to-host escapeApple patches CoreGraphics out-of-bounds write CVE-2026-86950Hackers exploit Tencent app flaw to deploy GrayRabbit malwareNintendo Switch Vulnerability Lets Nearby Attackers Run Unauthorized Code via QR CodesChina-Linked Hackers Chain Chrome Zero-Day With Windows Kernel FlawTikTok users' cameras hacked with open weight model by depthfirstGoogle Chrome Update Fixes 26 Security Flaws Including Two Critical Use-After-Free BugsChinese threat actor UTA0565 chained three zero-days — Chrome (CVE-2026-85046, CVE-2026-87491) and Windows ALPC (CVE-2026-85880) — via fakCVE-2026-63278 affects LibreOffice from The Document Foundation. Crafted document links could expand environment variable or INI file valuesChrome 152 Patches Over 300 VulnerabilitiesBDThemes WordPress Supply Chain Attack Creates Rogue Admins and Deploys WebshellsGoogle Chrome V8 Flaw Exploited in the Wild to Execute Arbitrary CodeChrome 150 and Firefox 152 — Critical Vulnerabilities PatchedCritical Node.js Sandbox Flaw Exposes AI Agents to Host Code ExecutionChinese APT Clones Legitimate Websites to Deliver Chrome and Windows Zero-Day ExploitsFortinet FortiWeb and FortiClient Flaws Let Unauthenticated Attackers Gain Access and Execute Arbitrary CodeZoom Zero-Click ‘Zoomsday’ Flaw Lets Meeting Participants Execute Code on Other Users’ DevicesInjectEave Attack Lets Attackers Eavesdrop on Headphone Audio From 30 Meters AwayGoogle warns of new Chrome zero-day flaw exploited in attacksCapacitor Vulnerability CVE-2026-103922D-Link DWR-M961 Router Hit by 15 Command Injection and Buffer Overflow VulnerabilitiesApple Patches Code Execution and Kernel Memory Flaws in iOS 26.6.1 and macOS 26.6.2Windows NTFS Heap Buffer Overflow CVE-2025-24993 Actively Exploited
|
3/28
|
| T1204 |
User Execution |
Execution |
Elementor WordPress flaw lets attackers create admin accountsWeedHack Malware Spreads Through SEO-Poisoned Minecraft Sites Despite C2 Disruption24 Malicious npm Packages Abuse Mirror Infrastructure to Host Obfuscated ClickFix Phishing PagesTelegram Desktop CVE-2026-107181 Account TakeoverRussian APT Star Blizzard Uses ‘RedFlick’ Infection Chain in Recent AttacksAtomic macOS (AMOS) Stealer infection campaign observedUnsloth Fixes Arbitrary Code Execution Flaw Triggered by Malicious Hugging Face ModelsC2Looper v2 Uses GitHub Repositories as Full Command-and-Control InfrastructureSloppyRAT Malware Uses ClickFix and Blockchain C2 to Help Ransomware HackersTwo VLC media player vulnerabilities (CVE-2026-56711, CVE-2026-73324) allow heap corruption — no patch availableChinese Hackers Deploy PackClient RAT via Tax-Themed Phishing AttacksCursor 0-Day Allows Arbitrary Code Execution by Simply Opening a RepositoryMalicious Exodus Installer Steals Browser Credentials and Turns PCs Into SOCKS ProxiesBlueDelta (APT28) HOOKEDGE Campaign Targets European Government and Diplomatic OrganizationsFakeGit Campaign: 7,600 Malicious GitHub Repos Pushing SmartLoader/StealC MalwarePrompt Injection in Claude Code Opus 5 Auto Mode Enables Malicious Code ExecutionCustom ChatGPTs push ClickFix attacks to deploy RAT malwareFake GTA 6 Demo Sites Deliver Vidar Stealer via Browser Session HijackingBlind Eagle-Linked Loader Uses GitHub, VBScript, PowerShell and InstallUtil to Deploy AsyncRATCore Werewolf Hackers Deploy New CoreRAT Malware Against Russian Government and Defense OrganizationsLUNEXSTEALER Gives Hackers Remote Control of Browsers Through Malicious Chrome ExtensionMacSync malware uses public iCloud calendars to deliver new payloadsAmnesiaStealer macOS Malware Steals Data, Controls Browser SessionsCritical Elementor Pro bug exposes WordPress sites to RCE attacksWordlistLoader Hides Shellcode in Plain English Words to Deliver Amatera StealerChinese threat actor UTA0565 chained three zero-days — Chrome (CVE-2026-85046, CVE-2026-87491) and Windows ALPC (CVE-2026-85880) — via fakRussian Hackers Deploy New HOOKEDGE Backdoor in Espionage Attacks Across EuropeFake Claude Opus 5 App Deploys RevStealer to Steal Passwords, Crypto Wallets and SessionsKonni Hackers Target Ukraine With Malicious LNK Files and VelvetCake PowerShell MalwareCVE-2026-63278 affects LibreOffice from The Document Foundation. Crafted document links could expand environment variable or INI file valuesLong-Running NPM Malware Campaign Accumulates 40,000 DownloadsHackers Place Fake Codex Download Above Legitimate OpenAI Result to Infect Mac UsersNorth Korean WaterPlum campaign uses fake recruitment interviews to deploy malware and steal cryptoFake Claude Install Guide Steals Mac Passwords and Turns Trusted Crypto Wallet Apps Into Phishing TrapsNew malware in movie torrents uses Solana blockchain for C2 controlPlaceholder domain used in dev docs now serves ClickFix attacksWordPress 7.1.1 patches stored XSS (CVE-2026-93485) affecting all versions since 4.7Contagious Interview Operators Move Beyond Git Hooks With Trojanized Mac ApplicationsCVE-2026-93836: WooCommerce WPC Product Bundles stored XSS (CVSS 7.2, unauthenticated)AI-Powered RatHat Android Trojan Steals Bank Credentials, PINs and MFA CodesGo Loader Uses Anti-Sandbox Checks and SNOWLIGHT to Execute Fileless VShell RAT in MemoryTelegram Desktop stored XSS in HTML export exfiltrates chat history for 2+ yearsASEC June 2026 APT Attack Report (South Korea)China-Linked UNC3569 Exploited Sogou Input Method to Deploy GRAYRABBIT BackdoorASEC July 2026 APT Attack Report (South Korea)Operation QUICSILVER: China-Nexus Actor Targets Myanmar Diplomats via VHD-Delivered Go BackdoorDark Caracal Deploys New GoCaracal Malware With Ethereum-Based C2 Across Latin AmericaMantax OTAX Combines Android Ransomware and Spyware for Double-Extortion AttacksFake Google Gemini installer distributes Vidar stealer via Google ColabHackers abuse Google Ads, Bing redirects to push Claude ClickFix attacksMALFEX: eight malicious npm packages deliver Overlord RAT, 40,767 downloadsUS charges Russian for infecting 80,000 freelancers with malwareStar Blizzard refines phishing and malware delivery with the RedFlick techniqueMicrosoft Outlook to block MSIX attachments starting NovemberAPT36-Linked HACKERAI Implant Shows Signs of LLM-Assisted Malware DevelopmentContagious Interview: North Korean threat actors compromised 30,000 devices in 100+ countriesSilver Fox Hackers Target China-Based Organizations With Counterfeit Software InstallersPsychedelic Stealer spread via fake CAPTCHA prompts on Ukrainian company sitesIranian APT Uses CHOSENBRICK Windows Malware for EspionageMalicious RubyGems Packages Target Cryptocurrency DevelopersTrueConf security advisory (AV26-835)macOS Users Targeted by Fake Zoom Installer Carrying CloudSyncD BackdoorMacSync: The Evasive macOS Stealer Exploiting ClickFix LuresKimsuky Moves AI-Assisted Development Into Local Environment With Operation GitPowerHackers Use Fake Cloudflare CAPTCHA to Deploy TerminalFix Reverse TunnelWindows AFD.sys Zero-Day Exploited by Lazarus Hackers to Gain SYSTEM AccessMicrosoft Links 30+ Domains to MacSync Stealer's Credential-Theft and Data-Exfiltration InfrastructurePavinLoader Multi-Stage Malware Abuses MSBuild and Trojanized .NET DLLsThreat actors abuse ChatGPT custom GPTs to deliver RAT payloads via ClickFix-style attacks
|
27/69
|
| T1559 |
Inter-Process Communication |
Execution |
Windows Process Injection Technique Bypasses EDR Monitoring Without WriteProcessMemory
|
gap
|
| T1609 |
Container Administration Command |
Execution |
Carbonato malware uses AI agents to hijack exposed Docker hosts
|
1/1
|
| T1610 |
Deploy Container |
Execution |
Carbonato malware uses AI agents to hijack exposed Docker hosts
|
1/1
|
| T1648 |
Serverless Execution |
Execution |
LLMjacking Attack Abuses Leaked AWS Credentials to Hijack Amazon Bedrock AI Models
|
gap
|
| T1651 |
Cloud Administration Command |
Execution |
Storm-3068 Hijacks Azure DevOps Pipelines to Steal Kubernetes Credentials After Account TakeoverStorm-3168: Agentic-driven cloud attacks using compromised service principals
|
1/2
|
| T1674 |
Input Injection |
Execution |
Manic Android malware family targets 169 apps with banking fraud and Wi-Fi mesh exfiltrationViewSonic vCast Vulnerabilities Let Attackers Gain Full Device Control Without AuthenticationCERT-UA: 100+ websites compromised to spread Lunex Stealer via fake Cloudflare checks (UAC-0277)SAP Patches Critical Code Injection, Memory Corruption VulnerabilitiesAgentCorruption: patched AWS Bedrock AgentCore prompt-injection flawAI-Powered RatHat Android Trojan Steals Bank Credentials, PINs and MFA CodesRatHat Android Banking Trojan Uses AI to Navigate Banking AppsHackers abuse Google Ads, Bing redirects to push Claude ClickFix attacksGhostJacking Attacks Hijack AI Agents to Bypass Firewalls and Steal Cloud Credentials
|
1/9
|
| T1677 |
Poisoned Pipeline Execution |
Execution |
GitLab Email Feature Lets Attackers Push Code to Protected Branches and Execute CI/CD JobsMini Shai-Hulud worm re-infects GitHub repositories via hijacked ActionsShai-Hulud Trinitite Supply-Chain Worm Compromises Popular npm PackageOpenAI Agents Flood RubyGems With 2,000 Packages and Exploit Build SystemOpenAI agents hacked a software service before the Hugging Face incident
|
1/5
|
| T1015 |
Accessibility Features |
Persistence |
StreamRAT Android Malware Targets 570K Meta Users in SpainRemControl Android malware targets European and Canadian users via fake Play Store pages
|
gap
|
| T1019 |
System Firmware |
Persistence |
Midnight Mimosa: ad-fraud malware preinstalled in cheap Android phone firmwareMidnight Mimosa: Preinstalled Android malware in MediaTek firmware
|
2/2
|
| T1034 |
Path Interception |
Persistence |
Cursor 0-Day Allows Arbitrary Code Execution by Simply Opening a Repository
|
1/1
|
| T1037 |
Boot or Logon Initialization Scripts |
Persistence |
New PamStealer macOS variant adds live C2 payload decryption and multi-layer persistenceINJ3CTOR3's FreePBX JOMANGY Campaign — Six-Layer Self-Healing Persistence on VoIP InfrastructureMacSync malware uses public iCloud calendars to deliver new payloads
|
3/3
|
| T1038 |
DLL Search Order Hijacking |
Persistence |
Hackers exploit Tencent app flaw to deploy GrayRabbit malwareInfostealer Malware Steals Claude Session Cookies to Hijack Accounts and Bypass 2FA
|
1/2
|
| T1060 |
Registry Run Keys / Startup Folder |
Persistence |
CrowdStrike 'FalconFlank' zero-day grants SYSTEM privilegesCustom ChatGPTs push ClickFix attacks to deploy RAT malwareThreat actors abuse ChatGPT custom GPTs to deliver RAT payloads via ClickFix-style attacks
|
3/3
|
| T1084 |
Windows Management Instrumentation Event Subscription |
Persistence |
Gryxa Toolkit Uses AI-Built Persistence to Fight Back Against Security Teams
|
1/1
|
| T1098 |
Account Manipulation |
Persistence |
Alert: FortiBleed remains active campaign, can lock out users or lead to ransomware attacksCritical WordPress Pods Flaw (CVE-2026-19598) Lets Unauthenticated Attackers Gain Admin AccessEvilTokens PhaaS Storm-2992 compromises 12,000+ inboxes via AI-powered device-code phishing and inbox rule persistenceFortiBleed Attackers Locking Victims Out of Fortinet DevicesStorm-3068 Hijacks Azure DevOps Pipelines to Steal Kubernetes Credentials After Account TakeoverN-able N-central authentication bypass chain (CVE-2026-86206, CVE-2026-86207)CVE-2026-93836: WooCommerce WPC Product Bundles stored XSS (CVSS 7.2, unauthenticated)EvilTokens PhaaS disrupted after compromising 12,000 Microsoft accountsMicrosoft: passkey social engineering enables cloud account hijackCritical WordPress TranslatePress Flaw Lets Attackers Take Over Admin AccountsWeChat Zero-Click Worm Took Over Accounts on iPhone and Android via Incoming Calls
|
5/11
|
| T1100 |
Web Shell |
Persistence |
StyleSmuggler: a Magento zero-day, CVE-2026-75650, delivering a Rust backdoor and a PHP web shellClop created custom web shell for Windchill data theft attacksF5 BIG-IP APM in-memory PHP web shell rootkitINJ3CTOR3's FreePBX JOMANGY Campaign — Six-Layer Self-Healing Persistence on VoIP InfrastructureRed Heron Hackers Exploit Critical Gitea RCE to Steal Source Code and Deploy Linux MalwareBitget Critical Breach: $387.5M Stolen via Zero-Days in Security AppliancesHackers Exploit Critical Cisco Secure Email Gateway Flaw to Execute Commands as RootCisco FMC Exploits Fuel Ransomware, APT AttacksWordPress Click2Shell RCE Chain via Theme Preview InjectionFirst-Ever Exploitation of PTC Windchill Vulnerability (CVE-2026-12569) — CISA Adds to KEV, Manufacturing PLM Systems in CrosshairsAdobe releases September 2026 patches for multiple products — StyleSmuggler Magento zero-day CVE-2026-75650 patchedActive exploitation of Cisco Secure Firewall Management Center vulnerabilitiesVulnerability Attack Case: Installation of a Web Shell and Execution of a Scanner by Exploiting a Telerik UI VulnerabilityCISA adds exploited WSO2, Adobe Commerce, SharePoint and RouterOS flaws to KEV catalogDPRK-Linked Actors Deploy Novel Linux Espionage Toolkit Against South Korean HAProxy ServersCVE-2026-105134: Ahsay AhsayCBS critical OS command injectionHackers Breach South Korean Churches via ERP Web Shell and IDORCisco FMC Zero-Day Exploited by Three Threat Clusters Including Sandworm and QilinChinese-Speaking Hackers Use Claude, Qwen and DeepSeek AI Agents to Attack Government SystemsAdobe security advisory (AV26-888) — CVE-2026-75650 StyleSmuggler confirmed exploited in the wildFamousSparrow deploys SparroWocky backdoor targeting Latin American governmentsCisco ISE zero-days CVE-2026-76460 and CVE-2026-20192 enable unauthenticated root accessWarlock ransomware breach SharePoint in water, telecom operator attacksChinese-speaking APT exploits wp2shell WordPress and ZyXEL switch flaws affecting 996 devices across 49 organizationsWooCommerce Wholesale Lead Capture Plugin Actively Exploited
|
12/25
|
| T1133 |
External Remote Services |
Persistence |
CERT Polska Confirms Siemens PLC Sabotage at Polish CHP Plant via Private APNThreat Actors Use Claude Code, Codex and DeepSeek AI to Power CyberattacksDOJ, FBI seize Flax Typhoon-linked hacking tools Microscan, FishHubFortiBleed Attackers Locking Victims Out of Fortinet DevicesNightEagle targets Russian companiesN-able N-central Critical Auth Bypass (CVE-2026-18556/18577) Actively Exploited — First Fix Was Incomplete; MSPs Urged to Hotfix NowHackers compromise 14,500 Dahua web cameras in 35-day campaignCisco FMC Zero-Day Exploited by Three Threat Clusters Including Sandworm and QilinPAN-OS CVE-2026-0257 CISA KEV — GlobalProtect Authentication Bypass Actively Exploited, Rapid7 Confirms Two Attack WavesCISA Adds VMware vCenter Path Traversal CVE-2026-59310 to KEVUS Water-Sector Campaign Now Confirmed in 12 States — Georgia's Clayton County Confirms Disruption as FBI Details PLC Tampering
|
3/11
|
| T1136 |
Create Account |
Persistence |
Elementor WordPress flaw lets attackers create admin accountsHackers Exploit PaperCut NG/MF Flaws to Steal Credentials and Deploy MeterpreterThreat actor compiles cryptominer on endpoint via Samsung MagicINFO flawBDThemes WordPress Supply Chain Attack Creates Rogue Admins and Deploys WebshellsAI-automated exploitation of PaperCut NG/MF vulnerabilities (CVE-2026-81578, CVE-2026-82078)JadePuffer Agentic Ransomware — First Documented AI-Agent-Driven Extortion Operation
|
4/6
|
| T1159 |
Launch Agent |
Persistence |
New PamStealer macOS variant adds live C2 payload decryption and multi-layer persistenceMacSync malware uses public iCloud calendars to deliver new payloads
|
2/2
|
| T1176 |
Software Extensions |
Persistence |
Glassworm Botnet Disrupted — CrowdStrike, Google, and Shadowserver Simultaneously Takedown 4-Layer C2 Infrastructure16 Malicious Firefox Extensions Impersonate Crypto Wallets to Steal Seed Phrases and Private KeysGlassWorm Supply Chain Attack Hides Malware Inside VS Code Color ThemesFake Chrome VPN Extensions Hijack Browser Traffic Through Russian Proxy NetworkKREMLIN Banking Malware Installs Chrome Extensions Users Never Approved to Steal Banking DataKREMLIN Banking Malware Hijacks Chrome and Edge to Steal Credentials and Session TokensLUNEXSTEALER Gives Hackers Remote Control of Browsers Through Malicious Chrome ExtensionMalicious Chrome and Edge Extensions Hijack Crypto Wallets and Steal Login CredentialsPoper Blocker Chrome extension exfiltrates browsing historyHackers Can Use PEEP Chrome Extension to Steal Credentials and Execute Shell CommandsBragJack attacks hijack AI browser agents through malicious extensions
|
2/11
|
| T1505 |
Server Software Component |
Persistence |
StyleSmuggler: a Magento zero-day, CVE-2026-75650, delivering a Rust backdoor and a PHP web shellCritical WordPress Pods Flaw (CVE-2026-19598) Lets Unauthenticated Attackers Gain Admin AccessGryxa Toolkit Uses AI-Built Persistence to Fight Back Against Security Teams12-Year-Old PostgreSQL Flaw Lets Backup Accounts Execute Code and Take Over DatabasesFBI Hackers Say They Won’t Publish Massive Trove of FBI Employee DataJFrog Artifactory under active attack with CVE chain exploitJFrog Artifactory Vulnerabilities Actively Exploited in the Wild to Gain Administrative ControlAdobe releases September 2026 patches for multiple products — StyleSmuggler Magento zero-day CVE-2026-75650 patchedRAVEN Tool Steals Entire Elasticsearch Databases and Rebuilds Deleted BackdoorsBDThemes WordPress Supply Chain Attack Creates Rogue Admins and Deploys WebshellsScreenConnect critical CVE-2026-84869 allows file transfer and execution via active sessionsThousands of Hacked WordPress Sites, One Operation: Unmasking StopAndProtectCVE-2026-93836: WooCommerce WPC Product Bundles stored XSS (CVSS 7.2, unauthenticated)Hackers compromise 14,500 Dahua web cameras in 35-day campaignOracle PeopleSoft CVE-2026-35273 (CVSS 9.8) — Mitigations Released, Mandiant/GTIG Confirm ShinyHunters Targeting 100+ Organizations, Primarily Higher EducationEarth Berberoka-Linked Hackers Target Brazil With Linux Malware and SEO PoisoningAPT36-Linked HACKERAI Implant Shows Signs of LLM-Assisted Malware DevelopmentPaperCut NG/MF Critical Zero-Day Exploited in the WildHackers infect Android car head units with proxy botnet malwareVulnerability in MyPresta Google Merchant Center Feed softwareShinyHunters breaches Clop leak site and steals onion service keysArtifactory flaws chained in attacks deploying backdoor malware
|
12/22
|
| T1543 |
Create or Modify System Process |
Persistence |
Plug & Pwn Attack Abuses Windows Plug and Play to Gain SYSTEM PrivilegesLinux Backdoor Abuses STUN Protocol, Exploits Dozens of FlawsHackers Turn an Open-Source AI Agent Into a Tool for Controlling Compromised Docker ServersChinese Fire Ant APT Plants GRE Tunnels on Cisco IOS XR Routers for Persistent Espionage
|
1/4
|
| T1547 |
Boot or Logon Autostart Execution |
Persistence |
Blinder Tunnel Campaign Targets Iraqi InfrastructureHackers Turn HiveMQ and Element Messenger Into Control Channels for Windows BackdoorsGryxa Toolkit Uses AI-Built Persistence to Fight Back Against Security TeamsCISA AA26-281A advisory: Chinese government-linked actors with FBI and international partnersIranian state-linked CHOSEN BRICK malware targets dissidents worldwideCling botnet exploits STUN protocol for IoT command and controlContagious Interview Operators Move Beyond Git Hooks With Trojanized Mac ApplicationsAeternum Botnet Hides C2 Infrastructure in Polygon Smart Contracts to Evade TakedownsTASK#STOMP PowerShell Backdoor Steals Business Documents and Executes Remote Commands
|
6/9
|
| T1014 |
Rootkit |
Stealth |
Singularity Rootkit Bypasses Elastic Defend eBPF Module Load DetectionRed Heron Hackers Exploit Critical Gitea RCE to Steal Source Code and Deploy Linux MalwareAPT group HoneyMyte upgrades CoolClient: the backdoor gets a kernel-level Windows rootkitPsychedelic Stealer spread via fake CAPTCHA prompts on Ukrainian company sitesWindows AFD.sys Zero-Day Exploited by Lazarus Hackers to Gain SYSTEM Access
|
2/5
|
| T1027 |
Obfuscated Files or Information |
Stealth |
Malicious SVG Reconstructs DCRat Archive Entirely Inside Victim's BrowserRussia-aligned UAC-0099 weaponized AI safety guardrails with GuardBreakerVidar Adds Virtual Machine and Custom Stream Ciphers For String ObfuscationAI-assisted malware rewrites itself via Gemini and Hugging Face APIs to evade detectionASCII Smuggling Technique Crosses From AI Prompt Injection to Phishing EvasionAgent Tesla Malware Campaign Uses Emoji Obfuscation to Steal CredentialsSynkLoader Malware Spreads Through Microsoft Teams Phishing and Steals Windows PasswordsWordlistLoader Hides Shellcode in Plain English Words to Deliver Amatera StealerPowerShell Malware Abuses Registry and DNS TXT Records to Deploy XMRig Crypto MinerRussian Hackers Deploy New HOOKEDGE Backdoor in Espionage Attacks Across EuropeFake Claude Install Guide Steals Mac Passwords and Turns Trusted Crypto Wallet Apps Into Phishing TrapsAPT group HoneyMyte upgrades CoolClient: the backdoor gets a kernel-level Windows rootkit2CLoader: A New Malware Loader Delivering Vidar and RemusEvolution of MATCHBOIL Downloader by UAC-0099China-Linked UNC3569 Exploited Sogou Input Method to Deploy GRAYRABBIT BackdoorAbyssos RAT Hijacks Browser Sessions, Steals Credentials and Gives Attackers Remote VNC AccessCompromised Rust Crate With 18,000+ Downloads Steals Source Code During BuildsRansomware victims: SEVEN SEAS GROUP, Forma Therapeutics, PaessolucoesCybercriminals Can Now Rent Malware That Re-Encrypts Itself to Keep Evading AntivirusText-Based QR Phishing Bypasses Email Security ToolsHackers infect Android car head units with proxy botnet malwareKimsuky deploys AI-generated decoys in evolving GitHub PAT-based LNK attack campaignHackers Use Fake Cloudflare CAPTCHA to Deploy TerminalFix Reverse TunnelHackers Abuse AI-Era ASCII Smuggling to Hide Phishing Content in Millions of EmailsWarden Infostealer Targets AI Agents and Developer Keys
|
10/25
|
| T1036 |
Masquerading |
Stealth |
Atomic macOS (AMOS) Stealer infection campaign observedMidnight Mimosa: ad-fraud malware preinstalled in cheap Android phone firmwareCloud-hosted tech-support scam kit delivered via Google Ads evades detectionCISA AA26-281A advisory: Chinese government-linked actors with FBI and international partnersFakeGit Campaign: 7,600 Malicious GitHub Repos Pushing SmartLoader/StealC MalwareSynkLoader Malware Spreads Through Microsoft Teams Phishing and Steals Windows PasswordsCustom ChatGPTs push ClickFix attacks to deploy RAT malwareSLEEPWALKER Backdoor Uses SMB, ICMP, DNS and VMware VMCI for Covert CommunicationsCling botnet exploits STUN protocol for IoT command and controlFake Claude Opus 5 App Deploys RevStealer to Steal Passwords, Crypto Wallets and SessionsOpenSUpdater Malware Hides Reflective Loader Inside Recompiled 7-Zip SFX to Evade DetectionHackers abuse Google Ads, Bing redirects to push Claude ClickFix attacksMidnight Mimosa: Preinstalled Android malware in MediaTek firmwareSectopRAT Malware Hides in Legitimate Software to Steal Browser Credentials and Crypto WalletsSilver Fox Hackers Target China-Based Organizations With Counterfeit Software InstallersIranian APT Uses CHOSENBRICK Windows Malware for EspionagemacOS Users Targeted by Fake Zoom Installer Carrying CloudSyncD BackdoorKimwolf botnet rebuilt to survive takedowns, researchers saySilverFox Malware Campaign Uses Smart Filtering to Hide Fake Software Downloads From Researchers
|
11/19
|
| T1055 |
Process Injection |
Stealth |
Malicious SVG Reconstructs DCRat Archive Entirely Inside Victim's BrowserWindows Process Injection Technique Bypasses EDR Monitoring Without WriteProcessMemoryF5 BIG-IP APM in-memory PHP web shell rootkitMalicious Exodus Installer Steals Browser Credentials and Turns PCs Into SOCKS ProxiesWindows Attack Hijacks Trusted Security Apps to Abuse Powerful Kernel DriversSLEEPWALKER Backdoor Uses SMB, ICMP, DNS and VMware VMCI for Covert CommunicationsWordlistLoader Hides Shellcode in Plain English Words to Deliver Amatera StealerAPT group HoneyMyte upgrades CoolClient: the backdoor gets a kernel-level Windows rootkitClosedQuorum Windows malware uses commercial AI models for autonomous tactical C2 decisionsCybercriminals Can Now Rent Malware That Re-Encrypts Itself to Keep Evading AntivirusBring Your Own EDR Attack Turns SentinelOne Into Trojan Horse to Bypass Windows PPLFour Linux kernel privesc flaws (DirtyAH6, TUNderflow, PPPoEject, DiagSpill) with public PoC
|
5/12
|
| T1070 |
Indicator Removal |
Stealth |
Alert: FortiBleed remains active campaign, can lock out users or lead to ransomware attacksCore Werewolf Hackers Deploy New CoreRAT Malware Against Russian Government and Defense OrganizationsDeadLock Ransomware: Rust Encryptor With Decentralized Recovery InfrastructureRussian Hackers Deploy New HOOKEDGE Backdoor in Espionage Attacks Across EuropeRansomware victims: SEVEN SEAS GROUP, Forma Therapeutics, PaessolucoesDeadLock ransomware uses blockchain to resist infrastructure takedown
|
5/6
|
| T1073 |
DLL Side-Loading |
Stealth |
NeedyMantis: Unpacking a post-compromise malware family used in targeted operationsFake LastPass Authenticator GitHub repos push new Rapuncel infostealer with EDR-killing kernel driverMicrosoft-Signed Defender Driver Weaponized to Disable EDR and AntivirusSilverFox Malware Campaign Uses Smart Filtering to Hide Fake Software Downloads From Researchers
|
4/4
|
| T1078 |
Valid Accounts |
Stealth |
OpenAI agents behind May hacking campaign targeting RubyGemsHacktron AI researchers used Claude to exploit a HEIF image-processing flaw in Discourse, pivoting from OpenAI community forum to employee account and GitHub resourcesAI-Built Exploit and Sign-In Flaw Opened Path to Internal OpenAI CodeAurora Ransomware Affiliate Uses Cursor AI to Plan Attacks Against 20+ OrganizationsHackers Actively Exploiting MikroTik RouterOS MikroTrick Flaws to Take Full Control of RoutersAlert: FortiBleed remains active campaign, can lock out users or lead to ransomware attacksA stolen API key turned Brevo's CDN into a supply-chain weapon - fake CAPTCHAs, silent WordPress backdoorsIE: HSE fined €645,000 over data breach affecting Westmeath hospitalFrench Tax Authority Data Breach Impacts 678,000 Individuals and BusinessesNovo Nordisk Breach — Two Separate Extortion Groups, Demands of $50M and $25M, Neither PaidD-Link DIR-X1860Z Flaws Enable Unauthenticated Admin Password Reset and Wi-Fi Credential TheftGitLab Email Feature Lets Attackers Push Code to Protected Branches and Execute CI/CD JobsIvanti September 2026 security advisory: EPMM, ITSM, Sentry vulnerabilitiesThreat Actors Use Claude Code, Codex and DeepSeek AI to Power CyberattacksTP-Link Tapo C200/C120 authentication bypass via CVE-2026-15315 and CVE-2026-15316Former US soldier sentenced for telecom hacking and extortion spreeJFrog Artifactory under active attack with CVE chain exploitCISA Urges Organizations to Patch Exposed VPNs and Segment Networks Against Gunra RansomwarecPanel/WHM Critical Authentication Bypass CVE-2026-41940Hackers Exploit Critical Cisco Secure Email Gateway Flaw to Execute Commands as RootJoint US–South Korea Advisory: Gunra Ransomware Exploits Fortinet VPNs to Bypass MFA and Steal Cloud DataFlorida confirms DMV database breached via stolen police accountCritical Snowflake GitHub Actions Flaw Allows Attackers to Steal Internal Jira CredentialsRansomware has a new target. Is your backup ready?Hackers Breach Brazilian Financial Firms and Execute Hundreds of Fraudulent TransactionsBrevo Supply Chain Attack: Cloudflare Worker injected malicious code across 100,000+ sitesAI-powered attack exploited PaperCut flaws to hack 395 organizationsKaspersky reports three clusters targeting Russian enterprisesAI-Autonomous Campaign Compromises 85 Government Accounts, Exfiltrates 2,500+ RecordsCritical Spring Security LDAP Vulnerability (CVE-2026-59270) Enables Remote Admin AccessAI-Orchestrated Campaign Against PaperCut NG/MF Exploiting CVE-2026-81578 and CVE-2026-82078JFrog Artifactory Vulnerabilities Actively Exploited in the Wild to Gain Administrative ControlCritical JFrog Artifactory Vulnerability Reportedly Exploited in the WildShinyHunters Claims 284M Patient Records from McKesson BreachFortiBleed Attackers Locking Victims Out of Fortinet DevicesStorm-3068 Hijacks Azure DevOps Pipelines to Steal Kubernetes Credentials After Account TakeoverRAVEN Tool Steals Entire Elasticsearch Databases and Rebuilds Deleted BackdoorsCompromised email accounts used to illegally access cryptocurrency accountsDanish university DTU breach exposes data of up to 200,000 peopleAI Agents Automate Credential Theft Campaigns in Under 6 HoursBigCommerce merchant data breach via compromised third-party Ribon app credentialsAnthropic Claude models compromised 3 real organizations during safety evaluationsN-able N-central authentication bypass chain (CVE-2026-86206, CVE-2026-86207)SolarWinds patches CVE-2026-28326 in Access Rights Manager - unauthenticated RCE via hard-coded keyNightEagle targets Russian companiesLLMjacking Attack Abuses Leaked AWS Credentials to Hijack Amazon Bedrock AI ModelsStorm-3168: Agentic-driven cloud attacks using compromised service principalsGitHub App Private Keys: 474 Leaked Keys ExposedCISA KEV update: five actively exploited Artifactory, ScreenConnect, and RouterOS flaws addedNikkei discloses breaches of employee Microsoft and Google email accountsOne Missing MFA Control Lets Credential Spray Become Full Akira Ransomware Intrusion9.5 Million Impacted by Aesto Health Data BreachHackers Launch Password Spraying Attacks Against AWS Root Accounts at 150+ OrganizationsHackers exploit critical Adobe Commerce flaw to hijack customer accountsN-able N-central Critical Auth Bypass (CVE-2026-18556/18577) Actively Exploited — First Fix Was Incomplete; MSPs Urged to Hotfix NowminiOrange WordPress SAML SSO plugin auth bypass enables admin takeoverTwo Alleged TeamPCP Hackers Arrested in AustraliaCARS24 Alleges 3,100 Customer Records Stolen and Sold for ₹1,000 Per LeadSuspected Chinese Hackers Turn VMware vCenter RCE Into Root Backdoors and ESXi RansomwareHackers compromise 14,500 Dahua web cameras in 35-day campaignHackers exploit critical JFrog Artifactory flaw to forge admin tokens768 Leaked AWS Keys Expose Corporate Cloud Accounts to Full Admin TakeoverApollo Global Data Breach Exposes Names, Addresses and Social Security NumbersOracle PeopleSoft CVE-2026-35273 (CVSS 9.8) — Mitigations Released, Mandiant/GTIG Confirm ShinyHunters Targeting 100+ Organizations, Primarily Higher EducationNearly 22,000 Microsoft Exchange servers vulnerable to hijack attacksDouble Counter just got breachedRussian Hackers Trick Academics and Diplomats Into Giving Them Access to Email and WhatsAppSuprema BioStar 2 door-access software leaks Active Directory service-account password in cleartextClaude AI Finds Authentication Bypass Flaws in Multiple SAML ImplementationsHackers Breach South Korean Churches via ERP Web Shell and IDORCritical WordPress TranslatePress Flaw Lets Attackers Take Over Admin AccountsBeacon CRM Data Breach Exposes Entire Customer Database After AWS Key CompromiseCritical Copeland XWEB Pro Flaw Lets Remote Attackers Take Control of Refrigeration SystemsPersonal Information Exposed in Apollo Global Data BreachNVIDIA patched critical NVIDIA Infrastructure Controller vulnerabilities across Linux builds. Learn how CVE-2026-65113 impacts systems and uIran-Linked Hackers Shut Down UK Power Plant for Four Days in CyberattackDomino’s customers targeted in credential stuffing attacksPanzer Ransomware Emerges With Windows, Linux, ESXi and FreeBSD Attack SupportUS Charges 17 Iranian Hackers, Offers $10M Rewards for 5 of ThemAI-automated exploitation of PaperCut NG/MF vulnerabilities (CVE-2026-81578, CVE-2026-82078)Three CVEs on MikroTik RouterOS — equipment massively deployed across ISPs, enterprises, and embedded networksShinyHunters claims FBI breach via unpatched PeopleSoft RCE, lateral movement to AWS GovCloudCritical Citrix NetScaler Flaw Allows Attackers to Bypass AuthenticationLiteLLM Admin API Broken Authorization Exploited in the WildSensitive Information Exposed in Nutex Health Data BreachAI Agents Breach Enterprise Network in Under 10 Hours and Steal Root CredentialsEvilTokens PhaaS Abuses Microsoft Device Codes to Hijack M365 AccountsDanish CPR data breach exposes records protected by weak '123456' passwordGentlemen Ransomware Affiliate Uses MCP as C2 Channel in Live CyberattacksArtifactory flaws chained in attacks deploying backdoor malwareASOS links data breach to social engineering attack, credential theftUS Water-Sector Campaign Now Confirmed in 12 States — Georgia's Clayton County Confirms Disruption as FBI Details PLC TamperingAnthropic discloses Claude AI misuse in cyberattacks and surveillanceHundreds of leaked AWS keys give full control over corporate accountsTeamFiltration Hackers Target 5,700 Microsoft 365 Accounts to Exploit Forgotten Service AccountsFake OpenAI, Anthropic and DeepSeek Crawlers Target .env Files and Cloud CredentialsWPMU DEV Dashboard plugin auth bypass affects 350K sites
|
15/97
|
| T1089 |
Disabling Security Tools |
Stealth |
Warlock ransomware breach SharePoint in water, telecom operator attacksMicrosoft-Signed Defender Driver Weaponized to Disable EDR and Antivirus
|
1/2
|
| T1099 |
Timestomp |
Stealth |
TASK#STOMP PowerShell Backdoor Steals Business Documents and Executes Remote Commands
|
1/1
|
| T1107 |
File Deletion |
Stealth |
Microsoft-Signed Defender Driver Weaponized to Disable EDR and Antivirus
|
1/1
|
| T1116 |
Code Signing |
Stealth |
FBI Hackers Say They Won’t Publish Massive Trove of FBI Employee DataOpenSUpdater Malware Hides Reflective Loader Inside Recompiled 7-Zip SFX to Evade DetectionSilverFox Malware Campaign Uses Smart Filtering to Hide Fake Software Downloads From Researchers
|
3/3
|
| T1118 |
InstallUtil |
Stealth |
Blind Eagle-Linked Loader Uses GitHub, VBScript, PowerShell and InstallUtil to Deploy AsyncRAT
|
1/1
|
| T1140 |
Deobfuscate/Decode Files or Information |
Stealth |
APT group HoneyMyte upgrades CoolClient: the backdoor gets a kernel-level Windows rootkitPavinLoader Multi-Stage Malware Abuses MSBuild and Trojanized .NET DLLs
|
gap
|
| T1170 |
Mshta |
Stealth |
Phishing Campaign Abuses Windows Mshta.exe to Steal Credentials and Secrets
|
1/1
|
| T1211 |
Exploitation for Stealth |
Stealth |
Two OpenAI Codex Desktop Sandbox Escape Techniques Disclosed
|
gap
|
| T1218 |
System Binary Proxy Execution |
Stealth |
Microsoft-Signed Defender Driver Weaponized to Disable EDR and AntivirusPavinLoader Multi-Stage Malware Abuses MSBuild and Trojanized .NET DLLs
|
1/2
|
| T1480 |
Execution Guardrails |
Stealth |
DeadLock Ransomware: Rust Encryptor With Decentralized Recovery Infrastructure
|
1/1
|
| T1497 |
Virtualization/Sandbox Evasion |
Stealth |
Go Loader Uses Anti-Sandbox Checks and SNOWLIGHT to Execute Fileless VShell RAT in Memory2CLoader: A New Malware Loader Delivering Vidar and RemusEvolution of MATCHBOIL Downloader by UAC-0099Graphalgo malware hits Terraform providers and Go modules in supply chain attackAeternum Botnet Runs Entire C2 Stack on the Polygon BlockchainMuddyWater-Linked Dindoor Backdoor Abuses Deno Runtime for Evasion
|
2/6
|
| T1500 |
Compile After Delivery |
Stealth |
Threat actor compiles cryptominer on endpoint via Samsung MagicINFO flaw
|
1/1
|
| T1562 |
Impair Defenses |
Stealth |
Singularity Rootkit Bypasses Elastic Defend eBPF Module Load DetectionSETTRA Ransomware Uses MeshAgent RMM and BYOVD to Encrypt Windows SystemsF5 BIG-IP APM in-memory PHP web shell rootkitGryxa Toolkit Uses AI-Built Persistence to Fight Back Against Security TeamsINJ3CTOR3's FreePBX JOMANGY Campaign — Six-Layer Self-Healing Persistence on VoIP InfrastructureMicrosoft Defender Zero-Days (CVE-2026-41091, CVE-2026-45498) — Actively Exploited, CISA Adds to KEVThreat actor compiles cryptominer on endpoint via Samsung MagicINFO flawBeyondTrust Endpoint Privilege Management Flaws Enable Local Privilege EscalationIranian state-linked CHOSEN BRICK malware targets dissidents worldwideDownload More RAM Attack Bypasses Windows VBS, HVCI and Disables Microsoft DefenderDeadLock Ransomware: Rust Encryptor With Decentralized Recovery Infrastructurex47.c Windows Botnet Weaponizes xAI Grok, AI API DrainingRemControl Android Banking Trojan Steals PINs Using AI-Built Phishing OverlaysCiscoClamAV Vulnerabilities Let Remote Attackers Crash Antivirus Scanning With Crafted FilesFake LastPass Authenticator GitHub repos push new Rapuncel infostealer with EDR-killing kernel driverOne Missing MFA Control Lets Credential Spray Become Full Akira Ransomware IntrusionDPRK-Linked Actors Deploy Novel Linux Espionage Toolkit Against South Korean HAProxy ServersMedusa ransomware tallies hundreds of new victims, says updated advisory on groups tacticsDeadLock ransomware uses blockchain to resist infrastructure takedownChinese Fire Ant APT Plants GRE Tunnels on Cisco IOS XR Routers for Persistent EspionageMicrosoft-Signed Defender Driver Weaponized to Disable EDR and AntivirusWindows AFD.sys Zero-Day Exploited by Lazarus Hackers to Gain SYSTEM AccessBring Your Own EDR Attack Turns SentinelOne Into Trojan Horse to Bypass Windows PPLClickFix Campaigns Targeting End Users via Legitimate ServicesThreat actors abuse ChatGPT custom GPTs to deliver RAT payloads via ClickFix-style attacks
|
15/25
|
| T1564 |
Hide Artifacts |
Stealth |
Hackers Create Hidden Microsoft 365 Inbox Rules to Conceal Vendor Payment FraudSilver Fox Hackers Target China-Based Organizations With Counterfeit Software Installers
|
gap
|
| T1574 |
Hijack Execution Flow |
Stealth |
Malicious SVG Reconstructs DCRat Archive Entirely Inside Victim's BrowserWindows Attack Hijacks Trusted Security Apps to Abuse Powerful Kernel DriversContagious Interview Operators Move Beyond Git Hooks With Trojanized Mac ApplicationsFake LastPass Authenticator GitHub repos push new Rapuncel infostealer with EDR-killing kernel driverCritical Node.js Sandbox Flaw Exposes AI Agents to Host Code ExecutionSectopRAT Malware Hides in Legitimate Software to Steal Browser Credentials and Crypto WalletsMicrosoft Defender 'ShieldBreak' zero-day grants SYSTEM privilegesHackers Use Fake Cloudflare CAPTCHA to Deploy TerminalFix Reverse TunnelThree HP Easy Start Flaws Let Attackers Gain Root Privileges on macOSWindows AFD.sys Zero-Day Exploited by Lazarus Hackers to Gain SYSTEM Access
|
7/10
|
| T1620 |
Reflective Code Loading |
Stealth |
Go Loader Uses Anti-Sandbox Checks and SNOWLIGHT to Execute Fileless VShell RAT in MemoryOpenSUpdater Malware Hides Reflective Loader Inside Recompiled 7-Zip SFX to Evade Detection
|
1/2
|
| T1656 |
Impersonation |
Stealth |
Telegram Vishing Ad Recruits Callers for Fake Google Security TeamIranian state-linked CHOSEN BRICK malware targets dissidents worldwideMicrosoft Teams Help Desk Impersonation Social Engineering CampaignRevolut breach: 680 high-profile accounts compromised via fake law enforcement requests, $3M Monero ransomRansom Busters: Ransomware Affiliate Poses as Recovery Firm to Re-Extort VictimsApollo Global Data Breach Exposes Names, Addresses and Social Security NumbersDutch Police Arrest ‘Reformed’ Hacker in Shiny Hunters InvestigationCrypto Scammers Hijack Microsoft’s Official X AccountMicrosoft: passkey social engineering enables cloud account hijackHackers Abuse AI-Era ASCII Smuggling to Hide Phishing Content in Millions of EmailsRevolut discloses data breach exposing financial info, passportsHackers Use AI-Generated Event Lures to Steal Google Accounts and Bypass MFA
|
1/12
|
| T1672 |
Email Spoofing |
Stealth |
Revolut discloses data breach exposing financial info, passports
|
gap
|
| T1684 |
Social Engineering |
Stealth |
Russia-aligned UAC-0099 weaponized AI safety guardrails with GuardBreakerTelegram Vishing Ad Recruits Callers for Fake Google Security TeamHackers Pose as IT Support on Microsoft Teams to Target More Than 150 EmployeesUK Man Tied to "The Com" Sentenced for Blackmail and Sextortion Against 117 VictimsRussian Hackers Trick Academics and Diplomats Into Giving Them Access to Email and WhatsAppAI-Powered AnonyMousKIT PhaaS Steals Apple IDs and 2FA Codes to Unlock Stolen iPhonesPersonal Information Exposed in Apollo Global Data BreachRemControl Android malware targets European and Canadian users via fake Play Store pagesASOS links data breach to social engineering attack, credential theft
|
2/9
|
| T1046 |
Network Service Discovery |
Discovery |
Red Hat Kubernetes Flaw Lets Unauthenticated Attackers Access Internal Cluster ServicesAI Agents Automate Credential Theft Campaigns in Under 6 HoursHackers Turn an Open-Source AI Agent Into a Tool for Controlling Compromised Docker ServersCheck Point warns of exploited Security Gateway VPN RCE (CVE-2026-85102)Carbonato malware uses AI agents to hijack exposed Docker hosts
|
2/5
|
| T1063 |
Security Software Discovery |
Discovery |
Aeternum Botnet Runs Entire C2 Stack on the Polygon Blockchain
|
1/1
|
| T1082 |
System Information Discovery |
Discovery |
Impersonating IT support: how threat actors turn a remote session into enterprise-wide accessWindows Defender ShieldCrash 0-Day Lets Attackers Read Arbitrary Files as SYSTEMChina-Linked Hackers Chain Chrome Zero-Day With Windows Kernel FlawCore Werewolf Hackers Deploy New CoreRAT Malware Against Russian Government and Defense OrganizationsAI-powered attack exploited PaperCut flaws to hack 395 organizationsAI-Powered BraZetsu Malware Turns Compromised Corporate PCs Into Tradable AssetsJFrog Artifactory Vulnerabilities Actively Exploited in the Wild to Gain Administrative ControlVulnerability Attack Case: Installation of a Web Shell and Execution of a Scanner by Exploiting a Telerik UI VulnerabilityOctagon Android Bot Targets Crypto Wallets and Banking Apps With Hidden VNC and Accessibility OverlaysHackers Abuse Windows Shadow Copies to Steal Active Directory Credentials and Kill Ransomware RecoveryAndroid Banking Trojan GigaPlay/VWork Exploits Work Profiles in IndonesiaMuddyWater-Linked Dindoor Backdoor Abuses Deno Runtime for Evasion
|
3/12
|
| T1083 |
File and Directory Discovery |
Discovery |
GitLab critical flaw CVE-2026-85706 drawing internet-wide probesGitLab Critical Path Traversal Vulnerability CVE-2026-85706Decades-old file security flaws found in Android, Linux, macOS, and WindowsGitLab Vulnerability Exploited One Day After DisclosureHackers Target Exposed Vite Dev Servers to Steal AWS, Azure SecretsGitLab Critical CVE-2026-85706 Under Active Exploitation - Unauthenticated Path TraversalMass scanning targets exposed Vite dev servers for cloud secrets via CVE-2026-39364Composer Path Traversal Flaw Lets Malicious Packages Expose Sensitive FilesAtlassian Bamboo CVE-2026-21589 critical path traversal (CVSS 9.3)OpenAI AI agents access Australian government systems
|
5/10
|
| T1087 |
Account Discovery |
Discovery |
CISA Warns of 17 Active Directory Attack Techniques Used for Privilege Escalation and PersistenceAI-automated exploitation of PaperCut NG/MF vulnerabilities (CVE-2026-81578, CVE-2026-82078)CISA Red Team Compromises Active Directory and Critical Business Systems
|
1/3
|
| T1217 |
Browser Information Discovery |
Discovery |
File Notification Attacks Let Hackers Track Keystrokes and Website Visits on Linux, Windows and macOS
|
gap
|
| T1526 |
Cloud Service Discovery |
Discovery |
Storm-3168: Agentic-driven cloud attacks using compromised service principals
|
1/1
|
| T1005 |
Data from Local System |
Collection |
P7 DarkSword iOS Exploit Kit Adds Crypto Wallet Theft and Remote CommandsFulcrumSec claims Manchester Airports hack, theft of 86 GB of dataFrench Tax Authority Data Breach Impacts 678,000 Individuals and BusinessesNovo Nordisk Breach — Two Separate Extortion Groups, Demands of $50M and $25M, Neither PaidManic Android malware family targets 169 apps with banking fraud and Wi-Fi mesh exfiltrationCenterPoint Energy Data Breach Exposes 7.5 Million Records on Dark WebClop created custom web shell for Windchill data theft attacksVidar Adds Virtual Machine and Custom Stream Ciphers For String ObfuscationARTEX AI, Claude agents used in cyberattacks on South Korean banksPackagist Themes Exploit iPhone Visitors to Steal Messages, Passwords and Crypto Wallet SeedsRuby on Rails Active Storage Flaw (CVE-2026-66066, CVSS 9.5): Unauthenticated Server File Read via Image UploadsAiLock Ransomware Strikes Morgan Services, IncMcKesson copes with fallout from data theft extortion attackTikTok users' cameras hacked with open weight model by depthfirstFlorida confirms DMV database breached via stolen police accountRansomware disrupts University of Illinois Chicago College of Medicine, data stolenHackers Target Exposed Vite Dev Servers to Steal AWS, Azure SecretsCore Werewolf Hackers Deploy New CoreRAT Malware Against Russian Government and Defense OrganizationsAI-Autonomous Campaign Compromises 85 Government Accounts, Exfiltrates 2,500+ RecordsMalicious Chrome and Edge Extensions Hijack Crypto Wallets and Steal Login CredentialsChina-Nexus Hackers Target Myanmar Diplomats With Government-Themed QUICAgent Malware AttacksAI-Powered BraZetsu Malware Turns Compromised Corporate PCs Into Tradable AssetsManic Android malware can exfiltrate data through nearby devicesManchester Airports Group says hackers stole travelers' dataMathspace discloses data breach affecting over 1 million peopleFake Claude Opus 5 App Deploys RevStealer to Steal Passwords, Crypto Wallets and SessionsDanish university DTU breach exposes data of up to 200,000 peopleRevolut breach: 680 high-profile accounts compromised via fake law enforcement requests, $3M Monero ransomStorm ransomware lists US healthcare provider West County Health Centers as victimNorth Korean WaterPlum hackers infected 30,000 devices worldwideHackers have apparently breached FBI systems and have extracted personal data “on all FBI employees and applicants.” The data reportedly incTelegram Desktop stored XSS in HTML export exfiltrates chat history for 2+ yearsSlate Valley Unified School District voted not to pay ransom demand; Kairos likely to leak dataTech contractor for Brightly Software sentenced to 2 years in prison for insider attackOpenClaw NovaStealer Attacks Target 60+ Crypto Wallets, SSH Keys and AWS CredentialsDPRK-Linked Actors Deploy Novel Linux Espionage Toolkit Against South Korean HAProxy ServersDark Caracal Deploys New GoCaracal Malware With Ethereum-Based C2 Across Latin AmericaU.S. Offers $10 Million Reward for Chinese Hacker Behind Alleged COVID-19 Research CyberattacksChinese-Speaking Hackers Exploit Known Flaws to Steal Philippine Nuclear and Naval DataTwo Alleged TeamPCP Hackers Arrested in AustraliaSuspected TraderTraitor Group Uses Trojanized Terraform Provider to Deliver Cross-Platform MalwareApollo Global Data Breach Exposes Names, Addresses and Social Security NumbersResearchers observe first 'near-autonomous' AI attack on government target in TaiwanTASK#STOMP PowerShell Backdoor Steals Business Documents and Executes Remote CommandsContagious Interview: North Korean threat actors compromised 30,000 devices in 100+ countriesRecently patched PaperCut zero-days used in data theft attacksBerlin Won't Pay Extortion Group Claiming Data TheftWeaselBiscuit npm stealer targets Chrome extension storage, linked to DPRK ContagiousPentagon data breach of military personnel raises national security concernsToxicPanda 2.0 Steals PINs From 140+ Banking and Cryptocurrency Apps Using Invisible OverlaysBimbo Bakeries USA SSN Exposure in Oracle E-Business Suite Zero-Day AttackAkira Ransomware Group Claims Stransky Heiz-Mess-Regeltechnik GmbHBragJack attacks hijack AI browser agents through malicious extensions
|
8/53
|
| T1056 |
Input Capture |
Collection |
16 Malicious Firefox Extensions Impersonate Crypto Wallets to Steal Seed Phrases and Private KeysDecades-old file security flaws found in Android, Linux, macOS, and WindowsManic Android malware family targets 169 apps with banking fraud and Wi-Fi mesh exfiltrationFile Notification Attacks Let Hackers Track Keystrokes and Website Visits on Linux, Windows and macOSMagecart Hackers Abuse Ethereum Smart Contracts to Steal Card Data From 40+ Online StoresJWR Phishing-as-a-Service Kit Uses WebSockets and AES to Run Real-Time Banking FraudBanking Trojans Manic, Grandoreiro, ToxicPanda 2.0 in the SpotlightSynkLoader Malware Spreads Through Microsoft Teams Phishing and Steals Windows PasswordsMantax Otax Android malware combines ransomware, spyware and remote control (verified via Zimperium zLabs)AmnesiaStealer macOS Malware Steals Data, Controls Browser SessionsMalicious Chrome and Edge Extensions Hijack Crypto Wallets and Steal Login CredentialsManic Android malware can exfiltrate data through nearby devicesOperation ASTERIX Uses Vishing and Fake Crypto Wallet Apps to Steal Seed PhrasesRemControl Android Banking Trojan Steals PINs Using AI-Built Phishing OverlaysRatHat Android Banking Trojan Uses AI to Navigate Banking AppsMicrosoft Entra TrustSink Attack Uses Rogue MFA Provider to Steal PasswordsAbyssos RAT Hijacks Browser Sessions, Steals Credentials and Gives Attackers Remote VNC AccessOctagon Android Bot Targets Crypto Wallets and Banking Apps With Hidden VNC and Accessibility OverlaysHackers Can Use PEEP Chrome Extension to Steal Credentials and Execute Shell CommandsStreamRAT Android Malware Targets 570K Meta Users in SpainRATHat Android Banking Trojan Uses Gemini AI and ADB Shell to Take Control of DevicesToxicPanda 2.0 Steals PINs From 140+ Banking and Cryptocurrency Apps Using Invisible OverlaysFake ChatGPT, Gemini Sites steal advertising accounts, MFA codes
|
3/23
|
| T1074 |
Data Staged |
Collection |
CARS24 Alleges 3,100 Customer Records Stolen and Sold for ₹1,000 Per Lead
|
gap
|
| T1113 |
Screen Capture |
Collection |
Impersonating IT support: how threat actors turn a remote session into enterprise-wide accessShadow hVNC Lets Hackers Operate a Second Windows Desktop Invisible to the VictimMantax Otax Android malware combines ransomware, spyware and remote control (verified via Zimperium zLabs)TikTok users' cameras hacked with open weight model by depthfirstViewSonic vCast Vulnerabilities Let Attackers Gain Full Device Control Without AuthenticationRemControl Android Banking Trojan Steals PINs Using AI-Built Phishing OverlaysPoper Blocker Chrome extension exfiltrates browsing historyOctagon Android Bot Targets Crypto Wallets and Banking Apps With Hidden VNC and Accessibility OverlaysTASK#STOMP PowerShell Backdoor Steals Business Documents and Executes Remote CommandsFamousSparrow deploys SparroWocky backdoor targeting Latin American governmentsStreamRAT Android Malware Targets 570K Meta Users in SpainBragJack attacks hijack AI browser agents through malicious extensions
|
2/12
|
| T1114 |
Email Collection |
Collection |
CISA AA26-281A advisory: Chinese government-linked actors with FBI and international partnersIranian state-linked CHOSEN BRICK malware targets dissidents worldwideIranian State Hacker Extradited to USCompromised email accounts used to illegally access cryptocurrency accountsEvilTokens PhaaS disrupted after compromising 12,000 Microsoft accounts
|
3/5
|
| T1119 |
Automated Collection |
Collection |
TIKTOUK WordPress Toolkit Could Enable AWS, SMTP and API Credential Theft AttacksPoper Blocker Chrome extension exfiltrates browsing historyWarden Infostealer Targets AI Agents and Developer Keys
|
1/3
|
| T1185 |
Browser Session Hijacking |
Collection |
Shadow hVNC Lets Hackers Operate a Second Windows Desktop Invisible to the VictimRussia-Linked Cyber Espionage Clusters Use OAuth Phishing to Target U.S. and European OrganizationsCaptiveCrunch: Midnight Blizzard Sub-Cluster Weaponizes Hotel Wi-Fi Captive Portals to Attack Corporate Travelers WorldwideAmnesiaStealer macOS Malware Steals Data, Controls Browser SessionsAbyssos RAT Hijacks Browser Sessions, Steals Credentials and Gives Attackers Remote VNC AccessMicrosoft Links 30+ Domains to MacSync Stealer's Credential-Theft and Data-Exfiltration Infrastructure
|
3/6
|
| T1213 |
Data from Information Repositories |
Collection |
659 Stripe Merchant API Keys Leaked Online, Exposing 688,000 Customer RecordsRAVEN Tool Steals Entire Elasticsearch Databases and Rebuilds Deleted BackdoorsHackers Breach South Korean Churches via ERP Web Shell and IDORDanish CPR data breach exposes records protected by weak '123456' password
|
gap
|
| T1530 |
Data from Cloud Storage |
Collection |
KillSec ransomware group disrupted in international law enforcement operationMisconfigured Supabase apps expose data in over 16,000 databasesAI-Autonomous Campaign Compromises 85 Government Accounts, Exfiltrates 2,500+ RecordsMetabase Zero-Day Attack Lets Hackers Gain Admin Access and Steal Database CredentialsRevolut Confirms Customer Data Breach via Fake Government Data Requests9.5 Million Impacted by Aesto Health Data BreachBeacon CRM Data Breach Exposes Entire Customer Database After AWS Key CompromiseIDScan Data Breach Exposes 153 Million Driver's LicensesJadePuffer Agentic Ransomware — First Documented AI-Agent-Driven Extortion Operation
|
3/9
|
| T1560 |
Archive Collected Data |
Collection |
Accenture Contractor Removed After FBI Data Breach Exposes Thousands of EmployeesRansomware Affiliate Poses as Recovery Firm to Re-Extort Victims After Data Theft
|
1/2
|
| T1020 |
Automated Exfiltration |
Exfiltration |
Iranian State Hacker Extradited to USRAVEN Tool Steals Entire Elasticsearch Databases and Rebuilds Deleted BackdoorsAI Agents Automate Credential Theft Campaigns in Under 6 HoursMedusa ransomware tallies hundreds of new victims, says updated advisory on groups tactics
|
gap
|
| T1030 |
Data Transfer Size Limits |
Exfiltration |
RAVEN Tool Steals Entire Elasticsearch Databases and Rebuilds Deleted Backdoors
|
gap
|
| T1041 |
Exfiltration Over C2 Channel |
Exfiltration |
CenterPoint Energy Data Breach Exposes 7.5 Million Records on Dark WebClop created custom web shell for Windchill data theft attacksAI-assisted malware rewrites itself via Gemini and Hugging Face APIs to evade detectionMini Shai-Hulud worm re-infects GitHub repositories via hijacked ActionsARTEX AI, Claude agents used in cyberattacks on South Korean banks77 "Evil Twin" Open VSX Extensions Harvest Developer Metadata — Shared C2 at mangorbit[.]comManic Android malware can exfiltrate data through nearby devicesHackers Target LiteLLM, RAGFlow and Kestra AI Infrastructure to Steal API Keys and Mine CryptoChina-Nexus SilkParasite APT Deploys Five New RATs Against Central Asian GovernmentsGrok Zero-Click Attack Steals Chat History Through Encrypted Prompt InjectionAI Agents Automate Credential Theft Campaigns in Under 6 HoursFake Claude Install Guide Steals Mac Passwords and Turns Trusted Crypto Wallet Apps Into Phishing TrapsAnthropic Claude models compromised 3 real organizations during safety evaluationsRansomware Affiliate Poses as Recovery Firm to Re-Extort Victims After Data TheftCompromised Rust Crate With 18,000+ Downloads Steals Source Code During BuildsASEC July 2026 APT Attack Report (South Korea)OpenClaw NovaStealer Attacks Target 60+ Crypto Wallets, SSH Keys and AWS CredentialsFake Google Gemini installer distributes Vidar stealer via Google ColabChinese-Speaking Hackers Exploit Known Flaws to Steal Philippine Nuclear and Naval DataTwo Alleged TeamPCP Hackers Arrested in AustraliaCARS24 Alleges 3,100 Customer Records Stolen and Sold for ₹1,000 Per LeadResearchers observe first 'near-autonomous' AI attack on government target in TaiwanHackers infect Android car head units with proxy botnet malwareMicrosoft Links 30+ Domains to MacSync Stealer's Credential-Theft and Data-Exfiltration Infrastructure
|
7/24
|
| T1048 |
Exfiltration Over Alternative Protocol |
Exfiltration |
Salesforce Agentforce Flaw Enables 0-Click Data Exfiltration via Prompt InjectionAccenture Contractor Removed After FBI Data Breach Exposes Thousands of EmployeesHelpfeel Confirms Gyazo Breach Exposing 23 Million User RecordsOracle PeopleSoft CVE-2026-35273 (CVSS 9.8) — Mitigations Released, Mandiant/GTIG Confirm ShinyHunters Targeting 100+ Organizations, Primarily Higher Education
|
2/4
|
| T1567 |
Exfiltration Over Web Service |
Exfiltration |
Panzer Ransomware Hits 16 Victims Across 11 Countries With Data Theft and Encryption16 Malicious Firefox Extensions Impersonate Crypto Wallets to Steal Seed Phrases and Private KeysCisco Talos details Antino backdoor used by China-nexus actor against Taiwan government orgsNovo Nordisk Breach — Two Separate Extortion Groups, Demands of $50M and $25M, Neither PaidManic Android malware family targets 169 apps with banking fraud and Wi-Fi mesh exfiltrationMagecart Hackers Abuse Ethereum Smart Contracts to Steal Card Data From 40+ Online StoresOpenAI's AI agents accidentally uploaded user-provided images to third-party sitesShinyHunters hacker “Rey,” allegedly involved in FBI data theft, detained in JordanFormer US soldier sentenced for telecom hacking and extortion spreeKillSec ransomware group disrupted in international law enforcement operation659 Stripe Merchant API Keys Leaked Online, Exposing 688,000 Customer RecordsJoint US–South Korea Advisory: Gunra Ransomware Exploits Fortinet VPNs to Bypass MFA and Steal Cloud DataMantax Otax Android malware combines ransomware, spyware and remote control (verified via Zimperium zLabs)AiLock Ransomware Strikes Morgan Services, Inc77 "Evil Twin" Open VSX Extensions Harvest Developer Metadata — Shared C2 at mangorbit[.]comChina-Nexus SilkParasite APT Deploys Five New RATs Against Central Asian GovernmentsGhostAction Supply Chain Campaign ReturnsShinyHunters Claims 284M Patient Records from McKesson BreachShinyHunters allegedly breached the FBI to steal personal data on agency employees, forcing the bureau's job portal offline. The group claimOpenAI Agent Swarm Escaped Sandboxes and Left 80,000 Attack Payloads BehindRevolut breach: 680 high-profile accounts compromised via fake law enforcement requests, $3M Monero ransomThousands of Hacked WordPress Sites, One Operation: Unmasking StopAndProtectStorm ransomware lists US healthcare provider West County Health Centers as victimAlleged ShinyHunters Leader Arrested in JordanHackers have apparently breached FBI systems and have extracted personal data “on all FBI employees and applicants.” The data reportedly incTelegram Desktop stored XSS in HTML export exfiltrates chat history for 2+ yearsSlate Valley Unified School District voted not to pay ransom demand; Kairos likely to leak dataTanStack npm Supply-Chain Compromise Exfiltrated 170 Private GitHub ReposPoper Blocker Chrome extension exfiltrates browsing historyShinyHunters claims breach of FBI jobs site exposing personnel dataRansomware victims: SEVEN SEAS GROUP, Forma Therapeutics, PaessolucoesDouble Counter just got breachedBerlin Won't Pay Extortion Group Claiming Data TheftATF Investigating Major Cyber Incident After Ransomware Group ClaimCritical Microsoft Copilot CoSnitch Flaw Lets Hackers Steal Sensitive Data With One ClickBimbo Bakeries USA SSN Exposure in Oracle E-Business Suite Zero-Day AttackTITAN RaaS Uses AI for Data Classification, Regulatory Analysis and Automated Ransom CalculationAkira Ransomware Group Claims Stransky Heiz-Mess-Regeltechnik GmbHBragJack attacks hijack AI browser agents through malicious extensionsChinese AI firms extract billions of tokens from U.S. AI models (AA26-251A)
|
6/40
|
| T1485 |
Data Destruction |
Impact |
CERT Polska Confirms Siemens PLC Sabotage at Polish CHP Plant via Private APNMini Shai-Hulud worm re-infects GitHub repositories via hijacked ActionsStorm-3168: Agentic-driven cloud attacks using compromised service principalsUS Water-Sector Campaign Now Confirmed in 12 States — Georgia's Clayton County Confirms Disruption as FBI Details PLC Tampering
|
2/4
|
| T1486 |
Data Encrypted for Impact |
Impact |
Aurora Ransomware Affiliate Uses Cursor AI to Plan Attacks Against 20+ OrganizationsPanzer Ransomware Hits 16 Victims Across 11 Countries With Data Theft and EncryptionNavitrans Ransomware Claim by EmperadorSETTRA Ransomware Uses MeshAgent RMM and BYOVD to Encrypt Windows SystemsWarlock ransomware exploits SharePoint vulnerabilities targeting critical infrastructureQilin Targets Canadian Firm B Wright Drywall in Ransomware AttackKillSec ransomware group disrupted in international law enforcement operationCISA Urges Organizations to Patch Exposed VPNs and Segment Networks Against Gunra RansomwareJoint US–South Korea Advisory: Gunra Ransomware Exploits Fortinet VPNs to Bypass MFA and Steal Cloud DataIDCF Cloud Outage After Unauthorized AccessCISA Confirms WatchGuard Firebox RCE CVE-2025-14733 Is Being Exploited in Ransomware AttacksMantax Otax Android malware combines ransomware, spyware and remote control (verified via Zimperium zLabs)Ransomware disrupts University of Illinois Chicago College of Medicine, data stolenRansomware has a new target. Is your backup ready?Kaspersky reports three clusters targeting Russian enterprisesDeadLock Ransomware: Rust Encryptor With Decentralized Recovery InfrastructureBerlin confirms data theft after Rhysida ransomware attack claimsStorm Ransomware Strikes GSAC Auto FinancingNorth Korean WaterPlum hackers infected 30,000 devices worldwideRansomware hits Osaka Metropolitan University: virtualization platform breached, about 500 servers downOne Missing MFA Control Lets Credential Spray Become Full Akira Ransomware IntrusionRansomware Affiliate Poses as Recovery Firm to Re-Extort Victims After Data TheftRansomware attack disrupts Japan's IDCF Cloud used by govt clientsMantax OTAX Combines Android Ransomware and Spyware for Double-Extortion AttacksSuspected Chinese Hackers Turn VMware vCenter RCE Into Root Backdoors and ESXi RansomwareMedusa ransomware tallies hundreds of new victims, says updated advisory on groups tacticsBeyond the ransomware: Tracking Storm-2570’s consistent tradecraft across deploymentsRansomware victims: SEVEN SEAS GROUP, Forma Therapeutics, PaessolucoesDeadLock ransomware uses blockchain to resist infrastructure takedownKeio Corporation ransomware attack on Tokyo rail group serverGroup Policy hijacked: PAYLOAD ransomware weaponizes Active Directory GPOPanzer Ransomware Emerges With Windows, Linux, ESXi and FreeBSD Attack SupportLockBit 5 ransomware claim on U.S. BankJapan's Keio confirms ransomware attack disrupted business systemsWarlock ransomware breach SharePoint in water, telecom operator attacksATF Investigating Major Cyber Incident After Ransomware Group ClaimJadePuffer Agentic Ransomware — First Documented AI-Agent-Driven Extortion OperationTITAN RaaS Uses AI for Data Classification, Regulatory Analysis and Automated Ransom CalculationSality Botnet Infrastructure Dismantled in Joint Global Takedown
|
7/39
|
| T1489 |
Service Stop |
Impact |
DeadLock ransomware uses blockchain to resist infrastructure takedownUS Water-Sector Campaign Now Confirmed in 12 States — Georgia's Clayton County Confirms Disruption as FBI Details PLC Tampering
|
1/2
|
| T1490 |
Inhibit System Recovery |
Impact |
KillSec ransomware group disrupted in international law enforcement operationJoint US–South Korea Advisory: Gunra Ransomware Exploits Fortinet VPNs to Bypass MFA and Steal Cloud DataRansomware has a new target. Is your backup ready?DeadLock Ransomware: Rust Encryptor With Decentralized Recovery InfrastructureRansomware hits Osaka Metropolitan University: virtualization platform breached, about 500 servers downRansomware Affiliate Poses as Recovery Firm to Re-Extort Victims After Data TheftDeadLock ransomware uses blockchain to resist infrastructure takedownPanzer Ransomware Emerges With Windows, Linux, ESXi and FreeBSD Attack SupportLockBit 5 ransomware claim on U.S. BankHackers Abuse Windows Shadow Copies to Steal Active Directory Credentials and Kill Ransomware RecoveryATF Investigating Major Cyber Incident After Ransomware Group Claim
|
5/11
|
| T1491 |
Defacement |
Impact |
ShinyHunters hacked Clop leak site using Grav CMS path traversal flawFBI arrests key suspect in major hack of agents' dataShinyHunters allegedly breached the FBI to steal personal data on agency employees, forcing the bureau's job portal offline. The group claimAlleged ShinyHunters Leader Arrested in JordanHackers have apparently breached FBI systems and have extracted personal data “on all FBI employees and applicants.” The data reportedly incShinyHunters claims breach of FBI jobs site exposing personnel dataDutch Police Arrest ‘Reformed’ Hacker in Shiny Hunters Investigation
|
2/7
|
| T1496 |
Resource Hijacking |
Impact |
Midnight Mimosa: ad-fraud malware preinstalled in cheap Android phone firmwarex47.c Windows Botnet Weaponizes xAI Grok, AI API DrainingHackers Target LiteLLM, RAGFlow and Kestra AI Infrastructure to Steal API Keys and Mine CryptoRedis cryptomining botnet compromised 3,562 servers via rogue replicationPoeLLM malware infects exposed AI servers in cryptomining attacksCVE-2026-105134: Ahsay AhsayCBS critical OS command injectionMidnight Mimosa: Preinstalled Android malware in MediaTek firmware
|
5/7
|
| T1498 |
Network Denial of Service |
Impact |
Ubuntu infrastructure under prolonged DDoS attackCling botnet exploits STUN protocol for IoT command and controlDysphoria Hijacks Routers, Gateways and IP Cameras to Build Massive IoT BotnetFBI and RCMP Seize NightmareStresser DDoS-for-Hire DomainsKimwolf botnet rebuilt to survive takedowns, researchers say
|
1/5
|
| T1499 |
Endpoint Denial of Service |
Impact |
Cisco Patches Firewall Zero-Day Exploited for DoS AttacksCisco Warns of High-Severity ClamAV Vulnerabilities With Public PoCCiscoClamAV Vulnerabilities Let Remote Attackers Crash Antivirus Scanning With Crafted FilesCVE-2026-76485: Critical Cisco NX-OS NGOAM RCE/DoS (CVSS 9.8)Apache HTTP Server Flaws Enable Remote Code Execution and Denial-of-Service AttacksFBI and RCMP Seize NightmareStresser DDoS-for-Hire Domains
|
gap
|
| T1529 |
System Shutdown/Reboot |
Impact |
Iran-Linked Hackers Shut Down UK Power Plant for Four Days in Cyberattack
|
gap
|
| T1531 |
Account Access Removal |
Impact |
FortiBleed Attackers Locking Victims Out of Fortinet Devices
|
gap
|
| T1565 |
Data Manipulation |
Impact |
A stolen API key turned Brevo's CDN into a supply-chain weapon - fake CAPTCHAs, silent WordPress backdoorsAgentCorruption: patched AWS Bedrock AgentCore prompt-injection flawRansom Busters: Ransomware Affiliate Poses as Recovery Firm to Re-Extort VictimsExim Mail Server 4.100.1 Patches Four Vulnerabilities Including SMTP Smuggling
|
1/4
|
| T1657 |
Financial Theft |
Impact |
Infostealers Harvest Replayable AI Session TokensPhantom Deal Fraud Campaign Impersonates Executives with Fake NDAs to Steal Corporate PaymentsFormer US soldier sentenced for telecom hacking and extortion spreeFive Venezuelans Plead Guilty to ATM Jackpotting Attacks in USBitget Confirms $351.6 Million Hot Wallet Hack, Suspends WithdrawalsHackers Create Hidden Microsoft 365 Inbox Rules to Conceal Vendor Payment FraudEvilTokens PhaaS disrupted after compromising 12,000 Microsoft accountsTech contractor for Brightly Software sentenced to 2 years in prison for insider attackRansom Busters: Ransomware Affiliate Poses as Recovery Firm to Re-Extort VictimsDutch Police Arrest ‘Reformed’ Hacker in Shiny Hunters InvestigationCrypto Scammers Hijack Microsoft’s Official X AccountBalonx PhaaS Steals Bank OTPs in Real Time While AI Calls and Android RAT Target VictimsOperation Jackal IV: 58 Arrests in Global Cybercrime CrackdownTren de Aragua ATM jackpotting scheme used malware and crypto laundering, draws OFAC sanctions
|
2/14
|
| T1003 |
OS Credential Dumping |
Credential Access |
IE: HSE fined €645,000 over data breach affecting Westmeath hospitalPrettyPrague PoC Claims Avast Antivirus Zero-Day for SYSTEM Privilege EscalationHackers Exploit PaperCut NG/MF Flaws to Steal Credentials and Deploy MeterpreterGryxa Toolkit Uses AI-Built Persistence to Fight Back Against Security TeamsCISA AA26-281A advisory: Chinese government-linked actors with FBI and international partnersAI-powered attack exploited PaperCut flaws to hack 395 organizationsCisco FMC Exploits Fuel Ransomware, APT AttacksActive exploitation of Cisco Secure Firewall Management Center vulnerabilitiesMetabase Zero-Day Attack Lets Hackers Gain Admin Access and Steal Database CredentialsHEIF Heist Image Processing Flaws Enable RCE Across Meta, Slack, GitHub EnterpriseClosedQuorum Windows malware uses commercial AI models for autonomous tactical C2 decisionsCISA Warns of 17 Active Directory Attack Techniques Used for Privilege Escalation and PersistenceFake LastPass Authenticator GitHub repos push new Rapuncel infostealer with EDR-killing kernel driverMedusa ransomware tallies hundreds of new victims, says updated advisory on groups tacticsCisco ISE zero-days CVE-2026-76460 and CVE-2026-20192 enable unauthenticated root accessNew TONTOU CPU Attack Bypasses Spectre v2 Mitigations, Leaks Linux Password HashesFortiGate CVE-2025-25249 now delivering PivotC2 RATHackers Abuse Windows Shadow Copies to Steal Active Directory Credentials and Kill Ransomware RecoveryAI Agents Breach Enterprise Network in Under 10 Hours and Steal Root Credentialswp2shell — CISA Adds to KEV; Wiz Details Webshell Installation at Scale
|
8/20
|
| T1021 |
Remote Services |
Lateral Movement |
Hacktron AI researchers used Claude to exploit a HEIF image-processing flaw in Discourse, pivoting from OpenAI community forum to employee account and GitHub resourcesAurora Ransomware Affiliate Uses Cursor AI to Plan Attacks Against 20+ OrganizationsCERT Polska Confirms Siemens PLC Sabotage at Polish CHP Plant via Private APNImpersonating IT support: how threat actors turn a remote session into enterprise-wide accessSloppyRAT Malware Uses ClickFix and Blockchain C2 to Help Ransomware HackersAttack Cases in Korea Involving the Installation of Radmin and UltraVNCHackers Turn HiveMQ and Element Messenger Into Control Channels for Windows BackdoorsCISA Urges Organizations to Patch Exposed VPNs and Segment Networks Against Gunra RansomwareAI-Autonomous Campaign Compromises 85 Government Accounts, Exfiltrates 2,500+ RecordsActive exploitation of Cisco Secure Firewall Management Center vulnerabilitiesTP-Link Archer AX55 Flaws Enable Remote Code Execution and Admin Password TheftCISA Warns of 17 Active Directory Attack Techniques Used for Privilege Escalation and PersistenceFBI Disables China-Linked Hacking Tools (QTFY) Used Against US AgenciesN-able N-central Critical Auth Bypass (CVE-2026-18556/18577) Actively Exploited — First Fix Was Incomplete; MSPs Urged to Hotfix NowMedusa ransomware tallies hundreds of new victims, says updated advisory on groups tacticsIran-Linked Hackers Shut Down UK Power Plant for Four Days in CyberattackAI-automated exploitation of PaperCut NG/MF vulnerabilities (CVE-2026-81578, CVE-2026-82078)ShinyHunters claims FBI breach via unpatched PeopleSoft RCE, lateral movement to AWS GovCloudGemini Hacked Three Companies in First Known Breakout by Google's AICISA Red Team Compromises Active Directory and Critical Business Systems
|
4/20
|
| T1024 |
Custom Cryptographic Protocol |
Command and Control |
Warden Infostealer Targets AI Agents and Developer Keys
|
gap
|
| T1040 |
Network Sniffing |
Credential Access |
Alert: FortiBleed remains active campaign, can lock out users or lead to ransomware attacks
|
1/1
|
| T1068 |
Exploitation for Privilege Escalation |
Privilege Escalation |
Windows Defender ShieldCrash 0-Day Lets Attackers Read Arbitrary Files as SYSTEMPrettyPrague PoC Claims Avast Antivirus Zero-Day for SYSTEM Privilege EscalationAndroid Zero-Day CVE-2025-48595 Actively ExploitedVulnerabilities Impacting MikroTik RouterOS - CVE-2026-67276, CVE-2026-67277 and CVE-2026-86060CISA adds three Linux kernel vulnerabilities to KEV catalog with confirmed active exploitationDocker Sandboxes TOCTOU vulnerabilities allow guest-to-host escape12-Year-Old PostgreSQL Flaw Lets Backup Accounts Execute Code and Take Over DatabasesMicrosoft Defender Zero-Days (CVE-2026-41091, CVE-2026-45498) — Actively Exploited, CISA Adds to KEVWindows Attack Hijacks Trusted Security Apps to Abuse Powerful Kernel DriversCrowdStrike 'FalconFlank' zero-day grants SYSTEM privilegesCritical Rancher Flaw Lets Authenticated Users Take Over All Managed Kubernetes ClustersAutonomous AI Agent Breached Organization Using Two Zammad Zero-DaysAndroid’s October 2026 Updates Patch 25 VulnerabilitiesPlug & Pwn Attack Abuses Windows Plug and Play to Gain SYSTEM PrivilegesBeyondTrust Endpoint Privilege Management Flaws Enable Local Privilege EscalationSonicWall SMA1000 — Two Zero-Day Flaws Under Active Exploitation, CVSS 10.0, Added to CISA KEVChina-Linked Hackers Chain Chrome Zero-Day With Windows Kernel FlawCISA alerts of active exploitation of three Linux kernel flawsCISA Adds 4 Known Exploited Vulnerabilities to Catalog (September 8, 2026)Multiple cPanel & WHM Vulnerabilities Enable Root Code Execution and Admin Session HijackingCritical Orkes Conductor Vulnerability Exploited in AttacksChinese threat actor UTA0565 chained three zero-days — Chrome (CVE-2026-85046, CVE-2026-87491) and Windows ALPC (CVE-2026-85880) — via fakSteam Client Service BrokenPipe local privilege escalation to SYSTEMCVE-2026-108707: WuKong_HRM critical auth bypassDell System Update flaw lets hackers gain root privilegesCISA adds 5 actively exploited flaws to KEV catalog: JFrog Artifactory, ConnectWise ScreenConnect, MikroTik RouterOSCritical KVM guest escape CVE-2026-89775 enables privilege escalation to host root on LinuxUnitree G1 Humanoid Robot BLE Vulnerabilities Enable Unauthenticated Root RCEParallels Desktop Flaw Lets Unprivileged Mac Users Gain Root AccessCVE-2026-76460 Cisco ISE unauth root RCE exploitedCISA Urges Immediate Patching of Exploited SharePoint VulnerabilitiesAcronis cPanel Backup Plugin Actively Exploited for Root Privilege EscalationVulnerability Attack Case: Installation of a Web Shell and Execution of a Scanner by Exploiting a Telerik UI VulnerabilityHardBreacher Exploit Targets Kaspersky Endpoint Security Zero-Day for Windows 11 Privilege EscalationMicrosoft Plugs Nearly 1,000 Security Holes — 999 CVEs including two exploited zero-daysMicrosoft Exchange Server security updates close elevation of privilege flaw CVE-2026-96940Critical Node.js Sandbox Flaw Exposes AI Agents to Host Code ExecutionFalconFlank PoC Claims CrowdStrike Falcon Zero-Day Enables Privilege Escalation on WindowsMicrosoft Plugs Nearly 400 Security HolesMicrosoft Record Patch Tuesday: 206 Vulnerabilities Fixed, Including 3 Zero-Days (GreenPlasma, YellowKey, HTTP/2 Bomb)Hackers exploit critical Adobe Commerce flaw to hijack customer accountsZyxel GS1900 switch buffer overflow (CVE-2026-7273) added to CISA KEVBlueMoon Exploit Kit Targets Chrome and WindowsCritical Copeland XWEB Pro Flaw Lets Remote Attackers Take Control of Refrigeration SystemsCISA: Three Linux Kernel Flaws Actively Exploited in the WildSAP warns of maximum severity OVERPASS kernel vulnerability (CVE-2026-44756)Microsoft July 2026 Patch Tuesday — Record 622 CVEs, Two Exploited Zero-Days, Rapid7 SharePoint Auth BypassCVE-2026-85889 - Critical flaw in Azure AI Foundry: missing authentication for a critical function (CVSS 10) allows remote privilege escalationCISA flags actively exploited Linux kernel bugs: kTLS leak, ebtables privesc, AF_ALG corruptionRed Hat ACM Flaw Lets Namespace Editors Escalate to Full Kubernetes Cluster-AdminMicrosoft Defender 'ShieldBreak' zero-day grants SYSTEM privilegesApple Patches Code Execution and Kernel Memory Flaws in iOS 26.6.1 and macOS 26.6.2Google fixes actively exploited Android zero-day on Pixel devicesCritical cPanel Vulnerability Allows Attackers to Gain Full Root Control of ServersZammad Critical Vulnerabilities Enable Remote Code Execution and Root Privilege EscalationThree HP Easy Start Flaws Let Attackers Gain Root Privileges on macOSCVE-2026-63520: Microsoft SharePoint Remote Code Execution (FIXED)CVE-2026-84076 IBM Guardium Data Protection 12.2 improper access control lets a remote authenticated attacker bypass security restrictions.Windows AFD.sys Zero-Day Exploited by Lazarus Hackers to Gain SYSTEM AccessCVE-2026-43783 macOS DesktopServicesHelper critical vulnerabilityWindows NTFS Heap Buffer Overflow CVE-2025-24993 Actively ExploitedFour Linux kernel privesc flaws (DirtyAH6, TUNderflow, PPPoEject, DiagSpill) with public PoCCISA Red Team Compromises Active Directory and Critical Business SystemsMicrosoft's September 2026 Patch Tuesday fixes two zero-day flaws, CVE-2026-81963 and CVE-2026-85880, both exploited in the wildLinux kernel ZcopyReaper vulnerability CVE-2026-43502 - RDS zerocopy local privilege escalation
|
12/65
|
| T1071 |
Application Layer Protocol |
Command and Control |
P7 DarkSword iOS Exploit Kit Adds Crypto Wallet Theft and Remote CommandsAurora Ransomware Affiliate Uses Cursor AI to Plan Attacks Against 20+ OrganizationsTIKTOUK WordPress Toolkit Could Enable AWS, SMTP and API Credential Theft AttacksCisco Talos details Antino backdoor used by China-nexus actor against Taiwan government orgsNeedyMantis: Unpacking a post-compromise malware family used in targeted operationsSloppyRAT Malware Uses ClickFix and Blockchain C2 to Help Ransomware HackersMidnight Mimosa: ad-fraud malware preinstalled in cheap Android phone firmware700 OpenAI Agents Coordinate Attack on Hugging Face and Gain Remote Code ExecutionJWR Phishing-as-a-Service Kit Uses WebSockets and AES to Run Real-Time Banking FraudIranian state-linked CHOSEN BRICK malware targets dissidents worldwideMantax Otax Android malware combines ransomware, spyware and remote control (verified via Zimperium zLabs)SLEEPWALKER Backdoor Uses SMB, ICMP, DNS and VMware VMCI for Covert CommunicationsMalicious Chrome and Edge Extensions Hijack Crypto Wallets and Steal Login CredentialsCling botnet exploits STUN protocol for IoT command and controlLinux Backdoor Abuses STUN Protocol, Exploits Dozens of FlawsPowerShell Malware Abuses Registry and DNS TXT Records to Deploy XMRig Crypto MinerNew malware in movie torrents uses Solana blockchain for C2 controlRemControl Android Banking Trojan Steals PINs Using AI-Built Phishing OverlaysRatHat Android Banking Trojan Uses AI to Navigate Banking AppsBigBear 2.0 PhaaS bypasses MFA in global M365 campaign using Evilginx2DPRK-Linked Hackers Add HashHiding to Blockchain C2 Network for Takedown-Resistant MalwareRansomware Affiliate Poses as Recovery Firm to Re-Extort Victims After Data TheftDPRK-Linked Actors Deploy Novel Linux Espionage Toolkit Against South Korean HAProxy ServersMidnight Mimosa: Preinstalled Android malware in MediaTek firmwareBambooToken Malware Uses MQTT to Control Windows and Linux SystemsAPT36-Linked HACKERAI Implant Shows Signs of LLM-Assisted Malware DevelopmentCritical Microsoft UFO MCP Flaw Lets Unauthenticated Attackers Remotely Control Android DevicesFortiGate CVE-2025-25249 now delivering PivotC2 RATChinese Fire Ant APT Plants GRE Tunnels on Cisco IOS XR Routers for Persistent EspionageKimwolf botnet rebuilt to survive takedowns, researchers sayNorth Korea-linked malware abuses Ethereum transactions as covert C2 channelGlobal Phishing Campaign Abuses Google Infrastructure to Evade Security and Steal CredentialsGentlemen Ransomware Affiliate Uses MCP as C2 Channel in Live CyberattacksAeternum Botnet Runs Entire C2 Stack on the Polygon BlockchainSality Botnet Infrastructure Dismantled in Joint Global TakedownChinese AI firms extract billions of tokens from U.S. AI models (AA26-251A)
|
16/36
|
| T1081 |
Credentials in Files |
Credential Access |
Clop created custom web shell for Windchill data theft attacks
|
gap
|
| T1090 |
Proxy |
Command and Control |
Blinder Tunnel Campaign Targets Iraqi InfrastructureMidnight Mimosa: ad-fraud malware preinstalled in cheap Android phone firmwareAttack Cases in Korea Involving the Installation of Radmin and UltraVNCFake Chrome VPN Extensions Hijack Browser Traffic Through Russian Proxy NetworkMalicious Exodus Installer Steals Browser Credentials and Turns PCs Into SOCKS ProxiesKillSec ransomware group disrupted in international law enforcement operationGPT-6 Astra Launches Unsanctioned Supply-Chain Attacks in Cyber SimulationsPeer2Profit AstroProxy Residential Proxy Network Exposes Internal Network Resourcesx47.c Windows Botnet Weaponizes xAI Grok, AI API DrainingLinux Backdoor Abuses STUN Protocol, Exploits Dozens of FlawsDysphoria Hijacks Routers, Gateways and IP Cameras to Build Massive IoT BotnetBigBear 2.0 PhaaS bypasses MFA in global M365 campaign using Evilginx2FBI Disables China-Linked Hacking Tools (QTFY) Used Against US AgenciesVulnerabilities in Kaon AR2140 routersChinese Fire Ant APT Plants GRE Tunnels on Cisco IOS XR Routers for Persistent EspionageKimwolf botnet rebuilt to survive takedowns, researchers sayChinese AI firms extract billions of tokens from U.S. AI models (AA26-251A)
|
8/17
|
| T1091 |
Replication Through Removable Media |
Lateral Movement |
WeChat Zero-Click Worm Took Over Accounts on iPhone and Android via Incoming Calls
|
gap
|
| T1095 |
Non-Application Layer Protocol |
Command and Control |
SLEEPWALKER Backdoor Uses SMB, ICMP, DNS and VMware VMCI for Covert CommunicationsBambooToken Malware Uses MQTT to Control Windows and Linux Systems
|
gap
|
| T1102 |
Web Service |
Command and Control |
Glassworm Botnet Disrupted — CrowdStrike, Google, and Shadowserver Simultaneously Takedown 4-Layer C2 InfrastructureClickFix Campaign Abuses Google Sheets C2 to Inject Malicious JavaScript Into ChromeC2Looper v2 Uses GitHub Repositories as Full Command-and-Control InfrastructureHackers Turn HiveMQ and Element Messenger Into Control Channels for Windows BackdoorsAI-assisted malware rewrites itself via Gemini and Hugging Face APIs to evade detectionBlueDelta (APT28) HOOKEDGE Campaign Targets European Government and Diplomatic OrganizationsNVIDIA NemoClaw Vulnerability Lets Attackers Hijack AI Agents via DNS RebindingMacSync malware uses public iCloud calendars to deliver new payloadsChina-Nexus SilkParasite APT Deploys Five New RATs Against Central Asian GovernmentsShinyHunters allegedly breached the FBI to steal personal data on agency employees, forcing the bureau's job portal offline. The group claimOpenAI Agent Swarm Escaped Sandboxes and Left 80,000 Attack Payloads BehindOperation ASTERIX Uses Vishing and Fake Crypto Wallet Apps to Steal Seed PhrasesVulnerability Attack Case: Installation of a Web Shell and Execution of a Scanner by Exploiting a Telerik UI VulnerabilityHackers Turn an Open-Source AI Agent Into a Tool for Controlling Compromised Docker ServersPoeLLM malware infects exposed AI servers in cryptomining attacksRansomware Affiliate Poses as Recovery Firm to Re-Extort Victims After Data TheftGraphalgo malware hits Terraform providers and Go modules in supply chain attackindexed-btree npm Package Executes Malware at Runtime via BTree.set()Carbonato malware uses AI agents to hijack exposed Docker hostsKimsuky Moves AI-Assisted Development Into Local Environment With Operation GitPowerGlobal Phishing Campaign Abuses Google Infrastructure to Evade Security and Steal Credentials
|
9/21
|
| T1105 |
Ingress Tool Transfer |
Command and Control |
Blinder Tunnel Campaign Targets Iraqi InfrastructureAttackers abusing trusted AI platforms to make malicious downloads look legitimateStyleSmuggler: a Magento zero-day, CVE-2026-75650, delivering a Rust backdoor and a PHP web shellNew PamStealer macOS variant adds live C2 payload decryption and multi-layer persistenceRussian APT Star Blizzard Uses ‘RedFlick’ Infection Chain in Recent AttacksC2Looper v2 Uses GitHub Repositories as Full Command-and-Control InfrastructureMidnight Mimosa: ad-fraud malware preinstalled in cheap Android phone firmwareThreat actor compiles cryptominer on endpoint via Samsung MagicINFO flaw700 OpenAI Agents Coordinate Attack on Hugging Face and Gain Remote Code ExecutionBlueDelta (APT28) HOOKEDGE Campaign Targets European Government and Diplomatic OrganizationsChina-Nexus SilkParasite APT Deploys Five New RATs Against Central Asian GovernmentsHackers Exploit Critical VMware vCenter Flaw to Deploy Reverse SSH Across 47 CountriesScreenConnect critical CVE-2026-84869 allows file transfer and execution via active sessions2CLoader: A New Malware Loader Delivering Vidar and RemusEvolution of MATCHBOIL Downloader by UAC-0099DPRK-Linked Hackers Add HashHiding to Blockchain C2 Network for Takedown-Resistant MalwareOpenSUpdater Malware Hides Reflective Loader Inside Recompiled 7-Zip SFX to Evade DetectionAbyssos RAT Hijacks Browser Sessions, Steals Credentials and Gives Attackers Remote VNC AccessASEC July 2026 APT Attack Report (South Korea)Critical VMware vCenter Directory Traversal Flaw Used in Global AttacksDark Caracal Deploys New GoCaracal Malware With Ethereum-Based C2 Across Latin AmericaAeternum Botnet Hides C2 Infrastructure in Polygon Smart Contracts to Evade TakedownsSuspected TraderTraitor Group Uses Trojanized Terraform Provider to Deliver Cross-Platform MalwareChinese-Speaking Hackers Use Claude, Qwen and DeepSeek AI Agents to Attack Government SystemsResearchers Execute Code Inside Fortune 500 Companies via AI Agent llms.txt FilesHackers Use Fake Cloudflare CAPTCHA to Deploy TerminalFix Reverse TunnelClickFix Campaigns Targeting End Users via Legitimate ServicesMuddyWater-Linked Dindoor Backdoor Abuses Deno Runtime for Evasion
|
16/28
|
| T1110 |
Brute Force |
Credential Access |
Alert: FortiBleed remains active campaign, can lock out users or lead to ransomware attacksDenmark Confirms Major Security Incident Exposing 8.8 Million Citizen RecordsCISA AA26-281A advisory: Chinese government-linked actors with FBI and international partnersFormer US soldier sentenced for telecom hacking and extortion spreeHCL BigFix Service Management CVSS 9.8 SQLi and cross-tenant data exposurecPanel/WHM Critical Authentication Bypass CVE-2026-41940Florida confirms DMV database breached via stolen police accountDOJ, FBI seize Flax Typhoon-linked hacking tools Microscan, FishHubHackers Breach Brazilian Financial Firms and Execute Hundreds of Fraudulent TransactionsAI-Autonomous Campaign Compromises 85 Government Accounts, Exfiltrates 2,500+ RecordsFortiBleed Attackers Locking Victims Out of Fortinet DevicesAI Agents Automate Credential Theft Campaigns in Under 6 HoursCISA Warns of 17 Active Directory Attack Techniques Used for Privilege Escalation and PersistenceAutomated AI agent used to breach cybersecurity nonprofit DIVDOne Missing MFA Control Lets Credential Spray Become Full Akira Ransomware IntrusionHackers Launch Password Spraying Attacks Against AWS Root Accounts at 150+ OrganizationsHackers compromise 14,500 Dahua web cameras in 35-day campaignDomino’s customers targeted in credential stuffing attacksTeamFiltration Hackers Target 5,700 Microsoft 365 Accounts to Exploit Forgotten Service Accounts
|
4/19
|
| T1111 |
Multi-Factor Authentication Interception |
Credential Access |
RatHat Android Banking Trojan Uses AI to Navigate Banking AppsAI-Powered AnonyMousKIT PhaaS Steals Apple IDs and 2FA Codes to Unlock Stolen iPhonesBigBear Microsoft 365 phishing service bypassed MFA at 258 organizations
|
1/3
|
| T1112 |
Modify Registry |
Defense Impairment |
PowerShell Malware Abuses Registry and DNS TXT Records to Deploy XMRig Crypto MinerMicrosoft-Signed Defender Driver Weaponized to Disable EDR and Antivirus
|
2/2
|
| T1145 |
Private Keys |
Credential Access |
ShinyHunters hacked Clop leak site using Grav CMS path traversal flaw
|
gap
|
| T1187 |
Forced Authentication |
Credential Access |
CVE-2026-95503 Red Hat Keycloak Kerberos auth flaw
|
gap
|
| T1189 |
Drive-by Compromise |
Initial Access |
P7 DarkSword iOS Exploit Kit Adds Crypto Wallet Theft and Remote CommandsAdobe Acrobat and Reader Security Alert (APSB26-141)Magecart Hackers Abuse Ethereum Smart Contracts to Steal Card Data From 40+ Online StoresProofpoint identified BlueMoon, an exploit kit chaining two Chrome/V8 flaws with a Windows privilege escalationCloud-hosted tech-support scam kit delivered via Google Ads evades detectionCISA AA26-281A advisory: Chinese government-linked actors with FBI and international partnersPackagist Themes Exploit iPhone Visitors to Steal Messages, Passwords and Crypto Wallet SeedsFortinet patches critical authentication bypass and proxy flaws across product lineChinese threat actor UTA0565 chained three zero-days — Chrome (CVE-2026-85046, CVE-2026-87491) and Windows ALPC (CVE-2026-85880) — via fakCERT-UA: 100+ websites compromised to spread Lunex Stealer via fake Cloudflare checks (UAC-0277)Chrome 152 Patches Over 300 VulnerabilitiesGoogle Chrome V8 Flaw Exploited in the Wild to Execute Arbitrary CodePlaceholder domain used in dev docs now serves ClickFix attacksGoogle Chrome 151 Patches Critical Use-After-Free and High-Severity VulnerabilitiesGoogle Chrome 151 Update Fixes 5 High-Severity Use-After-Free VulnerabilitiesWordPress 7.1.1 patches stored XSS (CVE-2026-93485) affecting all versions since 4.7Telegram Desktop stored XSS in HTML export exfiltrates chat history for 2+ yearsRatHat Android Banking Trojan Uses AI to Navigate Banking AppsRoundcube Fixes 12 Security Flaws Including Zero-Click XSS and SSRF BypassBlueMoon Exploit Kit Targets Chrome and WindowsCapacitor Vulnerability CVE-2026-103922WeChat Zero-Click Worm Took Over Accounts on iPhone and Android via Incoming Calls
|
3/22
|
| T1190 |
Exploit Public-Facing Application |
Initial Access |
91 Spring CVEs Impact Over 209,000 Software Components Across the Supply ChainFBI Warns Chinese Hackers Use Automated Tools and Botnets to Steal Sensitive DataCVE-2026-90606 critical buffer overflow in Totolink A3002MU routerCVE-2026-82107 - Critical (9.6) IBM DataStage on Cloud Pak for Data 5.4.0.0 authentication bypassHacktron AI researchers used Claude to exploit a HEIF image-processing flaw in Discourse, pivoting from OpenAI community forum to employee account and GitHub resourcesAI-Built Exploit and Sign-In Flaw Opened Path to Internal OpenAI CodeGitLab critical flaw CVE-2026-85706 drawing internet-wide probesGitLab Critical Path Traversal Vulnerability CVE-2026-85706Critical Ruby on Rails Vulnerability in Attackers' CrosshairsAnyPwn: AnyDesk Pre-auth Heap Buffer Overflow RCE PoC PublishedMathspace data breach exposes 1M users via Metabase flawHackers Actively Exploiting MikroTik RouterOS MikroTrick Flaws to Take Full Control of RoutersAlert: FortiBleed remains active campaign, can lock out users or lead to ransomware attacksWatchGuard patches critical Fireware OS RCE CVE-2026-86131Chef Automate Critical Vulnerability CVE-2026-80462 (CVSS 10.0)StyleSmuggler: a Magento zero-day, CVE-2026-75650, delivering a Rust backdoor and a PHP web shellShinyHunters hacked Clop leak site using Grav CMS path traversal flawVercel fixed a critical Next.js RCE vulnerability in image generation. Update to patch this Next.js RCE vulnerability and secure your apps.ZITADEL Cluster: 7 CVEs Including Critical Passkey ForgeryFulcrumSec claims Manchester Airports hack, theft of 86 GB of dataCisco patched 18 Secure Firewall vulnerabilities in FMC, ASA, and FTDVulnerabilities Impacting MikroTik RouterOS - CVE-2026-67276, CVE-2026-67277 and CVE-2026-86060D-Link DIR-X1860Z Flaws Enable Unauthenticated Admin Password Reset and Wi-Fi Credential TheftD-Link DIR-822A critical vulnerabilities with public PoC exploit codeWarlock ransomware exploits SharePoint vulnerabilities targeting critical infrastructureCISA adds three Linux kernel vulnerabilities to KEV catalog with confirmed active exploitationPaperCut Flaws Exploited in AI-Powered AttacksHow I Could’ve Accessed 17 Trillion Microsoft RecordsCritical WordPress Pods Flaw (CVE-2026-19598) Lets Unauthenticated Attackers Gain Admin AccessClop created custom web shell for Windchill data theft attacksHackers Exploit PaperCut NG/MF Flaws to Steal Credentials and Deploy MeterpreterINJ3CTOR3's FreePBX JOMANGY Campaign — Six-Layer Self-Healing Persistence on VoIP InfrastructureShinyHunters hacker “Rey,” allegedly involved in FBI data theft, detained in JordanCisco Security Advisory AV26-921: Critical SQL Injection in Secure Email Gateway (CVE-2026-76461)Metasploit Adds Exploit for PaperCut MF/NG Zero-Day RCE VulnerabilitiesFortinet warns of critical FortiMail flaw exploited in zero-day attacksHackers Exploiting Unpatched GeoServer Zero-Day12-Year-Old PostgreSQL Flaw Lets Backup Accounts Execute Code and Take Over DatabasesFBI Hackers Say They Won’t Publish Massive Trove of FBI Employee DataIvanti September 2026 security advisory: EPMM, ITSM, Sentry vulnerabilitiesGitLab Vulnerability Exploited One Day After DisclosureSonicWall Patches Critical Vulnerabilities in Discontinued GMS PlatformCVE-2026-90607 Critical (9.9) buffer overflow in Totolink A3002MU formNewScheduleThreat actor compiles cryptominer on endpoint via Samsung MagicINFO flawPentagon Data Breach Exposes SSNs and Military Records of Over 3 Million PeopleCVE-2026-78159 Critical RCE in The Events Calendar WordPress PluginTP-Link Tapo C200/C120 authentication bypass via CVE-2026-15315 and CVE-2026-15316Dutch NCSC warns critical Check Point VPN RCE exploitation is imminentWater Campaign Expands: New Jersey and Alabama Utilities Join the Target ListAdobe Campaign Classic CVSS 10.0 RCE (CVE-2026-48449) — Patched in APSB26-114Check Point VPN Pre-Authentication RCE (CVE-2026-85102, CVE-2026-85103)Cisco Patches Critical Nexus 9000 Switch Flaws, Warns of Unpatched Secure Email VulnerabilitiesHackers exploit Tencent app flaw to deploy GrayRabbit malwareRed Heron Hackers Exploit Critical Gitea RCE to Steal Source Code and Deploy Linux MalwareJFrog Artifactory under active attack with CVE chain exploitOpenfind SecuShare Pro CVE-2026-107459 Unauthenticated RCERockwell Automation Patches Critical ICS Vulnerabilities Across Multiple ProductsPakistani IP Chains CVE-2017-9841 and CVE-2021-41773 in Active ExploitationAutonomous AI Agent Breached Organization Using Two Zammad Zero-DaysDell asks admins to patch max severity CSM flaws as soon as possibleNVIDIA NemoClaw Vulnerability Lets Attackers Hijack AI Agents via DNS RebindingCritical HPE Fabric Composer Flaw Lets Unauthenticated Attackers Execute Commands as Privileged UserKillSec ransomware group disrupted in international law enforcement operationCISA Urges Organizations to Patch Exposed VPNs and Segment Networks Against Gunra RansomwareWordPress 7.1.2 patches critical conditional RCE vulnerability CVE-2026-87902ConnectWise Warns of ScreenConnect Guest File Transfer Flaw Affecting Cloud and On-Premise SystemsHCL BigFix Service Management CVSS 9.8 SQLi and cross-tenant data exposureBitget Critical Breach: $387.5M Stolen via Zero-Days in Security AppliancesRuby on Rails Active Storage Flaw (CVE-2026-66066, CVSS 9.5): Unauthenticated Server File Read via Image UploadsTeamCity RCE Exploit Window Closes Today — Rapid7 Details Permissive XStream AllowlistcPanel/WHM Critical Authentication Bypass CVE-2026-41940Hackers Start Exploiting Critical Langflow VulnerabilityWSO2 API Manager CVE-2026-5430 JWT Auth Bypass Under Active ExploitationFortinet patches critical authentication bypass and proxy flaws across product lineFreeRDP 3.31.0 Fixes 22 Security Flaws Including Heap Overflow and Pre-Auth DoS BugsHackers Exploit Critical Cisco Secure Email Gateway Flaw to Execute Commands as RootJoint US–South Korea Advisory: Gunra Ransomware Exploits Fortinet VPNs to Bypass MFA and Steal Cloud DataPlex Patches Multiple Security Vulnerabilities in Media Server and Desktop ClientCISA Confirms WatchGuard Firebox RCE CVE-2025-14733 Is Being Exploited in Ransomware AttacksSonicWall SMA1000 — Two Zero-Day Flaws Under Active Exploitation, CVSS 10.0, Added to CISA KEVCVE-2026-16340 (CRITICAL, CVSS 9.8): IBM DataPower Gateway 10.5.0.0 – 10.5.0.22, 10.6.0.0 – 10.6.0.10, 10.6.1 – 10.6.6, 11.0.0.0 – 11.0.0.2Gitea RCE (CVE-2026-60004) Added to CISA KEVConfigServer Firewall Remote Code Execution CVE-2026-65638Hackers Target Exposed Vite Dev Servers to Steal AWS, Azure SecretsCisco Patches a Dozen Critical VulnerabilitiesFortiSandbox unauthenticated information disclosure via crafted HTTP requestsD-Link DIR-895L Critical RCE CVE-2026-100740GitLab Critical CVE-2026-85706 Under Active Exploitation - Unauthenticated Path TraversalAI-powered attack exploited PaperCut flaws to hack 395 organizationsGitLab AI Gateway CVE-2026-90970 Critical Auth EscapeCisco Patches Firewall Zero-Day Exploited for DoS AttacksSplunk Fixes 17 Vulnerabilities Including Critical MCP Server RCEAccenture Contractor Removed After FBI Data Breach Exposes Thousands of EmployeesCritical Elementor Pro bug exposes WordPress sites to RCE attacksYunoHost SOGo package auth bypass lets attackers log in as any user (CVE-2026-74864)Check Point Discloses Critical VPN RCE VulnerabilitiesWordPress Click2Shell pre-auth RCE chain via CSRF in CoreCling botnet exploits STUN protocol for IoT command and controlCisco FMC Exploits Fuel Ransomware, APT AttacksNASA-AMMOS AIT-Core Critical Auth Bypass (CVE-2026-105105)Critical Spring Security LDAP Vulnerability (CVE-2026-59270) Enables Remote Admin AccessAI-Orchestrated Campaign Against PaperCut NG/MF Exploiting CVE-2026-81578 and CVE-2026-82078Hackers Target LiteLLM, RAGFlow and Kestra AI Infrastructure to Steal API Keys and Mine CryptoMass scanning targets exposed Vite dev servers for cloud secrets via CVE-2026-39364WordPress Click2Shell RCE Chain via Theme Preview InjectionKiteworks critical vulnerability and precautionary shutdown advisoryLinux Backdoor Abuses STUN Protocol, Exploits Dozens of FlawsJFrog Artifactory Vulnerabilities Actively Exploited in the Wild to Gain Administrative ControlHackers Exploit Critical VMware vCenter Flaw to Deploy Reverse SSH Across 47 CountriesServiceNow Patches Critical Flaws Enabling Unauthenticated RCE and SQL InjectionCritical Orkes Conductor Vulnerability Exploited in AttacksCritical JFrog Artifactory Vulnerability Reportedly Exploited in the WildHackers Target Zimbra Servers in Active Exploitation CampaignPublic PoC for AnyPwn AnyDesk RCE vulnerability disclosedFirst-Ever Exploitation of PTC Windchill Vulnerability (CVE-2026-12569) — CISA Adds to KEV, Manufacturing PLM Systems in CrosshairsShinyHunters Claims 284M Patient Records from McKesson BreachCritical Zimbra RCE flaw now actively exploited in attacksCVE-2026-108540: Critical OS command injection in OpenSpug Spug 3.0 to 4.0.1FortiBleed Attackers Locking Victims Out of Fortinet DevicesViewSonic vCast Vulnerabilities Let Attackers Gain Full Device Control Without AuthenticationSangoma Switchvox RCE Flaw Actively Exploited in Wild via Unauthenticated SQL InjectionShinyHunters allegedly breached the FBI to steal personal data on agency employees, forcing the bureau's job portal offline. The group claimRed Hat Kubernetes Flaw Lets Unauthenticated Attackers Access Internal Cluster ServicesMathspace discloses data breach affecting over 1 million peopleCisco BroadWorks Vulnerability Allows Remote Attackers to Access Sensitive FilesApache Tomcat Flaw Lets Attackers Bypass Security Constraints on WebSocket EndpointsCVE-2026-108707: WuKong_HRM critical auth bypassAdobe releases September 2026 patches for multiple products — StyleSmuggler Magento zero-day CVE-2026-75650 patchedCisco Patches Critical Zero-Day in Secure Email Gateway (CVE-2026-76461)Critical Cisco Nexus 9000 Flaw Lets Unauthenticated Attackers Execute Code as RootRedis cryptomining botnet compromised 3,562 servers via rogue replicationActive exploitation of Cisco Secure Firewall Management Center vulnerabilitiesCritical ASUS Control Center CVE-2026-75754 Flaw Allows Unauthenticated Root AccessMetabase Zero-Day Attack Lets Hackers Gain Admin Access and Steal Database CredentialsCritical WatchGuard AP Flaws Let Unauthenticated Attackers Execute Arbitrary CommandsRAVEN Tool Steals Entire Elasticsearch Databases and Rebuilds Deleted BackdoorsCVE-2026-89078 and CVE-2026-93577: GitLab CE/EE contain a double free and an integer overflow that let an authenticated user run arbitrary cDell System Update flaw lets hackers gain root privilegesThe Events Calendar Plugin Critical RCE Vulnerabilities (CVE-2026-78159, CVE-2026-78006)TP-Link Archer AX55 Flaws Enable Remote Code Execution and Admin Password TheftCritical Gogs Flaw Enables Remote Code Execution Through Path TraversalCISA adds 5 actively exploited flaws to KEV catalog: JFrog Artifactory, ConnectWise ScreenConnect, MikroTik RouterOSAI Shopping Assistant Vulnerabilities Enable Remote Code Execution on Retailer's ServersCVE-2026-94084 Critical Use-After-Free in Suricata IDS/IPSSonicWall SMA1000 CVE-2026-102255 pre-auth SSRF (CVSS 10.0)ScreenConnect critical CVE-2026-84869 allows file transfer and execution via active sessionsUnitree G1 Humanoid Robot BLE Vulnerabilities Enable Unauthenticated Root RCEForeign Hackers Target Colorado Water SystemsAnthropic Claude models compromised 3 real organizations during safety evaluationsClaude AI Develops Working RCE Exploit Against WAGO PLC With Researcher AssistanceN-able N-central authentication bypass chain (CVE-2026-86206, CVE-2026-86207)CVE-2026-76460 Cisco ISE unauth root RCE exploitedSolarWinds patches CVE-2026-28326 in Access Rights Manager - unauthenticated RCE via hard-coded keyCVE-2026-90817: Critical RCE in REDCap via survey hash code injectionThousands of Hacked WordPress Sites, One Operation: Unmasking StopAndProtectFrontline Education breach exposes school district employee dataCISA Urges Immediate Patching of Exploited SharePoint VulnerabilitiesServiceNow Fixes Five AI Platform Flaws Enabling SQL Injection, Data Theft and Privilege EscalationSAP Patches Critical Code Injection, Memory Corruption VulnerabilitiesCheck Point login flaw CVE-2026-91843 allows unauthenticated remote accessRansomware hits Osaka Metropolitan University: virtualization platform breached, about 500 servers downHEIF Heist Image Processing Flaws Enable RCE Across Meta, Slack, GitHub EnterpriseConnectWise Patches ScreenConnect Vulnerability Exploited in Worm-Like AttacksVulnerability Attack Case: Installation of a Web Shell and Execution of a Scanner by Exploiting a Telerik UI VulnerabilityMultiple Zscaler Client Connector Flaws Enable Remote Code ExecutionHackers have apparently breached FBI systems and have extracted personal data “on all FBI employees and applicants.” The data reportedly incCVE-2026-95102 Monta WebSocket authentication bypassCISA adds exploited WSO2, Adobe Commerce, SharePoint and RouterOS flaws to KEV catalogCVE-2026-96207: Microsoft Partner Center improper certificate validation (CVSS 10)CVE-2026-93836: WooCommerce WPC Product Bundles stored XSS (CVSS 7.2, unauthenticated)CISA: WatchGuard RCE flaw now exploited in ransomware attacksGoogle PageBreak AI Agent Finds Over 500 XSS Vulnerabilities Across Its Web ApplicationsCritical WatchGuard Agent Flaws Let Unauthenticated Attackers Execute Remote CodeCISA KEV update: five actively exploited Artifactory, ScreenConnect, and RouterOS flaws addedCisco SD-WAN Manager auth bypass CVE-2026-76504 (CVSS 9.8) under exploitation warningCVE-2026-105192: Unpatched critical RCE in LMCache (CVSS 9.8)Issabel PBX remote code execution exploited in active attacksTotolink A3002MU Critical Command Injection CVE-2026-93742ASEC June 2026 APT Attack Report (South Korea)Hackers Turn an Open-Source AI Agent Into a Tool for Controlling Compromised Docker ServersExim Mail Server 4.100.1 Patches Four Vulnerabilities Including SMTP SmugglingWordPress Authenticated RCE via Imagick Ghostscript CVE-2026-65640Helpfeel Confirms Gyazo Breach Exposing 23 Million User RecordsPoeLLM malware infects exposed AI servers in cryptomining attacksSpain Reports First Cyberattack Carried Out with an AI AgentMultiple IBM Verify Access vulnerabilities expose systems to remote attacksHackers Exploit Critical Oracle HTTP Server Flaw to Access and Modify Sensitive DataCloudClassroom-PHP-Project vulnerabilities: CVE-2026-100874 SQL injectionNginx Cache Key Injection Enables Access Control Bypass and Stored XSSCVE-2026-48842 Exploited Roundcube Webmail SQL InjectionCISA Adds Oracle WebLogic CVE-2024-21182 to KEV — Unauthenticated T3/IIOP Exploitation ConfirmedAn exploited VeloCloud vulnerability with a 10.0 CVSS score hits Arista appliancesFBI Disables China-Linked Hacking Tools (QTFY) Used Against US AgenciesCritical VMware vCenter Directory Traversal Flaw Used in Global AttacksSharePoint CVE-2026-65660 misclassified as spoofing actually enables fileless authenticated RCEChinese Hacker Uses DeepSeek AI to Automate Vulnerability ExploitationShinyHunters claims breach of FBI jobs site exposing personnel dataMicrosoft Record Patch Tuesday: 206 Vulnerabilities Fixed, Including 3 Zero-Days (GreenPlasma, YellowKey, HTTP/2 Bomb)GitLab Patches Multiple Security Flaws in CE and EE With 19.2.4 UpdateCritical N-able N-central Flaw Enables Pre-Auth Remote Code ExecutionU.S. Offers $10 Million Reward for Chinese Hacker Behind Alleged COVID-19 Research CyberattacksCritical MikroTik RouterOS Flaw Lets Unauthenticated Attackers Execute Code as RootHackers exploit critical Adobe Commerce flaw to hijack customer accountsN-able N-central Critical Auth Bypass (CVE-2026-18556/18577) Actively Exploited — First Fix Was Incomplete; MSPs Urged to Hotfix NowZyxel GS1900 switch buffer overflow (CVE-2026-7273) added to CISA KEVChinese-Speaking Hackers Exploit Known Flaws to Steal Philippine Nuclear and Naval DataminiOrange WordPress SAML SSO plugin auth bypass enables admin takeoverSuspected Chinese Hackers Turn VMware vCenter RCE Into Root Backdoors and ESXi RansomwareHackers compromise 14,500 Dahua web cameras in 35-day campaignHackers exploit critical JFrog Artifactory flaw to forge admin tokensGoogle Pixel owners urged to patch actively exploited modem flawFortinet FortiWeb and FortiClient Flaws Let Unauthenticated Attackers Gain Access and Execute Arbitrary CodeOracle PeopleSoft CVE-2026-35273 (CVSS 9.8) — Mitigations Released, Mandiant/GTIG Confirm ShinyHunters Targeting 100+ Organizations, Primarily Higher EducationDutch Police Arrest ‘Reformed’ Hacker in Shiny Hunters InvestigationSonicWall NetExtender Flaw Lets Attackers Write Arbitrary Files as RootCVE-2026-105134: Ahsay AhsayCBS critical OS command injectionNearly 22,000 Microsoft Exchange servers vulnerable to hijack attacksDouble Counter just got breachedCVE-2026-76485: Critical Cisco NX-OS NGOAM RCE/DoS (CVSS 9.8)Apache HTTP Server Flaws Enable Remote Code Execution and Denial-of-Service AttacksClaude AI Finds Authentication Bypass Flaws in Multiple SAML ImplementationsZiroom ZHOME A0101 critical command injection CVE-2026-101264 (CVSS 9.4)Hackers Breach South Korean Churches via ERP Web Shell and IDORCisco FMC Zero-Day Exploited by Three Threat Clusters Including Sandworm and QilinCritical WordPress TranslatePress Flaw Lets Attackers Take Over Admin AccountsCritical Copeland XWEB Pro Flaw Lets Remote Attackers Take Control of Refrigeration SystemsAtlassian Bamboo CVE-2026-21589 critical path traversal (CVSS 9.3)Ultra Addons for Contact Form 7 ( https:// radar.offseq.com/threat/cve-20 26-84750-cwe-434-unrestricted-upload-of-file-with-dangerous-type-iChinese-Speaking Hackers Use Claude, Qwen and DeepSeek AI Agents to Attack Government SystemsF5 BIG-IP APM zero-day CVE-2026-94127 actively exploited for unauthenticated RCEEarth Berberoka-Linked Hackers Target Brazil With Linux Malware and SEO PoisoningCISA: Three Linux Kernel Flaws Actively Exploited in the WildResearchers observe first 'near-autonomous' AI attack on government target in TaiwanCISA adds five exploited vulnerabilities to KEV catalogPAN-OS CVE-2026-0257 CISA KEV — GlobalProtect Authentication Bypass Actively Exploited, Rapid7 Confirms Two Attack WavesSAP warns of maximum severity OVERPASS kernel vulnerability (CVE-2026-44756)CVE-2026-19949: SQL Injection in All-in-One WP Migration Plugin Exposes Millions of WordPress Sites to TakeoverAWS AI Agent Vulnerabilities Let Attackers Bypass Authentication and Steal CredentialsAdobe security advisory (AV26-888) — CVE-2026-75650 StyleSmuggler confirmed exploited in the wildNVIDIA patched critical NVIDIA Infrastructure Controller vulnerabilities across Linux builds. Learn how CVE-2026-65113 impacts systems and uCISA Adds VMware vCenter Path Traversal CVE-2026-59310 to KEVUbiquiti Patches Three Max-Severity Flaws in UniFi Protect, Talk, and OSApache Roller pre-auth RCE CVE-2026-82384 (CVSS 9.8)Microsoft July 2026 Patch Tuesday — Record 622 CVEs, Two Exploited Zero-Days, Rapid7 SharePoint Auth BypassPaperCut NG/MF Critical Zero-Day Exploited in the WildCitrix NetScaler zero-days CVE-2026-88771-88778 patched after confirmed exploitationFamousSparrow deploys SparroWocky backdoor targeting Latin American governmentsCyberPanel Pre-Auth RCE Flaws Let Attackers Gain Remote Server AccessProgress Kemp LoadMaster Joins CISA KEV — Unauthenticated Command Injection Under AttackCVE-2026-92931: Progress Sitefinity SSRFCisco ISE zero-days CVE-2026-76460 and CVE-2026-20192 enable unauthenticated root accessCritical Microsoft UFO MCP Flaw Lets Unauthenticated Attackers Remotely Control Android DevicesD-Link DWR-M961 Router Hit by 15 Command Injection and Buffer Overflow VulnerabilitiesRecently patched PaperCut zero-days used in data theft attacksCheck Point warns of exploited Security Gateway VPN RCE (CVE-2026-85102)OpenSSL Security Advisory (AV26-846)Unauthenticated RCE Flaws Could Expose 200,000+ WordPress Sites to TakeoverCVE-2026-85889 - Critical flaw in Azure AI Foundry: missing authentication for a critical function (CVSS 10) allows remote privilege escalationTrueConf security advisory (AV26-835)CISA flags actively exploited Linux kernel bugs: kTLS leak, ebtables privesc, AF_ALG corruptionAI-automated exploitation of PaperCut NG/MF vulnerabilities (CVE-2026-81578, CVE-2026-82078)FortiGate CVE-2025-25249 now delivering PivotC2 RATThree CVEs on MikroTik RouterOS — equipment massively deployed across ISPs, enterprises, and embedded networksOpenAI agent 'infiltrated' Australian government website, PM says https://www.bbc.co.uk/news/articles/c6vgy0333dppo?at_medium=RSS&at_campaigWarlock ransomware breach SharePoint in water, telecom operator attacksShinyHunters claims FBI breach via unpatched PeopleSoft RCE, lateral movement to AWS GovCloudVulnerabilities in Kaon AR2140 routersSplunk patches 17 CVEs including critical CVE-2026-76268 (CVSS 9.1) unauthenticated RCECritical industrial firmware vulnerabilities including CVE-2026-27565 authentication bypassVulnerability in MyPresta Google Merchant Center Feed softwareCritical Red Hat Keycloak Password Reset Flaw Enables Unauthenticated Account TakeoverTP-Link Archer Command Injection Flaws Enable Root-Level Code ExecutionCritical Citrix NetScaler Flaw Allows Attackers to Bypass AuthenticationPaperCut warns of NG, MF flaw exploited in zero-day attacksGoogle fixes actively exploited Android zero-day on Pixel devicesPentagon data breach of military personnel raises national security concernsChinese-speaking APT exploits wp2shell WordPress and ZyXEL switch flaws affecting 996 devices across 49 organizationsLiteLLM Admin API Broken Authorization Exploited in the Wild[Control Systems] Siemens security advisory (AV26-890)Critical cPanel Vulnerability Allows Attackers to Gain Full Root Control of ServersShinyHunters breaches Clop leak site and steals onion service keysAI Agents Breach Enterprise Network in Under 10 Hours and Steal Root Credentialswp2shell — CISA Adds to KEV; Wiz Details Webshell Installation at ScaleZammad Critical Vulnerabilities Enable Remote Code Execution and Root Privilege EscalationUS warns of AI-powered attacks on Siemens PLCs in critical infrastructureMagento and Adobe Commerce StyleSmuggler 0-Day RCE Actively Exploited in AttacksJadePuffer Agentic Ransomware — First Documented AI-Agent-Driven Extortion OperationArtifactory flaws chained in attacks deploying backdoor malwareCVE-2026-63520: Microsoft SharePoint Remote Code Execution (FIXED)CVE-2026-84076 IBM Guardium Data Protection 12.2 improper access control lets a remote authenticated attacker bypass security restrictions.Microsoft Entra ID RCE Flaw Lets Unauthorized Attackers Execute Code RemotelyGemini Hacked Three Companies in First Known Breakout by Google's AIUS Water-Sector Campaign Now Confirmed in 12 States — Georgia's Clayton County Confirms Disruption as FBI Details PLC TamperingCISA orders feds to patch Citrix NetScaler RCE flaw by SaturdayNSA and CISA Warn of Active Cyber Threat Targeting Siemens S7 PLCsCheck Point Management Server CVE-2026-93616 actively exploited for arbitrary script executionCritical RCE Flaw in Windows IKE Extension Now Actively ExploitedBimbo Bakeries USA SSN Exposure in Oracle E-Business Suite Zero-Day AttackCVE-2026-61500 Rejetto HFS critical session-key flawCISA Urges Immediate Patching of Exploited Progress LoadMaster VulnerabilityFortra Patches Critical Vulnerabilities in BoKSMarimo RCE Flaw Lets Hackers Steal AWS Credentials and Pivot to Bastion Host in 8 SecondsWooCommerce Wholesale Lead Capture Plugin Actively ExploitedCisco Secure Workload CVE-2026-20223 (CVSS 10.0) — Max Severity, No WorkaroundsWPMU DEV Dashboard plugin auth bypass affects 350K sites
|
65/305
|
| T1193 |
Spearphishing Attachment |
Initial Access |
Blind Eagle-Linked Loader Uses GitHub, VBScript, PowerShell and InstallUtil to Deploy AsyncRATBeware of phishing emails disguised as quote requestsKonni Hackers Target Ukraine With Malicious LNK Files and VelvetCake PowerShell MalwareEvolution of MATCHBOIL Downloader by UAC-0099Infostealer Malware Steals Claude Session Cookies to Hijack Accounts and Bypass 2FAMicrosoft Outlook to block MSIX attachments starting NovemberKimsuky deploys AI-generated decoys in evolving GitHub PAT-based LNK attack campaign
|
2/7
|
| T1194 |
Spearphishing via Service |
Initial Access |
Salesforce Agentforce Flaw Enables 0-Click Data Exfiltration via Prompt InjectionSilverFox Malware Campaign Uses Smart Filtering to Hide Fake Software Downloads From Researchers
|
1/2
|
| T1195 |
Supply Chain Compromise |
Initial Access |
OpenAI agents behind May hacking campaign targeting RubyGemsCVE-2026-90606 critical buffer overflow in Totolink A3002MU routerMALFEX Supply Chain Campaign Targets npm and GitHub24 Malicious npm Packages Abuse Mirror Infrastructure to Host Obfuscated ClickFix Phishing PagesWeights & Biases wandb before 0.29.0 path traversal CVE-2026-91771 allows arbitrary file write via malicious backendA stolen API key turned Brevo's CDN into a supply-chain weapon - fake CAPTCHAs, silent WordPress backdoorsGlassworm Botnet Disrupted — CrowdStrike, Google, and Shadowserver Simultaneously Takedown 4-Layer C2 InfrastructurePoisoned npm Packages Steal AI Tokens and Spread Them Across Developer Build EnvironmentsNeedyMantis: Unpacking a post-compromise malware family used in targeted operationsAISI tests: GPT-6 Astra completes supply chain attacks in 29.2% of runsUnsloth Fixes Arbitrary Code Execution Flaw Triggered by Malicious Hugging Face ModelsGlassWorm Supply Chain Attack Hides Malware Inside VS Code Color ThemesCursor 0-Day Allows Arbitrary Code Execution by Simply Opening a RepositoryDocker Sandboxes TOCTOU vulnerabilities allow guest-to-host escapeMini Shai-Hulud worm re-infects GitHub repositories via hijacked ActionsCompromised marketing tool Brevo hits 100K+ websites via flawed SAML SSO exposing Cloudflare API keyMalicious Exodus Installer Steals Browser Credentials and Turns PCs Into SOCKS ProxiesHackers Compromise Coder Module Registry to Serve Malicious Packages and Steal CredentialsJFrog Artifactory under active attack with CVE chain exploitPackagist Themes Exploit iPhone Visitors to Steal Messages, Passwords and Crypto Wallet SeedsTraderTraitor Weaponizes Terraform Lock Files to Deploy macOS BackdoorsShai-Hulud Trinitite Supply-Chain Worm Compromises Popular npm PackageCritical Snowflake GitHub Actions Flaw Allows Attackers to Steal Internal Jira CredentialsLiteLLM Supply-Chain Breach Blast Radius: 2,500+ Organizations and 434,000 CI/CD PipelinesGPT-6 Astra Launches Unsanctioned Supply-Chain Attacks in Cyber SimulationsBrevo Supply Chain Attack: Cloudflare Worker injected malicious code across 100,000+ sites77 "Evil Twin" Open VSX Extensions Harvest Developer Metadata — Shared C2 at mangorbit[.]comOpenAI Agents Flood RubyGems With 2,000 Packages and Exploit Build SystemGitSpawn Flaw Enables Arbitrary Code Execution in Claude Code, Codex, Cursor and GrokHugging Face Transformers CVE-2026-80047 Allows Code Execution Before User ConsentGhostAction Supply Chain Campaign ReturnsLong-Running NPM Malware Campaign Accumulates 40,000 DownloadsBDThemes WordPress Supply Chain Attack Creates Rogue Admins and Deploys WebshellsAnthropic Claude models compromised 3 real organizations during safety evaluationsNorth Korean WaterPlum hackers infected 30,000 devices worldwideA wake-up call at the right time: The XZ Utils Backdoor. At the end of March 2024, the tech world held its collective breath. A Microsoft developer discovered malicious code in XZ Utils that could have enabled an SSH backdoor through liblzma.Contagious Interview Operators Move Beyond Git Hooks With Trojanized Mac ApplicationsBGP Hijack Diverts Softaculous Traffic to Deliver Malicious Virtualizor UpdateFake LastPass Authenticator GitHub repos push new Rapuncel infostealer with EDR-killing kernel driverTanStack npm Supply-Chain Compromise Exfiltrated 170 Private GitHub ReposDPRK-Linked Hackers Add HashHiding to Blockchain C2 Network for Takedown-Resistant MalwareComposer Path Traversal Flaw Lets Malicious Packages Expose Sensitive FilesCompromised Rust Crate With 18,000+ Downloads Steals Source Code During BuildsOpenClaw NovaStealer Attacks Target 60+ Crypto Wallets, SSH Keys and AWS CredentialsDPRK-Linked Actors Deploy Novel Linux Espionage Toolkit Against South Korean HAProxy ServersChinese APT Clones Legitimate Websites to Deliver Chrome and Windows Zero-Day ExploitsTwo Alleged TeamPCP Hackers Arrested in AustraliaSuspected TraderTraitor Group Uses Trojanized Terraform Provider to Deliver Cross-Platform MalwareGraphalgo malware hits Terraform providers and Go modules in supply chain attackMALFEX: eight malicious npm packages deliver Overlord RAT, 40,767 downloadsindexed-btree npm Package Executes Malware at Runtime via BTree.set()Q3 2026 Open Source Malware Index: When Compromise CompoundsCVE-2026-19949: SQL Injection in All-in-One WP Migration Plugin Exposes Millions of WordPress Sites to TakeoverHackers Compromise TanStack Query npm Package to Steal Developer CredentialsChainDrop npm Worm Hijacks GitHub Actions OIDC to Poison 444 Packages With Valid SLSA ProvenanceTensorlake npm Package Compromised to Deliver Shai-Hulud Credential-Stealing WormWeaselBiscuit npm stealer targets Chrome extension storage, linked to DPRK ContagiousOpenAI agents hacked a software service before the Hugging Face incidentMalicious RubyGems Packages Target Cryptocurrency DevelopersTrueConf security advisory (AV26-835)Researchers Execute Code Inside Fortune 500 Companies via AI Agent llms.txt FilesHackers infect Android car head units with proxy botnet malwarenpm Supply Chain Worm Returns After Four-Month Dormancy With Same Malicious PayloadNorth Korea-linked malware abuses Ethereum transactions as covert C2 channelArtifactory flaws chained in attacks deploying backdoor malwareAnthropic discloses Claude AI misuse in cyberattacks and surveillanceTraderTraitor macOS Backdoors Found on Non-Crypto Victim
|
15/67
|
| T1199 |
Trusted Relationship |
Initial Access |
Denmark Confirms Major Security Incident Exposing 8.8 Million Citizen RecordsCompromised marketing tool Brevo hits 100K+ websites via flawed SAML SSO exposing Cloudflare API keyMcKesson copes with fallout from data theft extortion attackStorm Ransomware Strikes GSAC Auto FinancingRansomware Affiliate Poses as Recovery Firm to Re-Extort Victims After Data TheftDaiwa Securities says info on 110,000 clients may have been leaked in vendor incidentAttackers compromise .gh, .sl, .as ccTLD registries and obtain counterfeit TLS certificatesASOS links data breach to social engineering attack, credential theft
|
gap
|
| T1200 |
Hardware Additions |
Initial Access |
Five Venezuelans Plead Guilty to ATM Jackpotting Attacks in US
|
gap
|
| T1208 |
Kerberoasting |
Credential Access |
CISA Warns of 17 Active Directory Attack Techniques Used for Privilege Escalation and PersistenceActive Directory SPN Misconfigurations Enable Kerberoasting Without Account LockoutsFortra Patches Critical Vulnerabilities in BoKS
|
gap
|
| T1210 |
Exploitation of Remote Services |
Lateral Movement |
AI-Built Exploit and Sign-In Flaw Opened Path to Internal OpenAI CodeVeeam Backup vulnerability CVE-2025-64393 allows low-privileged RCENightEagle targets Russian companiesConnectWise Patches ScreenConnect Vulnerability Exploited in Worm-Like AttacksChinese-Speaking Hackers Exploit Known Flaws to Steal Philippine Nuclear and Naval DataCISA flags actively exploited Linux kernel bugs: kTLS leak, ebtables privesc, AF_ALG corruptionMarimo RCE Flaw Lets Hackers Steal AWS Credentials and Pivot to Bastion Host in 8 Seconds
|
2/7
|
| T1212 |
Exploitation for Credential Access |
Credential Access |
Clop created custom web shell for Windchill data theft attacksMetabase Zero-Day Attack Lets Hackers Gain Admin Access and Steal Database CredentialsSuprema BioStar 2 door-access software leaks Active Directory service-account password in cleartextMicrosoft July 2026 Patch Tuesday — Record 622 CVEs, Two Exploited Zero-Days, Rapid7 SharePoint Auth BypassBranch Target Reuse: Practical Spectre-v2 Attacks in JIT Engines via Stale Branch Prediction EntriesSpectre v2 Variant Exposes Intel, AMD, Arm CPUs to Data LeaksFortra Patches Critical Vulnerabilities in BoKS
|
1/7
|
| T1219 |
Remote Access Tools |
Command and Control |
Impersonating IT support: how threat actors turn a remote session into enterprise-wide accessSETTRA Ransomware Uses MeshAgent RMM and BYOVD to Encrypt Windows SystemsAttack Cases in Korea Involving the Installation of Radmin and UltraVNCFBI Hackers Say They Won’t Publish Massive Trove of FBI Employee DataHackers Pose as IT Support on Microsoft Teams to Target More Than 150 EmployeesThe Gentlemen Ransomware Group Deployed Custom TukTuk C2 FrameworkHackers Abuse ChatGPT Shared Links and Fake Cloudflare CAPTCHA to Deploy NetSupport RATMicrosoft Teams Help Desk Impersonation Social Engineering CampaignHackers have apparently breached FBI systems and have extracted personal data “on all FBI employees and applicants.” The data reportedly incCISA KEV update: five actively exploited Artifactory, ScreenConnect, and RouterOS flaws addedAbyssos RAT Hijacks Browser Sessions, Steals Credentials and Gives Attackers Remote VNC AccessUS charges Russian for infecting 80,000 freelancers with malware
|
5/12
|
| T1484 |
Domain or Tenant Policy Modification |
Defense Impairment |
Microsoft Entra TrustSink Attack Uses Rogue MFA Provider to Steal Passwords
|
gap
|
| T1503 |
Credentials from Web Browsers |
Credential Access |
MALFEX Supply Chain Campaign Targets npm and GitHubAtomic macOS (AMOS) Stealer infection campaign observedx47.c Windows Botnet Weaponizes xAI Grok, AI API DrainingFake Google Gemini installer distributes Vidar stealer via Google ColabSectopRAT Malware Hides in Legitimate Software to Steal Browser Credentials and Crypto Wallets
|
2/5
|
| T1528 |
Steal Application Access Token |
Credential Access |
Infostealers Harvest Replayable AI Session TokensMalicious Twitch Extension Exposes 30,000 Users OAuth Tokens to Russian Bot ServiceRussia-Linked Cyber Espionage Clusters Use OAuth Phishing to Target U.S. and European OrganizationsMini Shai-Hulud worm re-infects GitHub repositories via hijacked Actions659 Stripe Merchant API Keys Leaked Online, Exposing 688,000 Customer RecordsMCP Python SDK OAuth Flaw Lets Malicious Servers Steal Credentials and Take Over AccountsGhostAction Supply Chain Campaign ReturnsAgentCorruption: patched AWS Bedrock AgentCore prompt-injection flawEvilTokens PhaaS disrupted after compromising 12,000 Microsoft accountsIssabel PBX remote code execution exploited in active attacksRussian Hackers Trick Academics and Diplomats Into Giving Them Access to Email and WhatsAppAWS AI Agent Vulnerabilities Let Attackers Bypass Authentication and Steal CredentialsChainDrop npm Worm Hijacks GitHub Actions OIDC to Poison 444 Packages With Valid SLSA ProvenanceWeaselBiscuit npm stealer targets Chrome extension storage, linked to DPRK ContagiousAnthropic discloses Claude AI misuse in cyberattacks and surveillanceWarden Infostealer Targets AI Agents and Developer Keys
|
4/16
|
| T1534 |
Internal Spearphishing |
Lateral Movement |
Impersonating IT support: how threat actors turn a remote session into enterprise-wide accessPhantom Deal Fraud Campaign Impersonates Executives with Fake NDAs to Steal Corporate PaymentsMicrosoft Teams Help Desk Impersonation Social Engineering CampaignNikkei employee Microsoft 365 account compromised, 9,000 phishing emails sent to sources and contactsHackers Impersonate Security Staff to Steal Credentials in ReliaQuest Social Engineering Attack
|
gap
|
| T1539 |
Steal Web Session Cookie |
Credential Access |
Infostealers Harvest Replayable AI Session TokensMalicious Twitch Extension Exposes 30,000 Users OAuth Tokens to Russian Bot ServiceTelegram Desktop CVE-2026-107181 Account TakeoverShadow hVNC Lets Hackers Operate a Second Windows Desktop Invisible to the VictimEvilTokens PhaaS Storm-2992 compromises 12,000+ inboxes via AI-powered device-code phishing and inbox rule persistenceRussia-Linked Cyber Espionage Clusters Use OAuth Phishing to Target U.S. and European OrganizationsKREMLIN Banking Malware Installs Chrome Extensions Users Never Approved to Steal Banking DataKREMLIN Banking Malware Hijacks Chrome and Edge to Steal Credentials and Session TokensMalicious Exodus Installer Steals Browser Credentials and Turns PCs Into SOCKS ProxiesPackagist Themes Exploit iPhone Visitors to Steal Messages, Passwords and Crypto Wallet SeedsInfostealers Are Stealing Cloud and AI Credentials From Infected DevicesCVE-2026-16340 (CRITICAL, CVSS 9.8): IBM DataPower Gateway 10.5.0.0 – 10.5.0.22, 10.6.0.0 – 10.6.0.10, 10.6.1 – 10.6.6, 11.0.0.0 – 11.0.0.2HBO Max Reddit Account Compromised, Distributing Malware via PasteSwitch for 48 HoursLUNEXSTEALER Gives Hackers Remote Control of Browsers Through Malicious Chrome ExtensionMalicious Chrome and Edge Extensions Hijack Crypto Wallets and Steal Login CredentialsAI-Powered BraZetsu Malware Turns Compromised Corporate PCs Into Tradable AssetsIdentity Abuse Through Trusted Communication ChannelsFake Claude Opus 5 App Deploys RevStealer to Steal Passwords, Crypto Wallets and SessionsCERT-UA: 100+ websites compromised to spread Lunex Stealer via fake Cloudflare checks (UAC-0277)Hackers Create Hidden Microsoft 365 Inbox Rules to Conceal Vendor Payment FraudChina-Linked TA419 Hackers Target US AI Policy Experts With Credential Phishing AttacksInfostealer Malware Steals Claude Session Cookies to Hijack Accounts and Bypass 2FABigBear 2.0 PhaaS bypasses MFA in global M365 campaign using Evilginx2Hackers Can Use PEEP Chrome Extension to Steal Credentials and Execute Shell CommandsAI-Powered AnonyMousKIT PhaaS Steals Apple IDs and 2FA Codes to Unlock Stolen iPhonesBalonx PhaaS Steals Bank OTPs in Real Time While AI Calls and Android RAT Target VictimsBigBear Microsoft 365 phishing service bypassed MFA at 258 organizationsHackers Use AI-Generated Event Lures to Steal Google Accounts and Bypass MFA
|
7/28
|
| T1548 |
Abuse Elevation Control Mechanism |
Privilege Escalation |
CrowdStrike 'FalconFlank' zero-day grants SYSTEM privilegesCritical Rancher Flaw Lets Authenticated Users Take Over All Managed Kubernetes ClustersCaptiveCrunch: Midnight Blizzard Sub-Cluster Weaponizes Hotel Wi-Fi Captive Portals to Attack Corporate Travelers WorldwideAcronis cPanel Backup Plugin Actively Exploited for Root Privilege EscalationFalconFlank PoC Claims CrowdStrike Falcon Zero-Day Enables Privilege Escalation on WindowsDeadLock ransomware uses blockchain to resist infrastructure takedownRATHat Android Banking Trojan Uses Gemini AI and ADB Shell to Take Control of DevicesPsychedelic Stealer spread via fake CAPTCHA prompts on Ukrainian company sitesRed Hat ACM Flaw Lets Namespace Editors Escalate to Full Kubernetes Cluster-AdminmacOS Users Targeted by Fake Zoom Installer Carrying CloudSyncD BackdoorA single Kubernetes YAML can hand an attacker full GCP org ownership. Google's verdict: working as designed. 9 detections, 7 IOCs. Full anal
|
4/11
|
| T1550 |
Use Alternate Authentication Material |
Lateral Movement |
miniOrange WordPress SAML SSO plugin auth bypass enables admin takeoverRussian Hackers Trick Academics and Diplomats Into Giving Them Access to Email and WhatsApp
|
gap
|
| T1552 |
Unsecured Credentials |
Credential Access |
Infostealers Harvest Replayable AI Session TokensAI-Built Exploit and Sign-In Flaw Opened Path to Internal OpenAI CodeGitLab critical flaw CVE-2026-85706 drawing internet-wide probesGitLab Critical Path Traversal Vulnerability CVE-2026-85706Critical Ruby on Rails Vulnerability in Attackers' CrosshairsGlassworm Botnet Disrupted — CrowdStrike, Google, and Shadowserver Simultaneously Takedown 4-Layer C2 InfrastructureTIKTOUK WordPress Toolkit Could Enable AWS, SMTP and API Credential Theft AttacksNovo Nordisk Breach — Two Separate Extortion Groups, Demands of $50M and $25M, Neither PaidHackers Compromise Coder Module Registry to Serve Malicious Packages and Steal CredentialsOpenAI: Agent Behavior That Led to Hugging Face Intrusion Formed in May659 Stripe Merchant API Keys Leaked Online, Exposing 688,000 Customer RecordsMisconfigured Supabase apps expose data in over 16,000 databasesHCL BigFix Service Management CVSS 9.8 SQLi and cross-tenant data exposureBitget Critical Breach: $387.5M Stolen via Zero-Days in Security AppliancesRuby on Rails Active Storage Flaw (CVE-2026-66066, CVSS 9.5): Unauthenticated Server File Read via Image UploadsHackers Start Exploiting Critical Langflow VulnerabilityInfostealers Are Stealing Cloud and AI Credentials From Infected DevicesOpenAI’s Systems Meddled With U.S. Government SitesHackers Target Exposed Vite Dev Servers to Steal AWS, Azure SecretsShai-Hulud Trinitite Supply-Chain Worm Compromises Popular npm PackageHackers Target LiteLLM, RAGFlow and Kestra AI Infrastructure to Steal API Keys and Mine CryptoMass scanning targets exposed Vite dev servers for cloud secrets via CVE-2026-39364TP-Link Archer AX55 Flaws Enable Remote Code Execution and Admin Password TheftOpenAI Agent Swarm Escaped Sandboxes and Left 80,000 Attack Payloads BehindLLMjacking Attack Abuses Leaked AWS Credentials to Hijack Amazon Bedrock AI Models28,000 Exposed .git Repositories Leak Active AWS, OpenAI, Stripe and GitHub CredentialsStorm-3168: Agentic-driven cloud attacks using compromised service principalsGitHub App Private Keys: 474 Leaked Keys ExposedTanStack npm Supply-Chain Compromise Exfiltrated 170 Private GitHub Repos768 Leaked AWS Keys Expose Corporate Cloud Accounts to Full Admin TakeoverOpenAI Reports Rogue AI Agents Harmed Over 100 OrganizationsSuprema BioStar 2 door-access software leaks Active Directory service-account password in cleartextBeacon CRM Data Breach Exposes Entire Customer Database After AWS Key CompromiseHackers Compromise TanStack Query npm Package to Steal Developer CredentialsTensorlake npm Package Compromised to Deliver Shai-Hulud Credential-Stealing WormShinyHunters breaches Clop leak site and steals onion service keysnpm Supply Chain Worm Returns After Four-Month Dormancy With Same Malicious PayloadGentlemen Ransomware Affiliate Uses MCP as C2 Channel in Live CyberattacksHundreds of leaked AWS keys give full control over corporate accountsCISA Red Team Compromises Active Directory and Critical Business SystemsWarden Infostealer Targets AI Agents and Developer KeysMarimo RCE Flaw Lets Hackers Steal AWS Credentials and Pivot to Bastion Host in 8 Seconds
|
11/42
|
| T1553 |
Subvert Trust Controls |
Defense Impairment |
Critical Apache HttpComponents Flaw Allows Server Impersonation in MITM Attacks
|
gap
|
| T1555 |
Credentials from Password Stores |
Credential Access |
P7 DarkSword iOS Exploit Kit Adds Crypto Wallet Theft and Remote CommandsTIKTOUK WordPress Toolkit Could Enable AWS, SMTP and API Credential Theft AttacksKREMLIN Banking Malware Hijacks Chrome and Edge to Steal Credentials and Session TokensAgent Tesla Malware Campaign Uses Emoji Obfuscation to Steal CredentialsCritical N-able Passportal Bug Lets Malicious Sites Access Password VaultsChina-Linked Hackers Chain Chrome Zero-Day With Windows Kernel FlawFake GTA 6 Demo Sites Deliver Vidar Stealer via Browser Session HijackingAmnesiaStealer macOS Malware Steals Data, Controls Browser SessionsCERT-UA: 100+ websites compromised to spread Lunex Stealer via fake Cloudflare checks (UAC-0277)Fake Claude Install Guide Steals Mac Passwords and Turns Trusted Crypto Wallet Apps Into Phishing TrapsInfostealer Malware Steals Claude Session Cookies to Hijack Accounts and Bypass 2FAAbyssos RAT Hijacks Browser Sessions, Steals Credentials and Gives Attackers Remote VNC AccessOpenClaw NovaStealer Attacks Target 60+ Crypto Wallets, SSH Keys and AWS CredentialsPhishing Campaign Abuses Windows Mshta.exe to Steal Credentials and SecretsMacSync: The Evasive macOS Stealer Exploiting ClickFix LuresMicrosoft Links 30+ Domains to MacSync Stealer's Credential-Theft and Data-Exfiltration Infrastructure
|
9/16
|
| T1556 |
Modify Authentication Process |
Defense Impairment |
Storm-3068 Hijacks Azure DevOps Pipelines to Steal Kubernetes Credentials After Account TakeoverChina-Linked TA419 Hackers Target US AI Policy Experts With Credential Phishing AttacksMicrosoft Entra TrustSink Attack Uses Rogue MFA Provider to Steal Passwords
|
gap
|
| T1557 |
Adversary-in-the-Middle |
Credential Access |
WatchGuard patches critical Fireware OS RCE CVE-2026-86131Fake Chrome VPN Extensions Hijack Browser Traffic Through Russian Proxy NetworkKREMLIN Banking Malware Hijacks Chrome and Edge to Steal Credentials and Session TokensPlug & Pwn Attack Abuses Windows Plug and Play to Gain SYSTEM PrivilegesJWR Phishing-as-a-Service Kit Uses WebSockets and AES to Run Real-Time Banking FraudHackers Pose as IT Support on Microsoft Teams to Target More Than 150 EmployeesBanking Trojans Manic, Grandoreiro, ToxicPanda 2.0 in the SpotlightCritical N-able Passportal Bug Lets Malicious Sites Access Password VaultsCaptiveCrunch: Midnight Blizzard Sub-Cluster Weaponizes Hotel Wi-Fi Captive Portals to Attack Corporate Travelers WorldwideIdentity Abuse Through Trusted Communication ChannelsHackers Create Hidden Microsoft 365 Inbox Rules to Conceal Vendor Payment FraudAutomated AI agent used to breach cybersecurity nonprofit DIVDChina-Linked TA419 Hackers Target US AI Policy Experts With Credential Phishing AttacksBigBear 2.0 PhaaS bypasses MFA in global M365 campaign using Evilginx2Balonx PhaaS Steals Bank OTPs in Real Time While AI Calls and Android RAT Target VictimsCheck Point warns of exploited Security Gateway VPN RCE (CVE-2026-85102)BigBear Microsoft 365 phishing service bypassed MFA at 258 organizationsCritical industrial firmware vulnerabilities including CVE-2026-27565 authentication bypassCritical Apache HttpComponents Flaw Allows Server Impersonation in MITM AttacksHackers Use AI-Generated Event Lures to Steal Google Accounts and Bypass MFA
|
7/20
|
| T1558 |
Steal or Forge Kerberos Tickets |
Credential Access |
Aurora Ransomware Affiliate Uses Cursor AI to Plan Attacks Against 20+ OrganizationsActive Directory SPN Misconfigurations Enable Kerberoasting Without Account Lockouts
|
gap
|
| T1566 |
Phishing |
Initial Access |
Infostealers Harvest Replayable AI Session TokensBlinder Tunnel Campaign Targets Iraqi InfrastructureAttackers abusing trusted AI platforms to make malicious downloads look legitimateWeedHack Malware Spreads Through SEO-Poisoned Minecraft Sites Despite C2 Disruption24 Malicious npm Packages Abuse Mirror Infrastructure to Host Obfuscated ClickFix Phishing PagesClickFix Campaign Abuses Google Sheets C2 to Inject Malicious JavaScript Into ChromeRussian APT Star Blizzard Uses ‘RedFlick’ Infection Chain in Recent AttacksMalicious SVG Reconstructs DCRat Archive Entirely Inside Victim's BrowserCisco Talos details Antino backdoor used by China-nexus actor against Taiwan government orgsChinese Hackers Deploy PackClient RAT via Tax-Themed Phishing AttacksEvilTokens PhaaS Storm-2992 compromises 12,000+ inboxes via AI-powered device-code phishing and inbox rule persistenceRussia-Linked Cyber Espionage Clusters Use OAuth Phishing to Target U.S. and European OrganizationsAI-assisted malware rewrites itself via Gemini and Hugging Face APIs to evade detectionPhantom Deal Fraud Campaign Impersonates Executives with Fake NDAs to Steal Corporate PaymentsBlueDelta (APT28) HOOKEDGE Campaign Targets European Government and Diplomatic OrganizationsASCII Smuggling Technique Crosses From AI Prompt Injection to Phishing EvasionJWR Phishing-as-a-Service Kit Uses WebSockets and AES to Run Real-Time Banking FraudHackers Pose as IT Support on Microsoft Teams to Target More Than 150 EmployeesAgent Tesla Malware Campaign Uses Emoji Obfuscation to Steal CredentialsInfostealers Are Stealing Cloud and AI Credentials From Infected DevicesTraderTraitor Weaponizes Terraform Lock Files to Deploy macOS BackdoorsSynkLoader Malware Spreads Through Microsoft Teams Phishing and Steals Windows PasswordsChina-Linked Hackers Chain Chrome Zero-Day With Windows Kernel FlawIranian state-linked CHOSEN BRICK malware targets dissidents worldwideThe Gigabud banking trojan pairs with Vwork to clone bank apps into Android work profiles, evading fraud checks. Group-IB confirmed losses iDOJ, FBI seize Flax Typhoon-linked hacking tools Microscan, FishHubRingCentral data breach exposed info of 1.6 million accountsHBO Max Reddit Account Compromised, Distributing Malware via PasteSwitch for 48 HoursHackers Breach Brazilian Financial Firms and Execute Hundreds of Fraudulent TransactionsFake GTA 6 Demo Sites Deliver Vidar Stealer via Browser Session HijackingCore Werewolf Hackers Deploy New CoreRAT Malware Against Russian Government and Defense OrganizationsBeware of phishing emails disguised as quote requestsLUNEXSTEALER Gives Hackers Remote Control of Browsers Through Malicious Chrome ExtensionAmnesiaStealer macOS Malware Steals Data, Controls Browser SessionsChina-Nexus Hackers Target Myanmar Diplomats With Government-Themed QUICAgent Malware AttacksHackers Abuse ChatGPT Shared Links and Fake Cloudflare CAPTCHA to Deploy NetSupport RATIdentity Abuse Through Trusted Communication ChannelsRussian Hackers Deploy New HOOKEDGE Backdoor in Espionage Attacks Across EuropeMicrosoft Teams Help Desk Impersonation Social Engineering CampaignHackers Place Fake Codex Download Above Legitimate OpenAI Result to Infect Mac UsersCompromised email accounts used to illegally access cryptocurrency accountsNorth Korean WaterPlum campaign uses fake recruitment interviews to deploy malware and steal cryptoRevolut breach: 680 high-profile accounts compromised via fake law enforcement requests, $3M Monero ransomFake Claude Install Guide Steals Mac Passwords and Turns Trusted Crypto Wallet Apps Into Phishing TrapsNorth Korean WaterPlum hackers infected 30,000 devices worldwideOperation ASTERIX Uses Vishing and Fake Crypto Wallet Apps to Steal Seed PhrasesRemControl Android Banking Trojan Steals PINs Using AI-Built Phishing OverlaysEvilTokens PhaaS disrupted after compromising 12,000 Microsoft accountsAI-Powered RatHat Android Trojan Steals Bank Credentials, PINs and MFA CodesBalonx Sistema PhaaS Targets 20+ Mexican Banks With AI Vishing and Android RATRevolut Confirms Customer Data Breach via Fake Government Data RequestsGo Loader Uses Anti-Sandbox Checks and SNOWLIGHT to Execute Fileless VShell RAT in MemoryHackers Bypass Microsoft 365 RejectDirectSend With Empty SMTP Sender to Spoof Internal EmailsNikkei discloses breaches of employee Microsoft and Google email accountsASEC June 2026 APT Attack Report (South Korea)China-Linked TA419 Hackers Target US AI Policy Experts With Credential Phishing AttacksBigBear 2.0 PhaaS bypasses MFA in global M365 campaign using Evilginx2DPRK-Linked Hackers Add HashHiding to Blockchain C2 Network for Takedown-Resistant MalwareASEC July 2026 APT Attack Report (South Korea)OpenClaw NovaStealer Attacks Target 60+ Crypto Wallets, SSH Keys and AWS CredentialsOperation QUICSILVER: China-Nexus Actor Targets Myanmar Diplomats via VHD-Delivered Go BackdoorDark Caracal Deploys New GoCaracal Malware With Ethereum-Based C2 Across Latin AmericaHackers Launch Password Spraying Attacks Against AWS Root Accounts at 150+ OrganizationsFake Google Gemini installer distributes Vidar stealer via Google ColabPhishing Campaign Abuses Windows Mshta.exe to Steal Credentials and SecretsMicrosoft: passkey social engineering enables cloud account hijackAI-Powered AnonyMousKIT PhaaS Steals Apple IDs and 2FA Codes to Unlock Stolen iPhonesNikkei employee Microsoft 365 account compromised, 9,000 phishing emails sent to sources and contactsUS charges Russian for infecting 80,000 freelancers with malwareStar Blizzard refines phishing and malware delivery with the RedFlick techniqueHackers Use Chameleon SEO Poisoning to Hide Banking Phishing Pages From Security ScannersBalonx PhaaS Steals Bank OTPs in Real Time While AI Calls and Android RAT Target VictimsAPT36-Linked HACKERAI Implant Shows Signs of LLM-Assisted Malware DevelopmentContagious Interview: North Korean threat actors compromised 30,000 devices in 100+ countriesStreamRAT Android Malware Targets 570K Meta Users in SpainRATHat Android Banking Trojan Uses Gemini AI and ADB Shell to Take Control of DevicesText-Based QR Phishing Bypasses Email Security ToolsUS Charges 17 Iranian Hackers, Offers $10M Rewards for 5 of ThemBigBear Microsoft 365 phishing service bypassed MFA at 258 organizationsKimsuky deploys AI-generated decoys in evolving GitHub PAT-based LNK attack campaignKimsuky Moves AI-Assisted Development Into Local Environment With Operation GitPowerHackers Use Fake Cloudflare CAPTCHA to Deploy TerminalFix Reverse TunnelEvilTokens PhaaS Abuses Microsoft Device Codes to Hijack M365 AccountsCritical Microsoft Copilot CoSnitch Flaw Lets Hackers Steal Sensitive Data With One ClickNorth Korea-linked malware abuses Ethereum transactions as covert C2 channelGlobal Phishing Campaign Abuses Google Infrastructure to Evade Security and Steal CredentialsWindows AFD.sys Zero-Day Exploited by Lazarus Hackers to Gain SYSTEM AccessAndroid Banking Trojan GigaPlay/VWork Exploits Work Profiles in IndonesiaAnthropic discloses Claude AI misuse in cyberattacks and surveillanceMicrosoft Links 30+ Domains to MacSync Stealer's Credential-Theft and Data-Exfiltration InfrastructureHackers Abuse AI-Era ASCII Smuggling to Hide Phishing Content in Millions of EmailsFake ChatGPT, Gemini Sites steal advertising accounts, MFA codesClickFix Campaigns Targeting End Users via Legitimate ServicesCISA Red Team Compromises Active Directory and Critical Business SystemsTraderTraitor macOS Backdoors Found on Non-Crypto VictimRevolut discloses data breach exposing financial info, passportsHackers Use AI-Generated Event Lures to Steal Google Accounts and Bypass MFAHackers Impersonate Security Staff to Steal Credentials in ReliaQuest Social Engineering AttackMuddyWater-Linked Dindoor Backdoor Abuses Deno Runtime for Evasion
|
30/99
|
| T1568 |
Dynamic Resolution |
Command and Control |
NVIDIA NemoClaw Vulnerability Lets Attackers Hijack AI Agents via DNS Rebindingx47.c Windows Botnet Weaponizes xAI Grok, AI API DrainingKimwolf botnet rebuilt to survive takedowns, researchers say
|
gap
|
| T1570 |
Lateral Tool Transfer |
Lateral Movement |
NeedyMantis: Unpacking a post-compromise malware family used in targeted operationsConnectWise Patches ScreenConnect Vulnerability Exploited in Worm-Like Attacks
|
2/2
|
| T1571 |
Non-Standard Port |
Command and Control |
Blinder Tunnel Campaign Targets Iraqi InfrastructureBanking Trojans Manic, Grandoreiro, ToxicPanda 2.0 in the SpotlightStorm-3168: Agentic-driven cloud attacks using compromised service principalsBalonx Sistema PhaaS Targets 20+ Mexican Banks With AI Vishing and Android RATHackers Bypass Microsoft 365 RejectDirectSend With Empty SMTP Sender to Spoof Internal EmailsFortiGate CVE-2025-25249 now delivering PivotC2 RAT
|
2/6
|
| T1572 |
Protocol Tunneling |
Command and Control |
Attack Cases in Korea Involving the Installation of Radmin and UltraVNCHackers Turn HiveMQ and Element Messenger Into Control Channels for Windows BackdoorsFBI Hackers Say They Won’t Publish Massive Trove of FBI Employee DataSLEEPWALKER Backdoor Uses SMB, ICMP, DNS and VMware VMCI for Covert CommunicationsCling botnet exploits STUN protocol for IoT command and controlChina-Nexus SilkParasite APT Deploys Five New RATs Against Central Asian GovernmentsHackers Exploit Critical VMware vCenter Flaw to Deploy Reverse SSH Across 47 CountriesNightEagle targets Russian companiesCritical VMware vCenter Directory Traversal Flaw Used in Global AttacksRATHat Android Banking Trojan Uses Gemini AI and ADB Shell to Take Control of DevicesCarbonato malware uses AI agents to hijack exposed Docker hostsChinese Fire Ant APT Plants GRE Tunnels on Cisco IOS XR Routers for Persistent Espionage
|
6/12
|
| T1573 |
Encrypted Channel |
Command and Control |
New PamStealer macOS variant adds live C2 payload decryption and multi-layer persistenceHackers exploit Tencent app flaw to deploy GrayRabbit malwareTraderTraitor Weaponizes Terraform Lock Files to Deploy macOS BackdoorsOperation QUICSILVER: China-Nexus Actor Targets Myanmar Diplomats via VHD-Delivered Go BackdoorDark Caracal Deploys New GoCaracal Malware With Ethereum-Based C2 Across Latin AmericaAeternum Botnet Hides C2 Infrastructure in Polygon Smart Contracts to Evade TakedownsOctagon Android Bot Targets Crypto Wallets and Banking Apps With Hidden VNC and Accessibility OverlaysKimwolf botnet rebuilt to survive takedowns, researchers sayCritical Apache HttpComponents Flaw Allows Server Impersonation in MITM Attacks
|
3/9
|
| T1578 |
Modify Cloud Compute Infrastructure |
Defense Impairment |
AI Agents Breach Enterprise Network in Under 10 Hours and Steal Root CredentialsA single Kubernetes YAML can hand an attacker full GCP org ownership. Google's verdict: working as designed. 9 detections, 7 IOCs. Full anal
|
gap
|
| T1583 |
Acquire Infrastructure |
Resource Development |
FBI Warns Chinese Hackers Use Automated Tools and Botnets to Steal Sensitive DataThe Gentlemen Ransomware Group Deployed Custom TukTuk C2 FrameworkPeer2Profit AstroProxy Residential Proxy Network Exposes Internal Network ResourcesRansomware Affiliate Poses as Recovery Firm to Re-Extort Victims After Data TheftDark Caracal Deploys New GoCaracal Malware With Ethereum-Based C2 Across Latin AmericaHackers abuse Google Ads, Bing redirects to push Claude ClickFix attacksRemControl Android malware targets European and Canadian users via fake Play Store pagesSality Botnet Infrastructure Dismantled in Joint Global TakedownTraderTraitor macOS Backdoors Found on Non-Crypto Victim
|
3/9
|
| T1584 |
Compromise Infrastructure |
Resource Development |
Peer2Profit AstroProxy Residential Proxy Network Exposes Internal Network ResourcesHackers obtain counterfeit TLS certificates for Google and other large servicesIran-Linked Hackers Shut Down UK Power Plant for Four Days in Cyberattack
|
1/3
|
| T1585 |
Establish Accounts |
Resource Development |
AISI tests: GPT-6 Astra completes supply chain attacks in 29.2% of runsTelegram Vishing Ad Recruits Callers for Fake Google Security TeamGPT-6 Astra Launches Unsanctioned Supply-Chain Attacks in Cyber SimulationsRansomware Affiliate Poses as Recovery Firm to Re-Extort Victims After Data TheftCrypto Scammers Hijack Microsoft’s Official X Account
|
gap
|
| T1606 |
Forge Web Credentials |
Credential Access |
ZITADEL Cluster: 7 CVEs Including Critical Passkey ForgeryHow I Could’ve Accessed 17 Trillion Microsoft RecordsAuthlib signature bypass vulnerability CVE-2026-96760, CVE-2026-28802, CVE-2026-27962WSO2 API Manager CVE-2026-5430 JWT Auth Bypass Under Active ExploitationFortinet patches critical authentication bypass and proxy flaws across product lineCISA Urges Immediate Patching of Exploited SharePoint VulnerabilitiesCISA adds exploited WSO2, Adobe Commerce, SharePoint and RouterOS flaws to KEV catalogPAN-OS CVE-2026-0257 CISA KEV — GlobalProtect Authentication Bypass Actively Exploited, Rapid7 Confirms Two Attack WavesCVE-2026-63520: Microsoft SharePoint Remote Code Execution (FIXED)CVE-2026-61500 Rejetto HFS critical session-key flaw
|
2/10
|
| T1608 |
Stage Capabilities |
Resource Development |
FakeGit Campaign: 7,600 Malicious GitHub Repos Pushing SmartLoader/StealC MalwareKonni Hackers Target Ukraine With Malicious LNK Files and VelvetCake PowerShell MalwareRansomware Affiliate Poses as Recovery Firm to Re-Extort Victims After Data TheftChinese APT Clones Legitimate Websites to Deliver Chrome and Windows Zero-Day Exploits
|
1/4
|
| T1611 |
Escape to Host |
Privilege Escalation |
CopyEscape Docker Flaw Lets Malicious Containers Overwrite Host Files and Execute CodeBroadcom VMware security advisory (AV26-1008)Meta Muse VM escape vulnerabilities fixed before launchOpenAI Agent Swarm Escaped Sandboxes and Left 80,000 Attack Payloads BehindHackers Turn an Open-Source AI Agent Into a Tool for Controlling Compromised Docker ServersVMware Workstation VMXNET3 VM Escape Vulnerability (CVE-2026-59346)
|
gap
|
| T1621 |
Multi-Factor Authentication Request Generation |
Credential Access |
EvilTokens PhaaS Storm-2992 compromises 12,000+ inboxes via AI-powered device-code phishing and inbox rule persistenceRussia-Linked Cyber Espionage Clusters Use OAuth Phishing to Target U.S. and European OrganizationsCaptiveCrunch: Midnight Blizzard Sub-Cluster Weaponizes Hotel Wi-Fi Captive Portals to Attack Corporate Travelers WorldwideEvilTokens PhaaS disrupted after compromising 12,000 Microsoft accountsBigBear 2.0 PhaaS bypasses MFA in global M365 campaign using Evilginx2Russian Hackers Trick Academics and Diplomats Into Giving Them Access to Email and WhatsAppAI-Powered AnonyMousKIT PhaaS Steals Apple IDs and 2FA Codes to Unlock Stolen iPhonesEvilTokens PhaaS Abuses Microsoft Device Codes to Hijack M365 AccountsHackers Impersonate Security Staff to Steal Credentials in ReliaQuest Social Engineering Attack
|
4/9
|
| T1649 |
Steal or Forge Authentication Certificates |
Credential Access |
Hackers obtain counterfeit TLS certificates for Google and other large servicesCheck Point warns of exploited Security Gateway VPN RCE (CVE-2026-85102)
|
1/2
|
| T1659 |
Content Injection |
Initial Access |
Elementor WordPress flaw lets attackers create admin accountsAttackers abusing trusted AI platforms to make malicious downloads look legitimate24 Malicious npm Packages Abuse Mirror Infrastructure to Host Obfuscated ClickFix Phishing PagesA stolen API key turned Brevo's CDN into a supply-chain weapon - fake CAPTCHAs, silent WordPress backdoorsPackagist Themes Exploit iPhone Visitors to Steal Messages, Passwords and Crypto Wallet SeedsCaptiveCrunch: Midnight Blizzard Sub-Cluster Weaponizes Hotel Wi-Fi Captive Portals to Attack Corporate Travelers WorldwideSalesforce Agentforce Flaw Enables 0-Click Data Exfiltration via Prompt InjectionBrevo Supply Chain Attack: Cloudflare Worker injected malicious code across 100,000+ sitesBigCommerce merchant data breach via compromised third-party Ribon app credentialsOpenAI Reports Rogue AI Agents Harmed Over 100 OrganizationsPsychedelic Stealer spread via fake CAPTCHA prompts on Ukrainian company sitesWikimedia: Rogue OpenAI agents behind unauthorized Wikipedia editsAsos data breached, hackers sent users threatening messages
|
3/13
|
| T1669 |
Wi-Fi Networks |
Initial Access |
Manic Android malware family targets 169 apps with banking fraud and Wi-Fi mesh exfiltrationCaptiveCrunch: Midnight Blizzard Sub-Cluster Weaponizes Hotel Wi-Fi Captive Portals to Attack Corporate Travelers Worldwide
|
1/2
|
| T1688 |
Safe Mode Boot |
Defense Impairment |
One Missing MFA Control Lets Credential Spray Become Full Akira Ransomware Intrusion
|
1/1
|