In a significant cybersecurity breach, the ShinyHunters group has exploited a previously unaddressed vulnerability in Oracle PeopleSoft to infiltrate enterprise systems. Their campaign has primarily targeted universities, leveraging the exploit to extract sensitive data while demanding ransom payments for its confidentiality. The operation was observed between May 27 and June…
ShinyHunters Breach Exposes Sensitive Data The cybersecurity firm Mandiant has reported that several organizations faced serious security breaches, with some compromising their confidential data. This resulted in sensitive information being published on the Data Leak Site (DLS) operated by the notorious group, ShinyHunters. Notably, some organizations successfully mitigated the attacks,…
Vercel Reports Security Breach Following Compromise of AI Tool Vercel, a prominent provider of web infrastructure, has recently revealed a security breach that compromised “certain” internal systems, allowing unauthorized access to its operations. The incident arose from a vulnerability in Context.ai, a third-party artificial intelligence tool utilized by one of…
Trellix, a cybersecurity firm, has reported experiencing a breach that granted unauthorized access to a portion of its source code repository. The company has stated that it recently discovered this security compromise and is taking immediate steps to address the issue by collaborating with leading forensic experts. Additionally, Trellix has…
Cybercriminals Utilize ClickFix Tactic and Fake CAPTCHA Pages to Distribute CORNFLAKE.V3 Backdoor
August 21, 2025
Malware / Cryptocurrency
Threat actors have been observed employing the ClickFix social engineering tactic to disseminate a versatile backdoor known as CORNFLAKE.V3. Google-owned Mandiant reported this activity, identified as UNC5518, as part of an access-as-a-service scheme that utilizes fake CAPTCHA pages to entice users into granting initial system access, which is subsequently monetized by other threat groups. “The initial infection method, referred to as ClickFix, involves tricking users on compromised websites into copying and executing a malicious PowerShell script through the Windows Run dialog,” Google detailed in a report released today. Access provided by UNC5518 is believed to be exploited by at least two distinct hacking groups, UNC5774 and UNC4108, to launch a multi-stage infection process and introduce additional payloads. UNC5774, another financially motivated group, employs CORNFLAKE to deploy various subsequent payloads. UNC4108, also a threat actor…
Cybercriminals Exploit ClickFix Strategy to Distribute CORNFLAKE.V3 Backdoor via Fake CAPTCHA Pages On August 21, 2025, cybersecurity experts reported a notable tactic employed by cybercriminals involving the deployment of a versatile backdoor, known as CORNFLAKE.V3, through a method termed ClickFix. This strategy was detailed by Mandiant, a subsidiary of Google,…
Cybercriminals Utilize ClickFix Tactic and Fake CAPTCHA Pages to Distribute CORNFLAKE.V3 Backdoor
August 21, 2025
Malware / Cryptocurrency
Threat actors have been observed employing the ClickFix social engineering tactic to disseminate a versatile backdoor known as CORNFLAKE.V3. Google-owned Mandiant reported this activity, identified as UNC5518, as part of an access-as-a-service scheme that utilizes fake CAPTCHA pages to entice users into granting initial system access, which is subsequently monetized by other threat groups. “The initial infection method, referred to as ClickFix, involves tricking users on compromised websites into copying and executing a malicious PowerShell script through the Windows Run dialog,” Google detailed in a report released today. Access provided by UNC5518 is believed to be exploited by at least two distinct hacking groups, UNC5774 and UNC4108, to launch a multi-stage infection process and introduce additional payloads. UNC5774, another financially motivated group, employs CORNFLAKE to deploy various subsequent payloads. UNC4108, also a threat actor…
Salesloft OAuth Breach Through Drift AI Chat Agent Compromises Salesforce Customer Data
August 27, 2025
Cloud Security / Threat Intelligence
A significant data breach has targeted the sales automation platform Salesloft, allowing hackers to steal OAuth and refresh tokens linked to the Drift AI chat agent. This opportunistic attack has been connected to a threat group identified by Google Threat Intelligence Group (GTIG) and Mandiant, known as UNC6395. GTIG has reported over 700 potentially affected organizations. According to researchers Austin Larsen, Matt Lin, Tyler McLellan, and Omar ElAhdan, the attacks began as early as August 8, 2025, and continued until at least August 18, 2025, focusing on Salesforce customer accounts through the compromised Salesloft Drift application. The hackers have been seen exporting large volumes of data from various corporate Salesforce instances, likely in an effort to harvest credentials for further exploitation.
Salesloft OAuth Breach through Drift AI Chat Agent Affects Salesforce Customer Data August 27, 2025 In a significant cybersecurity incident, a data breach involving the sales automation service Salesloft has led to the compromise of OAuth and refresh tokens linked to the Drift artificial intelligence chat agent. This incident appears…
Salesloft OAuth Breach Through Drift AI Chat Agent Compromises Salesforce Customer Data
August 27, 2025
Cloud Security / Threat Intelligence
A significant data breach has targeted the sales automation platform Salesloft, allowing hackers to steal OAuth and refresh tokens linked to the Drift AI chat agent. This opportunistic attack has been connected to a threat group identified by Google Threat Intelligence Group (GTIG) and Mandiant, known as UNC6395. GTIG has reported over 700 potentially affected organizations. According to researchers Austin Larsen, Matt Lin, Tyler McLellan, and Omar ElAhdan, the attacks began as early as August 8, 2025, and continued until at least August 18, 2025, focusing on Salesforce customer accounts through the compromised Salesloft Drift application. The hackers have been seen exporting large volumes of data from various corporate Salesforce instances, likely in an effort to harvest credentials for further exploitation.
June 27, 2013
Security experts assert that the Chinese hacker group known as Comment Crew is still active and operating covertly. Rumors within the intelligence community suggest, “The Comment Crew is back again,” with researchers suspecting their involvement in the recent cyber tensions between the U.S. and China.
Looking back, in February, the Mandiant Intelligence firm published a significant report detailing an extensive computer espionage campaign called APT1. Mandiant linked APT1, which compromised 141 organizations over seven years, to a Chinese military unit known as “61398.” Notably, the security firm identified a consistent pattern in attacks carried out by this group and established key indicators to recognize ongoing advanced persistent threat (APT) attacks.
Mandiant has been monitoring the group for years, and while it is not the only firm to do so, FireEye has also provided valuable insights into their operations.
Chinese Hacking Group ‘Comment Crew’ Remains Active and Under the Radar In recent developments, cybersecurity experts have confirmed that the notorious Chinese hacking collective known as Comment Crew continues to operate covertly. Observations within the intelligence community suggest that this group has resurfaced, raising suspicions of their involvement in escalating…
June 27, 2013
Security experts assert that the Chinese hacker group known as Comment Crew is still active and operating covertly. Rumors within the intelligence community suggest, “The Comment Crew is back again,” with researchers suspecting their involvement in the recent cyber tensions between the U.S. and China.
Looking back, in February, the Mandiant Intelligence firm published a significant report detailing an extensive computer espionage campaign called APT1. Mandiant linked APT1, which compromised 141 organizations over seven years, to a Chinese military unit known as “61398.” Notably, the security firm identified a consistent pattern in attacks carried out by this group and established key indicators to recognize ongoing advanced persistent threat (APT) attacks.
Mandiant has been monitoring the group for years, and while it is not the only firm to do so, FireEye has also provided valuable insights into their operations.
Salesloft Shuts Down Drift Temporarily Following OAuth Token Theft Affecting Numerous Organizations
Sep 03, 2025
Data Breach / Threat Intelligence
Salesloft announced on Tuesday the temporary suspension of Drift, slated to occur “in the very near future,” due to an extensive supply chain attack impacting multiple companies. This breach has led to the widespread theft of authentication tokens linked to the marketing software-as-a-service platform. The company stated, “This action will allow us to thoroughly review the application and enhance its resilience and security before restoring full functionality.” Consequently, the Drift chatbot on customer websites will be offline, and Drift itself will not be accessible. Salesloft emphasized its commitment to preserving the integrity and security of its systems and customers’ data, collaborating with cybersecurity partners Mandiant and Coalition as part of their incident response strategy. This announcement follows a disclosure from Google Threat Intelligence Group (GTIG) and Mandiant regarding the ongoing threats.
Salesloft to Temporarily Suspend Drift Following Widespread OAuth Token Theft September 3, 2025 In a significant development within the cybersecurity landscape, Salesloft has announced plans to take its Drift service offline imminently. This decision follows a widespread supply chain attack that has affected numerous organizations, leading to the unauthorized acquisition…
Salesloft Shuts Down Drift Temporarily Following OAuth Token Theft Affecting Numerous Organizations
Sep 03, 2025
Data Breach / Threat Intelligence
Salesloft announced on Tuesday the temporary suspension of Drift, slated to occur “in the very near future,” due to an extensive supply chain attack impacting multiple companies. This breach has led to the widespread theft of authentication tokens linked to the marketing software-as-a-service platform. The company stated, “This action will allow us to thoroughly review the application and enhance its resilience and security before restoring full functionality.” Consequently, the Drift chatbot on customer websites will be offline, and Drift itself will not be accessible. Salesloft emphasized its commitment to preserving the integrity and security of its systems and customers’ data, collaborating with cybersecurity partners Mandiant and Coalition as part of their incident response strategy. This announcement follows a disclosure from Google Threat Intelligence Group (GTIG) and Mandiant regarding the ongoing threats.
A serious security flaw has been identified in multiple versions of the ThroughTek Kalay P2P Software Development Kit (SDK), potentially allowing remote attackers to gain control of vulnerable devices and execute harmful code. Labeled as CVE-2021-28372 (with a CVSS score of 9.6) and uncovered by FireEye Mandiant in late 2020, this issue involves improper access controls in ThroughTek’s point-to-point (P2P) products. If exploited, attackers could listen in on live audio, view real-time video streams, and compromise device credentials, leading to further attacks stemming from exposed functionalities. According to the U.S. Cybersecurity and Infrastructure Security Agency (CISA), “successful exploitation of this vulnerability could enable remote code execution and unauthorized access to sensitive information, including audio/video feeds from cameras.” There are estimated to be 83 million active devices vulnerable to this flaw.
Severe Vulnerability in ThroughTek SDK Exposes Millions of IoT Devices to Potential Attacks On August 18, 2021, a significant security flaw was identified within multiple versions of the ThroughTek Kalay P2P Software Development Kit (SDK). This vulnerability, designated as CVE-2021-28372 with a CVSS score of 9.6, poses a serious risk…
A serious security flaw has been identified in multiple versions of the ThroughTek Kalay P2P Software Development Kit (SDK), potentially allowing remote attackers to gain control of vulnerable devices and execute harmful code. Labeled as CVE-2021-28372 (with a CVSS score of 9.6) and uncovered by FireEye Mandiant in late 2020, this issue involves improper access controls in ThroughTek’s point-to-point (P2P) products. If exploited, attackers could listen in on live audio, view real-time video streams, and compromise device credentials, leading to further attacks stemming from exposed functionalities. According to the U.S. Cybersecurity and Infrastructure Security Agency (CISA), “successful exploitation of this vulnerability could enable remote code execution and unauthorized access to sensitive information, including audio/video feeds from cameras.” There are estimated to be 83 million active devices vulnerable to this flaw.
