Threat Intelligence Center

The Cybersecurity and Infrastructure Security Agency has partnered with industry stakeholders to address growing security gaps in automatic tank gauge systems deployed across chemical manufacturing, energy production, food and agriculture, and transportation sectors.

The browser has become the primary attack surface for AI-enabled threats targeting professional service firms. Threat actors including BlackFile and ShinyHunters are deploying browser-based malware and attack frameworks—ClickFix, ConsentFix, InstallFix, and LLMShare among them—to establish initial access and maintain persistence.

Microsoft Entra is accelerating passwordless authentication adoption by promoting passkeys as the primary identity verification method. This shift reflects industry movement toward eliminating password-based vulnerabilities that remain a primary attack vector for credential theft and unauthorized access.

Security researchers have tracked TeamPCP's supply chain campaign targeting AI, machine learning, and cloud computing developers. The threat actors distribute malicious packages through the Nx Console VS Code extension and npm repositories, including Mini Shai-Hulud, Shai-Hulud framework, durabletask, echarts-for-react, and size-sensor.

Security researchers have disclosed a critical vulnerability in CIFSwitch Linux that permits unauthenticated attackers to obtain root-level access on affected systems. This flaw impacts multiple Linux distributions running vulnerable versions of CIFSwitch. The vulnerability bypasses standard authentication mechanisms, allowing direct privilege escalation.

Redline infostealer malware has become a critical tool in the hands of ransomware affiliates, initial access brokers, and extortion groups targeting professional service firms. By stealing session cookies and authentication tokens, attackers can bypass multi-factor authentication and gain persistent access to corporate networks without requiring valid credentials.