Cybersecurity articles tagged #Data Exfiltration on RuntimeRebel.https://runtimerebel.comhttps://runtimerebel.com/blog/cryptographic-context-injection-exposes-grok-chat-datahttps://runtimerebel.com/blog/cryptographic-context-injection-exposes-grok-chat-dataAdversa AI reveals Cryptographic Context Injection, allowing web pages to steal Grok user data and chat prompts without user consent.Thu, 20 Aug 2026 16:23:24 GMTXaiAdversa AIPrompt InjectionData ExfiltrationGrokhttps://runtimerebel.com/blog/cve-2026-24301-cosnitch-exploits-microsoft-copilot-personalhttps://runtimerebel.com/blog/cve-2026-24301-cosnitch-exploits-microsoft-copilot-personalVaronis disclosed CoSnitch (CVE-2026-24301), affecting Microsoft Copilot Personal, enabling one-click data exfiltration and persistent memory poisoning.Wed, 19 Aug 2026 00:39:19 GMTData ExfiltrationPrompt InjectionCVE-2026-24301Microsoft Copilot PersonalMemory Poisoninghttps://runtimerebel.com/blog/beacon-crm-data-breach-exposes-over-1000-charity-databaseshttps://runtimerebel.com/blog/beacon-crm-data-breach-exposes-over-1000-charity-databasesBeacon CRM data breach exposed personal details of supporters across 1,000+ charities due to a compromised AWS access key.Sun, 16 Aug 2026 00:43:21 GMTData BreachCloud SecurityData ExfiltrationBeacon CRMCharitieshttps://runtimerebel.com/blog/webmail-css-injection-hidden-data-exfiltration-threatshttps://runtimerebel.com/blog/webmail-css-injection-hidden-data-exfiltration-threatsSecurity researchers warn that Cascading Style Sheets can exfiltrate sensitive data from webmail inboxes if vendors fail to sanitize styles.Mon, 10 Aug 2026 01:01:51 GMTWeb SecurityData ExfiltrationPhishingVulnerabilitieshttps://runtimerebel.com/blog/rovoblast-critical-one-click-p2p-injection-in-atlassian-rovo-aihttps://runtimerebel.com/blog/rovoblast-critical-one-click-p2p-injection-in-atlassian-rovo-aiVaronis disclosed a critical one-click parameter-to-prompt injection, dubbed RovoBlast, in Atlassian Rovo AI, enabling enterprise data exfiltration.Sat, 08 Aug 2026 16:23:23 GMTData ExfiltrationEnterprise SecurityAI SecurityAtlassian Rovo AIRovoBlasthttps://runtimerebel.com/blog/atlassian-rovo-indirect-prompt-injection-exfiltrates-jira-datahttps://runtimerebel.com/blog/atlassian-rovo-indirect-prompt-injection-exfiltrates-jira-dataAtlassian Rovo is vulnerable to indirect prompt injection and URL parameter manipulation, leaking Jira and Confluence data to external servers.Sat, 08 Aug 2026 16:21:55 GMTZero-DayData ExfiltrationCloud SecurityAtlassianJirahttps://runtimerebel.com/blog/levi-strauss-co-corporate-data-stolen-via-social-engineeringhttps://runtimerebel.com/blog/levi-strauss-co-corporate-data-stolen-via-social-engineeringLevi Strauss & Co. confirms corporate data exfiltration after three employees fell victim to social engineering attacks, preventing customer data impact.Fri, 07 Aug 2026 16:42:59 GMTLevi StraussSocial EngineeringData ExfiltrationCorporate DataUNC6671https://runtimerebel.com/blog/ai-security-strategy-managing-the-network-as-a-control-planehttps://runtimerebel.com/blog/ai-security-strategy-managing-the-network-as-a-control-planeAnalyze the transition of network firewalls into the primary control plane for securing AI workloads and preventing data exfiltration in enterprise environments.Thu, 30 Jul 2026 14:06:15 GMTAI SecurityNetwork FirewallLLM SecurityData ExfiltrationZero Trusthttps://runtimerebel.com/blog/shinyhunters-targeting-healthcare-data-theft-surges-health-isac-warnshttps://runtimerebel.com/blog/shinyhunters-targeting-healthcare-data-theft-surges-health-isac-warnsHealth-ISAC warns of increasing ShinyHunters data theft attacks on healthcare and med-tech organizations. Learn about TTPs and critical mitigations.Wed, 29 Jul 2026 20:57:58 GMTShinyHuntersHealthcareData TheftHealth ISACPhishingData Exfiltrationhttps://runtimerebel.com/blog/shinyhunters-claims-ernst-young-hack-analysis-of-third-party-riskshttps://runtimerebel.com/blog/shinyhunters-claims-ernst-young-hack-analysis-of-third-party-risksErnst & Young faces data theft claims from ShinyHunters following a breach of a third-party platform. Learn about the impact and vendor security mitigation.Wed, 29 Jul 2026 06:32:39 GMTShinyHuntersErnst YoungThird Party RiskData ExfiltrationFinancial Serviceshttps://runtimerebel.com/blog/coca-cola-subsidiary-fairlife-impacted-by-ransomware-data-thefthttps://runtimerebel.com/blog/coca-cola-subsidiary-fairlife-impacted-by-ransomware-data-theftThe Coca-Cola Company confirms a data breach at subsidiary Fairlife following a ransomware attack. Learn about the impact and mitigation strategies.Mon, 27 Jul 2026 17:43:54 GMTFairlifeCoca ColaRansomwareData ExfiltrationThird Party Riskhttps://runtimerebel.com/blog/mcbs-data-breach-pear-ransomware-group-impacts-1-2-million-patientshttps://runtimerebel.com/blog/mcbs-data-breach-pear-ransomware-group-impacts-1-2-million-patientsMedical Business Management Services (MCBS) confirms a massive data breach affecting 1.2 million people after a 3 TB data theft by the PEAR ransomware group.Mon, 27 Jul 2026 07:34:29 GMTMCBSPEAR RansomwareHealthcare SecurityData Exfiltrationhttps://runtimerebel.com/blog/ontrac-data-breach-corporate-network-hack-compromises-customer-infohttps://runtimerebel.com/blog/ontrac-data-breach-corporate-network-hack-compromises-customer-infoOnTrac discloses a corporate network breach impacting customer personal data. Learn about the incident timeline and how to mitigate logistics sector risks.Fri, 24 Jul 2026 21:05:16 GMTOntracData ExfiltrationLogistics SecurityPii Breachhttps://runtimerebel.com/blog/anubis-ransomware-targets-fairlife-threatens-data-leakhttps://runtimerebel.com/blog/anubis-ransomware-targets-fairlife-threatens-data-leakThe Anubis ransomware gang claims responsibility for a cyberattack on Coca-Cola's Fairlife, threatening a data leak. Learn about their TTPs and mitigation.Tue, 21 Jul 2026 21:12:30 GMTAnubis RansomwareFairlifeCoca ColaData ExfiltrationRansomware Grouphttps://runtimerebel.com/blog/hollowgraph-malware-uses-microsoft-graph-for-stealthy-c2https://runtimerebel.com/blog/hollowgraph-malware-uses-microsoft-graph-for-stealthy-c2HollowGraph malware leverages Microsoft Graph API calendar features for covert command-and-control and data exfiltration from Microsoft 365 environments.Mon, 20 Jul 2026 18:05:43 GMTHollowGraphMicrosoft GraphMicrosoft 365C2Data ExfiltrationAPI Abusehttps://runtimerebel.com/blog/hollowgraph-malware-leverages-microsoft-365-calendar-for-stealthy-c2https://runtimerebel.com/blog/hollowgraph-malware-leverages-microsoft-365-calendar-for-stealthy-c2HollowGraph, a new espionage malware, hides C2 commands and exfiltrates data via legitimate Microsoft 365 calendar events, mimicking normal Graph API traffic.Mon, 20 Jul 2026 18:05:24 GMTHollowGraphMicrosoft 365Microsoft Graph APIEspionageC2Data ExfiltrationGroup IBhttps://runtimerebel.com/blog/okobot-framework-multi-payload-data-crypto-theft-attackshttps://runtimerebel.com/blog/okobot-framework-multi-payload-data-crypto-theft-attacksThe new OkoBot framework deploys over 20 distinct payloads, primarily targeting cryptocurrency seed phrases, credentials, and sensitive data.Thu, 16 Jul 2026 21:02:27 GMTOkoBotMalwareInfostealerCryptocurrency TheftCredential TheftData Exfiltrationhttps://runtimerebel.com/blog/spirals-ransomware-rapid-network-encryption-in-under-24-hourshttps://runtimerebel.com/blog/spirals-ransomware-rapid-network-encryption-in-under-24-hoursAnalysis of Spirals ransomware, a high-velocity threat actor capable of completing corporate intrusions and data encryption in less than one day.Thu, 16 Jul 2026 10:12:46 GMTSpirals RansomwareScreenconnectRcloneData Exfiltrationhttps://runtimerebel.com/blog/xai-grok-build-repository-upload-risks-analyzing-cli-data-exposurehttps://runtimerebel.com/blog/xai-grok-build-repository-upload-risks-analyzing-cli-data-exposurexAI's Grok Build CLI version 0.2.93 discovered uploading entire Git repositories, including history and secrets, to remote storage without user consent.Tue, 14 Jul 2026 09:59:54 GMTXaiGrok BuildGit SecurityData ExfiltrationAI Securityhttps://runtimerebel.com/blog/lidl-data-breach-service-provider-hack-exposes-customer-infohttps://runtimerebel.com/blog/lidl-data-breach-service-provider-hack-exposes-customer-infoLidl notifies customers in Germany, Belgium, and Netherlands after a third-party service provider breach exposed personal data and order histories.Mon, 13 Jul 2026 14:40:17 GMTLidl BreachThird Party RiskSupply Chain AttackRetail SecurityData Exfiltrationhttps://runtimerebel.com/blog/healthcare-service-provider-cyberattacks-surge-supply-chain-riskhttps://runtimerebel.com/blog/healthcare-service-provider-cyberattacks-surge-supply-chain-riskCyberattacks on healthcare service providers more than doubled in H1 2026, signaling a shift in targeting toward the medical supply chain and data aggregators.Sat, 11 Jul 2026 06:14:50 GMTHealthcare SecuritySupply Chain AttackH1 2026 TrendsData Exfiltrationhttps://runtimerebel.com/blog/progress-sharefile-storage-zone-controller-security-threat-shut-down-nowhttps://runtimerebel.com/blog/progress-sharefile-storage-zone-controller-security-threat-shut-down-nowProgress Software urges customers to shut down ShareFile Storage Zone Controllers immediately following reports of a credible external security threat.Fri, 10 Jul 2026 21:06:52 GMTProgress SoftwareShareFileStorage Zone ControllerData ExfiltrationWindows Serverhttps://runtimerebel.com/blog/dialogflow-cx-rogue-agent-bug-enabled-ai-conversation-hijackinghttps://runtimerebel.com/blog/dialogflow-cx-rogue-agent-bug-enabled-ai-conversation-hijackingA 'Rogue Agent' vulnerability in Google Dialogflow CX could have allowed attackers to silently manipulate AI conversations, exfiltrate data, and compromise multiple…Wed, 08 Jul 2026 14:16:28 GMTGoogle Dialogflow CXRogue AgentAIConversation HijackingData ExfiltrationCloud Securityhttps://runtimerebel.com/blog/citrixbleed-netscaler-memory-disclosure-exploited-post-disclosurehttps://runtimerebel.com/blog/citrixbleed-netscaler-memory-disclosure-exploited-post-disclosureCitrixBleed, a new vulnerability in NetScaler appliances, is being actively exploited using public PoC code to retrieve arbitrary memory content. Patch immediately.Fri, 03 Jul 2026 07:27:45 GMTCitrix BleedNetScalerArbitrary Memory ContentPoC ExploitationData Exfiltrationhttps://runtimerebel.com/blog/ai-agents-vulnerable-to-data-leak-via-poisoned-mcp-toolshttps://runtimerebel.com/blog/ai-agents-vulnerable-to-data-leak-via-poisoned-mcp-toolsMicrosoft warns that malicious tool descriptions for AI agents can lead to stealthy data exfiltration, bypassing security controls by mimicking routine actions.Wed, 01 Jul 2026 01:02:51 GMTAI AgentsData ExfiltrationSupply Chain AttackMicrosoftPrompt Injectionhttps://runtimerebel.com/blog/agentic-ai-identity-problem-new-attack-surface-for-enterpriseshttps://runtimerebel.com/blog/agentic-ai-identity-problem-new-attack-surface-for-enterprisesAgentic AI systems pose novel identity and access management challenges, creating new attack vectors for data exfiltration and privilege escalation.Mon, 29 Jun 2026 17:07:07 GMTAgentic AIAI SecurityIdentity ManagementLLM SecurityPrivilege EscalationData ExfiltrationZero Trusthttps://runtimerebel.com/blog/klue-supply-chain-attack-hits-salesforce-instances-of-security-firmshttps://runtimerebel.com/blog/klue-supply-chain-attack-hits-salesforce-instances-of-security-firmsAttackers breached competitive intelligence platform Klue, exfiltrating data from Salesforce instances of customers including Huntress and Recorded Future.Fri, 19 Jun 2026 09:44:49 GMTKlueSalesforceHuntressRecorded FutureSaaS SecurityData Exfiltrationhttps://runtimerebel.com/blog/chinese-espionage-google-workspace-rule-abuse-in-research-sectorshttps://runtimerebel.com/blog/chinese-espionage-google-workspace-rule-abuse-in-research-sectorsChina-linked threat actors exploited REDCap server backdoors and manipulated Google Workspace mail rules to exfiltrate North American research data.Tue, 16 Jun 2026 01:12:06 GMTREDCapGoogle WorkspaceCyber EspionageChinaData Exfiltrationhttps://runtimerebel.com/blog/china-nexus-actor-year-long-espionage-against-us-researchershttps://runtimerebel.com/blog/china-nexus-actor-year-long-espionage-against-us-researchersA China-nexus actor spied on US researchers for a year, stealing RedCAP credentials and exfiltrating sensitive data from numerous institutions, discovered by Google.Mon, 15 Jun 2026 17:49:38 GMTChina Nexus ActorEspionageUS ResearchersRedCAP CredentialsData ExfiltrationNation State Threathttps://runtimerebel.com/blog/microsoft-365-copilot-searchleak-one-click-data-exfiltrationhttps://runtimerebel.com/blog/microsoft-365-copilot-searchleak-one-click-data-exfiltrationVaronis Threat Labs uncovered 'SearchLeak', a one-click flaw in Microsoft 365 Copilot Enterprise Search allowing exfiltration of emails, files, and MFA codes.Mon, 15 Jun 2026 17:44:57 GMTMicrosoft 365 CopilotSearchLeakData ExfiltrationOne Click ExploitVaronis Threat Labshttps://runtimerebel.com/blog/university-of-nottingham-confirms-breach-after-shinyhunters-data-leakhttps://runtimerebel.com/blog/university-of-nottingham-confirms-breach-after-shinyhunters-data-leakThe University of Nottingham confirms a data breach after the ShinyHunters group leaked over 450,000 records, highlighting risks to academic data security.Thu, 11 Jun 2026 09:39:20 GMTShinyHuntersUniversity of NottinghamHigher EducationData ExfiltrationPII Leakhttps://runtimerebel.com/blog/openai-chatgpt-lockdown-mode-mitigating-prompt-injection-exfiltrationhttps://runtimerebel.com/blog/openai-chatgpt-lockdown-mode-mitigating-prompt-injection-exfiltrationOpenAI introduces ChatGPT Lockdown Mode for personal accounts to prevent prompt injection attacks from exfiltrating sensitive data via external tools.Sat, 06 Jun 2026 16:29:48 GMTOpenAIChatGPTPrompt InjectionData ExfiltrationAI SecurityLockdown Modehttps://runtimerebel.com/blog/dashlane-brute-force-attack-safeguarding-encrypted-password-vaultshttps://runtimerebel.com/blog/dashlane-brute-force-attack-safeguarding-encrypted-password-vaultsDashlane reports a brute-force attack resulting in the download of encrypted user vaults. Learn about the impact and remediation steps for this identity threat.Tue, 02 Jun 2026 09:34:12 GMTDashlaneBrute ForceCredential StuffingPassword ManagerData Exfiltrationhttps://runtimerebel.com/blog/enterprise-ai-risk-concentrated-among-power-users-in-2026-reporthttps://runtimerebel.com/blog/enterprise-ai-risk-concentrated-among-power-users-in-2026-reportLayerX Security’s 2026 report reveals that enterprise AI risk is concentrated among power users, highlighting a significant visibility gap for security teams.Thu, 28 May 2026 13:24:16 GMTLayerX SecurityAI SecurityData ExfiltrationShadow AIInsider Riskhttps://runtimerebel.com/blog/malicious-npm-package-targets-claude-ai-user-data-technical-analysishttps://runtimerebel.com/blog/malicious-npm-package-targets-claude-ai-user-data-technical-analysisResearchers discover mouse5212-super-formatter, a malicious npm package designed to exfiltrate sensitive files from Claude AI user directories.Wed, 27 May 2026 17:12:05 GMTNPMClaude AISupply Chain AttackData ExfiltrationAnthropichttps://runtimerebel.com/blog/github-data-breach-analysis-of-teampcp-internal-repository-thefthttps://runtimerebel.com/blog/github-data-breach-analysis-of-teampcp-internal-repository-theftGitHub confirms the theft of 4,000 internal repositories by threat actor TeamPCP. Learn the technical implications and defense strategies for security teams.Thu, 21 May 2026 09:16:24 GMTGitHubTeamPCPSource Code TheftInternal RepositoriesData Exfiltrationhttps://runtimerebel.com/blog/blackfile-analyzing-unc6671-vishing-cloud-data-extortionhttps://runtimerebel.com/blog/blackfile-analyzing-unc6671-vishing-cloud-data-extortionExamines UNC6671's BlackFile vishing, AiTM, and cloud data exfiltration tactics against Microsoft 365 & Okta. Actionable mitigations included.Fri, 15 May 2026 20:32:33 GMTUNC6671BlackFileVishingAitMMicrosoft 365OktaSharePointOneDriveData ExfiltrationExtortionSocial Engineeringhttps://runtimerebel.com/blog/west-pharmaceutical-breach-analysis-of-system-encryptionhttps://runtimerebel.com/blog/west-pharmaceutical-breach-analysis-of-system-encryptionWest Pharmaceutical Services confirms data exfiltration and system encryption in a major cyberattack. Learn about the impact and defense strategies.Thu, 14 May 2026 00:55:20 GMTWest PharmaceuticalRansomwareData ExfiltrationPharmaceutical SectorManufacturinghttps://runtimerebel.com/blog/anatomy-of-e-commerce-fraud-detecting-and-mitigating-phishing-siteshttps://runtimerebel.com/blog/anatomy-of-e-commerce-fraud-detecting-and-mitigating-phishing-sitesA technical analysis of fraudulent retail infrastructure, exploring domain spoofing, CDN obfuscation, and credit card exfiltration techniques.Wed, 13 May 2026 09:10:20 GMTPhishingE Commerce FraudSocial EngineeringDomain SpoofingData Exfiltrationhttps://runtimerebel.com/blog/hugging-face-model-supply-chain-vulnerability-tokenizer-hijackinghttps://runtimerebel.com/blog/hugging-face-model-supply-chain-vulnerability-tokenizer-hijackingAttackers can weaponize Hugging Face AI models by manipulating tokenizer files, leading to model output hijacking and sensitive data exfiltration.Tue, 12 May 2026 20:40:02 GMTHugging FaceAI SecurityML SecuritySupply Chain AttackData ExfiltrationTokenizer Manipulationhttps://runtimerebel.com/blog/llm-text-in-text-steganography-emerging-covert-channel-riskshttps://runtimerebel.com/blog/llm-text-in-text-steganography-emerging-covert-channel-risksAnalysis of how Large Language Models enable sophisticated text-in-text steganography for covert communication, data exfiltration, and C2 operations.Mon, 11 May 2026 13:11:36 GMTLLMSteganographyData ExfiltrationAI SecurityCovert Channelshttps://runtimerebel.com/blog/bypassing-enterprise-dlp-via-browser-based-data-exfiltrationhttps://runtimerebel.com/blog/bypassing-enterprise-dlp-via-browser-based-data-exfiltrationExamine how modern SaaS workflows and generative AI prompts bypass traditional DLP, creating significant visibility gaps in enterprise security posture.Thu, 07 May 2026 16:41:43 GMTDLPData ExfiltrationSaaS SecurityGenAI RiskBrowser Securityhttps://runtimerebel.com/blog/google-chrome-abe-bypass-heightened-infostealer-threathttps://runtimerebel.com/blog/google-chrome-abe-bypass-heightened-infostealer-threatVoidStealer Trojan authors bypass Google Chrome's App-Bound Encryption (ABE), enabling infostealers to exfiltrate cookies and credentials from users.Thu, 07 May 2026 00:51:02 GMTGoogle ChromeApp Bound EncryptionABE BypassVoidStealerInfostealerData Exfiltrationhttps://runtimerebel.com/blog/sandhills-medical-ransomware-breach-affects-170000-patientshttps://runtimerebel.com/blog/sandhills-medical-ransomware-breach-affects-170000-patientsSandhills Medical Foundation discloses a data breach affecting 170,000 individuals after an Inc Ransom attack involving sensitive medical and personal data.Thu, 30 Apr 2026 08:53:00 GMTInc RansomSandhills Medical FoundationHealthcare SecurityPHIData Exfiltrationhttps://runtimerebel.com/blog/nsa-insider-threat-lessons-chris-inglis-on-post-snowden-securityhttps://runtimerebel.com/blog/nsa-insider-threat-lessons-chris-inglis-on-post-snowden-securityFormer NSA Deputy Director Chris Inglis reflects on the Snowden leaks, offering critical insights for CISOs on insider threat detection and enculturation.Wed, 29 Apr 2026 08:54:19 GMTInsider ThreatNSAChris InglisEdward SnowdenData ExfiltrationCyber Culturehttps://runtimerebel.com/blog/trigona-ransomware-custom-tool-for-faster-data-exfiltrationhttps://runtimerebel.com/blog/trigona-ransomware-custom-tool-for-faster-data-exfiltrationTrigona ransomware operators are employing a new custom command-line tool to accelerate data exfiltration, posing a significant threat to compromised networks.Thu, 23 Apr 2026 20:26:10 GMTTrigonaRansomwareData ExfiltrationCustom ToolCybercrimehttps://runtimerebel.com/blog/microsoft-and-salesforce-patch-prompt-injection-flaws-in-ai-agentshttps://runtimerebel.com/blog/microsoft-and-salesforce-patch-prompt-injection-flaws-in-ai-agentsResearchers identified prompt injection vulnerabilities in Microsoft Copilot and Salesforce Agentforce that could allow attackers to exfiltrate sensitive data.Wed, 15 Apr 2026 12:32:01 GMTMicrosoft CopilotSalesforce AgentforcePrompt InjectionData ExfiltrationAI Securityhttps://runtimerebel.com/blog/mcgraw-hill-data-breach-salesforce-misconfiguration-exploitedhttps://runtimerebel.com/blog/mcgraw-hill-data-breach-salesforce-misconfiguration-exploitedMcGraw-Hill confirms a data breach after threat actors exploited a Salesforce misconfiguration, exposing internal records and student information.Tue, 14 Apr 2026 20:25:19 GMTMcGraw HillSalesforceMogilevichMisconfigurationData Exfiltrationhttps://runtimerebel.com/blog/hims-data-breach-exposes-patient-phi-technical-impact-analysishttps://runtimerebel.com/blog/hims-data-breach-exposes-patient-phi-technical-impact-analysisAnalysis of the Hims & Hers Health data breach exposing sensitive PHI. Learn how threat actors use health data for targeted extortion and phishing campaigns.Sat, 11 Apr 2026 00:38:27 GMTHims Hers HealthPhi ExposureTelehealth SecurityData ExfiltrationExtortionhttps://runtimerebel.com/blog/securing-enterprise-browser-environments-against-ai-extension-riskshttps://runtimerebel.com/blog/securing-enterprise-browser-environments-against-ai-extension-risksDiscover the security blind spots of AI browser extensions and how to mitigate data exfiltration risks in corporate environments via managed policies.Fri, 10 Apr 2026 12:25:18 GMTBrowser SecurityAI ThreatsShadow AIData ExfiltrationLayerX