Log in Request a demo
Industry · Technology And SaaS

Our Keys And Customer Logins Are Out There.

Leaked keys, code and customer logins give attackers a way in without breaking anything. Finding them first is faster than cleaning up after.

Request A Demo See The Platform
What We Watch For Technology And SaaS 4 Threats

In Short

Software companies, including SaaS providers, build and run software for others, so a leak at one company can reach many. Keys in public code, stolen developer logins and poisoned software packages give attackers a way in without breaking anything. Finding them first is faster than cleaning up after.

At A GlanceHijacked build tools, poisoned packages, stolen developer logins and leaked keys at software companies, and the rules that apply.

Main Threats

What Threatens Software Companies.

Incident A Hijacked Build Step In March 2025 the popular GitHub Action tj-actions/changed-files was compromised, so every workflow that used it ran malicious code. Read The Incident → Incident A Self-Copying Package Worm In mid-September 2025 the Shai-Hulud worm spread through the npm registry by taking over maintainer accounts. Read The Incident → Incident A Poisoned Library Release On 31 March 2026 two malicious versions of the Axios JavaScript library were published to npm. Read The Incident → Glossary term Stolen Developer Logins Infostealer malware copies saved passwords and sessions from developer machines. The logs are sold. See The Definition →

Compliance

Which Rules Apply To You.

NIS2 Directive The European Commission lists digital infrastructure and some digital services among the sectors the directive covers. It asks covered entities to take appropriate cybersecurity risk-management measures and to notify authorities of significant incidents, and applies to medium-sized and large entities. Official Site ↗
GDPR The EU's main data protection law. It applies to organizations established in the EU that process personal data, and to organizations outside the EU that offer goods or services to people in the EU or monitor their behavior. Official Site ↗

A plain summary of who each rule covers, taken from the official page. Not legal advice. Your legal team decides what applies to you.

Products

How Brandefense Helps.

Threat Landscape

Who Targets Technology And SaaS, And Where.

Akira ransomware group Active Akira is a ransomware group active since March 2023. Since 2023 · Ransomware as a service (per MITRE ATT&CK) Hive Disrupted Hive was a ransomware as a service operation active from June 2021. Since 2021 · Ransomware as a service Medusa Active Medusa is a ransomware-as-a-service operation first identified in June 2021, according to the FBI, CISA and HHS. Since 2021 · Ransomware as a service (closed group until at least early 2023) Qilin Active Qilin, also tracked as Agenda, is a ransomware as a service family that MITRE ATT&CK says has been active since at least 2022. Since 2022 · Ransomware as a service RansomHub Ransomware group RansomHub is a ransomware as a service operation, formerly known as Cyclops and Knight, according to a joint advisory (AA24-242A) from the FBI, CISA, MS-ISAC and HHS released on August 29, 2024. Since 2024 · Ransomware as a service REvil ransomware group Disrupted REvil, also called Sodinokibi, is a ransomware as a service operation that MITRE ATT&CK says ran since at least April 2019. Since 2019 · Ransomware as a service Rhysida Active Rhysida is a ransomware operation that CISA, the FBI and the MS-ISAC say has mainly been deployed against education, healthcare, manufacturing, IT and government organizations since May 2023. Since 2023 · Ransomware as a service (profit-sharing with associates)
ESXiArgs ransomware campaign against VMware ESXi servers Incident In early February 2023 a ransomware campaign hit VMware ESXi servers that were exposed to the internet and not patched. February 2023 · Multiple sectors Hugging Face AI agent intrusion Incident In July 2026 Hugging Face, an AI model and dataset platform, reported an intrusion into part of its production systems, run end to end by an autonomous AI agent. July 2026 · Technology and software supply chain Keyv npm maintainer account takeover Incident In early August 2026, attackers took over the GitHub account of a maintainer of Keyv, a widely used JavaScript caching library, and pushed malware into its npm packages. August 2026 · Technology and software supply chain LiteLLM PyPI package compromise Incident On 24 March 2026, two malicious versions of LiteLLM (1.82.7 and 1.82.8), a widely used AI gateway package, were published to PyPI with a credential stealer that looked for SSH keys, cloud credentials and Kubernetes tokens. March 2026 · Technology and software supply chain Nx Console extension and GitHub repositories breach Incident On 18 May 2026 an attacker published a malicious version 18.95.0 of the Nx Console extension for VS Code, using a real Nx contributor's identity. May 2026 · Technology and software supply chain SolarWinds Orion supply chain compromise Incident The SolarWinds Orion supply chain compromise was disclosed in December 2020, when attackers were found to have put a backdoor into Orion network monitoring updates released between March and June 2020. December 2020 · Technology and software supply chain TanStack npm worm (Mini Shai-Hulud) Incident The TanStack npm worm, also called Mini Shai-Hulud, was a supply chain attack. May 2026 · Technology and software supply chain tj-actions GitHub Action compromise Incident In March 2025 the popular GitHub Action tj-actions/changed-files was compromised. March 2025 · Technology and software supply chain Trivy scanner and GitHub Actions compromise Incident In March 2026 an attacker used stolen credentials to publish a malicious version of the Trivy security scanner and to replace the tags of two of its GitHub Actions with credential-stealing code. March 2026 · Technology and software supply chain
Brazil Country Brazil faces banking trojans and fraud, ransomware against health services and other organizations, and state-linked campaigns. Latin America Canada Country Canada faces state espionage, ransomware against hospitals, governments and critical infrastructure, and pro-Russia denial of service campaigns. North America France Country France faces espionage by state-linked groups, data theft and ransomware, and attacks around big events such as the Paris 2024 Games. Europe Ireland Country Ireland is a European country whose national cyber center (NCSC) leads the response to major cyber incidents. Europe Israel Country Israel is a small, highly connected country that faces frequent cyber activity linked to the region's conflicts. Middle East Japan Country Japan faces cyber espionage linked by its police to China and North Korea, ransomware against manufacturers and smaller firms, and theft of crypto assets. Asia Pacific Netherlands Country The Netherlands faces cyber espionage by Russian and Chinese state actors, ransomware, DDoS attacks and data leaks through suppliers. Europe Nigeria Country Nigeria is one of Africa's largest digital economies, and its own cyber agency says government websites have been defaced and hit by ransomware. Africa Poland Country Poland faces cyber threats from state-linked actors such as APT28, Sandworm and Dragonfly, and from ransomware families such as LockBit. Europe Romania Country Romania is targeted by Russian state-linked actors and hacktivists, according to official sources. Europe Taiwan Country Taiwan faces constant cyber pressure that its National Security Bureau ties to China: 2.63 million intrusion attempts a day against critical infrastructure in 2025, by the Bureau's count. Asia Pacific Ukraine Country Ukraine is the country where Russian state cyber operations have been most destructive, from the 2015 power grid attack to wiper malware in 2022. Europe United States Country This page collects what matters for cyber threats in the United States: the sectors attackers go after, the threat groups that US government sources link to the country, the major national incidents, and the bodies and rules to know. North America

FAQ

Frequently Asked Questions.

  • Can it find our keys in public code?

    Search of public code hosts and paste sites is part of the leak watch. Ask in the demo how it covers your repositories.

  • Does it scan our dependencies?

    No. It looks from outside at exposure and at criminal sources. Dependency scanning is a different tool.

  • Which rules apply to a SaaS company?

    NIS2 covers digital infrastructure and some digital services for medium-sized and large entities, and GDPR applies to personal data. Check with your legal team.

  • What should we do after a leaked key?

    Rotate it first, then check logs for use. The finding shows where it was found and when.

  • What is a hijacked build step?

    In March 2025 a popular build action called tj-actions/changed-files was compromised. Every workflow that used it ran malicious code. It shows how one shared tool can reach many software companies.

  • What is a self-copying package worm?

    In mid-September 2025 the Shai-Hulud worm spread through a public package registry by taking over maintainer accounts. Poisoned packages give attackers a way in without breaking anything. Cyber Threat Intelligence follows campaigns that target software supply chains.

  • How do stolen developer logins reach attackers?

    Infostealer malware copies saved passwords and sessions from developer machines. The logs are sold. Dark Web Monitoring alerts you when staff, developer or customer logins tied to your domains appear in criminal markets.

  • Why do forgotten test environments matter?

    Services, test environments and storage that face the internet can be used by attackers, even if nobody remembers them. External Attack Surface Management shows what you expose, including the forgotten ones.

  • How can a SaaS company see which flaws are being exploited now?

    Vulnerability Intelligence tells you which flaws are being exploited now. That helps your team fix the ones that matter first.

  • Why can a leak at one software company reach many customers?

    Software companies build and run software for others, so a leak at one company can reach many. Keys in public code, stolen developer logins and poisoned software packages give attackers a way in without breaking anything. Data leak detection finds your documents and code where they should not be.

Mentioned In
  1. Navigating DRPS to Safeguard Intellectual Property in the Tech Sector →March 2024
  2. APT18 →Threat group
  3. APT19 →Threat group

Related Reading.

Knowledge Hub →
Glossary Infostealer An infostealer is a type of malware that copies saved passwords, browser cookies and other data from an infected device and sends it to the attacker. Open → 101 guide External Attack Surface Management 101 How to find, check and reduce everything an attacker could reach from the internet, and how to keep that list true as your company changes. Open → 101 guide Threat Intelligence 101 A plain introduction to threat intelligence: what it is, how it works and how a small team can start using it. Open →

Other Ways In.

All Roles →
RoleCIO and IT directorSee what your company exposes to the internet, which suppliers carry risk into your systems, and… RoleCISOSee what is exposed outside your network in terms a board understands, and know what to… Threat groupAPT18APT18 (MITRE G0026) is described by MITRE ATT&CK as a threat group active since at least… Threat groupAPT19MITRE ATT&CK describes APT19 (also Codoso) as a Chinese-based group that has targeted defense, finance, legal…

For Technology And SaaS

Stay Ahead Of Digital Threats.

Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.

Request a demo See The Platform