Major Incidents or Breaches

  • Solana-based decentralized exchange Drift confirmed a security incident on 1 April 2026, resulting in a loss of approximately $285 million. The attack, attributed to North Korean threat actors, exploited durable nonces and social engineering to compromise an admin key and drain five vaults.
  • Hims & Hers Health disclosed a data breach involving the theft of support tickets from a third-party customer service platform (Zendesk).
  • The German political party Die Linke suffered an IT systems outage and data theft, with the Qilin ransomware group claiming responsibility and threatening to leak sensitive data.
  • Meta paused work with data vendor Mercor after a data breach potentially exposed sensitive AI industry secrets, affecting major AI labs.
  • T-Mobile clarified that a recent insider-driven cybersecurity incident had a limited impact.
  • European Commission cloud infrastructure was breached as part of the ongoing TeamPCP supply chain campaign, with over 1,000 SaaS environments reportedly affected. Sportradar was also named among impacted organizations.
  • Sensitive Customs and Border Protection (CBP) facility codes leaked via publicly accessible online flashcards.
  • Axios npm package was compromised in a supply chain attack following a targeted social engineering campaign by North Korean threat actors (UNC1069).
  • ChatGPT experienced a data leak, and a water facility was hit by ransomware, according to SecurityWeek’s round-up.

Newly Discovered Vulnerabilities

  • Critical vulnerabilities in Citrix ShareFile could be chained to bypass authentication and achieve unauthenticated remote code execution (RCE) via arbitrary file uploads.
  • A zero-day vulnerability in the TrueConf video conferencing platform was exploited by a Chinese threat actor for reconnaissance, privilege escalation, and payload execution in attacks on Asian government entities.
  • Microsoft detailed the use of cookie-controlled PHP web shells on Linux servers, enabling persistent remote code execution via cron jobs.
  • A new variant of the SparkCat malware was found in iOS and Android apps on official app stores, stealing images of crypto wallet recovery phrases.
  • React2Shell vulnerability was exploited in a large-scale credential harvesting campaign, compromising over 750 systems.
  • Apple released an iOS 18 patch for the DarkSword mobile OS-cracking tool, extending protection to devices unable to upgrade to iOS 26.
  • Symantec vulnerability and anti-ClickFix mechanisms for macOS were also noted in recent security news.

Notable Threat Actor Activity

  • North Korean threat actors (UNC1069) conducted a targeted social engineering campaign against the Axios npm maintainer, resulting in a supply chain compromise.
  • North Korean actors were attributed to the $285 million Drift DEX heist, leveraging nonce-based transactions and admin key compromise.
  • China-linked TA416 resumed targeting European government and diplomatic organizations since mid-2025, using PlugX malware and OAuth-based phishing.
  • Chinese threat actors exploited a TrueConf zero-day in attacks against Asian governments.
  • TeamPCP’s supply chain campaign continues to expand, with additional attribution disputes involving ShinyHunters and Lapsus$.
  • Criminal threat actors increased phishing attacks by 130% by exploiting the conflict in Iran, according to Bitdefender.
  • Job scam campaigns impersonating Coca-Cola and Ferrari were discovered, targeting user credentials for Google and Facebook accounts.
  • Qilin ransomware group was responsible for the Die Linke breach and extortion.

Trends, Tools, or Tactics of Interest

  • Multi-extortion ransomware attacks are increasingly leveraging stolen data for public leaks, intensifying pressure on victims.
  • Third-party and supply chain risks remain a significant security gap, as highlighted by recent breaches and campaigns.
  • Mobile attack surfaces are expanding due to shadow AI in apps, outdated devices, and zero-click exploits.
  • Threat actors are using HTTP cookies as control channels for PHP web shells on Linux, with persistence achieved via cron jobs.
  • Automated credential harvesting campaigns are utilizing frameworks like Nexus Listener and large-scale scanning.
  • Unmanaged Windows 11 24H2 devices are being force-upgraded by Microsoft to 25H2.
  • LinkedIn was reported to be secretly scanning for over 6,000 Chrome extensions and collecting device data via hidden JavaScript.
  • Emerging research suggests “skull vibration harmonics” could be used for authentication in XR headsets.
  • Chainguard released Factory 2.0, a platform to automate and harden the software supply chain.
  • CrowdStrike’s next-gen SIEM now ingests Microsoft Defender telemetry, reflecting increased integration between major security vendors.
  • Outbound email security and the need for IT staff security awareness training were emphasized in recent industry commentary.
  • Inconsistent privacy labels for mobile apps were highlighted as inadequate for informing users of data practices.

Regulatory or Policy Developments Affecting the Security Industry

  • Governments are implementing varied age-based bans on social media access for children, though execution and effectiveness remain debated.
  • The FBI classified a recent hack as a “major incident,” indicating increased regulatory scrutiny on federal cybersecurity events.