Cybersecurity Brief – 2026-04-11

Sat, 11 Apr 2026 00:00:00 +0000

Major Incidents or Breaches

CPUID suffered a supply chain attack where hackers altered download links for CPU-Z and HWMonitor, serving malicious executables via the official website.
Telehealth company Hims experienced a breach, exposing highly sensitive personal health information (PHI) of users.
Medical technology firm Stryker was impacted by a cyberattack.
Microsoft reported that the financially motivated threat actor Storm-2755 targeted Canadian employees in payroll hijacking attacks.
Nearly 4,000 US industrial devices, including PLCs, have been identified as exposed to Iranian-linked cyberattacks targeting critical infrastructure.
Fake websites impersonating Claude AI were found distributing PlugX malware, providing attackers remote access to victim systems.

Juniper Networks patched multiple vulnerabilities in Junos OS, including a critical flaw that allows remote, unauthenticated takeover of affected devices.
Chrome 147 addressed 60 vulnerabilities, including two critical bugs in the WebML component.
Orthanc DICOM software vulnerabilities were disclosed, leading to potential denial-of-service, information disclosure, and remote code execution.
A critical vulnerability in Marimo was exploited in the wild within nine hours of public disclosure.
ClickFix campaigns exploited a new method to infect Macs by bypassing macOS Tahoe’s Terminal warnings, using Script Editor instead.

The “Silver Fox” threat actor is conducting tax-themed phishing campaigns targeting Japanese firms during tax season.
Ongoing GlassWorm campaign now uses a Zig dropper to infect developer integrated development environments (IDEs).
Iranian-linked hackers are actively targeting US critical infrastructure by manipulating PLCs and SCADA systems.
Storm-2755 continues payroll hijacking attacks, focusing on Canadian employees.
Recovery scammers are targeting individuals who have already been victims of fraud, leveraging so-called “sucker lists.”

Analysis of one billion CISA KEV remediation records indicates that most critical vulnerabilities are exploited before defenders can patch, highlighting the limitations of human-scale security operations.
Device Bound Session Credentials (DBSC) have been rolled out in Chrome 146 and above to prevent session theft by cryptographically binding authentication to devices.
Google introduced end-to-end encryption (E2EE) for Gmail on Android and iOS, now available for enterprise users.
AI browser extensions are emerging as an unmonitored channel for AI consumption, raising new security concerns.
Anthropic’s Mythos Preview AI model, capable of finding and exploiting zero-days, is drawing attention to the risks of advanced exploit-writing AI tools.
MITRE released the Fight Fraud Framework, providing a behavior-based model of fraud tactics and techniques.
ClickFix demonstrates a new macOS infection vector by using Script Editor to bypass standard paste warnings.
LayerX and other security vendors highlight the risk of browser extensions as attack vectors, particularly in the context of AI and GenAI usage.

FINRA launched a Financial Intelligence Fusion Center to enhance response to cybersecurity and fraud threats in the financial sector.
Increased compliance oversight pressure is reported across public sector cybersecurity, with leaders now required to prove security effectiveness, not just prevent attacks.