Cybersecurity Brief – 2026-04-02

Thu, 02 Apr 2026 00:00:00 +0000

Major Incidents or Breaches

Hasbro, the global toy manufacturer, has disclosed a cyberattack and is investigating the extent of potential data compromise.
The Axios NPM package was breached in a North Korean supply chain attack. Attackers used a stolen NPM access token to bypass GitHub Actions OIDC-based CI/CD controls and publish backdoored package versions.
CERT-UA reported a phishing campaign impersonating the agency to distribute AGEWHEEZE malware to approximately 1 million email addresses.
TrueConf conference servers were targeted via a zero-day vulnerability, allowing attackers to execute arbitrary files on connected endpoints through malicious software updates.
Over 2.3 million Android devices were infected with the NoVoice malware, which was distributed through more than 50 apps on Google Play.
A new service, EvilTokens, is enabling device code phishing attacks against Microsoft accounts, facilitating advanced business email compromise (BEC) campaigns.
The TeamPCP supply chain campaign update confirmed its first victim and documented post-compromise cloud enumeration activities, with attribution narrowing towards specific threat actors.
A new phishing campaign is targeting Spanish-speaking users in Latin America and Europe with dynamic PDF lures to deliver Casbaneiro (Metamorfo) banking trojans.
Cyberattacks against Latin American governments have intensified, with disruptive incidents in Puerto Rico and a surge in attacks on Colombia’s health sector.
The US Department of Justice has charged an individual for exploiting smart contract vulnerabilities to steal $55 million from the Uranium crypto exchange, leading to its shutdown.

Newly Discovered Vulnerabilities

Google released patches for 21 vulnerabilities in Chrome, including the actively exploited zero-day CVE-2026-5281 affecting the Dawn component. This is the fourth Chrome zero-day exploited in 2026.
Apple expanded the iOS 18.7.7 and iPadOS 18.7.7 security updates to more devices to address the DarkSword exploit kit, which is being actively exploited.
A zero-day vulnerability in TrueConf conferencing software was exploited in the wild to deliver malicious updates and execute arbitrary files on endpoints.

Notable Threat Actor Activity

North Korean threat actors are attributed to the Axios NPM supply chain attack, leveraging a compromised token to distribute malicious packages.
Microsoft and Malwarebytes warn of an ongoing campaign distributing VBS malware via WhatsApp messages on Windows. The campaign uses UAC bypass techniques to hijack systems and has been active since late February 2026.
The Casbaneiro group continues to target Spanish-speaking users in Latin America and Europe with phishing campaigns delivering banking trojans.
The Venom Stealer malware-as-a-service (MaaS) platform is automating persistent information-stealing attacks, specifically commoditising ClickFix social engineering techniques.
The new CrystalRAT malware, promoted via Telegram, combines remote access, credential theft, keylogging, and clipboard hijacking, and is available as malware-as-a-service.

Trends, Tools, or Tactics of Interest

Attackers are increasingly leveraging legitimate tools and valid credentials for initial access, with a decline in traditional malware use. Common vectors include VPN abuse, remote monitoring and management (RMM) tools, and social engineering.
Fileless malware and malicious scripts are being used to minimise filesystem footprint while maintaining persistence.
Device code phishing and business email compromise are being facilitated by new toolkits like EvilTokens.
ClickFix attacks are being commoditised via MaaS platforms, with new malware such as DeepLoad deployed to steal credentials, install malicious browser extensions, and propagate via USB drives.
The public sector and education face persistent threats, with resource constraints and human risk remaining key vulnerabilities.
Fraudsters are increasingly targeting the digital assets of deceased individuals and their families for account takeover and scams.

Regulatory or Policy Developments Affecting the Security Industry

The FBI issued a warning regarding privacy and data security risks associated with Chinese-developed mobile applications, though no specific apps were named.
The US Department of Justice continues to pursue prosecution of cybercriminals, as evidenced by the Uranium crypto exchange case.

Other Notable Industry Developments

Linx Security raised $50 million to advance identity security and governance solutions.
Depthfirst secured $80 million in Series B funding to expand AI research and security model development.

Cybersecurity Brief – 2026-04-01

Wed, 01 Apr 2026 00:00:00 +0000

Major Incidents or Breaches

Cisco Source Code Breach: Cisco confirmed a cyberattack resulting in the theft of internal source code. Attackers leveraged credentials stolen in the recent Trivy supply chain incident to breach Cisco’s development environment.
Axios NPM Package Compromise: The npm account for Axios, a widely-used JavaScript HTTP client, was hijacked to distribute remote access trojans targeting Linux, Windows, and macOS. The attack is suspected to have North Korean threat actor involvement.
Claude Code Source Leak: Anthropic disclosed that internal source code for its Claude Code AI assistant was inadvertently published via an npm packaging error. No customer data or credentials were exposed.
TrueConf Zero-Day Exploitation: Government networks in Southeast Asia were targeted using a zero-day vulnerability in TrueConf video conferencing software, in a campaign dubbed “Operation TrueChaos.”
Uranium Finance Crypto Exchange Theft: A Maryland individual was charged with stealing $53 million from Uranium Finance through two hacks, subsequently laundering the proceeds via a cryptocurrency mixer.

Newly Discovered Vulnerabilities

Vertex AI Over-Privilege Flaw: Researchers identified a security issue in Google Cloud’s Vertex AI platform where attackers could weaponize AI agents to access sensitive data and private artifacts due to excessive permissions.
Vim and Emacs RCE Bugs: Remote code execution vulnerabilities were discovered in Vim and GNU Emacs editors, triggered by simply opening a malicious file. These were identified using Anthropic’s Claude AI.
GIGABYTE Control Center Arbitrary File Write: The GIGABYTE Control Center utility is vulnerable to an arbitrary file-write flaw, allowing unauthenticated remote attackers to access files on affected systems.
CrewAI Prompt Injection Vulnerabilities: Security flaws in CrewAI allow attackers to exploit prompt injection, chain vulnerabilities to escape sandboxes, and execute arbitrary code on target devices.
Critical Fortinet FortiClient EMS Flaw: Active exploitation of a critical SQL injection vulnerability in FortiClient EMS enables unauthenticated remote code execution via crafted HTTP requests.
StrongSwan VPN Integer Underflow: An integer underflow vulnerability in StrongSwan, present for 15 years, allows unauthenticated remote attackers to crash VPN services.

Notable Threat Actor Activity

CrystalX RAT: Researchers analyzed CrystalX, a new multi-functional RAT offered as Malware-as-a-Service (MaaS), combining spyware, credential stealing, and prankware features.
Silver Fox Campaign: The Silver Fox threat actor is targeting Chinese-speaking users with a campaign leveraging typosquatted domains and a new RAT, AtlasCross, to deliver malware via fake software brands.
Iranian APTs – Pay2Key and Pseudo-Ransomware: Iranian state-linked groups have revived Pay2Key operations and are deploying pseudo-ransomware tactics, targeting high-impact US organizations and threatening major US tech firms with attacks beginning April 1.
Venom Stealer: The Venom Stealer malware is being actively distributed, with features for persistent, automated credential, session, and cryptocurrency theft.
TeamPCP Cloud Intrusions: The TeamPCP group is conducting rapid attacks on AWS, Azure, and SaaS environments using stolen credentials, validated with tools like TruffleHog, followed by enumeration and lateral movement.

Trends, Tools, or Tactics of Interest

Supply Chain Attacks on npm: The Axios incident underscores ongoing risks in the npm ecosystem, with attackers targeting popular packages to distribute cross-platform malware.
Credential Theft as Attack Enabler: Reports highlight the industrialization of credential theft, fueling ransomware, SaaS breaches, and nation-state cyberattacks, shifting focus toward detecting misuse of legitimate access.
Weaponization of AI Agents: Security research demonstrates attackers exploiting AI agents’ over-privileged access (notably in Vertex AI) for lateral movement and data exfiltration.
Continuous Credential Harvesting: Malware such as Venom Stealer is enabling ongoing, automated credential theft, increasing the persistence and scale of attacks.
Speed of Attacks: Threat groups are accelerating the pace of attacks, particularly in cloud and SaaS environments, emphasizing the need for rapid detection and response.

Regulatory or Policy Developments Affecting the Security Industry

Android Developer Verification Rollout: Google has begun rolling out mandatory developer verification for all Android app developers, aiming to reduce the distribution of malicious apps by anonymous actors, with enforcement set for September.
Apple iOS Backported Patches: Apple announced rare backported security patches for iOS 18 users to address vulnerabilities exploited by the DarkSword hacking tool, without requiring upgrades to newer iOS versions.
Google Drive Ransomware Detection: Google has enabled AI-powered ransomware detection by default for all paying Google Drive users, enhancing protection against file-encrypting malware in cloud storage.

Uranium on DanSec Daily

Cybersecurity Brief – 2026-04-02

Major Incidents or Breaches

Newly Discovered Vulnerabilities

Notable Threat Actor Activity

Trends, Tools, or Tactics of Interest

Regulatory or Policy Developments Affecting the Security Industry

Other Notable Industry Developments

Cybersecurity Brief – 2026-04-01

Major Incidents or Breaches

Newly Discovered Vulnerabilities

Notable Threat Actor Activity

Trends, Tools, or Tactics of Interest

Regulatory or Policy Developments Affecting the Security Industry