2026-04-03 AI创业新闻

Hackers Exploit CVE-2025-55182 to Breach 766 Next.js Hosts, Steal Credentials

A large-scale credential harvesting operation has been observed exploiting the React2Shell vulnerability as an initial infection vector to steal database credentials, SSH private keys, Amazon Web Services (AWS) secrets, shell command history, Stripe API keys, and GitHub tokens at scale. Cisco Talos has attributed the operation to a threat cluster it tracks as UAT-10608 . At least 766 hosts spanning multiple geographic regions and cloud providers have been compromised as part of the activity. “Post-compromise, UAT-10608 leverages automated scripts for extracting and exfiltrating credentials from a variety of applications, that are then posted to its command-and-control (C2),” security researchers Asheer Malhotra and Brandon White said in a report shared with The Hacker News ahead of publication.

“The C2 hosts a web-based graphical user interface (GUI) titled ‘NEXUS Listener’ that can be used to view stolen information and gain analytical insights using precompiled statistics on credentials harvested and hosts compromised.” The campaign is assessed to be targeting Next.js applications that are vulnerable to CVE-2025-55182 (CVSS score: 10.0), a critical flaw in React Server Components and Next.js App Router that could result in remote code execution, for initial access, and then dropping the NEXUS Listener collection framework. This is accomplished by means of a dropper that proceeds to deploy a multi-phase harvesting script that collects various details from the compromised system - Environment variables JSON-parsed environment from JS runtime SSH private keys and authorized_keys Shell command history Kubernetes service account tokens Docker container configurations (running containers, their images, exposed ports, network configurations, mount points, and environment variables) API keys IAM role-associated temporary credentials by querying the Instance Metadata Service for AWS, Google Cloud, and Microsoft Azure Running processes The cybersecurity company said the breadth of the victim set and the indiscriminate targeting pattern align with automated scanning, likely leveraging services like Shodan, Censys, or custom scanners, to identify publicly reachable Next.js deployments and probe them for the vulnerability. Central to the framework is a password-protected web application that makes all the stolen data available to the operator via a graphical user interface that features search capabilities to sift through the information. “The application contains a listing of several statistics, including the number of hosts compromised and the total number of each credential type that were successfully extracted from those hosts,” Talos said.

“The web application allows a user to browse through all of the compromised hosts. It also lists the uptime of the application itself.” The current version of NEXUS Listener is V3, indicating that the tool has undergone substantial development iterations before reaching the current stage. Talos, which was able to obtain data from an unauthenticated NEXUS Listener instance, said it contained API keys associated with Stripe, artificial intelligence platforms (OpenAI, Anthropic, and NVIDIA NIM), communication services (SendGrid and Brevo), along with Telegram bot tokens, webhook secrets, GitHub and GitLab tokens, database connection strings, and other application secrets. The extensive data gathering operation highlights how bad actors could weaponize access to compromised hosts to stage follow-on attacks.

Organizations are advised to audit their environments to enforce the principle of least privilege, enable secret scanning, avoid reusing SSH key pairs, implement IMDSv2 enforcement on all AWS EC2 instances, and rotate credentials if compromise is suspected. “Beyond the immediate operational value of individual credentials, the aggregate dataset represents a detailed map of the victim organizations’ infrastructure: what services they run, how they’re configured, what cloud providers they use, and what third-party integrations are in place,” the researchers said. “This intelligence has significant value for crafting targeted follow-on attacks, social engineering campaigns, or selling access to other threat actors.” Found this article interesting? Follow us on Google News , Twitter and LinkedIn to read more exclusive content we post.

Cisco Patches 9.8 CVSS IMC and SSM Flaws Allowing Remote System Compromise

Cisco has released updates to address a critical security flaw in the Integrated Management Controller (IMC) that, if successfully exploited, could allow an unauthenticated, remote attacker to bypass authentication and gain access to the system with elevated privileges. The vulnerability, tracked as CVE-2026-20093, carries a CVSS score of 9.8 out of a maximum of 10.0. “This vulnerability is due to incorrect handling of password change requests,” Cisco said in an advisory released Wednesday. “An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device.” “A successful exploit could allow the attacker to bypass authentication, alter the passwords of any user on the system, including an Admin user, and gain access to the system as that user.” Security researcher “jyh” has been credited with discovering and reporting the vulnerability.

The shortcoming affects the following products regardless of the device configuration - 5000 Series Enterprise Network Compute Systems (ENCS) - Fixed in 4.15.5 Catalyst 8300 Series Edge uCPE - Fixed in 4.18.3 UCS C-Series M5 and M6 Rack Servers in standalone mode - Fixed in 4.3(2.260007), 4.3(6.260017), and 6.0(1.250174) UCS E-Series Servers M3 - Fixed in 3.2.17 UCS E-Series Servers M6 - Fixed in 4.15.3 Another critical vulnerability patched by Cisco impacts Smart Software Manager On-Prem (SSM On-Prem), which could enable an unauthenticated, remote attacker to execute arbitrary commands on the underlying operating system. The vulnerability, CVE-2026-20160 (CVSS score: 9.8), stems from an unintentional exposure of an internal service. “An attacker could exploit this vulnerability by sending a crafted request to the API of the exposed service,” Cisco said . “A successful exploit could allow the attacker to execute commands on the underlying operating system with root-level privileges.” Patches for the flaw have been released in Cisco SSM On-Prem version 9-202601.

Cisco said the vulnerability was discovered internally during the resolution of a Cisco Technical Assistance Center (TAC) support case. While neither of the vulnerabilities has been exploited in the wild, a number of recently disclosed security flaws in Cisco products have been weaponized by threat actors. In the absence of a workaround, customers are recommended to update to the fixed version for optimal protection. Found this article interesting?

ThreatsDay Bulletin: Pre-Auth Chains, Android Rootkits, CloudTrail Evasion & 10 More Stories

The latest ThreatsDay Bulletin is basically a cheat sheet for everything breaking on the internet right now. No corporate fluff or boring lectures here, just a quick and honest look at the messy reality of keeping systems safe this week. Things are moving fast. The list includes researchers chaining small bugs together to create massive backdoors, old software flaws coming back to haunt us, and some very clever new tricks that let attackers bypass security logs entirely without leaving a trace.

We are also seeing sketchier traffic on the underground and the usual supply chain mess, where one bad piece of code threatens thousands of apps. It is definitely worth a quick scan before you log off for the day, if only to make sure none of this is sitting in your own network. Let’s get into it. Pre-auth RCE chain exposed Security Flaws in Progress ShareFile watchTower Labs has disclosed two security flaws in Progress ShareFile (CVE-2026-2699 and CVE-2026-2701) that could be chained to achieve pre-authenticated remote code execution.

While CVE-2026-2699 is an authentication bypass via the “/ConfigService/Admin.aspx” endpoint, CVE-2026-2701 refers to a case of post-authenticated remote code execution. An attacker could combine the two vulnerabilities to sidestep authentication and upload web shells. Progress released fixes for the vulnerabilities with Storage Zone Controller 5.12.4 released on March 10, 2026. There are about 30,000 internet-facing instances, making patching against the flaws crucial.

Rootkit spreads via 50+ apps Operation Novoice Rootkit Campaign Targets Older Android Devices A new Android malware named NoVoice has been distributed via more than 50 apps that were downloaded at least 2.3 million times. While apps masqueraded as utilities, image galleries, and games, and offered the advertised functionality, the malware attempted to obtain root access on the device by exploiting 22 Android vulnerabilities that received patches between 2016 and 2021. “If the exploits succeed, the malware gains full control of the device,” McAfee Labs said . “From that moment onward, every app that the user opens is injected with attacker-controlled code.

This allows the operators to access any app data and exfiltrate it to their servers.” The malware avoids infecting devices in certain regions, like Beijing and Shenzhen in China, and implements more than a dozen checks for emulators, debuggers, and VPNs. It then contacts a remote server to send device information and fetch appropriate exploits to gain root access and disable SELinux. Upon gaining elevated access, the rootkit modifies system libraries to facilitate the execution of malicious code when specific apps are opened, install arbitrary apps, and enable persistence. NoVoice has been found to share some level of overlap with Triada .

One of the targeted apps is WhatsApp, which enabled the malware to harvest data from the app as soon as it was launched. Google has since removed the apps. The highest concentration of infections has been reported in Nigeria, Ethiopia, Algeria, India, and Kenya. FBI flags foreign app risks FBI Warns of Risky Foreign-Developed Mobile Apps The U.S.

Federal Bureau of Investigation (FBI) is warning of the data security risks associated with foreign-developed mobile applications. “As of early 2026, many of the most downloaded and top-grossing apps in the United States are developed and maintained by foreign companies, particularly those based in China,” the FBI said . “The apps that maintain digital infrastructure in China are subject to China’s extensive national security laws, enabling the Chinese government to potentially access mobile app users’ data.” The bureau also warned that these apps may harvest contact information under the pretext of inviting friends to use them, store personal data in Chinese servers, or contain malware that could collect data beyond what is authorized by the user. “This could include malicious code and hard-to-remove malware designed to exploit known vulnerabilities in various operating systems and insert a backdoor for escalated privileges, such as enabling the download and execution of additional malicious packages designed to provide unauthorized access to users’ data,” it added.

The FBI did not name the apps, but TikTok, Shein, Temu, and DeepSeek fit the profile. New bureau targets cyber threats U.S. Activates Bureau of Emerging Threats The U.S. State Department has officially launched the Bureau of Emerging Threats , a new unit tasked with protecting U.S.

national security against cyber attacks against critical infrastructure, threats in the space domain, and misuse of artificial intelligence (AI) and other advanced technology risks from Iran, China, Russia, and North Korea. Cybercrime kingpin extradited HuiOne Group Former Chairman Extradited to China Li Xiong, the former chairman of a Cambodian financial conglomerate, HuiOne , has been extradited to China. He has been accused of operating gambling dens, fraud, unlawful business operations, and money laundering. According to Xinhua , Li is said to be a key member of the transnational cybercrime syndicate masterminded by Chen Zhi , the chairman of Prince Group, who was extradited to China in January 2026 and has been indicted by the U.S.

for operating large-scale, forced-labor “pig butchering” scam compounds in Southeast Asia. In May 2025, the U.S. Treasury’s Financial Crimes Enforcement Network labeled Huione Group “a financial institution of primary money laundering concern.” Gmail username change arrives Google Officially Rolls Out the Ability to Change Email Address Google said it’s rolling out the ability to change a username to Google Account users in the U.S. “Your previous Google Account email ending in gmail.com will become an alternate email address,” Google said in a support document.

“You’ll receive emails to both your old and new addresses. The data saved in your account won’t be affected. This includes things like photos, messages, and emails sent to your previous email address.” While users can change back to their previous email address at any time, it’s not possible to create a new Google Account email ending in gmail.com for the next 12 months. The new email address cannot be deleted either.

Court halts AI risk label U.S. Court Blocks Supply Chain Risk Designation A U.S. federal judge has temporarily blocked the Trump administration’s designation of Anthropic as a supply chain risk . The AI company had argued that the designation was causing immediate and irreparable harm.

“Nothing in the governing statute supports the Orwellian notion that an American company may be branded a potential adversary and saboteur of the U.S. for expressing disagreement with the government,” District Judge Rita Lin wrote in the ruling. Phishing apps target mobile users Threat Actors Target Android and iOS Users in Phishing Campaign Cybercriminals have set their sights on Android users through a new phishing scheme that disguises malicious applications as beta-testing opportunities for ChatGPT and Meta advertising tools. In these attacks, what appears to be an invitation to advertising apps turns out to be a carefully planned attempt to steal Facebook credentials and hijack control of user accounts.

“These messages push malicious apps delivered through ‘firebase-noreply@google.com’ via Firebase App Distribution, a legitimate Google service for distributing pre-release apps to testers,” LevelBlue said . “Once installed, these apps request Facebook credentials, leading to phishing and account takeover.” A similar campaign has leveraged phishing emails impersonating ChatGPT and Gemini to push users into downloading malicious iOS apps from the Apple App Store. “Disguised as business or ad management tools, these apps prompt for Facebook credentials, leading to credential harvesting,” the company added . Drive adds ransomware defense Google Makes Drive Ransomware Detection and File Restoration Generally Available Google has made ransomware detection and file restoration in Drive generally available after launching the feature in beta in September 2025 to help organizations minimize the impact of malware attacks on personal computers.

Ransomware detection pauses file syncing, and file restoration allows users to bulk restore their files to a previous version in Drive. “Compared to when the feature was in beta, we are now able to detect even more types of ransomware encryption and are able to do it faster,” Google said . “Our latest AI model is detecting 14x more infections, leading to even more comprehensive protection.” GhostSocks activity intensifies Surge in GhostSocks Activity Cybersecurity company Darktrace said it has observed a steady increase in GhostSocks activity across its customer base since late 2025. “In one notable case from December 2025, Darktrace detected GhostSocks operating alongside Lumma Stealer, reinforcing that the partnership between Lumma and GhostSocks remains active despite recent attempts to disrupt Lumma’s infrastructure,” it said.

Originally marketed on the Russian underground forum xss[.]is as a malware-as-a-service (MaaS), GhostSocks enables threat actors to turn compromised devices into residential proxies, leveraging the victim’s internet bandwidth to route malicious traffic through it. It utilizes the SOCKS5 proxy protocol, creating a SOCKS5 connection on infected devices. It began to be widely adopted following its partnership with Lumma Stealer in 2024. Open-source malware spikes 14x Malware in Open-Source Ecosystems Increases 14x The number of malware advisories across open-source ecosystems has increased 13.6x since January 2024, as threat actors take control of trusted packages to poison the software supply chain.

“Of the 1,011 npm ATO [Account takeover] advisories recorded in the OSV database over all time, 930 were filed in 2025, a roughly 12x year-over-year increase representing 92% of all ATOs reported on npm,” Endor Labs said . Among the 2025 npm ATO cases, 38.4% of affected packages had more than 1,000 monthly downloads, 18.5% exceeded 10,000, and 11.1% had more than 100,000. Attackers are deliberately targeting packages that are deeply embedded in production systems and automated CI/CD pipelines, maximizing the blast radius of each compromise.” XLoader boosts stealth tactics XLoader Continues to Evolve An updated version of the XLoader information-stealing malware (version 8.7) has been found to incorporate several changes to the code obfuscation to make automation and analysis more difficult. These include the use of encrypted strings that are decrypted at runtime, encrypted code blocks consisting of functions that are decrypted at runtime, and improved methods to conceal hard-coded values and specific functions, per Zscaler.

XLoader also uses a combination of multiple encryption layers with different keys for encrypting network traffic. “XLoader continues to be a highly active information stealer that constantly receives updates,” the company said . “As a result of the malware’s multiple encryption layers, decoy C2 servers, and robust code obfuscation, XLoader has been able to remain largely under the radar.” ImageMagick zero-days enable RCE Security Flaws in ImageMagick Cybersecurity researchers have found multiple zero-day vulnerabilities in ImageMagick that could be chained to achieve remote code execution through a single image or PDF upload. According to Pwn.ai , the attack works on the default configuration and the most restrictive “secure” configuration.

The issue affects every major Linux distribution, as well as WordPress installations that process image uploads. It remains unpatched as of writing. In the interim, it’s advised to process PDFs in an isolated sandbox with no network access, disable XML-RPC in WordPress, and block GhostScript. Attackers evade CloudTrail logging How to Silently Disable CloudTrail?

Adversaries are bypassing traditional CloudTrail detections, like StopLogging or DeleteTrail, and instead using lesser-known AWS APIs to blind logging systems. This includes creating “invisible activity zones” using PutEventSelectors, using StopEventDataStoreIngestion and DeleteEventDataStore to halt or destroy long-term forensic visibility, disabling anomaly detection via PutInsightSelectors, neutralizing cross-account protections through DeleteResourcePolicy and DeregisterOrganizationDelegatedAdmin. “The real risk is in the sequence: individually, these API calls look like routine maintenance—but chained together, they allow attackers to erase evidence and evade detection entirely,” Abstract Security said. LofyGang deploys dual-payload RAT LofyGang Returns with Improved RAT Malware The threat actor known as LofyGang resurfaced with a fake npm package (“undicy-http”) that delivers a dual-payload attack: a Node.js-based Remote Access Trojan (RAT) with live screen streaming, and a native Windows PE binary that uses direct syscalls to inject into browser processes and steal credentials, cookies, credit cards, IBANs, and session tokens from more than 50 web browsers and 90 cryptocurrency wallet extensions.

The session hijacking module targets Roblox, Instagram, Spotify, TikTok, Steam, Telegram, and Discord. “The Node.js layer independently operates as a full RAT with remote shell, screen capture, webcam/microphone streaming, file upload, and persistence capabilities, all controlled through a WebSocket C2 panel,” JFrog said . The Node.js layer also downloads a native PE binary to facilitate data exfiltration via a Discord webhook and a Telegram bot. Nothing here looks huge on its own.

That’s the point. Small changes, repeated enough times, start to matter. Things that used to be hard are getting easier. Things that were noisy are getting quiet.

You stop seeing the obvious signs and start missing the subtle ones. Read it like a pattern, not a list. Same ideas showing up in slightly different forms. Systems doing what they’re designed to do—just used differently.

That gap is where most problems live now. That’s the recap. Found this article interesting? Follow us on Google News , Twitter and LinkedIn to read more exclusive content we post.

Researchers Uncover Mining Operation Using ISO Lures to Spread RATs and Crypto Miners

A financially motivated operation codenamed REF1695 has been observed leveraging fake installers to deploy remote access trojans (RATs) and cryptocurrency miners since November 2023. “Beyond cryptomining, the threat actor monetizes infections through CPA (Cost Per Action) fraud, directing victims to content locker pages under the guise of software registration,” Elastic Security Labs researchers Jia Yu Chan, Cyril François, and Remco Sprooten said in an analysis published this week. Recent iterations of the campaign have also been found to deliver a previously undocumented .NET implant codenamed CNB Bot. These attacks leverage an ISO file as the infection vector to deliver a .NET Reactor-protected loader and a text file with explicit instructions to the user to bypass Microsoft Defender SmartScreen protections against running unrecognized applications by clicking on “More info” and “Run anyway.” The loader is designed to invoke PowerShell, which is responsible for configuring broad Microsoft Defender Antivirus exclusions to fly under the radar and launch CNB Bot in the background.

At the same time, the user is displayed an error message: “Unable to launch the application. Your system may not meet the required specifications. Please contact support.” CNB Bot functions as a loader with capabilities to download and execute additional payloads, update itself, and uninstall and perform cleanup actions to cover up the tracks. It communicates with a command-and-control (C2) server using HTTP POST requests.

Other campaigns mounted by the threat actor have leveraged similar ISO lures to deploy PureRAT , PureMiner , and a bespoke .NET-based XMRig loader, the last of which reaches out to a hard-coded URL to extract the mining configuration and launch the miner payload. As recently observed in the FAUX#ELEVATE campaign, “WinRing0x64.sys,” a legitimate, signed, and vulnerable Windows kernel driver, is abused to obtain kernel-level hardware access and modify CPU settings to boost hash rates, thereby enabling performance improvement. The use of the driver has been observed in many cryptojacking campaigns over the years. The functionality was added to XMRig miners in December 2019.

Elastic said it also identified another campaign that leads to the deployment of SilentCryptoMiner . The miner, besides using direct system calls to evade detection, takes steps to disable Windows Sleep and Hibernate modes, set up persistence via a scheduled task, and uses the “Winring0.sys” driver to fine-tune the CPU for mining operations. Another notable component of the attack is a watchdog process that ensures the malicious artifacts and persistence mechanisms are restored in the event they are deleted. The campaign is estimated to have accrued 27.88 XMR ($9,392) across four tracked wallets, indicating that the operation is yielding consistent financial returns to the attacker.

“Beyond the C2 infrastructure, the threat actor abuses GitHub as a payload delivery CDN, hosting staged binaries across two identified accounts,” Elastic said. “This technique shifts the download-and-execute step away from operator-controlled infrastructure to a trusted platform, reducing detection friction.” Found this article interesting? Follow us on Google News , Twitter and LinkedIn to read more exclusive content we post.

The State of Trusted Open Source Report

In December 2025 , we shared the first-ever The State of Trusted Open Source report, featuring insights from our product data and customer base on open source consumption across our catalog of container image projects, versions, images, language libraries, and builds. These insights shed light on what teams pull, deploy, and maintain day to day, alongside the vulnerabilities and remediation realities these projects face. Fast forward a few months, and software development is accelerating at a pace that most didn’t see coming. AI is increasingly embedded across the development lifecycle, from code generation to infrastructure automation, as models become more advanced and better at meeting the demands of modern work.

This shift is expanding what teams can build and how quickly they can ship. It is also reshaping the security landscape. Before diving into the numbers, it’s important to explain how we perform this analysis. We examined over 2,200 unique container image projects, 33,931 total vulnerability instances, and 377 unique CVEs from December 1, 2026, through February 28, 2026.

When we use terms like “top 20 projects” and “long tail projects” (as defined by images outside of the top 20), we’re referring to real usage patterns observed across our customer portfolio and in production pulls. In this report, we noticed a few new themes that point to this shift. These themes built on the trends from our last report, ultimately showcasing the impact of increased AI-driven development both in the types of container images being used and in the number of CVEs being discovered and remediated: Python and PostgreSQL growth reflects AI-driven development: Python remains the most popular image (72.1% of all customers use it), and PostgreSQL saw a 73% increase in usage quarter-over-quarter, underscoring the growing adoption of a modern AI stack across various use cases. The modern platform stack is becoming increasingly standardized: Across Chainguard customers, language ecosystem images account for more than half of the top 25 images used in production.

Chainguard Base is becoming a foundation for developer tooling: The chainguard-base image, a minimal distroless base image without any toolchain or apps, was the 5th most-used Chainguard image, as customers use it as a sort of “utility belt” for their specific use cases (over 75% of Chainguard customers customize at least one image). AI is accelerating software development and vulnerability discovery: We applied over 300% more fixes in Chainguard Containers and saw a 145% increase in vulnerabilities from last quarter, signaling the use of AI to push more code and discover more CVEs. The long tail continues to define real-world risk: 96% of the vulnerabilities found and remediated in Chainguard Containers occurred outside of the top 20 most popular projects—this is consistent with the findings from December. Compliance continues to drive adoption of trusted open source: We saw the same themes from December present here, underscored by a FIPS-compliant variant of a Chainguard container image entering the top 10 images by customer count for the first time.

Usage: What teams actually run in production We identified multiple themes centered on the prevalence of AI in code generation across regions and industries. This prevalence leads to greater adoption of the Python language ecosystem and adjacent technologies on the usage side. Most popular images: Python and PostgreSQL growth reflect AI-driven development PostgreSQL usage grew 73% quarter-over-quarter The images that saw the strongest growth this quarter closely align with the technologies driving AI adoption. Python remains the most widely deployed image across Chainguard customers.

When combining FIPS ( Federal Information Processing Standards ) and non-FIPS variants, 72.1% of Chainguard customers are using a Python image . This reflects Python’s role as the default language for machine learning, data pipelines, and automation. What was once concentrated in experimentation environments is now moving into production systems across industries. Node continues to anchor application infrastructure, with 60.7% of Chainguard customers utilizing it in their environments.

Together, Python and Node define the dominant runtime layer for modern applications. The most notable change this quarter is in databases. PostgreSQL usage grew by 73% quarter over quarter , the largest increase among widely deployed images. This growth aligns with broader trends in AI workloads.

PostgreSQL is increasingly used as a foundation for vector search and retrieval-augmented generation, supported by extensions that enable embedding storage and similarity queries. As AI moves into production, databases are evolving alongside application runtimes. The modern platform stack is converging Over 50% of the most popular images are language ecosystems This quarter, the data showed that production environments are converging around a consistent set of foundational components. Language ecosystems account for more than half of the top 25 images used across customers .

Python (72.1% of all customers), Node (60.7%), Java (44.4%), Go (42.8%), and .NET (27%) continue to define the runtime layer, with growth across each ecosystem. Outside of runtimes, teams are standardizing on a familiar set of cloud-native components. Traffic management tools such as nginx and service mesh components remain widely deployed. Monitoring systems built around Prometheus continue to expand.

Deployment workflows are increasingly anchored in GitOps tools such as ArgoCD and kubectl. The result is a layered architecture that is broadly consistent across organizations. A small number of runtimes, a shared set of operational components, and a large and highly variable long tail of supporting dependencies. Standardization is happening at the platform level, even as application-specific variation continues to grow.

Chainguard Base is becoming a foundation for developer tooling Chainguard-base was the 5th most-deployed image by customer count Chainguard Base is a minimal distroless base image without any toolchain or applications. It is designed to provide a secure foundation that teams can extend with only the components they need. This quarter, it was the 5th-most-deployed image by customer count , used by 36.3% of customers across FIPS and non-FIPS variants. Its role becomes clearer when looking at customization patterns.

Across all customized repositories, 95% include added packages, and more than three-quarters of customers customize at least one image . When organizations customize Chainguard Containers, the most frequently added packages are developer and operational utilities such as curl, bash, jq, git, and cloud tooling. These are not full application stacks. They are the tools needed to build, debug, and operate software.

This demonstrates a consistent pattern: teams use Chainguard Base as a secure starting point, then layer in the exact tooling required for their workflows. It is serving as a flexible foundation for CI/CD pipelines, debugging environments, and internal platform tooling. As platform engineering practices mature, the need for secure, customizable base environments is becoming more pronounced. Chainguard Base is emerging as a core building block in that model.

CVEs: AI is accelerating software development and vulnerability discovery Over 300% more fix instances this quarter Just as we observed on the usage side with the increase in Python and PostgreSQL container images, AI is also changing the speed at which vulnerabilities surface. In the previous report, we tracked 154 unique CVEs and 10,100 fix instances across Chainguard Containers. This quarter, that number rose to 377 unique CVEs and 33,931 fix instances ( a 145% increase in unique vulnerabilities and over 300% more fixes applied compared to last quarter ). This increase reflects two parallel forces: 1) development is becoming faster and more distributed, which increases the number of dependencies entering production environments; and 2) vulnerability discovery is accelerating as researchers and attackers use automation and AI-assisted techniques to analyze code at scale.

The result is a tighter feedback loop between development and security. More code is being written, more dependencies are being introduced, and more vulnerabilities are being identified across the ecosystem. What stands out is not only the increase in volume, but the Chainguard Factory’s ability to respond to it. Median remediation time held essentially flat at 2.0 days compared to 1.96 days last quarter, despite the much higher volume .

High-severity vulnerabilities continued to be resolved quickly, with 97.9% fixed within one week. The pace of discovery is increasing. The expectation for response is keeping up. The long tail continues to define real-world risk 96% of CVEs occur outside the most popular images While core infrastructure is becoming more standardized, most of the software supply chain lives outside the most visible components.

Let us explain: the median customer sources about 74% of their images from the long tail of the catalog (images outside the top 20 in popularity). This reflects the reality that production environments extend far beyond a small set of widely used images. Security risk follows the same pattern. This quarter, 96.2% of CVE instances occurred outside the top 20 most widely used images .

This is consistent with the previous report, which found that nearly all vulnerabilities were concentrated in long-tail projects. The implication is straightforward: the images that teams interact with most frequently represent only a small portion of their actual exposure. The majority of vulnerabilities exist in dependencies that are less visible, less frequently updated, and often not directly owned by application teams. Even across severity levels, the distribution holds.

Critical, High, Medium, and Low vulnerabilities all follow the same pattern, with the overwhelming majority (96.18% on average) occurring outside the top 20 images. Attackers know what is popular, so they tend to look for vulnerable areas that are outside most users’ top-of-mind. As development accelerates and dependency graphs expand, managing the long tail becomes the central challenge of software supply chain security. Compliance is reshaping adoption patterns Regulatory requirements are increasingly influencing how organizations build and deploy software.

This quarter marks the first time a FIPS-compliant Chainguard image ( python-fips ) has reached the top 10 by customer count, even when FIPS and non-FIPS variants are combined into a single metric. This milestone reflects a broader shift toward compliance-driven adoption. FIPS adoption is increasing across multiple runtimes. Python FIPS, Node FIPS, and nginx FIPS images all saw growth in customer counts over the quarter.

Overall, 42% of customers now run at least one FIPS image in production . This reflects the growing influence of frameworks such as FedRAMP, PCI DSS, SOC 2, and the EU Cyber Resilience Act. Compliance is no longer limited to a subset of industries. It is becoming a baseline requirement for software that operates in regulated environments.

As a result, secure and compliant images are moving from optional to expected. A secure foundation for the AI era The data from this quarter points to a clear trend. Software ecosystems are expanding. The number of unique images in use grew by 18%, reflecting broader adoption and more diverse workloads.

At the same time, vulnerability discovery increased significantly, with a 145% rise in unique CVEs and a 3x increase in fixes. Despite that growth, Chainguard’s remediation performance remained stable. Median fix times held steady, and high-severity vulnerabilities continued to be resolved quickly. This combination matters.

It shows that it is possible to scale both coverage and responsiveness simultaneously. As AI continues to accelerate development, the volume of code and dependencies will grow. The challenge for security teams is not simply to keep up with that growth, but to manage it in a way that maintains consistency and trust. The organizations that succeed will be those that treat security as part of the development system itself, rather than as a layer applied afterward.

At Chainguard, we recognize the challenges that security and engineering teams face as AI technology becomes increasingly ubiquitous. We recently announced products such as Chainguard Agent Skills and Chainguard Actions to address this problem directly. As development speeds up, organizations must address hidden attack vectors throughout the software development lifecycle. The trusted open source we offer creates a secure-by-default foundation you can build on.

Ready to learn more about how Chainguard can protect your open source artifacts? Get in touch with our team today. Found this article interesting? This article is a contributed piece from one of our valued partners.

WhatsApp Alerts 200 Users After Fake iOS App Installed Spyware; Italian Firm Faces Action

Meta-owned messaging platform WhatsApp said it alerted about 200 users who were tricked into installing a bogus version of its iOS app that was infected with spyware. According to reports from Italian newspaper La Repubblica and news agency ANSA , the vast majority of the targets are located in Italy. It’s assessed that the threat actors behind the activity used social engineering tactics to get users to install malicious software that mimicked WhatsApp. All the affected users have been logged out and have been recommended to uninstall the malware-laced apps and download the official WhatsApp app.

WhatsApp did not reveal who was targeted in these attacks. The tech giant said it’s also taking action against Asigint, an Italian subsidiary of spyware company SIO, for allegedly creating a counterfeit version of WhatsApp. On its website, the company advertises solutions to law enforcement agencies, government organizations, and police and intelligence agencies for monitoring suspect activities, gathering intelligence, or conducting covert operations. In December 2025, TechCrunch reported that SIO was behind a set of malicious Android apps that masqueraded as WhatsApp and other popular apps but stole private data from a target’s device using a spyware family called Spyrtacus.

The apps are believed to have been used by a government customer to target unknown victims in Italy. SIO is one of the many Italian companies selling surveillance tools, including Cy4Gate, eSurv, GR Sistemi, Negg, Raxir, and RCS Lab, turning the country into a ” spyware hub .” Early last year, WhatsApp alerted around 90 users that they were targeted with Paragon Solutions’ spyware known as Graphite. Then, in August 2025, it notified less than 200 users who may have been targeted as part of a sophisticated campaign by chaining together zero-day vulnerabilities in iOS and the messaging app. The development comes a little over a month after a Greek court sentenced Tal Dilian, the founder of the Intellexa Consortium, and three associates, Sara Hamou, Felix Bitzios, and Yiannis Lavranos, to prison for their role in the illegal use of the vendor’s Predator spyware to target politicians, business leaders, and journalists in the country.

The 2022 surveillance scandal, dubbed Predatorgate or Greek Watergate, prompted the European Parliament to launch a formal inquiry into the use of such tools. However, a new law passed that year has since legalized government use under strict conditions. In July 2024, the Greek Supreme Court cleared the state intelligence service and government officials of wrongdoing. “Questions remain about the role of the Greek government, which has consistently denied purchasing or using Predator,” Amnesty International said .

“Transparency is a crucial part of accountability – as is remedy for the many victims of the human rights violations brought about by the unlawful use of this technology.” In a statement shared with Reuters late last month, Dilian said he intends to appeal the decision, adding, “I believe a conviction without evidence is not ⁠justice, it could be part of a cover-up and even a crime.” Italy and Greece are far from the only European countries to be caught in the spyware technology’s crosshairs. Back in January 2026, Spain’s High Court closed its probe into the use of NSO Group’s Pegasus to spy on Spanish politicians, citing a lack of cooperation from Israeli authorities. The case dates to May 2022, when the Spanish government disclosed that the Israeli company’s spyware had been used to eavesdrop on devices belonging to Prime Minister Pedro Sánchez and Defence Minister Margarita Robles. Companies like Intellexa and NSO Group have consistently maintained that their surveillance technology has only been licensed to governments to fight serious crimes and bolster national security.

NSO Group’s Executive Chairman David Friedman said the “world is a far safer place” when the company’s tools ”are in the right hands within the right countries.” Found this article interesting? Follow us on Google News , Twitter and LinkedIn to read more exclusive content we post.

Apple Expands iOS 18.7.7 Update to More Devices to Block DarkSword Exploit

Apple on Wednesday expanded the availability of iOS 18.7.7 and iPadOS 18.7.7 to a broader range of devices to protect users from the risk posed by a recently disclosed exploit kit known as DarkSword . “We enabled the availability of iOS 18.7.7 for more devices on April 1, 2026, so users with Automatic Updates turned on can automatically receive important security protections from web attacks called DarkSword,” the company said. “The fixes associated with the DarkSword exploit first shipped in 2025.” The update is available for the following devices - iPhone XR, iPhone XS, iPhone XS Max, iPhone 11 (all models), iPhone SE (2nd generation), iPhone 12 (all models), iPhone 13 (all models), iPhone SE (3rd generation), iPhone 14 (all models), iPhone 15 (all models), iPhone 16 (all models), and iPhone 16e iPad mini (5th generation - A17 Pro), iPad (7th generation - A16), iPad Air (3rd - 5th generation), iPad Air 11-inch (M2 - M3), iPad Air 13-inch (M2 - M3), iPad Pro 11-inch (1st generation - M4), iPad Pro 12.9-inch (3rd - 6th generation), and iPad Pro 13-inch (M4) The latest update aims to cover devices that have the capability to update to iOS 26 but are still on older versions. Apple first released iOS 18.7.7 and iPadOS 18.7.7 on March 24, 2026, but only for iPhone XS, iPhone XS Max, iPhone XR, and iPad 7th generation.

Last month, the company also urged users to update older devices to iOS 15.8.7, iPadOS 15.8.7, iOS 16.7.15, and iPadOS 16.7.15 to address some of the exploits that were used in DarkSword and another exploit kit called Coruna . While Apple is known to backport fixes for older devices depending on the criticality of the vulnerabilities, the move to allow iOS 18 users to patch their devices without having to update to the latest operating system version marks an unusual departure for the tech giant. In a statement shared with WIRED, an Apple spokesperson said it was expanding the update to more devices to help them stay protected. Users who do not have auto-update enabled will have the option to either update to the latest, patched version of iOS 18 or to iOS 26.

The rare step comes weeks after Google Threat Intelligence Group (GTIG), iVerify, and Lookout shared details of an iOS exploit kit called DarkSword that has been put to use in cyber attacks targeting users in Saudi Arabia, Turkey, Malaysia, and Ukraine since July 2025. The kit is capable of targeting iOS and iPadOS devices running versions between iOS 18.4 and 18.7. The attack gets triggered when a user running a vulnerable device visits a legitimate-but-compromised website that hosts the malicious code as part of what’s called a watering hole attack. Once launched, the attacks have been found to deploy backdoors and a dataminer for persistent access and information theft.

It’s currently not known how the advanced hacking tool came to be shared by multiple threat actors. A newer version of the kit has since been leaked on the code-sharing site GitHub, fueling concerns that more threat actors could jump on the exploitation bandwagon. The discovery also highlights that powerful spyware for iPhones may not be as rare as previously thought, and that they could become attractive tools for mass exploitation. As of last week, Apple began issuing Lock Screen notifications to iPhones and iPads running older versions of iOS and iPadOS to alert users of web-based attacks and urge them to install the latest updates.

Proofpoint and Malfors also revealed that another Russia-linked threat actor known as COLDRIVER (aka TA446) has exploited the DarkSword kit to deliver the GHOSTBLADE data stealer malware in attacks targeting government, think tank, higher education, financial, and legal entities. “DarkSword silently steals vast amounts of user data purely because the user Now visited a real (but compromised) website,” Rocky Cole, co-founder and COO at iVerify, said in a statement shared with The Hacker News. “Apple has at least agreed with the security community’s assessment that this presents a clear and present threat to devices that remain unpatched on earlier versions of iOS, which roughly 20% of people are still running.” “Leaving those users exposed would be a hard decision to defend, particularly for a company that centers its brand around security and privacy. Backporting patches to older iOS versions seems like the least they can do in lieu of providing a security framework for outside developers.

The fact is that patching is too little too late when 0-days are involved, and the exploit market is booming.” Found this article interesting? Follow us on Google News , Twitter and LinkedIn to read more exclusive content we post.

CERT-UA Impersonation Campaign Spread AGEWHEEZE Malware to 1 Million Emails

The Computer Emergency Response Team of Ukraine (CERT-UA) has disclosed details of a new phishing campaign in which the cybersecurity agency itself was impersonated to distribute a remote administration tool known as AGEWHEEZE. As part of the attacks, the threat actors, tracked as UAC-0255 , sent emails on March 26 and 27, 2026, posing as CERT-UA to distribute a password-protected ZIP archive hosted on Files.fm and urged recipients to install the “specialized software.” The targets of the campaign included state organizations, medical centers, security companies, educational institutions, financial institutions, and software development companies. Some of the emails were sent from the email address “incidents@cert-ua[.]tech.” The ZIP file (“CERT_UA_protection_tool.zip”) is designed to download malware packaged as security software from the agency. The malware, per CERT-UA, is a remote access trojan codenamed AGEWHEEZE.

A Go-based malware, AGEWHEEZE communicates with an external server (“54.36.237[.]92”) over WebSockets and supports a wide range of commands to execute commands, perform file operations, modify the clipboard, emulate mouse and keyboard, take screenshots, and manage processes and services. It also creates persistence by using a scheduled task, modifying the Windows Registry, or adding itself to the Startup directory. The attack is assessed to have been largely unsuccessful. “No more than a few infected personal devices belonging to employees of educational institutions of various forms of ownership were identified,” the agency said.

“The team’s specialists provided the necessary methodological and practical assistance.” An analysis of the bogus website “cert-ua[.]tech” has revealed that it was likely generated with assistance from artificial intelligence (AI) tools, with the HTML source code also including a comment: “С Любовью, КИБЕР СЕРП,” meaning “With Love, CYBER SERP.” In posts on Telegram, Cyber Serp claims that they are “cyber-underground operatives from Ukraine.” The Telegram channel was created in November 2025 and has more than 700 subscribers. The threat actor also said the phishing emails were sent to 1 million ukr[.]net mailboxes as part of the campaign, and that over 200,000 devices have been compromised. “We are not bandits – the average Ukrainian citizen will never suffer as a result of our actions,” it said in a post. Last month, Cyber Serp took responsibility for an alleged breach of Ukrainian cybersecurity company Cipher, stating it obtained a complete dump of the servers, including a client database and source code for their line of CIPS products, among others.

In a statement on its website, Cipher acknowledged that attackers compromised the credentials of an employee at one of its technology companies but said its infrastructure was operating normally. The infected user had access to a single project, which did not contain sensitive data, it added. Found this article interesting? Follow us on Google News , Twitter and LinkedIn to read more exclusive content we post.

Microsoft Warns of WhatsApp-Delivered VBS Malware Hijacking Windows via UAC Bypass

Microsoft is calling attention to a new campaign that has leveraged WhatsApp messages to distribute malicious Visual Basic Script (VBS) files. The activity, beginning in late February 2026, leverages these scripts to initiate a multi-stage infection chain for establishing persistence and enabling remote access. It’s currently not known what lures the threat actors use to trick users into executing the scripts. “The campaign relies on a combination of social engineering and living-off-the-land techniques,” the Microsoft Defender Security Research Team said .

“It uses renamed Windows utilities to blend into normal system activity, retrieves payloads from trusted cloud services such as AWS, Tencent Cloud, and Backblaze B2, and installs malicious Microsoft Installer (MSI) packages to maintain control of the system.” The use of legitimate tools and trusted platforms is a deadly combination, as it allows threat actors to blend in normal network activity and increase the likelihood of success of their attacks. The activity begins with the attackers distributing malicious VBS files via WhatsApp messages that, when executed, create hidden folders in “C:\ProgramData” and drop renamed versions of legitimate Windows utilities like “curl.exe” (renamed as “netapi.dll”) and “bitsadmin.exe” (renamed as “sc.exe”). Upon gaining an initial foothold, the attackers aim to establish persistence and escalate privileges, ultimately installing malicious MSI packages on victim systems. This is achieved by downloading auxiliary VBS files hosted on AWS S3, Tencent Cloud, and Backblaze B2 using the renamed binaries.

“Once the secondary payloads are in place, the malware begins tampering with User Account Control (UAC) settings to weaken system defenses,” Redmond said. “It continuously attempts to launch cmd.exe with elevated privileges, retrying until UAC elevation succeeds or the process is forcibly terminated, modifying registry entries under HKLM\Software\Microsoft\Win, and embedding persistence mechanisms to ensure the infection survives system reboots.” These actions allow the threat actors to gain elevated privileges without user interaction via a combination of Registry manipulation with UAC bypass techniques, and ultimately deploy unsigned MSI installers. This includes legitimate tools like AnyDesk that provide attackers with persistent remote access, enabling the attackers to exfiltrate data or deploy more malware. “This campaign demonstrates a sophisticated infection chain combining social engineering (WhatsApp delivery), stealth techniques (renamed legitimate tools, hidden attributes), and cloud-based payload hosting,” Microsoft said.

Found this article interesting? Follow us on Google News , Twitter and LinkedIn to read more exclusive content we post.

Block the Prompt, Not the Work: The End of “Doctor No”

There is a character that keeps appearing in enterprise security departments, and most CISOs know exactly who that is. It doesn’t build. It doesn’t enable. Its entire function is to say “No.” No to ChatGPT.

No to DeepSeek. No to the file-sharing tool the product team swears by. For years, this looked like security. But in 2026, “Doctor No” is no longer just a management headache – it is a systemic security liability.

Because when you block the work, users don’t stop. They reroute. The Tax-Evaders of Productivity When security feels like a tax on efficiency, employees find a way to “evade” it. The industry has long relied on Endpoint Agents to enforce control.

But as any CISO knows, these agents come with a heavy “tax.” They hook into the OS kernel, they’re invasive, they notoriously break during macOS updates, and they make high-performance machines run hot. The result? Users find workarounds. Files move into personal Gmail.

Prompts are pasted into unmanaged AI tools. This is the Workaround Economy – a shadow infrastructure that exists not despite your security, but because of it. And the defining characteristic of this economy is that it operates with zero organizational visibility. The Illusion of Control: The “Theatrical” Stack Most teams still default to blocking because their legacy tools were never built to do much else.

It’s not that these capabilities don’t exist; it’s that they are architecturally untenable for modern web work. The SSL Inspection Trap: Firewalls, Secure Web Gateways (SWG), and even many modern SASE/SSE solutions technically attempt to “see” encrypted traffic through SSL decryption. But in a world of certificate pinning and complex web app “plumbing,” this brute-force approach is a high-risk trade-off. Because these tools sit between the user and the web, they frequently break the very tools – like Slack, WhatsApp, or high-performance GenAI interfaces – that the business relies on.

For a CISO, the choice is binary and brutal: turn on inspection and break the user experience, or turn it off and remain blind. The Visibility Gap: EDR sees machine-level processes, and legacy DLP scans files at rest. But for most organizations, the live, streaming browser session remains a black box. While some newer ‘suite’ extensions attempt to peek inside, they only work on managed devices where the IT team has total control.

Even then, they often come with a hidden cost: micro-latencies that make typing feel ‘laggy,’ rendering errors that break complex web app interfaces, and heavy CPU usage that turns a high-end laptop into a space heater. And even still, they remain blind to the prompt typed on a contractor’s laptop, a partner’s browser, or an unmanaged home device—the exact places where sensitive data is most likely to leak before the user even clicks ‘send’. The Extension Jungle: You can block a URL, but can you see the browser extension silently harvesting credentials ? Most stacks cannot.

Blocking a website while leaving the browser session unmonitored is Theatrical Security. It provides the appearance of a policy without the reality of protection. The Law Firm Lesson: A Case of “Ghost” Compliance A prominent U.S. law firm recently discovered the danger of this gap.

When data sovereignty concerns arose around DeepSeek, they did what seemed right: they blocked the domain. IT closed the ticket. Leadership felt covered. A subsequent visibility exercise told a different story.

Seventy percent of their users had already installed an AI “wrapper” extension. Because the extension executed entirely inside the browser session, it was invisible to the firewall and the endpoint agent. Corporate traffic was being silently routed through servers in China. No alert had fired.

No policy had triggered. They had blocked the website. They hadn’t blocked the risk. While satisfied to find this gap, that feeling was quickly overshadowed by the particular stress of discovering that a control you’d trusted was purely theatrical.

The compliance implications could have been dire. The New Standard: Secure the Session, Not the Device The browser has become the new OS of work. Security that lives anywhere else is simply too far away from the “Point of Risk.” The standard in 2026 is moving away from invasive agents and toward Session-Level Governance. The goal is a toolset that provides surgical control – governing the data, not the destination.

This requires a standard of security that can:
Execute Prompt-Level DLP: Identifying and redacting sensitive code or PII in real-time, within the buffer, before the “Send” button is ever clicked. Govern the Extension Layer: Identifying and risk-scoring the “silent” extensions that bypass domain blocks entirely. Enforce Agentless Controls: Providing clipboard and upload governance that works on any browser, on any device (including BYOD and contractors), without the “kernel-hooking” performance tax that drives users toward workarounds. From Gatekeeper to Enabler The role of security teams is changing.

Instead of defining themselves as “gatekeepers”, most successful security leaders are now becoming a visibility layer – one that enables the business to say “Yes” because they can finally see, and govern, what happens when people work. The question is no longer whether your users are using AI. They are. The question is whether your security stack is helping them do it safely, or simply forcing them into the shadows.

Keep the good work. Block the bad. That is the standard now for the modern digital workplace. To learn more about how to govern GenAI use – with prompt-level visibility and real-time DLP – without blocking the productivity your teams depend on, visit: redaccess.io/use-case-genai/ Found this article interesting?

This article is a contributed piece from one of our valued partners. Follow us on Google News , Twitter and LinkedIn to read more exclusive content we post.

Casbaneiro Phishing Targets Latin America and Europe Using Dynamic PDF Lures

A multi-pronged phishing campaign is targeting Spanish-speaking users in organizations across Latin America and Europe to deliver Windows banking trojans like Casbaneiro (aka Metamorfo) via another malware called Horabot . The activity has been attributed to a Brazilian cybercrime threat actor tracked as Augmented Marauder and Water Saci . The e-crime group was first documented by Trend Micro in October 2025. “This threat group employs a wider-ranging attack model focused on a bespoke delivery and propagation mechanism that includes WhatsApp, ClickFix techniques, and email-centric phishing,” BlueVoyant security researchers Thomas Elkins and Joshua Green said in a technical breakdown published Tuesday.

“It is now evident that while these Brazil-based operators heavily leverage script-based WhatsApp automation to compromise retail and consumer users in Latin America, they concurrently maintain and deploy an advanced, email-hijacking engine to penetrate enterprise perimeters there and Europe as well.” The starting point of the campaign is a phishing email that employs court summons-themed messages to deceive recipients into opening a password-protected PDF attachment. Clicking on an embedded link in the document directs the victim to a malicious link and initiates an automatic download of a ZIP archive, which, in turn, leads to the execution of interim HTML Application (HTA) and VBS payloads. The VBS script is designed to carry out environment and anti-analysis checks similar to those found in Horabot artifacts, including checks for Avast antivirus software, and proceeds to retrieve next-stage payloads from a remote server. Among the downloaded files are AutoIt-based loaders, each of which extracts and runs encrypted payload files with “.ia” or “.at” extensions to eventually launch two malware families: Casbaneiro (“staticdata.dll”) and Horabot (“at.dll”).

While Casbaneiro is the primary payload, Horabot is used as a propagation mechanism for the malware. Casbaneiro’s Delphi DLL module contacts a command-and-control (C2) server to fetch a PowerShell script that employs Horabot to distribute the malware via phishing emails to harvested contacts from Microsoft Outlook. “Rather than distributing a static file or hardcoded link as seen in older Horabot campaigns, this script initiates an HTTP POST request to a remote PHP API (hxxps://tt.grupobedfs[.]com/…/gera_pdf.php), passing a randomly generated four-digit PIN,” BlueVoyant said. “The server dynamically forges a bespoke, password-protected PDF impersonating a Spanish judicial summons, which is returned to the infected host.

The script then iterates over the filtered email list, utilizing the compromised user’s own email account to send a tailored phishing email with the newly generated PDF attached.” Also used in tandem is a secondary Horabot-related DLL (“at.dll”) that functions as a spam and account hijacking tool targeting Yahoo, Live, and Gmail accounts to send phishing emails via Outlook. Horabot is assessed to be put to use in attacks targeting Latin America since at least November 2020. Water Saci has a history of using WhatsApp Web as a distribution vector for disseminating banking trojans like Maverick and Casbaneiro in a worm-like manner. However, recent campaigns highlighted by Kaspersky have leveraged the ClickFix social engineering tactic to dupe users into running malicious HTA files with the end goal of deploying Casbaneiro and the Horabot spreader.

“Taken together, the integration of ClickFix social engineering, alongside dynamic PDF generation and WhatsApp automation, demonstrates an agile adversary that is continually innovating and executing diverse attack paths to bypass modern security controls,” the researchers concluded. “This adversary is maintaining a bifurcated, multi-pronged attack infrastructure, dynamically deploying the WhatsApp-centric Maverick chain and concurrently utilizing both ClickFix and email-based Horabot attack paths.” Found this article interesting? Follow us on Google News , Twitter and LinkedIn to read more exclusive content we post.

New Chrome Zero-Day CVE-2026-5281 Under Active Exploitation — Patch Released

Google on Thursday released security updates for its Chrome web browser to address 21 vulnerabilities, including a zero-day flaw that it said has been exploited in the wild. The high-severity vulnerability, CVE-2026-5281 (CVSS score: N/A), concerns a use-after-free bug in Dawn , an open-source and cross-platform implementation of the WebGPU standard. “Use-after-free in Dawn in Google Chrome prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page,” according to a description of the flaw in the NIST’s National Vulnerability Database (NVD). As is customary for these alerts, Google did not provide any further details on how the shortcoming is being exploited and who may be behind the effort.

This is typically done so as to ensure that a majority of users are updated with a fix and prevent other actors from joining the exploitation bandwagon. “Google is aware that an exploit for CVE-2026-5281 exists in the wild,” the company acknowledged. The development arrives merely after Google shipped fixes for two high-severity flaws ( CVE-2026-3909 and CVE-2026-3910 ) that were exploited as zero-days. In February, the tech giant also addressed an actively exploited use-after-free bug in Chrome’s CSS component ( CVE-2026-2441 ).

In total, Google has patched a total of four actively weaponized Chrome zero-days since the start of the year. For optimal protection, users are advised to update their Chrome browser to versions 146.0.7680.177/178 for Windows and Apple macOS, and 146.0.7680.177 for Linux. To make sure the latest updates are installed, users can navigate to More > Help > About Google Chrome and select Relaunch. Users of other Chromium-based browsers, such as Microsoft Edge, Brave, Opera, and Vivaldi, are also advised to apply the fixes as and when they become available.

Update The U.S. Cybersecurity and Infrastructure Security Agency (CISA), on April 1, 2026, added CVE-2026-5281 to its Known Exploited Vulnerabilities ( KEV ) catalog, requiring Federal Civilian Executive Branch (FCEB) agencies to apply the necessary fixes by April 15, 2026. Found this article interesting? Follow us on Google News , Twitter and LinkedIn to read more exclusive content we post.