This week featured several concerning security incidents. Critical software experienced unauthorized modifications. Everyday tools contained active flaws. Some attacks required minimal effort due to existing vulnerabilities.

A single initial problem can rapidly escalate. Small issues can quickly affect numerous systems, resulting in new vulnerabilities, quicker exploitation, and compressed response times.

This is a summary of the week’s events. Review the details.

N. Korean Hackers Compromised Axios npm Package—Suspected North Korean actors took over the npm account of the main developer of Axios, a widely used npm package. They then deployed malicious versions of the software, carrying a cross-platform malware called WAVESHAPER.V2. This activity is attributed to the UNC1069 group, known for financially motivated cybercrimes. This exemplifies the potential for widespread impact when a common npm package is compromised. The malware’s self-deletion features hint at a pre-planned operation. According to Avital Harel of Upwind, software build pipelines are becoming the prime target, allowing attackers to achieve widespread trust by compromising build and distribution systems. Organizations should focus on securing CI/CD systems, package dependencies, and developer environments. Ismael Valenzuela of Arctic Wolf noted this reflects a trend of attackers targeting widely used software components for broad access. Even brief infection windows can expose countless systems because Axios is embedded into enterprise applications, making detection and containment difficult, even for those who didn’t directly install Axios. This emphasizes the need for security teams to view build‑time tools and dependencies as part of the attack surface and practice zero trust.

• Google Patches Actively Exploited Chrome 0-Day—Google issued security updates for Chrome to patch 21 security vulnerabilities, including a zero-day already being exploited. The vulnerability, CVE-2026-5281 (severity: high), is a use-after-free bug in Dawn, an open-source WebGPU implementation. Chrome users should update to versions 146.0.7680.177/178 for Windows and macOS, and 146.0.7680.177 for Linux. Specific details about the vulnerability’s exploitation and the responsible parties were not disclosed by Google.
• TrueConf 0-Day Exploited in Attacks Targeting Government Entities in Southeast Asia—Chinese hackers exploited a zero-day vulnerability (CVE-2026-3502, CVSS 7.8) in the TrueConf video conferencing platform to attack government organizations in Southeast Asia. The vulnerability stems from a lack of integrity checks when fetching updates, allowing attackers to distribute malicious code. Check Point reported that the affected TrueConf server, operated by a government IT department, served as a video conferencing platform for many government organizations, delivering the same malicious update to all. This activity began in January 2026 and involved deploying the Havoc framework, with initial infections likely stemming from malicious links. TrueConf is widely adopted globally, serving around 100,000 organizations.
• Active Exploitation of Fortinet FortiClient EMS Flaw—Fortinet released emergency patches for a critical security flaw (CVE-2026-35616) in FortiClient EMS, which is being actively exploited. This vulnerability is a pre-authentication API access bypass that can lead to privilege escalation. WatchTowr recorded the first exploit attempts against CVE-2026-35616 in their honeypots on March 31, 2026. This occurs soon after another critical FortiClient EMS vulnerability (CVE-2026-21643) also came under active exploitation.
• Apple Backports DarkSword Fixes to More Devices—Apple released iOS 18.7.7 and iPadOS 18.7.7 for a wider range of devices to protect against DarkSword, a recently identified exploit kit. This update targets customers who haven’t upgraded to iOS 26 but are capable. Apple’s action is in response to substantial threats created by the DarkSword exploit kit. The widespread distribution of these patches highlights the severity of the threat posed by malware such as DarkSword. Apple released the fix in iOS 18 because of the large number of users still using that OS and the DarkSword kit leak on GitHub so they could remain protected and did not need to upgrade to iOS 26. The leak is critical since it makes the kit readily available to less skilled cybercriminals.
• DeepLoad Malware Delivered via ClickFix Attack—The ClickFix technique is being used to distribute DeepLoad, a stealthy malware that can steal credentials and intercept browser activity. The malware initially appeared on a dark web forum in early February 2026, advertised as “a centralized panel for multiple types of malware.” ZeroFox reports that “DeepLoad’s design is explicitly focused on actively facilitating real-time cryptocurrency theft, which almost certainly makes it an attractive malware suite in the cybercrime-as-a-service (CaaS) environment.” The malware is distributed through ClickFix attacks disguised as resolving fake browser error messages. Besides stealing credentials, it installs a malicious browser extension to intercept sensitive data and spreads via USB drives. The complexity of DeepLoad’s code suggests that it may have been developed using AI technologies.
• Claude Code Source Code Leaks—Anthropic admitting that the internal code for its Al coding assistant, Claude Code leaked from human error. When Anthropic released version 2.1.88 of its Claude Code npm package, it mistakenly included a map file revealing almost 2,000 source code files and over 512,000 lines of code. The source code leak revealed features either in development for or existing in the service, including Undercover mode to obscure AI authorship, KAIROS (a persistent agent), defenses against distillation attacks, and frustration monitoring through keyword detection. Attackers exploited this leakage to trick developers into downloading stealer malware.

New vulnerabilities are constantly emerging, and the time it takes for them to be exploited is decreasing. The vulnerabilities listed are this week’s most pressing, because they are high-severity, found in widely used software, or are gaining attention from the cybersecurity community.

Address these issues promptly by patching affected systems, and prioritize those marked as urgent: CVE-2026-35616 (Fortinet FortiClient EMS), CVE-2026-20093 (Cisco Integrated Management Controller), CVE-2026-20160 (Cisco Smart Software Manager On-Prem), CVE-2026-5281 (Google Chrome), CVE-2026-3502 (TrueConf), CVE-2026-27876, CVE-2026-27880 (Grafana), CVE-2026-4789 (Kyverno), CVE-2026-2275, CVE-2026-2285, CVE-2026-2286, CVE-2026-2287 (CrewAI), CVE-2025-14819 (Notepad++), CVE-2026-34714, CVE-2026-34982 (Vim), CVE-2026-33660, CVE-2026-33696 (n8n), CVE-2026-25639 (Axios), CVE-2026-25075 (strongSwan), CVE-2026-34156 (NocoBase), CVE-2026-3308 (Artifex MuPDF), CVE-2026-1579 (PX4 Autopilot), CVE-2026-3991 (Symantec Data Loss Prevention Agent for Windows), CVE-2026-33026 (nginx-ui), CVE-2026-33416, CVE-2026-33636 (libpng), CVE-2026-3775, CVE-2026-3779 (Foxit PDF Editor), CVE-2026-34980, CVE-2026-34990 (CUPS), and CVE-2026-34121 (TP-Link).

• Learn How to Close Identity Gaps Using Insights from IT Leaders → Identity programs face increased risk from fragmented apps, manual credentials. Based on insights from over 600 IT and security leaders in 2026, this discussion covers how to measure, remediate, and proactively manage identity gaps to regain control.
• Learn How to Build Secure AI Agents Using Identity, Visibility, and Control → Many teams are using AI agents, but may not secured them. This session reveals how to do it by applying identity, visibility, and control. See deployment examples, how to track agent activity, and ensure safe behavior. Also, discover how to secure AI systems now while the standards emerge.

• Increased Device Code Phishing Attacks —Device code phishing attacks, abusing the OAuth device authorization grant flow to compromise accounts, have increased over 37x this year. Push Security reported a 15x surge in device code phishing pages since early March 2026, signaling adoption is growing. The company explains that “The technique tricks a user into issuing access tokens for an attacker-controlled application (not a device, confusingly).” Any app supporting device code logins may be targeted, and Microsoft is targeted the most. EvilTokens (ANTIBOT), a criminal Phishing-as-a-Service (PaaS) toolkit with support for the technique, is growing in popularity using Cloudflare Workers frontend and Railway backend authentication. Venom offers similar phishing-as-a-service device code phishing capabilities. Other PaaS kits that support this attack method include SHAREFILE, CLURE, LINKID, AUTHOV, DOCUPOLL, FLOW_TOKEN, PAPRIKA, DCSTATUS, and DOLCE.
• LinkedIn Questioned Over BrowserGate —A report labeled BrowserGate claims LinkedIn secretly uses JavaScript scripts on its website to check for thousands of installed Chrome extensions silently collecting data. The report claims LinkedIn scans for 200 products that compete with its sales tools, including Apollo, Lusha and ZoomInfo. Using an employer’s user list, LinkedIn determines the company product usage. Then, LinkedIn sends warnings to users of these violating, third-party tools. Also, LinkedIn loads an invisible HUMAN Security tracking pixel and other fingerprinting scripts from LinkedIn and Google servers on every page load. In response, LinkedIn told Bleeping Computer it needs to scans for extensions used to scrape data without user’s consent. The company stated the report is from a person flagged from scraping LinkedIn’s Terms of Service.
• ICE Confirms Use of Paragon Spyware —The U.S. Immigration and Customs Enforcement (ICE) verified it uses Paragon spyware to “identify, disrupt and dismantle Foreign Terrorist Organizations, addressing the escalating fentanyl epidemic and safeguarding national security.” Paragon’s Graphite spyware has been located on journalists phones. Last year, WhatsApp announced it disrupted a campaign that deployed the spyware on its users. Australia, Canada, Cyprus, Denmark, Israel and Singapore’s governments are suspected to be Israeli company’s customers.
• Ex-Engineer Admits Extortion Charge —Daniel Rhyne, 59, of Kansas City, Missouri, admitted guilt to a failed data extortion campaign targeting his old employer. Rhyne was apprehended in September 2024. Rhyne worked as a core structure engineer at a US firm in New Jersey. In November 2023, the defendant executed a system-wide ransomware threat and demanded firm pay about 20 Bitcoin equating to $750,000. The U.S. Justice Department (DoJ) also convicted Cameron Curry (aka Loot), 27, of North Carolina, for cyber extortion against a technology org, Brightly Software. “Trial evidence established that Curry misused his position to access the victim company’s personnel and other sensitive corporate records, which he then used to carry out the cyber extortion scheme after he learned that his contract was not going to be renewed and that he would no longer be employed by the company,” the DoJ declared. Curry sent 60 emails to company executives. He would expose company data unless he receiving $2.5 million in cryptocurrency. Brightly had paying $7,540 in bitcoin.
• Residential Proxies Avoid Reputation Protocols —Threat intelligence firm GreyNoise studies of 4 billion sessions from between Nov 29, 2025 to Feb 27, 2026 found 39% of IPs were from an home connection, and 78% terminate. stated. The rotation rate is past any feed based defense mechanisms. This behavior separates the source IPs of its targets to the user. 0.1% have exploiting payloads, and 1.0% from the data center traffic. Residential proxies traffic comes from IoT botnet and infected machines, networks also resilient efforts to be taken down “operators backfilled after IPIDEA loss 40% in nodes. Every major takedown gets regenerated.” It recommends “Detection must shift from ‘where is the traffic from?’ “to what is the traffic doing, and device fingerprinting produces reliable detection”
• N. Korea suspects compromised cryptocurrency companies using React2Shell — A new scheme has been recognized jeopardizing cryptocurrency orgs by taking advantage of vulnerabilities like React2Shell (CVE-2025-55182), tenants from AWS by using credentials, proprietary information theft, containing secrets. Crypto sector from AWS to exchange has been targeted Ctrl-Alt Intel mentioned, stating to follow cryptocurrency theft operations.
• India Extends SIM-Binding Mandate —The Indians government increased its messaging apps mandate to binding through to December 31, 2026. comes after Broadband Forum represent Meta and Google, warned the Department of Telecommunication and that directions were unconstitutional. Messaging accounts are to the physical SIM card during set under November 2025. Users could connect through content and other messages. Given 90 day comply by the end of Feburary 2026. SIM can combat spammers to border fraud. With companies giving till the deadline, Whatsapp is said testing SIM binding on Android.
• Russian Actors gain access through Compromised Structure — Russian actors APT and void Blizzard are check whether access is possible and to check validity, The analysis of the state service connection states “Unfortunately, these attempts sometimes succeed if the root cause of the initial incident has not been completely eliminated”.
• OkCupid settles FTC for privacy—OkCupid and group reached a settlement. With the FTC over 3 user photos shared with Clarifai. The complaint also accused the website for other sharing locations without consent. OkCupid and match did not admission to agreements, a misrepresent sharing personal data ban.
• Advertised Android Malware Mirax new — A private malware like service enables the devices, 700 financial services, passwords. $2,500 per month.
• Venom Stealer via ClickFix—A subscription malware steals subscriptions for Apex Predator, starting $250/month or $1,800 for life, extracting data from the initial. Blackfog noted a social engineering tool directly into the operator with initial, that does not stop after done. SkimokKeep used from WebDAV to download DLL of executions along from sandboxing. The tutorials come from OpenClaw. Claude with malwares Macsyc used.
• Infection stealer spot— Campaigns also themed emails deliver Phantom Storms. New stealer information also like MioLab and PXA Stealer targeting financial institutions in Q1 2026 from Microsoft Flare’s data from stealer are threatening from downloads. An employee downloads by one employee direct access on that entire Tuesday to $15 by Thursday.
• Phishing Philippine Banking Targeting—Phishing email for harvesting or for multi factor authentication. For Financial Banks began early 2024 from account to harvest banking logins using telegram The group attributed by PHISLES
• Harvest Extension for Conversations — An extension harvests conversions called anti malware steals Discord channel systematic copying bySecuritysnacks.
• Iran conflict for the espionage activity in the Middle East—After math or for countries. Government sectors by microsoft One activity not attributed to domain harvesting TA473 or. Live uamap platform from news coming from the Middle East.
• UK warns to app messaging—From account recovery codes ,from apps like sharing

• Dev Machine Guard → scans developers from tool without code to miss exposure.
• Pius → mapping attack of reconnaissance by exposures of security.

Disclaimer: For research and educational use only. Not security audited. Review all code before use, test in isolated environments, and ensure compliance with applicable laws.

It’s important to note that small problems do matter. Normal system function could cause problems which leads to bigger gaps.

Routines can have implications and everything is not a safe implication of potential use. If small risk, can cause bigger consequences