Good morning. This is your security briefing for Saturday, March 14, 2026, covering 15 articles across threat intelligence, vulnerabilities, and security research. All attribution is by the article authors. All article analysis is automated.
Microsoft reports on the Contagious Interview campaign, a social engineering operation active since December 2022 targeting software developers at enterprise solution providers and media firms. Threat actors pose as recruiters from cryptocurrency or AI companies, tricking victims into executing malicious code through fake job interviews and technical assignments hosted on GitHub, GitLab, or Bitbucket, ultimately granting attackers access to API tokens, cloud credentials, and signing keys.
Endor Labs has identified the return of PhantomRaven, a sophisticated npm supply-chain attack campaign that used Remote Dynamic Dependencies to deliver malicious payloads harvesting developer credentials, environment variables, and CI/CD tokens. The multi-wave attack compromised at least 214 packages with over 86,000 downloads, exfiltrating data to attacker-controlled servers via HTTP and WebSockets, all attributed to author JPD.
A Qualys Security Advisory warns of multiple critical vulnerabilities in AppArmor that allow unprivileged local attackers to escalate privileges to root on Ubuntu, Debian, and SUSE systems. The vulnerabilities enable manipulation of AppArmor profiles through world-writable pseudo-files, leading to kernel exploitation vectors including uncontrolled recursion, out-of-bounds reads, use-after-free, and double-free conditions that can result in complete system compromise.
MD SEC Active Breach reports on CVE-2026-24291, dubbed RegPwn, a local privilege escalation vulnerability in Windows systems that exploits registry symbolic links to allow attackers to escalate from standard user to SYSTEM-level privileges. The vulnerability affects Windows 10, 11, and Windows Server versions 2012 through 2025, and has been patched in the latest Windows security updates.
Cookie Engineer's Weblog analyzes the Phexia Campaign, a sophisticated multi-stage macOS malware operation potentially attributed to APT28. The attack uses social engineering to trick users into executing a malicious Clickfix payload in Terminal, establishing persistence through LaunchAgents and stealing credentials from browsers, wallets, password managers, and keychains while manipulating system permission prompts.
Zscaler ThreatLabz reports a China-nexus threat actor, potentially linked to Mustang Panda, conducted a cyberattack campaign targeting countries in the Persian Gulf region beginning March 1, 2026. The attack used Arabic-language lures and a multi-stage infection chain deploying a PlugX backdoor variant with advanced obfuscation techniques including Control Flow Flattening, Mixed Boolean Arithmetic, and RC4 encryption, leveraging geopolitical tensions in the Middle East for initial compromise.
LAB52, the intelligence team at S2 Group, has identified a new campaign named DRILLAPP targeting Ukrainian entities with a JavaScript-based backdoor that exploits Microsoft Edge browser capabilities. The backdoor enables file operations, audio/video capture, and screen recording, with possible links to Russia-affiliated threat actor Laundry Bear, using LNK and CPL files to deliver malware variants that leverage Chrome DevTools Protocol.
Telewizya Polska reports that Ukrainian government cyber operations have inflicted an estimated $220 million in financial losses on Russia as part of ongoing geopolitical conflict, representing a significant component of modern warfare strategy.
Check Point Research unveils the Handala threat actor's modus operandi, conducting a sophisticated cyber-espionage campaign since 2022 primarily targeting Israeli government entities, academic institutions, and private companies. The group uses spear-phishing emails with malicious attachments to deploy a custom backdoor named Handala for persistent access and data exfiltration, demonstrating continuous evolution with updated tools and techniques to evade detection.
Cometkim reports a supply-chain cryptocurrency stealing payload compromising the AppsFlyer SDK on March 10, 2026, targeting Bitcoin, Ethereum, Solana, and Monero/XRP transactions. The malware uses a four-layer architecture with network hooking, C2 communication, and address replacement mechanisms to silently redirect cryptocurrency transactions to attacker-controlled wallets through compromised browser extensions, malicious NPM packages, and injected scripts on cryptocurrency websites.
Security researchers report a global cybercrime operation has compromised over 250 WordPress websites across 12 countries to distribute credential-stealing malware including Vidar Stealer v2, Impure Stealer, and VodkaStealer. The attack chain uses ClickFix implants disguised as Cloudflare CAPTCHAs to deliver PowerShell stagers and the Double Donut shellcode loader, enabling in-memory execution that evades traditional detection, targeting news outlets, businesses, and political organizations since December 2025.
Kaspersky Lab's Securelist analyzes BeatBanker, a multi-functional Android Trojan targeting users in Brazil through phishing sites and WhatsApp messages. The malware combines cryptocurrency mining using XMRig for Monero, banking credential theft via overlay attacks on financial apps, and RAT capabilities including screen recording and keylogging, employing in-memory loading and native library packing to evade detection.
Aryaka Networks reports Russian-speaking threat actors are conducting a spear-phishing campaign called BlackSanta EDR-Killer targeting HR and recruitment personnel. The attack delivers malicious ISO files disguised as resumes that deploy an EDR-killer module using DLL sideloading and defense evasion techniques to disable endpoint security before deploying additional payloads and exfiltrating sensitive information through encrypted communications.
Security researcher crvvdev published a detailed technical analysis of the EMAC Anti-Cheat Driver, a kernel-mode anti-cheat system for Counter-Strike 2 on GamersClub platform. The analysis reveals sophisticated protection mechanisms including VMProtect virtualization, XOR-obfuscated IAT, syscall interception, memory scanning, and hardware fingerprinting, raising security implications including potential exploitation risks and privacy concerns.
Airbus CERT released Kerlab, a Rust-based implementation of the Kerberos protocol containing offensive security tools for password spraying, brute-force attacks, and ticket manipulation. The toolkit includes utilities like kerforce, kerspray, and kerticket that can perform online attacks, convert tickets for offline cracking with Hashcat, and manipulate Kerberos authentication tickets, providing capabilities for both defensive analysis and offensive operations against Kerberos-based authentication systems.
That concludes today's briefing.