Good morning. Yesterday's security developments from Thursday, March 26, 2026 bring us 14 articles covering extraditions, supply chain attacks, and active zero-day exploitation. All attribution is by the article authors. All article analysis is automated.
The U.S. Attorney's Office for the Western District of Texas reports that Armenian national Hambardzum Minasyan has been extradited to the United States and charged for his role in developing and administering the RedLine infostealing malware. Minasyan allegedly registered virtual private servers and domains to host command-and-control infrastructure, created malware distribution repositories, and received cryptocurrency payments from affiliates who used the malware to steal sensitive data from victims including major corporations.
Apifox reports a supply chain attack that compromised their CDN on March 4th, 2026, injecting malicious JavaScript into their official distribution. The multi-stage attack targeted users of Apifox desktop versions below 2.8.19, exfiltrating SSH keys, shell history, Git credentials, and system information to a C2 server using RSA-encrypted communications.
WithSecure Labs details exploitation of Ivanti EPMM starting February 2026 through CVE-2026-1281 and CVE-2026-1340, enabling remote code execution. Multiple threat actors deployed AntSword webshells to establish persistence, execute commands as root, and exfiltrate sensitive data including databases and system files, demonstrating rapid vulnerability exploitation post-disclosure and automated toolkit usage.
Luxembourg Times reports that memory-resident malware compromised all 4,850 devices managed by Luxembourg's State Centre for Information Technology, remaining undetected for nearly a month before discovery on February 26th. The malware accessed device and user data managed by CTIE but did not compromise personal data stored directly on devices, and CTIE successfully isolated and remediated the affected systems.
The Xen security team has disclosed XSA-482, a vulnerability in the Linux kernel's privcmd driver that allows circumvention of kernel lockdown and secure boot protections through page table manipulation. The flaw affects PV, PVH, and HVM guests running Linux with secure boot enabled, allowing unprivileged guest administrators to modify kernel memory and potentially achieve complete system compromise, though patches are available subject to embargo restrictions.
SSD Secure Disclosure reports a critical remote code execution vulnerability in UNISOC modem firmware affecting chipsets T612, T616, T606, and T7250 used in devices from major brands like Honor, realme, vivo, Samsung, and Motorola across 140 plus countries. The flaw allows an attacker to execute arbitrary code on target devices over the cellular network by sending malformed SDP messages within SIP signaling that trigger uncontrolled recursion and stack overflow, and the vendor has not responded to the disclosure.
OPSWAT Unit 515 discovered a chain of four vulnerabilities in Cisco Catalyst 9300 Series switches that enable privilege escalation from low-privileged accounts to execute administrative commands. The exploit chain allows authenticated attackers to force switches into maintenance mode causing full denial of service that may require physical intervention, with additional XSS and CRLF injection vulnerabilities also identified.
S12 Zero x Twelve Dark Development provides a detailed technical walkthrough of using Bring Your Own Vulnerable Driver techniques to bypass Windows Code Integrity and establish kernel read/write primitives. The technique exploits vulnerable legitimate drivers like gdrv.sys to disable Driver Signature Enforcement, enabling attackers with Administrator privileges to load unsigned malicious drivers for persistence, privilege escalation, and evasion.
Push Security researcher Dan Green reports that attackers are conducting a sophisticated phishing campaign targeting business TikTok accounts used by marketing teams through Adversary-in-the-Middle phishing kits. The attack leverages cloned login pages disguised as legitimate TikTok for Business or Google Careers sites to steal session tokens and hijack accounts, employing evasion techniques including Cloudflare hosting, Google Storage buckets, and dynamic URLs to bypass detection.
Socket.dev reports attackers are conducting a widespread phishing campaign targeting developers on GitHub by posting fake Visual Studio Code security alerts in GitHub Discussions. The malicious posts contain links that lead to a multi-step redirection chain, ultimately delivering a JavaScript reconnaissance payload that fingerprints victims and connects to command-and-control infrastructure, functioning as a Traffic Distribution System designed to filter and target victims for follow-on attacks.
SecuritySnack discovered a malicious Chrome extension named ChatGPT Ad Blocker stealing ChatGPT conversation data by exfiltrating HTML content, user prompts, and metadata to a Discord webhook. The extension was developed by krittinkalra with ties to AI4ChatCo and Writecream, using JavaScript to inject content scripts and capture sanitized page data before exfiltration, representing a supply chain risk for users seeking ad-blocking functionality for ChatGPT.
Trend Micro reports the Pawn Storm cyber espionage group, also known as APT28 or Fancy Bear, has launched a campaign using PRISMEX malware targeting Ukraine's defense supply chain and allies across Central and Eastern Europe. The campaign actively exploits Windows zero-days CVE-2026-21513 and CVE-2026-21509, utilizing advanced techniques including steganography, COM hijacking, and fileless execution to evade EDR systems, with targets including government, military, and critical infrastructure entities in Czech Republic, Poland, Romania, Slovakia, Slovenia, and Turkey.
Gendigital reports VoidStealer is malware that bypasses Application-Bound Encryption in Chromium-based browsers on Windows by launching Chrome as a suspended debug process and using hardware breakpoints to extract the Chrome Master Key directly from memory. The malware uses legitimate Windows debugging APIs to access browser memory and decrypt saved passwords, cookies, and web data without administrator privileges, then exfiltrates via C2 and self-deletes to evade detection.
haxrob has published a GitHub repository containing source code for a controller variant of BPFDoor, a known stealth backdoor malware. The controller supports multiple network modes including TCP, ICMP, and UDP, reverse shell capabilities, HTTPS communications, and custom magic packet sequences, representing attacker infrastructure code for remotely managing BPFDoor implants.
That concludes today's briefing.