Yesterday's security developments from Monday, March 30, 2026. We analyzed 8 articles. All attribution is by the article authors. All article analysis is automated.
Nokia Deepfield Emergency Response Team has identified Drifter, a newly discovered DDoS botnet targeting Android TV devices with exposed ADB ports. The botnet disguises its malware as system updates and uses C2 infrastructure that mimics IP camera brand domains to evade detection. It has launched attacks reaching up to 2.6 terabits per second from approximately 80,000 sources, targeting game servers, cloud infrastructure, and ISPs globally.
Sergio Albea reports that attackers are exploiting clipboard functionality to steal sensitive data including passwords, authentication tokens, and cryptocurrency addresses. The research details PowerShell-based clipboard manipulation techniques using Get-Clipboard and Set-Clipboard cmdlets, and defenders are advised to monitor for PowerShell processes with clipboard-related command line arguments as a high-priority detection signal.
PWN.AI Security Research has discovered multiple zero-day vulnerabilities in ImageMagick that can be chained to achieve Remote Code Execution and arbitrary file reads. The vulnerabilities affect millions of servers across major Linux distributions and WordPress installations by default, bypassing various security policies including the 'secure' policy through format detection exploits and GhostScript delegate invocation.
According to AHA!, CVE-2026-4946 is a high-severity vulnerability in NSA Ghidra versions prior to 12.0.3 that allows arbitrary command execution through malicious auto-generated annotations. When analysts click on crafted comments during binary analysis, attacker-controlled commands execute on their machine through improperly processed @execute directives embedded in malicious binaries, enabling file system modification, data exfiltration, and payload delivery. This poses significant risks to malware research labs and incident response teams who routinely analyze untrusted binaries.
Check Point Research discovered a hidden outbound communication channel in ChatGPT's code execution runtime that allowed silent exfiltration of sensitive user data including messages, uploaded files, and AI-generated summaries. The vulnerability used DNS tunneling to bypass security controls, as DNS resolution was permitted despite direct internet access being blocked. OpenAI confirmed the issue and deployed a fix on February 20, 2026.
Lorenzo Meacci introduces InsomniacUnwinding, a novel evasion technique that preserves valid stack unwinding information while encrypting process memory during sleep cycles. The technique bypasses EDR detection by maintaining legitimate-looking call stacks even when using sleep masking, addressing limitations of traditional call stack spoofing methods used in malware like Cobalt Strike beacons.
Sekoia TDR has identified EvilTokens, a newly discovered Phishing-as-a-Service kit enabling cybercriminals to conduct Microsoft device code phishing attacks at scale. The kit automates the theft of access and refresh tokens, converting them into Primary Refresh Tokens for persistent, MFA-bypassing access to Microsoft 365 environments, with campaigns targeting finance, HR, logistics, and sales employees globally across the US, Australia, Canada, France, India, Switzerland, and UAE.
That concludes today's briefing.