Good morning. Today's security briefing covers developments from Wednesday, April 01, 2026, with 7 articles analyzed. All attribution is by the article authors. All article analysis is automated.
0x3oBAD reports on a sophisticated attack campaign by the China-linked APT group Mustang Panda using a PlugX malware variant. The attack chain utilized malicious link files, PowerShell scripts, and DLL side-loading via legitimate executable ErsChk.exe, followed by multi-stage decryption to deploy a reflective PlugX loader that establishes command and control communication with advanced obfuscation, in-memory execution, and evasion techniques including dynamic API resolution through hashing.
A hosting provider detected a malicious Notepad++ update distributed through a compromised software distribution channel. Attackers accessed shared hosting accounts from Taiwan, Vietnam, Singapore, Hong Kong, Japan, and China using ProtonVPN, deploying PHP tunnels on the hosting infrastructure, with the provider identifying malicious PHP files through specific SHA-256 hashes and attacker IP addresses.
BleepingComputer reports that Cisco suffered a breach resulting in theft of source code from over 300 GitHub repositories after threat actors exploited stolen credentials from a supply chain attack involving Trivy. The attack chain involved a malicious GitHub Action plugin that distributed the TeamPCP Cloud Stealer infostealer, compromising Trivy's CI/CD pipeline and subsequently providing access to Cisco's development environment and AWS keys.
According to Google Threat Intelligence Group and Mandiant, North Korea-nexus threat actor UNC1069 compromised the widely used axios NPM package on March 31, 2026, by introducing a malicious dependency called plain-crypto-js into axios releases 1.14.1 and 0.30.4. The attack deployed WAVESHAPER.V2 RAT across Windows, macOS, and Linux systems, affecting hundreds of millions of users and enabling reconnaissance, command execution, and secret theft through supply chain compromise.
Patrick Wardle and the Objective-See Foundation published a reverse engineering analysis of Apple's native protections against ClickFix attacks in macOS 26.4. The analysis reveals Apple implemented protections using new reserved Endpoint Security events, types 148 and 149, within the xprotectd component that detect when users attempt to paste terminal commands from applications like Safari, though these protections are not accessible to third-party security tools.
A developer has released WinDbg MCP, a newly developed tool that exposes all pybag Windows debugger functions as a Model Context Protocol server. This enables AI coding assistants and custom agents to programmatically control user-mode processes, kernel sessions, and crash dump analysis, providing 55 distinct debugger functions accessible through typed tool calls with structured JSON responses.
GReAT analyzes CrystalX RAT, a Malware-as-a-Service platform active since March 2026 that combines traditional RAT capabilities including stealer, keylogger, clipper, and spyware functions with unique prankware features. Dozens of victims have been identified primarily in Russia, though the platform poses a global threat with no regional limitations, and the MaaS model indicates an evolving threat requiring monitoring of command and control infrastructure and implant hashes.
That concludes today's briefing.