Good morning. This is your security briefing for Sunday, April 12, 2026, covering nine security developments. All attribution is by the article authors. All article analysis is automated.
Breakglass Intelligence reports that APT41, also known as Winnti, has deployed a sophisticated backdoor targeting Linux cloud workloads across AWS, Google Cloud, Azure, and Alibaba Cloud to harvest credentials. The malware uses covert command and control over SMTP port 25 with selective handshake validation requiring correct tokens, and facilitates lateral movement via UDP broadcast. This campaign represents a six-year evolution of Winnti backdoors toward cloud-native credential theft.
Adobe, EXPMON Public, and the Counter Threat Unit researchers report active exploitation of a zero-day vulnerability in Adobe Reader that has been ongoing since December 2025. The vulnerability exploits privileged Acrobat APIs to steal local system information and files, with attacks appearing to target the Russian oil and gas sector. Adobe has released a security update addressing the prototype pollution vulnerability, which has a severity score of 8.6 and allows arbitrary code execution.
Calif reports on a heap buffer overflow vulnerability in nginx's HTTP DAV module, discovered through human-AI collaboration with Claude. The flaw allows arbitrary file read and write operations when specific non-default configurations are present, including the alias directive with DAV methods COPY or MOVE. While affecting a small population, the vulnerability enables remote attackers to read sensitive data, compromise systems, or cause denial of service.
CyberInsider reports that downloads of HWMonitor and CPU-Z from the official CPUID website were compromised through a supply chain attack, redirecting users to trojanized packages hosted on external storage. The sophisticated malware employs multi-stage infection, memory-resident operations, and advanced evasion techniques. The threat group behind this attack has been previously linked to distributing trojanized FileZilla.
Google's Chrome team and Account Security team report they have implemented Device Bound Session Credentials, a new protocol that cryptographically binds authentication sessions to specific devices using hardware-backed security modules like TPMs and Secure Enclaves. The technology prevents session theft by making stolen cookies unusable, as attackers cannot possess the required private keys, with early deployment showing significant reduction in session theft.
Tanrikuluatahan provides technical analysis detailing how changes in Windows 11 24H2 and 25H2 broke Mimikatz's credential extraction command due to signature pattern changes, address resolution modifications, and struct layout alterations. The article provides technical solutions for patching Mimikatz to restore credential extraction capabilities on these newer Windows builds, demonstrating successful hash extraction after implementing the fixes.
That concludes today's briefing.