Good morning. This is your security briefing for Thursday, April 23, 2026, covering 8 articles. All attribution is by the article authors. All article analysis is automated.
Infrawatch has discovered a massive SIM Farm as a Service operation managed by the ProxySmart control plane, spanning 87 exposed instances across 17 countries and 94 physical phone-farm locations. This Belarus-based infrastructure supports at least 24 commercial proxy providers, enabling industrial-scale abuse by providing mobile proxies that bypass IP-based security controls through carrier-grade network address translation and rapid IP rotation, with built-in anti-bot evasion capabilities.
Hunt.io reports that the DinDoor backdoor, linked to Iranian APT group Seedworm, also known as MuddyWater, is leveraging the legitimate Deno runtime to execute malicious JavaScript and evade detection. The malware is delivered via MSI files with 20 active command and control servers identified, and has been observed targeting U.S. organizations as part of a Malware-as-a-Service platform sharing infrastructure with other threats like CastleLoader.
Acronis reports that Chinese APT group Mustang Panda has deployed the LOTUSLITE version 1.1 backdoor targeting India's banking sector, South Korean and U.S. policy circles. The campaign has evolved from CHM-based delivery to DLL sideloading using legitimate Microsoft-signed executables, with enhanced evasion techniques including modified command and control packet magic values, and uses lures impersonating HDFC Bank and entities involved in Korean peninsula diplomacy.
Microsoft reports that North Korea-aligned threat actor Jasper Sleet is infiltrating organizations by posing as legitimate remote IT workers using stolen or fabricated identities enhanced with AI-assisted deception. The actor exploits remote hiring processes, accessing career sites and Workday Recruiting Web Service endpoints to gather job information, then gains trusted access to internal systems including Microsoft Teams, SharePoint, and OneDrive for data theft and extortion.
CYFIRMA has documented Operation PhantomCLR, a sophisticated post-exploitation framework targeting Middle East and EMEA financial sectors through AppDomainManager hijacking of a legitimate signed Intel binary. The attack chain uses spear-phishing delivery, dual-layer sandbox evasion, reflective in-memory loading, JIT-based shellcode execution, and HTTPS domain fronting over CloudFront CDN for command and control communication, while employing anti-forensic techniques to erase memory artifacts and bypass endpoint detection and response solutions.
Talos Intelligence reports that attackers are exploiting native macOS features including Remote Application Scripting, Spotlight metadata, and built-in utilities like osascript and socat to execute code, move laterally, and establish persistence on macOS systems. These living-off-the-land techniques leverage legitimate functionalities such as the eppc protocol, Finder comments for payload hiding, and alternative file transfer methods like SMB, Netcat, Git, and TFTP to bypass traditional security controls, primarily targeting macOS systems used by developers and DevOps teams.
LayerX security researchers report that at least 12 malicious browser extensions disguised as TikTok video downloaders compromised over 130,000 users through a coordinated campaign. The extensions used remote configuration endpoints to dynamically modify behavior and expand data collection capabilities 6 to 12 months after initial publication, evading marketplace reviews, with the shared codebase indicating persistent activity by the same threat actors.
That concludes today's briefing.