Security Signals (4/21/26-5/5/26)
Welcome to Security Signals
Every two weeks, we bring you expert insights and handpicked articles covering the latest threats, threat actor activity, vulnerabilities, incident trends, and defensive strategies. Whether you’re on the front lines or shaping your organization’s security posture, Security Signals delivers the information you need to stay informed and ready.
For more articles, check out our #onpatrol4malware blog.
April 2026 Edition
Key stats from real-world telemetry and live attack observations over the past month – a concise look at what we’re seeing across malware, phishing, ransomware, C2s, and domain abuse.
Insights (TL;DR)
Top ATT&CK Techniques Observed
- T1195 – Supply Chain Compromise (Score: 9/9): Abuse of trusted software distribution channels including npm packages, developer tools, and compromised updates.
- T1566 – Phishing / Social Engineering (Score: 8/9): OAuth AiTM attacks, smishing kits, CAPTCHA lures, and AI-generated phishing campaigns.
- T1555 – Credential Access (Score: 8/9): Widespread infostealer activity targeting credentials, sessions, and financial data.
- T1190 – Exploit Public-Facing Applications (Score: 7/9): Active exploitation of cPanel, LLM infrastructure, and internet-facing services.
- T1071 – Application Layer C2 (Score: 7/9): Use of SaaS platforms, OAuth workflows, and blockchain-based communication channels.
- T1059 – Command Execution (Score: 6/9): PowerShell, Python backdoors, and multi-stage loaders enabling execution and persistence.
What Matters Most This Period
- Supply chain attacks are leading initial access. Compromised packages, repositories, and software updates are being used to scale access across enterprise environments.
- Credential theft is the common objective. Across phishing, malware, and supply chain attacks, the end goal is consistently identity and account access.
- AI is increasing attacker efficiency. Threat actors are using AI-generated lures and automation to improve targeting and scale campaigns.
- Trusted platforms are being systematically abused. GitHub, SaaS tools, browser extensions, and developer ecosystems are central to multiple attack chains.
- Infrastructure exploitation remains high-impact. Targeting of appliances and exposed services continues to deliver significant access.
What Defenders Should Watch
- Execution from developer tools, package managers, and software installers
- OAuth abuse, MFA bypass attempts, and unusual authentication flows
- Browser extensions and macOS scripting activity tied to credential theft
- Outbound connections to newly observed or cloud-hosted infrastructure
- Mobile applications requesting sensitive permissions tied to financial workflows
Quick Wins
- Restrict and monitor package manager and developer tool usage
- Enforce MFA with additional verification for high-risk actions
- Alert on execution from temporary and download directories
- Block newly registered domains associated with phishing and fake software
- Review exposure of internet-facing services and administrative interfaces
Key Insight: Attackers are converging on three scalable entry points: 1) trusted software (supply chain), 2) trusted users (phishing), and 3) trusted platforms (SaaS/cloud) – all with credential theft as the consistent objective.
Articles
Late April 2026 Cyber Threat Reports highlight a surge in supply chain compromises, OAuth phishing, and infostealer activity, alongside growing abuse of developer ecosystems, SaaS platforms, and AI-driven attack techniques. From npm package backdoors and trojanized software to credential theft campaigns and ransomware operations like Qilin and Kyber, attackers continue to scale access through trusted environments while targeting identity and infrastructure at speed.
Tropic Trooper Pivots to AdaptixC2 and Custom Beacon Listener
Source: Zscaler
(Published: 22 April 2026)
Tropic Trooper has shifted tactics by adopting AdaptixC2 and a custom beacon listener in a multi-stage campaign targeting organizations across East Asia. Read more.
When Malware Authors Study Algebra: The Group Theory Inside Bedep’s DGA
Source: Gen Digital
(Published: 22 April 2026)
Bedep was a malware family active mainly in 2014 and 2015 that used an unusually sophisticated domain generation algorithm, or DGA, to hide its command-and-control infrastructure. Read more.
DragonBreath: Dragon in the Kernel
Source: Ransom-ISAC
(Published: 22 April 2026)
A 0-day BYOVD vulnerability in dragoncore_k.sys signed by Zhengzhou 403 Network Technology, with shell company analysis, Dragon Breath APT-Q-27 attribution, and an APT31 / Wuhan Xiaoruizhi personnel nexus. Read more.
The Gentlemen RaaS and SystemBC Activity Observed in Enterprise Intrusions
Source: PolySwarm
(Published: 22 April 2026)
Recent enterprise intrusions reveal increased activity from The Gentlemen ransomware-as-a-service operation alongside SystemBC malware used for command-and-control. Read more.
Malicious Checkmarx Artifacts Found in Official KICS Docker Repository and Code Extensions
Source: Socket
(Published: 22 April 2026)
Docker and Socket have uncovered malicious Checkmarx KICS images and suspicious code extension releases in a broader supply chain compromise. Read more.
The Meta 2FA Trap: From Verified Badge to Account Takeover
Source: Cofense
(Published: 22 April 2026)
Attackers are exploiting Meta’s verified badge system to bypass 2FA protections and take over user accounts through social engineering techniques. Read more.
Hold the Phone! International Revenue Share Fraud Driven by Fake CAPTCHAs
Source: Infoblox
(Published: 23 April 2026)
CAPTCHAs, the mundane tasks where we demonstrate our ability to select bicycles or distinguish chihuahuas from blueberry muffins, are increasingly being weaponized to trick users into performing actions with unexpected consequences. Read more.
Analyzing a Full ClickFix Attack Chain – Part 1
Source: Stormshield
(Published: 23 April 2026)
In a previous article, we introduced the ClickFix technique. Read more.
Komari C2 Agent Abuse
Source: Huntress
(Published: 23 April 2026)
Threat actors are abusing Komari C2 agents to establish persistence and execute malicious commands across compromised environments. Read more.
Snow Flurries: How UNC6692 Employed Social Engineering to Deploy a Custom Malware Suite
Source: Google Cloud Blog
(Published: 23 April 2026)
Google Threat Intelligence Group identified a multistage intrusion campaign by UNC6692 that used persistent social engineering, custom malware, and pivoting inside victim environments. Read more.
Operation TrustTrap: Domain Spoofing Campaign
Source: Cyble
(Published: 23 April 2026)
Operation TrustTrap leverages domain spoofing techniques to deceive users and facilitate phishing and credential theft campaigns. Read more.
Inside agenteV2: How Brazilian Attackers Use Fake Court Summons to Steal Banking Credentials in Real Time
Source: ANY.RUN
(Published: 24 April 2026)
A new phishing campaign targeting Brazilian users demonstrates how modern financial malware has evolved from simple credential theft into full-scale, operator-driven fraud platforms. Read more.
Bitwarden CLI Supply Chain Compromise
Source: SafeDep
(Published: 24 April 2026)
The malicious @bitwarden/cli npm release was not a normal Bitwarden update. Read more.
Kyber Ransomware: Double Trouble With Windows and ESXi Attacks
Source: Rapid7
(Published: 24 April 2026)
Kyber ransomware operators are targeting both Windows and ESXi environments, increasing impact through multi-platform encryption strategies. Read more.
Compromised eScan Update Enables Multi-Stage Malware and Blockchain C2
Source: Darktrace
(Published: 24 April 2026)
A compromised eScan software update was used to deliver multi-stage malware that communicates with blockchain-based command-and-control infrastructure. Read more.
KYCShadow Android Banking Malware Exploits Fake KYC Workflows
Source: CYFIRMA
(Published: 25 April 2026)
KYCShadow malware targets Android users by abusing fake KYC processes to steal credentials and one-time passwords. Read more.
Lotus Wiper Malware Campaign
Source: Kaspersky Securelist
(Published: 25 April 2026)
Lotus Wiper is a destructive malware campaign targeting organizations with data wiping capabilities following initial compromise. Read more.
CVE-2026-33626 Exploited in LLM Inference Engines Within Hours
Source: Sysdig
(Published: 25 April 2026)
Attackers rapidly weaponized CVE-2026-33626 to exploit LMDeploy-based LLM inference engines within hours of disclosure. Read more.
Mustang Panda Targets Banking Sector and Geopolitical Entities
Source: Acronis
(Published: 26 April 2026)
Mustang Panda is conducting campaigns targeting banking institutions and geopolitical organizations using advanced malware delivery techniques. Read more.
High-Risk GenAI Browser Extensions Expose Users to Data Theft
Source: Unit 42 (Palo Alto Networks)
(Published: 26 April 2026)
Researchers identified multiple GenAI browser extensions exposing sensitive user data through excessive permissions and insecure handling of inputs. Read more.
BlueNoroff Uses ClickFix, Fileless PowerShell, and AI-Generated Fake Zoom Meetings to Target Web3 Sector
Source: Arctic Wolf
(Published: 27 April 2026)
Arctic Wolf has identified a targeted intrusion against a North American Web3/cryptocurrency company, which we attribute with a high confidence level to BlueNoroff, a financially motivated subgroup of DPRK’s Lazarus Group. Read more.
New NGate Variant Hides in Trojanized NFC Payment App
Source: ESET Research
(Published: 27 April 2026)
A new NGate malware variant is distributed through trojanized NFC payment apps to steal financial data from mobile users. Read more.
Critical cPanel Authentication Bypass Actively Exploited
Source: Cato Networks
(Published: 27 April 2026)
A critical authentication bypass vulnerability in cPanel/WHM is being actively exploited in the wild to gain unauthorized access to systems. Read more.
Oluomo OAuth AiTM Phishing Campaign
Source: Censys
(Published: 28 April 2026)
Attackers are leveraging OAuth-based adversary-in-the-middle techniques using naturalization-themed lures to harvest credentials. Read more.
Silent Lures: Empty Subject Email Attacks
Source: Cyberproof
(Published: 28 April 2026)
Attackers are using empty subject lines in phishing emails to bypass filters and increase user engagement rates. Read more.
GachiLoader Uses AI-Themed Lures to Deliver Rhadamanthys Infostealer
Source: Malwarebytes (ThreatDown)
(Published: 29 April 2026)
GachiLoader campaigns use AI-themed lures and fake repositories to distribute Rhadamanthys infostealer malware. Read more.
Mini Shai-Hulud Targets SAP npm Packages With a Bun-Based Secret Stealer
Source: Aikido
(Published: 29 April 2026)
A new npm supply-chain compromise is targeting the SAP developer ecosystem. Read more.
Claude Adds Malware to Crypto Agent
Source: ReversingLabs
(Published: 29 April 2026)
ReversingLabs researchers discovered malicious code in a crypto trading project after an AI-based coding agent added a malicious package as a dependency. Read more.
Fake DHL Phishing Campaign Targets Credentials
Source: Forcepoint
(Published: 29 April 2026)
A phishing campaign impersonating DHL delivery notifications is being used to steal user credentials through fake tracking pages. Read more.
ClickFix Removes Your Background but Leaves the Malware
Source: Huntress
(Published: 30 April 2026)
BackgroundFix is a ClickFix lure dressed up as a free image-editing tool. Read more.
OtterCookie and Shifty Corsair Attack Strategy
Source: BlueVoyant
(Published: 30 April 2026)
Researchers observed a bifurcated attack strategy combining OtterCookie malware with shifting infrastructure to evade detection. Read more.
Mapping Remus Infostealer
Source: Cyber Intelligence Insights
(Published: 30 April 2026)
Researchers mapped Remus infostealer infrastructure using indicators, hosting patterns, ASN analysis, and blockchain pivots to uncover additional C2 domains and operator infrastructure. Read more.
Email Threat Landscape: Q1 2026 Trends and Insights
Source: Microsoft Security
(Published: 30 April 2026)
Microsoft analyzed Q1 2026 email threat activity, highlighting trends in phishing, social engineering, malware delivery, and credential theft. Read more.
RDP Security Risks Highlight Need for Secure Remote Access
Source: Forescout
(Published: 30 April 2026)
Ongoing threats targeting RDP services are driving the need for stronger remote access security controls and monitoring. Read more.
Watch Guard! Qilin Affiliate Exploits Network Appliances for Initial Access
Source: Ctrl-Alt-Intel
(Published: 01 May 2026)
Qilin is a long-standing and prolific Ransomware-as-a-Service group, active since late 2022, causing real-world impact across numerous sectors globally. Read more.
Inside Lazarus: AI-Driven Attacks on Developers
Source: Expel
(Published: 01 May 2026)
Lazarus Group is leveraging AI tools to scale attacks targeting developers and software supply chains. Read more.
Phoenix Phishing-as-a-Service Kit for Smishing Campaigns
Source: Group-IB
(Published: 02 May 2026)
The Phoenix PhaaS kit is enabling large-scale smishing campaigns with automated phishing infrastructure. Read more.
Want more articles? Check out the previous edition of Security Signals here.
Free Evaluation
Gain a comprehensive view of the external cyber landscape with Malware Patrol’s Cyber Threat Intelligence (CTI) services. We cover a broad spectrum of malicious activities, including malware, ransomware, phishing, cryptominers, newly registered domains, and command-and-control servers to equip your organization with the insights needed to proactively detect and mitigate potential attacks.
Take advantage of a free trial to test our data for yourself.
