VulnHub

In March 2026, a threat actor known as TeamPCP executed a supply chain attack that targeted developer workstations, turning them into credential vaults for attackers. These machines are crucial for developers, as they handle the creation and management of various credentials across services and tools. By infiltrating these systems, attackers gained access to sensitive information that could be reused across multiple platforms, increasing the risk of data breaches. This incident raises significant concerns for companies that rely on developer machines, highlighting the need for improved security measures to protect sensitive credentials. As attackers continue to exploit these valuable resources, organizations must reassess their security protocols to safeguard against similar threats in the future.

Hackers have targeted users of Guardarian by publishing 36 malicious NPM packages that masquerade as Strapi plugins. These deceptive packages are designed to execute shell commands, escape container environments, and steal user credentials. This attack poses a serious risk to developers and organizations using Strapi, as the malicious code could lead to significant data breaches or unauthorized access. Users of Strapi should exercise caution and verify the authenticity of any plugins they intend to use, as these packages can compromise their systems. This incident serves as a reminder of the ongoing risks associated with third-party software dependencies.

North Korean hackers, previously linked to the Axios supply chain attack, are now targeting prominent maintainers of Node.js in a social engineering campaign. These attackers are using deceptive tactics to compromise the accounts of these developers, potentially putting the security of the Node.js ecosystem at risk. This is concerning because Node.js is widely used in web development, and any breach could lead to widespread vulnerabilities in applications that rely on its libraries. Developers and organizations that utilize Node.js should be on high alert and take precautions to protect their accounts and code repositories. The ongoing targeting of developers reflects a broader trend of cybercriminals seeking to exploit trusted software maintainers to gain access to critical systems.

Fortinet has issued an emergency security update for a serious vulnerability found in its FortiClient Enterprise Management Server (EMS). This flaw is currently being exploited in the wild, posing a significant risk to organizations using the software. Users of FortiClient EMS should prioritize applying the patch released over the weekend to protect their systems from potential attacks. The vulnerability affects the management of client devices, which could allow unauthorized access or control if not addressed promptly. The urgency of this update highlights the ongoing challenges companies face in securing their environments against evolving threats.

In a significant security breach, the decentralized exchange Drift reported that it lost $285 million due to an attack linked to North Korea's government. The breach occurred on April 1, 2026, following a six-month social engineering campaign that began in the fall of 2025. Attackers employed sophisticated tactics to manipulate individuals within the organization, ultimately leading to the theft of a large sum of money. This incident raises concerns about the vulnerabilities within decentralized finance platforms and highlights the potential for state-sponsored cybercriminal activities. Companies operating in the crypto space need to enhance their security measures and employee training to prevent such attacks in the future.

Hackers are actively exploiting a vulnerability known as React2Shell (CVE-2025-55182) to automate the theft of user credentials from Next.js applications. This attack targets systems that have not been updated or patched against this specific vulnerability, making them susceptible to unauthorized access. Researchers have observed that this campaign is widespread, indicating that many developers using vulnerable versions of Next.js may be at risk. The implications are significant, as stolen credentials can lead to account takeovers and further breaches within organizations. Companies using Next.js should prioritize updating their applications to mitigate this threat and protect user data.

The Axios HTTP client development team reported that one of their developers fell victim to a social engineering attack, likely orchestrated by North Korean hackers. The attackers used a fake Teams error message to gain access to the maintainer's account, which allowed them to compromise the project. This incident raises concerns about the security of widely-used open-source software, as it demonstrates how easily social engineering tactics can lead to significant breaches. Users and developers of Axios should be aware of these tactics and implement stronger security measures to protect their accounts and projects. The incident serves as a reminder of the persistent threat posed by state-sponsored hacking groups.

A breach involving the European Commission's cloud infrastructure has resulted in the exposure of sensitive data from at least 30 EU entities. The incident was linked to the TeamPCP hacking group, which is known for targeting various organizations. CERT-EU, the Computer Emergency Response Team for the EU, confirmed this breach and made the information public on March 27. This incident raises significant concerns about the security of sensitive government data and the potential for further exploitation of the exposed information. Organizations within the EU must assess their security measures to prevent similar breaches in the future.

Stryker, a prominent medical device manufacturer in the U.S., has announced that it has fully resumed operations after a cyberattack attributed to the Iran-linked hacktivist group Handala. The attack, which occurred three weeks ago, resulted in the wiping of several of Stryker's systems, disrupting its operations. This incident raises concerns about the security of critical healthcare infrastructure, as such attacks can impact patient care and safety. Stryker's swift recovery is a positive sign, but it highlights the ongoing risks that companies in the healthcare sector face from cyber threats. As the industry becomes more reliant on digital systems, securing these networks is increasingly crucial.

Recent findings show that the Akira ransomware group has become more efficient in executing attacks, significantly shortening the time it takes to compromise systems. This development poses a serious risk to organizations, as attackers are now able to exploit vulnerabilities and deploy ransomware more quickly than before. The report from CyberScoop indicates that businesses need to be increasingly vigilant, as traditional defenses may no longer be sufficient against this evolving threat. Companies are urged to review their cybersecurity measures and ensure they are up to date with the latest defenses to mitigate potential attacks. The growing speed of these intrusions could lead to increased financial and operational damage for those caught off guard.

A recent campaign has seen threat actors impersonating CERT-UA, the Ukrainian Computer Emergency Response Team, to distribute AGEWHEEZE malware. This operation has targeted around 1 million users across various sectors, including government, healthcare, education, and finance. By masquerading as a trusted entity, the attackers aim to deceive users into downloading the malicious software, which can lead to data theft and other security issues. The scale of the attack is concerning, as it affects critical sectors that handle sensitive information. Users in these fields should be particularly vigilant about the sources of software downloads and ensure they are only using verified channels.