April Roundup of Trending News in Cybersecurity

Read more cybersecurity news in this edition of NetSecNews.

• 

  Jessica Owens

  MSSP Training & Development Coordinator, T2 SOC Analyst

AI-Powered ‘DeepLoad‘ Steals Credentials, Evades Detection 

DarkReading reports that a newly discovered malware called DeepLoad uses AI-generated obfuscation and stealthy Windows techniques to immediately steal credentials and keystrokes while evading traditional security detection, even persisting after systems appear cleaned. (DarkReading)

“DeepLoad delivered through ClickFix is a strong example of how threat actors continue to refine and expand on proven attack methods. What started as a social engineering technique has evolved into a layered intrusion chain capable of fileless execution, AI-generated obfuscation, WMI persistence, credential theft, rogue browser extension abuse, and follow-on spread. It underscores why security practitioners must stay current on threat trends, adversary tradecraft, and the platforms attackers continue to exploit.   Consistently investing time to learn, track developments, and share intelligence across the security community is essential to defending against these rapidly evolving TTPs.“ –Roman Weathermon, CTI Lead at C3 Integrated Solutions

New Chaos Variant Targets Misconfigured Cloud Deployments, Adds SOCKS Proxy 

A new variant of the Chaos malware is exploiting misconfigured cloud and container environments (such as exposed Hadoop or Docker instances) to compromise Linux servers, shifting away from router-focused attacks while adding a SOCKS proxy feature to enable stealthy traffic relaying, cryptomining, and DDoS activity. (HackerNews) 

Project Glasswing: Securing critical software for the AI era \ Anthropic 

Anthropic announces Project Glasswing, a gated cybersecurity initiative that gives trusted partners early access to its unreleased Claude Mythos Preview AI model to rapidly find and fix critical software vulnerabilities before attackers can exploit them. (Anthropic) 

CISA orders feds to patch exploited Ivanti EPMM flaw by Sunday 

CISA has ordered U.S. federal agencies to urgently patch an actively exploited Ivanti Endpoint Manager Mobile (EPMM) vulnerability after attackers were found abusing the flaw in real-world attacks, citing serious risks to government networks if left unaddressed. (BleepingComputer)

Axios Supply Chain Attack Pushes Cross-Platform RAT via Compromised npm Account 

Attackers compromised a maintainer’s npm account to poison popular Axios releases with a malicious dependency, turning the supplychain attack into a delivery mechanism for a stealthy crossplatform remote access trojan affecting Windows, macOS, and Linux systems. (HackerNews)

The Identity Paradox: The Hidden Risks in Your Valid Credentials 

This blog argues that the “identity paradox” lies in the fact that as as organizations collect more identity and authentication data than ever, attackers increasingly evade detection by abusing valid credentials and trusted sessions—making malicious activity look like normal user behavior. (SentinelOne) 

Mobile Attack Surface Expands as Enterprises Lose Control 

As outdated devices, vulnerable apps, shadow AI, and zero-click exploits significantly expand the mobile attack surface and expose sensitive data, enterprises are losing visibility and control over their mobile environments. (SecurityWeek)