DJBSEC's CyberNews 2026-04-17

Today’s daily news covers the following categories: Authentication Malware Vulnerability Threat Intelligence Insider Threat

---

Two-Factor Authentication Expands Beyond Traditional Devices

Authentication
Two-factor authentication (2FA) is evolving beyond traditional desktop and mobile devices, with new methods emerging to improve both security and usability. Innovations such as passkeys, hardware tokens, and biometric authentication aim to reduce reliance on passwords and mitigate phishing risks. These approaches help address common weaknesses like credential theft and session hijacking. However, adoption challenges remain, particularly around compatibility and user experience. Organizations must balance stronger authentication controls with ease of use to ensure effective deployment.
Read More

Mirax Malware Campaign Compromises 220,000 Accounts

Malware
The Mirax malware campaign has compromised over 220,000 accounts, granting attackers full remote control of infected systems. Once deployed, the malware allows execution of commands, data theft, and long-term persistence. Its scale demonstrates how modern malware campaigns can rapidly impact large numbers of users. Victims may not realize they are compromised due to stealthy techniques. Security teams should focus on endpoint detection, patching, and monitoring to reduce exposure.
Read More

UAC-0247 Campaign Steals Browser and WhatsApp Data

Malware
A campaign tracked as UAC-0247 is actively targeting users to steal browser credentials and WhatsApp data. Attackers use phishing and malicious payloads to infect systems and extract sensitive information. Once compromised, victims’ communications and login data can be exfiltrated for further attacks. The campaign highlights increasing focus on personal messaging platforms as valuable targets. Users should avoid suspicious downloads and enable strong security protections.
Read More

Cisco ISE Vulnerabilities Threaten Enterprise Access Control

Vulnerability
Multiple vulnerabilities in Cisco Identity Services Engine (ISE) could allow attackers to bypass authentication and gain unauthorized access. ISE plays a critical role in network access control, making these flaws particularly dangerous. Exploitation could lead to widespread compromise across enterprise environments. Cisco has released patches to address the issues. Organizations should update immediately and review access policies.
Read More

Attackers Exploit n8n Automation Workflows

Threat Intelligence
Hackers are abusing the n8n workflow automation platform to execute malicious actions and exfiltrate data. By leveraging legitimate automation tools, attackers can blend in with normal operations and avoid detection. This tactic reflects a growing trend of exploiting trusted platforms. Compromised workflows can be used to automate attacks at scale. Organizations should monitor automation systems and restrict unauthorized changes.
Read More

Cisco FMC Targeted by Actively Exploited Vulnerabilities

Vulnerability
Attackers are actively exploiting vulnerabilities in Cisco Firepower Management Center (FMC). These flaws can allow unauthorized access and weaken network defenses. Since FMC manages firewall policies, compromise could have serious security implications. Researchers warn that exploitation is already occurring in the wild. Immediate patching and monitoring are critical to mitigate risk.
Read More

U.S. Nationals Sentenced in North Korean IT Worker Scheme

Insider Threat
Two U.S. nationals have been sentenced for supporting North Korean IT workers operating laptop farms. These operations allowed foreign actors to obtain remote jobs and access corporate systems. The scheme generated revenue for North Korea while creating insider threat risks. It highlights how hiring practices can be exploited for espionage and financial gain. Organizations should strengthen identity verification and access controls during onboarding.
Read More

Researchers Map 1,250 Command-and-Control Servers

Threat Intelligence
Security researchers have mapped over 1,250 command-and-control servers tied to Russian hosting infrastructure. These servers are used to manage malware campaigns and coordinate attacks. The mapping provides valuable insight into attacker infrastructure and tactics. Disrupting such networks can significantly reduce cybercriminal operations. Organizations can use this intelligence to improve detection and response capabilities.
Read More