A week in security (March 30 – April 5)
2026-04-06T20:52:13Z•d35861adec6771255dfedfaeb9db8eb108cfb14ea598621113427045cb6d67c1
ai-misuseaxiosclickfixcredential-theftdarkswordfraudglassworminfiniti-stealeriosmacosmalwarenpmphishingpolicyremote-access-trojanrouter-bansupply-chainvenom-stealervirtual-phonesvpn-auditwhatsappwindows
What happened
Malwarebytes Labs roundup (Mar 30–Apr 6, 2026) covering multiple active threats and security developments. Notable items include: credential-harvesting job scams impersonating Coca‑Cola and Ferrari; a WhatsApp-on-Windows campaign that aims for persistent access; an npm supply‑chain compromise of axios distributing a Remote Access Trojan; fake Avast scan sites that install Venom Stealer; a new macOS infostealer (Infiniti Stealer) using ClickFix and Python/Nuitka; GlassWorm spyware that installs a malicious browser extension and abuses developer tools; Apple expanding DarkSword exploit mitigions
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- malwarebytes_labs
- Record identifier
- d35861adec6771255dfedfaeb9db8eb108cfb14ea598621113427045cb6d67c1
- Enrichment time
- 2026-04-06T20:52:13Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.