Threat actor UAC-0255 impersonate CERT-UA to spread AGEWHEEZE malware via phishing

Multiple high-impact incidents reported: a threat actor tracked as UAC-0255 impersonated CERT-UA in a large phishing campaign distributing the AGEWHEEZE malware via Files.fm (fake “security tool,” ~1M recipients); an Italian spyware vendor (SIO/Asigint) pushed a fake WhatsApp client to ~200 users containing spyware; Google patched and CISA added CVE-2026-5281 (use-after-free in WebGPU Dawn, CVSS 8.8) — an actively exploited Chrome zero-day — to its KEV catalog; the Axios npm account was hijacked and linked by Google to North Korea–linked UNC1069 to distribute RAT malware across Windows/Linux/m