North Korea–linked hackers drain $285M from Drift in sophisticated attack
2026-04-04T02:51:45Z•18f771639dabfa2c60cf75413118884b551b08201956d713481af24e0c61f03a
AGEWHEEZEAxiosCVE-2026-20093CVE-2026-5281Chrome zero-dayCisco patchesCrystalX RATHasbro breachMaaSNorth KoreaPSK Wind breachUNC1069WebGPUcryptocurrency heistfake WhatsAppimpersonationnpmphishingpro-Iran Handalaspywaresupply-chain
What happened
Multiple high-impact incidents and active threats were reported: a sophisticated $285M cryptocurrency heist likely linked to North Korea used durable nonce accounts to pre-sign and delay transactions; Google attributed an Axios npm supply-chain compromise to North Korea-linked UNC1069; Google/Chrome patched an actively exploited WebGPU/Dawn zero-day (CVE-2026-5281) added to CISA’s KEV list; Cisco released fixes including CVE-2026-20093; and a large phishing campaign (UAC-0255) distributing AGEWHEEZE targeted ~1M users. Additional notable items include discovery of CrystalX RAT as a Telegram‑ma
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- securityaffairs
- Record identifier
- 18f771639dabfa2c60cf75413118884b551b08201956d713481af24e0c61f03a
- Enrichment time
- 2026-04-04T02:51:45Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.