Phishing campaign exploits OAuth redirection to bypass defenses

Multiple high-impact incidents and active campaigns were reported: threat actors are abusing OAuth redirection in targeted phishing against government/public-sector users to bypass email/browser defenses; Google confirmed active exploitation of a high-severity Qualcomm Android flaw (CVE-2026-21385); a Chrome extension vulnerability (CVE-2026-0628) could let malicious extensions hijack the Gemini Live assistant to spy and exfiltrate files; and Russia-linked APT28 exploited an MSHTML zero-day (CVE-2026-21513) before patching. North Korea–linked APT37 (Ruby Jumper) combined Zoho WorkDrive C2 anda