North Korea–linked hackers drain $285M from Drift in sophisticated attack
2026-04-03T14:51:47Z•914377768a6cac2115b3399ab980a330e2d97f9edc33c78f4119dffbe1ad12e6
AGEWHEEZEAxiosCERT-UA-impersonationCVE-2026-20093CVE-2026-5281CrystalX-RATHandalaHasbroMaaSPSK-WindUNC1069WhatsAppchrome-zero-daycryptocurrency-heistfake-appnorth-koreanpmphishingspywaresupply-chain
What happened
Multiple high-impact cyber incidents and discoveries were reported: a sophisticated, likely North Korea-linked heist drained $285M from Drift using nonce-based pre-signed transactions and multisig compromise; Google attributed an Axios npm supply-chain compromise to North Korea-linked UNC1069; Google fixed an actively exploited Chrome WebGPU zero-day (CVE-2026-5281); Cisco patched multiple vulnerabilities including CVE-2026-20093; Kaspersky uncovered CrystalX RAT as a new Telegram-distributed MaaS offering RAT/stealer/keylogging capabilities; pro-Iran Handala claims breach of Israeli defence/C
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- securityaffairs
- Record identifier
- 914377768a6cac2115b3399ab980a330e2d97f9edc33c78f4119dffbe1ad12e6
- Enrichment time
- 2026-04-03T14:51:47Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.