China-Linked TA416 Targets European Governments with PlugX and OAuth-Based Phishing

This collection highlights a surge of active, high-impact threats across multiple vectors: state-aligned and financially motivated supply-chain and social-engineering campaigns, active zero-day exploitation, large-scale webhosting compromises, and novel persistence/control techniques. Notable activity includes China-linked TA416 targeting European government/diplomatic organizations (PlugX, OAuth phishing), North Korea–attributed UNC1069 compromising the Axios npm package, a large-scale React2Shell campaign (Next.js/credential theft), Microsoft-documented cookie-controlled PHP web shells pers‑