China-Linked TA416 Targets European Governments with PlugX and OAuth-Based Phishing

A collection of early-April 2026 security stories highlighting active, high-impact activity: China-linked TA416 resumed targeting European government/diplomatic organizations using PlugX and OAuth-based phishing; Microsoft documented cookie-controlled PHP web shells persisting via cron on Linux hosts; North Korean UNC1069 attributed for a targeted social-engineering compromise of the Axios npm package; a $285M Solana/Drift theft tied to a durable-nonce social engineering attack; large-scale credential harvesting exploiting the React2Shell flaw in Next.js (CVE-2025-55182); an actively exploited