China-Linked TA416 Targets European Governments with PlugX and OAuth-Based Phishing

A roundup of April 1–3, 2026 security news: China-linked TA416 (and overlapping clusters) resumed targeting European governments with PlugX and OAuth-based phishing; Microsoft describes cookie-controlled PHP web shells persisting via cron; UNC1069 (North Korea) conducted a targeted social‑engineering supply‑chain compromise of the Axios npm package; a SparkCat mobile malware variant was found stealing images of crypto wallet recovery phrases; a $285M Solana DeFi theft (Drift) involved durable‑nonce social engineering; large-scale credential harvesting exploited React2Shell (CVE‑2025‑55182) on