China-Linked TA416 Targets European Governments with PlugX and OAuth-Based Phishing

Multiple high-impact incidents and disclosures across April 2026: China-aligned TA416 resumed targeting European government/diplomatic organizations using PlugX and OAuth-based phishing; North Korean-linked UNC1069 carried out a targeted social-engineering compromise of the Axios npm maintainer (npm supply-chain compromise); a novel Solana attack using durable nonces led to a ~$285M Drain of Drift funds; large-scale credential theft operation exploited React2Shell (CVE-2025-55182) to harvest keys and secrets; Microsoft documented cookie-controlled PHP web shells persisting via cron; mobile Spy