China-Linked TA416 Targets European Governments with PlugX and OAuth-Based Phishing

A broad set of active campaigns and disclosures affecting governments, cloud platforms, software supply chains and end users were reported. China-linked TA416 resumed targeting European government and diplomatic organizations (PlugX, OAuth-based phishing); North Korean UNC1069 and DPRK-linked actors carried out tailored social‑engineering supply‑chain attacks against the Axios npm package; a large credential‑harvesting campaign exploited CVE-2025-55182 against Next.js hosts; Microsoft described cookie‑controlled PHP web shells and WhatsApp‑delivered VBS malware; researchers disclosed mobile (i