CERT-UA Impersonation Campaign Spread AGEWHEEZE Malware to 1 Million Emails

The Hacker News roundup details multiple active and high-impact campaigns and disclosures: CERT‑UA was impersonated to distribute AGEWHEEZE via password‑protected ZIPs; WhatsApp messages have been used to deliver VBS malware that leverages a UAC bypass for multi‑stage remote access; Google patched a Chrome zero‑day (CVE‑2026‑5281) exploited in the wild; the Axios npm package was compromised in a supply‑chain attack attributed to UNC1069, pushing a cross‑platform RAT; TrueConf zero‑day (CVE‑2026‑3502) was exploited against Southeast Asian government networks; Vertex AI permission/model issues可以