Weekly threat intelligence digest: April 20 - 26, 2026

Executive summary

This week's threat landscape is marked by a surge in high-severity incidents, including supply chain compromises, phishing campaigns leveraging legitimate infrastructure, and ransomware evolution. Critical vulnerabilities were reported across multiple platforms, with a concerning focus on weaponizing trusted tools and services. State-sponsored actors remain active, targeting DeFi and cryptocurrency ecosystems, while ransomware gangs expand their operational capabilities through botnet integrations and living-off-the-land tactics. Defenders must prioritize supply chain security, monitor for emerging threats, and implement proactive measures to mitigate risks in a rapidly evolving threat environment.

Critical & high priority

Apple Notification Infrastructure Weaponised for Phishing

Attackers are exploiting Apple's account change notification system to deliver phishing emails from Apple's own servers, bypassing traditional spam filters. This sophisticated campaign leverages the authenticity of Apple's infrastructure to deceive users into revealing credentials or downloading malicious payloads.

• Affected: Users receiving suspicious notifications from Apple accounts.
• What to do: Educate users to verify any unexpected account change notifications directly through official channels and report suspicious activity.

Vercel Supply Chain Breach Exposes Thousands of Applications

A compromised Context.ai account allowed attackers to breach Vercel's infrastructure, potentially compromising thousands of deployed applications. The incident highlights the risks of third-party tool adoption in critical development workflows.

• Affected: Developers and organizations using Vercel for deployment.
• What to do: Review supply chain dependencies, implement strict access controls for third-party tools, and monitor for unauthorized changes in CI/CD pipelines.

KelpDAO DeFi Theft by Lazarus Group

North Korean state actors exploited a $290 million DeFi protocol, likely targeting smart contract vulnerabilities or poor operational security. This underscores the ongoing risks of decentralised finance infrastructure to state-sponsored attackers.

• Affected: Users and platforms operating within DeFi ecosystems.
• What to do: Strengthen audits of DeFi protocols, implement multi-party controls for critical assets, and monitor for异常activity in smart contracts.

Critical Vulnerability in Breeze Cache WordPress Plugin

A file upload vulnerability in the widely-used Breeze Cache plugin allows unauthenticated attackers to upload arbitrary files, leading to remote code execution on affected servers. Exploitation is actively underway.

• Affected: WordPress sites using Breeze Cache.
• What to do: Immediately update to the latest version of the plugin and disable it if critical assets are exposed.

Notable developments

Teams as an Attack Surface for Credential Harvesting

Microsoft has observed increasing abuse of external Teams channels for helpdesk impersonation and credential harvesting. Attackers use legitimate-looking communication to trick users into revealing sensitive information.

• Affected: Organizations using Microsoft Teams for internal or customer communications.
• What to do: Train employees to verify suspicious requests through alternative channels and implement multi-factor authentication for critical accounts.

Gemini CLI Workspace Trust Bypass

A vulnerability in Gemini CLI allowed malicious environment configurations to execute arbitrary code during CI/CD workflows. The --yolo flag bypassed tool allowlisting controls, highlighting risks in automated development environments.

• Affected: Developers using Gemini CLI in headless or CI/CD modes.
• What to do: Apply patches immediately and review CI/CD pipelines for untrusted dependencies.

Vulnerability landscape

This week saw 120 new CVEs tracked, with a significant concentration of High severity vulnerabilities (86). Critical vulnerabilities were rare but impactful, including the Breeze Cache flaw. The top affected vendors include FlowiseAI (5), PowerDNS (2), and PJSIP (1), suggesting increased targeting of AI tools and DNS infrastructure.

Recommended actions

1. Supply chain security: Conduct thorough audits of third-party dependencies and implement strict access controls for CI/CD tools like Vercel and Gemini CLI.
2. Patch management: Prioritize updates for the Breeze Cache plugin and other critical vulnerabilities reported this week.
3. Phishing defense: Educate users on recognizing suspicious notifications from trusted services like Apple, and verify account changes directly through official channels.
4. Monitor DeFi risks: Strengthen safeguards around DeFi assets and conduct regular audits of smart contracts to mitigate state-sponsored attack vectors.

Looking ahead

Next week, defenders should monitor for:

• Potential follow-up attacks leveraging the Vercel breach, such as unauthorized code injections in deployed applications.
• Increased activity from ransomware groups like UNC6692, who are expanding their use of trusted platforms like Microsoft Teams for malware delivery.
• Further exploitation of Go-based tools and frameworks, following the disclosure of GopherWhisper's backdoor infrastructure.

The threat landscape remains dynamic, with attackers increasingly targeting trusted tools and services to bypass traditional security measures. Defenders must stay vigilant and adapt their strategies to address these evolving risks.