Originally reported by BleepingComputer, Graham Cluley, Cisco Talos, Malwarebytes Labs, Bitdefender Labs
TL;DR
CISA added an actively exploited n8n RCE vulnerability to its KEV catalog, mandating federal patches by March 25. Meanwhile, Iranian-linked Handala group deployed wiper malware against medical technology giant Stryker.
CISA added an actively exploited n8n RCE vulnerability to the Known Exploited Vulnerabilities catalog, indicating confirmed active exploitation in the wild.
CISA added CVE-2023-50427 to its Known Exploited Vulnerabilities catalog this week, ordering federal agencies to patch the n8n workflow automation platform by March 25, 2026. The remote code execution vulnerability in n8n versions before 1.19.4 allows attackers to execute arbitrary code through crafted HTTP requests. Cisco Talos researchers discovered the flaw, which affects the popular open-source workflow automation tool used across enterprise environments.
Medical technology giant Stryker confirmed it was hit by a wiper malware attack claimed by Handala, an Iranian-linked pro-Palestinian hacktivist group. The attack took critical systems offline, impacting the company's operations. Handala has previously targeted Israeli and Western organizations with destructive malware campaigns, marking an escalation in targeting critical healthcare infrastructure providers.
The Department of Justice charged another former DigitalMint employee for participation in an insider scheme supporting BlackCat (ALPHV) ransomware operations. The employee allegedly worked as a ransomware negotiator while secretly partnering with the criminal organization. This follows previous charges against other DigitalMint insiders who facilitated cryptocurrency transactions for ransomware payments, demonstrating the ongoing law enforcement focus on dismantling ransomware support networks.
Researchers identified a new wave of the PhantomRaven supply-chain campaign targeting the npm registry with 88 malicious packages. The packages exfiltrate sensitive data from JavaScript developers, including environment variables, SSH keys, and authentication tokens. The campaign represents an evolution of previous npm poisoning attacks, with threat actors continuously adapting their techniques to evade detection mechanisms.
Bitdefender Labs discovered a malicious Google Ads campaign targeting users searching for Claude AI downloads. The campaign serves fake "Claude Code" applications containing malware for both Windows and macOS systems. Attackers exploit the popularity of AI tools to distribute information stealers and remote access trojans, highlighting the growing threat landscape around AI-adjacent software.
Elementor's Ally accessibility plugin contains an SQL injection vulnerability affecting over 250,000 WordPress installations. The unauthenticated SQLi flaw allows attackers to extract sensitive database information without requiring login credentials. Site administrators should immediately update to the latest plugin version to prevent data theft.
Microsoft patched a vulnerability in its Authenticator app for Android and iOS that could allow malicious applications on the same device to intercept authentication codes and sign-in links. The bug highlights the importance of maintaining updated authentication applications and avoiding installation of untrusted software on devices containing sensitive authentication tools.
Cisco Talos disclosed vulnerabilities in BioSig Project Libbiosig library and OpenCFD OpenFOAM, plus an unpatched vulnerability in Microsoft DirectX. The research demonstrates continued focus on identifying security flaws in widely-deployed libraries and frameworks that could impact multiple applications.
Malwarebytes Labs documented several evolving social engineering campaigns, including IPv6-based phishing link obfuscation in fake United Healthcare toothbrush offers, sextortion emails using passwords harvested from temporary email services, and tax season robocalls promoting fraudulent relief programs. These campaigns show attackers adapting to seasonal opportunities and technical countermeasures.
Meta deployed new anti-scam protections across WhatsApp, Facebook, and Messenger, while WhatsApp introduced parent-managed accounts for pre-teens with enhanced privacy controls. These defensive measures represent ongoing efforts by major platforms to combat social engineering attacks and protect vulnerable user populations.
Originally reported by BleepingComputer, Graham Cluley, Cisco Talos, Malwarebytes Labs, Bitdefender Labs