The Hacker News

Attackers are hijacking GitHub accounts and silently planting malware in Python repos. ForceMemo uses stolen tokens to force-push malicious code while preserving the original commit author and message—rewriting Git history with no visible trace in the UI. 🔗 Read → https://thehackernews.com/2026/03/glassworm-attack-uses-stolen-github.html

🔥 This week’s CYBER RECAP is pure “👀 what the hell now” energy. Fresh bugs. Quiet abuse. Supply-chain messes. Botnet weirdness. Phishing getting uglier. AI doing AI things. And the usual pile of flaws you really don’t want to ignore. Skim it for the headlines. Read it properly for the stuff that’s going to show up in everyone’s incident notes next. 🔗 Read → https://thehackernews.com/2026/03/weekly-recap-chrome-0-days-router.html

Stop testing silos. Attackers don’t exploit single flaws; they chain them. Agentic AI validation replaces fragmented scanning with continuous, system-wide testing. It maps the path from threat to asset in real-time. 🔗 Stop guessing. Start validating → https://thehackernews.com/2026/03/why-security-validation-is-becoming.html

🛑 ALERT: ClickFix campaigns are spreading macOS infostealer MacSync. Victims paste a Terminal command from fake install pages or ChatGPT threads, installing malware that steals credentials, files, Keychain data, and crypto wallet seeds. 🔗 Read → https://thehackernews.com/2026/03/clickfix-campaigns-spread-macsync-macos.html

⚠️ A new ClickFix variant abuses Win+R to mount a remote WebDAV drive and run malware. It launches a trojanized WorkFlowy Electron app that beacons to C2 every 2 seconds. Atos says it bypassed Microsoft Defender and surfaced only through threat hunting. 🔗 Inside: WebDAV trick + ASAR injection → https://thehackernews.com/2026/03/investigating-new-click-fix-variant.html

🚨 Russian-linked actors targeted Ukrainian entities with DRILLAPP, a JavaScript backdoor executed through Microsoft Edge. It abuses Chromium debugging flags to access files, record audio, capture webcam images, and grab screen data. Lures referenced Starlink installs and a Ukrainian charity. 🔗 Read → https://thehackernews.com/2026/03/drillapp-backdoor-targets-ukraine.html

🔒 Google is tightening Android’s defenses. In Android 17 Beta 2, Advanced Protection Mode 🛡️ blocks most apps from accessing the Accessibility Services API. Malware has long abused it to read screens and steal data. 🔗 Read → https://thehackernews.com/2026/03/android-17-blocks-non-accessibility.html

🛑 OpenClaw AI agents can leak data via indirect prompt injection. A crafted URL generated by the agent triggers Telegram or Discord link previews that silently send sensitive data to attacker domains. China’s CNCERT warns organizations to isolate or restrict the tool. 🔗 Attack details → https://thehackernews.com/2026/03/openclaw-ai-agent-flaws-could-enable.html

Researchers found 72 malicious extensions in the Open VSX registry. Attackers publish a harmless VS Code extension, gain trust, then update it to pull a GlassWorm dependency. The payload steals tokens, credentials, and crypto wallets from developer systems. 🔗 Read → https://thehackernews.com/2026/03/glassworm-supply-chain-attack-abuses-72.html

Researchers exposed a long-running cyber espionage campaign targeting Southeast Asian militaries. The cluster CL-STA-1087 deployed AppleChris and MemFun backdoors plus a custom Mimikatz variant to quietly extract data on C4I systems, military capabilities, and Western defense ties. 🔗 Tools and tradecraft → https://thehackernews.com/2026/03/chinese-hackers-target-southeast-asian.html

🛑 Meta will shut down Instagram’s end-to-end encrypted chats on May 8, 2026. Users with affected conversations will get instructions to download messages or media before the change. 🔗 Read → https://thehackernews.com/2026/03/meta-to-shut-down-instagram-end-to-end.html

INTERPOL dismantled 45,000 malicious IPs and servers tied to phishing, malware, and ransomware. Operation Synergia III across 72 countries led to 94 arrests, 110 suspects under investigation, and seized devices and servers tied to global scam infrastructure. 🔗 Read → https://thehackernews.com/2026/03/interpol-dismantles-45000-malicious-ips.html