Daily Threat Briefing — Mar 23, 2026

📰 Cybersecurity News Headlines

Top stories from leading cybersecurity publications as of March 23, 2026.

1. VoidStealer malware steals Chrome master key via debugger trick
   — Bleeping Computer
   
   An information stealer called VoidStealer uses a new approach to bypass Chrome's Application-Bound Encryption (ABE) and extract the master k…
2. Trivy vulnerability scanner breach pushed infostealer via GitHub Actions
   — Bleeping Computer
   
   The Trivy vulnerability scanner was compromised in a supply-chain attack by threat actors known as TeamPCP, which distributed credential-ste…
3. Google adds ‘Advanced Flow’ for safe APK sideloading on Android
   — Bleeping Computer
   
   Google has announced a new mechanism in Android called Advanced Flow that will allow sideloading APKs from unverified developers for power u…
4. Microsoft Azure Monitor alerts abused for callback phishing attacks
   — Bleeping Computer
   
   Microsoft Azure Monitor alerts are being abused to send callback phishing emails that impersonate warnings from the Microsoft Security Team …
5. FBI Warns Russian Hackers Target Signal, WhatsApp in Mass Phishing Attacks
   — The Hacker News
   
   Threat actors affiliated with Russian Intelligence Services are conducting phishing campaigns to compromise commercial messaging application…
6. Oracle Patches Critical CVE-2026-21992 Enabling Unauthenticated RCE in Identity Manager
   — The Hacker News
   
   Oracle has released security updates to address a critical security flaw impacting Identity Manager and Web Services Manager that could be e…
7. Trivy Supply Chain Attack Triggers Self-Spreading CanisterWorm Across 47 npm Packages
   — The Hacker News
   
   The threat actors behind the supply chain attack targeting the popular Trivy scanner are suspected to be conducting follow-on attacks that h…
8. CISA Flags Apple, Craft CMS, Laravel Bugs in KEV, Orders Patching by April 3, 2026
   — The Hacker News
   
   The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added five security flaws impacting Apple, Craft CMS, and Laravel…
9. Patch Now: Oracle's Fusion Middleware Has Critical RCE Flaw
   — Dark Reading
   
   Attackers can execute arbitrary code without authentication if Oracle's Identity or Web Services Managers are exposed to the Web.
10. Cyber OpSec Fail: Beast Gang Exposes Ransomware Server
    — Dark Reading
    
    Files on a central cloud server used by the ransomware group highlight a systematic, aggressive attack on network backups as a key TTP.
11. Interlock Ransomware Targets Cisco Enterprise Firewalls
    — Dark Reading
    
    The ransomware gang, known for double-extortion attacks, had access to a critical Cisco firewall vulnerability weeks before it was publicly …
12. GSocket Backdoor Delivered Through Bash Script, (Fri, Mar 20th)
    — SANS ISC
    
    Yesterday, I discovered a malicious Bash script that installs a GSocket backdoor on the victim&#x27s computer. I don&#x27t know the source o…

Generated by HiveNet.ai Threat Intelligence Platform · March 23, 2026 · Sources: The Hacker News, Bleeping Computer, Krebs on Security, Dark Reading, SANS ISC