CISO Daily Brief: Critical Vulnerabilities, Malware Campaigns, and Supply Chain Threats (April 2, 2026)

Today’s security landscape continues to evolve rapidly, with several critical vulnerabilities and active threat campaigns requiring immediate CISO attention. This briefing highlights the most pressing issues, including zero-day exploits, large-scale phishing, and supply chain risks. The following summary provides actionable insights and executive-level guidance for enterprise security leaders.

Top Items CISOs Should Care About (Priority)

Over 14,000 F5 BIG-IP APM Instances Still Exposed to RCE Attacks

• What happened: Over 14,000 F5 BIG-IP APM devices remain exposed to remote code execution (RCE) vulnerabilities, posing a significant risk to critical infrastructure.
• Why it matters: Unpatched devices could enable attackers to gain control over enterprise networks and disrupt operations.
• What to verify internally:
  • Inventory and exposure of F5 BIG-IP APM instances
  • Patch status and version compliance
  • Network segmentation and access controls for exposed devices
  • Monitoring for anomalous activity on F5 appliances
• Exec questions to prepare for:
  • Are any of our F5 devices exposed or unpatched?
  • What is our patching cadence for critical infrastructure?
  • How are we monitoring for exploitation attempts?
  • What is the business impact if these devices are compromised?
• Sample CISO response: "We have identified all F5 BIG-IP APM instances, prioritized patching, and enhanced monitoring to mitigate RCE risks across our environment."

New Chrome Zero-Day CVE-2026-5281 Under Active Exploitation — Patch Released

• What happened: Google released a patch for the fourth actively exploited Chrome zero-day this year, CVE-2026-5281, following reports of in-the-wild attacks.
• Why it matters: Widespread browser exploitation increases risk of endpoint compromise across the enterprise.
• What to verify internally:
  • Current Chrome browser versions deployed
  • Patch deployment status across all endpoints
  • Endpoint detection for browser-based exploits
  • Employee awareness of browser update prompts
• Exec questions to prepare for:
  • Are all corporate devices running the latest Chrome version?
  • How quickly can we deploy browser patches organization-wide?
  • What controls are in place to detect browser exploitation?
  • Are there any known incidents related to this vulnerability?
• Sample CISO response: "We have initiated an urgent Chrome update across all endpoints and are monitoring for signs of exploitation."

CERT-UA Impersonation Campaign Spread AGEWHEEZE Malware to 1 Million Emails

• What happened: Attackers impersonated CERT-UA in a phishing campaign, distributing AGEWHEEZE malware to over 1 million email recipients.
• Why it matters: Trusted entity impersonation increases the likelihood of successful phishing and malware delivery.
• What to verify internally:
  • Email filtering effectiveness against impersonation
  • Employee awareness and phishing training
  • Incident response readiness for malware outbreaks
  • Review of recent suspicious email activity
• Exec questions to prepare for:
  • Have any employees received or interacted with these phishing emails?
  • How are we protecting against trusted entity impersonation?
  • What is our response plan for large-scale phishing incidents?
  • Are our email security controls up to date?
• Sample CISO response: "We are reviewing email logs for campaign indicators and reinforcing phishing awareness among staff."

Hackers Exploit TrueConf Zero-Day to Push Malicious Software Updates

• What happened: A zero-day vulnerability in TrueConf was exploited to deliver malicious software updates, compromising the software supply chain.
• Why it matters: Supply chain attacks can bypass traditional defenses and impact trusted software deployments.
• What to verify internally:
  • Use of TrueConf or affected software versions
  • Integrity checks on recent software updates
  • Review of supply chain risk management processes
  • Monitoring for unusual update activity
• Exec questions to prepare for:
  • Are we using any affected software or services?
  • How do we verify the integrity of software updates?
  • What is our exposure to supply chain attacks?
  • What steps are we taking to mitigate this risk?
• Sample CISO response: "We are validating the integrity of all recent software updates and reviewing our supply chain security controls."

Microsoft Warns of WhatsApp-Delivered VBS Malware Hijacking Windows via UAC Bypass

• What happened: Microsoft reported active exploitation of a VBS malware delivered via WhatsApp, leveraging a UAC bypass to hijack Windows systems.
• Why it matters: Popular messaging platforms are being used to deliver advanced malware, increasing endpoint risk.
• What to verify internally:
  • Endpoint protection coverage for VBS and UAC bypass techniques
  • Employee guidance on secure messaging practices
  • Incident detection and response for WhatsApp-related threats
  • Review of recent endpoint alerts
• Exec questions to prepare for:
  • Are our endpoints protected against this malware?
  • Do we have visibility into messaging app usage?
  • What is our response plan for UAC bypass attacks?
  • Have we seen any related incidents internally?
• Sample CISO response: "We have updated endpoint protections and are reinforcing secure messaging guidance for all employees."

Apple Expands iOS 18.7.7 Update to More Devices to Block DarkSword Exploit

• What happened: Apple broadened the rollout of iOS 18.7.7 to additional devices, addressing the DarkSword exploit and reducing the risk of device compromise.
• Why it matters: Timely patching is critical to protect mobile endpoints from active exploits.
• What to verify internally:
  • Device inventory and iOS version coverage
  • Mobile device management (MDM) enforcement of updates
  • Monitoring for signs of exploitation on mobile devices
  • Employee compliance with update policies
• Exec questions to prepare for:
  • Are all corporate iOS devices updated to the latest version?
  • What is our process for urgent mobile OS updates?
  • How do we monitor for mobile device exploits?
  • What is the risk to business operations if devices are compromised?
• Sample CISO response: "We are enforcing the latest iOS update across all managed devices and monitoring for any signs of exploit activity."

New EvilTokens Service Fuels Microsoft Device Code Phishing Attacks

• What happened: A new phishing-as-a-service platform, EvilTokens, is enabling large-scale attacks targeting Microsoft device codes for credential theft and lateral movement.
• Why it matters: Increased risk of identity compromise and unauthorized access to enterprise resources.
• What to verify internally:
  • Authentication logs for suspicious device code activity
  • Effectiveness of multi-factor authentication (MFA)
  • User awareness of device code phishing risks
  • Incident response playbooks for identity compromise
• Exec questions to prepare for:
  • How are we detecting and responding to device code phishing?
  • Is MFA enforced for all Microsoft accounts?
  • What is our exposure to this phishing service?
  • Have any credentials been compromised?
• Sample CISO response: "We are monitoring for suspicious authentication activity and reinforcing MFA and phishing awareness across the organization."

'NoVoice' Android Malware on Google Play Infected 2.3 Million Devices

• What happened: The 'NoVoice' Android malware was distributed via Google Play, infecting 2.3 million devices and increasing endpoint risk.
• Why it matters: Official app store infections can bypass user trust and compromise mobile security at scale.
• What to verify internally:
  • Mobile device security controls and app vetting processes
  • Employee guidance on safe app installation
  • Monitoring for indicators of compromise on Android devices
  • Review of mobile incident response procedures
• Exec questions to prepare for:
  • Are any corporate devices affected by this malware?
  • How do we ensure app security on managed devices?
  • What is our process for responding to mobile malware outbreaks?
  • How are we educating users about mobile threats?
• Sample CISO response: "We are scanning all managed Android devices for indicators of compromise and reinforcing secure app installation policies."

New CrystalRAT Malware Adds RAT, Stealer and Prankware Features

• What happened: CrystalRAT, a new malware variant, now includes remote access, data theft, and prankware capabilities, expanding its threat profile.
• Why it matters: The evolving malware landscape increases the complexity of endpoint defense and detection.
• What to verify internally:
  • Endpoint detection and response (EDR) coverage for new malware variants
  • Threat intelligence integration for emerging threats
  • Review of recent suspicious endpoint activity
  • Employee awareness of new malware tactics
• Exec questions to prepare for:
  • Are our defenses updated for this new malware?
  • How do we stay informed about emerging threats?
  • Have we seen any related activity in our environment?
  • What is our response plan for advanced malware?
• Sample CISO response: "We are updating detection rules and reviewing endpoint telemetry for signs of CrystalRAT activity."

Apple Expands iOS 18 Updates to More iPhones to Block DarkSword Attacks

• What happened: Apple is extending iOS 18 updates to additional iPhone models to address the DarkSword exploit.
• Why it matters: Broader device coverage reduces the risk of exploit-driven compromise across the mobile fleet.
• What to verify internally:
  • Coverage of iOS 18 updates across all managed iPhones
  • Update compliance reporting in MDM
  • Employee communication on update requirements
  • Monitoring for exploit attempts on mobile devices
• Exec questions to prepare for:
  • Are all eligible devices updated?
  • What is our update compliance rate?
  • How do we handle non-compliant devices?
  • What is the risk if updates are delayed?
• Sample CISO response: "We are tracking update compliance and following up on any outstanding devices to ensure full coverage."

Notable Items

• Casbaneiro phishing targets Latin America and Europe using dynamic PDF lures
• Analysis: Attackers increasingly abuse trusted tools and supply chain for intrusions
• Threat report: Routine access abuse is powering modern intrusions
• FBI warns against using Chinese mobile apps due to privacy risks

CISO Action Checklist Today

• Inventory and patch all F5 BIG-IP APM instances immediately
• Deploy latest Chrome updates across all endpoints
• Enforce and verify iOS 18.7.7 and iOS 18 updates on all managed devices
• Review email filtering and phishing awareness programs
• Validate endpoint protection against VBS and UAC bypass malware
• Check for indicators of compromise from TrueConf and Android malware campaigns
• Monitor authentication logs for suspicious device code activity
• Update detection rules for new malware variants (e.g., CrystalRAT)
• Reinforce secure messaging and app installation guidance with employees
• Review supply chain risk management and software update integrity processes