In today’s cybersecurity news…
InstallFix attacks spread fake Claude code sites
Researchers at Push Security uncovered a malvertising campaign dubbed “InstallFix” that spreads fake Claude Code installation pages through Google sponsored search results. Victims who copy and paste the malicious install command deploy Amatera Stealer malware, which can steal developer credentials and provide access to enterprise development environments. The attack exploits the practice of copying terminal commands from websites, a standard installation method for many developer and AI coding tools. (Dark Reading)
UNC4899 breaches crypto firm via trojanized file
UNC4899, a North Korean threat actor, is suspected of stealing millions from an unnamed cryptocurrency firm in 2025 by compromising a developer’s personal device. The attacker reportedly delivered a trojanized file via AirDrop, which the developer then moved to their corporate workstation. The malicious Python code executed a binary masquerading as a Kubernetes CLI tool, providing access to the cloud environment. UNC4899 used living-off-the-cloud techniques to escalate privileges, move laterally, extract database credentials, modify user accounts, and ultimately withdraw millions. (The Hacker News)
UK launches cyber-fraud crackdown unit
The UK government is launching the Online Crime Centre in April to disrupt cyber-fraud operations as part of a broader anti-fraud strategy. The unit will coordinate law enforcement, intelligence agencies, banks, telecom providers, and tech companies to shut down scam infrastructure such as fraudulent accounts, websites, and phone numbers. Cyber-enabled fraud costs the UK about £14 billion annually, and officials say the effort will also use AI tools to detect suspicious transactions and deploy scam-baiting chatbots to gather intelligence on criminals. (Infosecurity Magazine)
US unveils new cyber strategy
Meanwhile, the US administration released a national cybersecurity strategy outlining six policy pillars focused on strengthening U.S. digital defenses and countering foreign cyber threats. The plan emphasizes proactive measures including offensive cyber operations, closer public-private partnerships, and investments in emerging technologies like AI and quantum computing. Other priorities include securing federal networks, protecting critical infrastructure and supply chains, streamlining regulations, and expanding the cybersecurity workforce. (Infosecurity Magazine)
Huge thanks to our sponsor, Dropzone AI
By the time someone gets to it, the window for early detection has closed. The attacker is already inside.
Tomorrow, I will tell you what Dropzone AI is bringing to RSAC to solve exactly this problem. If you cannot wait, head to dropzone.ai/rsa-2026-ai-diner.
FBI warns of phishers impersonating US officials
The FBI is warning about phishing attacks where criminals impersonate city and county planning officials to target people and businesses applying for land-use permits. Victims receive emails referencing real permit details and are instructed to pay fake fees via wire transfer, peer-to-peer payments, or cryptocurrency. The FBI advises verifying official domains and contacting local governments directly before making payments, and reporting incidents to the Internet Crime Complaint Center. (BleepingComputer)
Darktrace names third chief in 18 months
The Financial Times’ sources say Darktrace has appointed Ed Jennings as its third permanent CEO in 18 months, following Jill Popelka’s 16-month tenure and interim CEO Charles Goodman. The UK cybersecurity firm is owned by Thoma Bravo and plans to invest over $200 million in the US in 2026 to grow US sales to half of total revenue and compete with Palo Alto Networks and CrowdStrike. Jennings’ US-based experience at Quickbase and Mimecast is expected to help drive growth. (Financial Times)
Ransomware hits ELECQ, customer data stolen
Chinese EV charger maker ELECQ suffered a ransomware attack on its AWS cloud systems on March 7th, which encrypted and copied customer data. Exposed information includes names, emails, phone numbers, and home addresses, but no financial data or charger functionality was affected. The company took servers offline, restored systems from backups, and tightened remote access. Regulators in the UK and Germany have been notified, and customers are advised to monitor accounts and reset passwords. (The Register)
Threat actor uses Elastic Cloud for stolen data
Researchers at Huntress uncovered a campaign where attackers exploited multiple enterprise software vulnerabilities, including SolarWinds Web Help Desk, to steal system data and store it in a free-trial Elastic Cloud SIEM instance. The threat actor used encoded PowerShell scripts to collect host, Active Directory, and patch data, then managed it via the SIEM’s Kibana interface, affecting at least 216 hosts across 34 domains. Victims spanned government, education, finance, manufacturing, and IT sectors. Elastic and law enforcement coordinated to take down the cloud instance and notify affected orgs. (Infosecurity Magazine)