{"id":45160,"date":"2026-04-07T02:55:27","date_gmt":"2026-04-06T18:55:27","guid":{"rendered":"https:\/\/nuoya.nuoyayasuo.top\/index.php\/2026\/04\/07\/weekly-recap-axios-hack-chrome-0-day-fortinet-exploits-paragon-spyware-and-more\/"},"modified":"2026-04-07T02:55:27","modified_gmt":"2026-04-06T18:55:27","slug":"weekly-recap-axios-hack-chrome-0-day-fortinet-exploits-paragon-spyware-and-more","status":"publish","type":"post","link":"https:\/\/nuoya.nuoyayasuo.top\/index.php\/2026\/04\/07\/weekly-recap-axios-hack-chrome-0-day-fortinet-exploits-paragon-spyware-and-more\/","title":{"rendered":"⚡ Weekly Recap: Axios Hack, Chrome 0-Day, Fortinet Exploits, Paragon Spyware and More"},"content":{"rendered":"
\"&#9889;<\/a><\/div>\n

This week had real hits. The key software got tampered with. Active bugs showed up in the tools people use every day. Some attacks didn’t even need much effort because the path was already there.<\/p>\n

One weak spot now spreads wider than before. What starts small can reach a lot of systems fast. New bugs, faster use, less time to react.<\/p>\n

That’s this week. Read through it.<\/p>\n

⚡ Threat of the Week<\/strong><\/h2>\n

Axios npm Package Compromised by N. Korean Hackers<\/a><\/strong>—Threat actors with ties to North Korea seized control of the npm account belonging to the lead maintainer of Axios, a popular npm package with nearly 100 million weekly downloads, to push malicious versions containing a cross-platform malware dubbed WAVESHAPER.V2. The activity has been attributed to a financially motivated threat actor known as UNC1069. The incident demonstrates how quickly the compromise of a popular npm package can have ripple effects through the ecosystem. The malware’s self-deleting anti-forensic cleanup points to a deliberate, planned operation. “The build pipeline is becoming the new front line. Attackers know that if they can compromise the systems that build and distribute software, they can inherit trust at scale,” Avital Harel, Security Researcher at Upwind, said. “That’s what makes these attacks so dangerous — they’re not just targeting one application, they’re targeting the process behind many of them. Organizations should be looking much more closely at CI\/CD systems, package dependencies, and developer environments, because that’s increasingly where attackers are placing their bets.” Ismael Valenzuela, vice president of Labs, Threat Research, and Intelligence at Arctic Wolf, said the Axios npm compromise reflects a broader trend where attackers infiltrate trusted, widely used software components to obtain access to downstream customers at scale. “Even though the malicious versions were available for only a few hours, Axios is so deeply embedded across enterprise applications that organizations may have unknowingly pulled the compromised code into their environments through build pipelines or downstream dependencies,” Valenzuela added. “That downstream exposure is what makes these incidents particularly difficult to spot and contain, especially for teams that never directly chose to install Axios themselves. This incident reinforces that security teams need to treat build‑time tools and dependencies as part of the attack surface and not just trust tools by default.”<\/p>\n

<\/a> <\/p>\n