<?xml version="1.0" encoding="utf-8"?>
<rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom"><channel><title>NCSC-FI daily news followup 2026-04-01</title><link>https://ncsc.fi</link><description>News for 2026-04-01</description><atom:link href="https://www.kyberturvallisuuskeskus.fi/sites/default/files/rss/news.xml" rel="self"></atom:link><language>en-us</language><lastBuildDate>Thu, 02 Apr 2026 05:00:11 +0300</lastBuildDate><item><title>Why we’re still not doing April Fools’ Day</title><link>https://www.malwarebytes.com/blog/scams/2026/04/why-were-still-not-doing-april-fools-day</link><description><![CDATA[ People lost an estimated $442 billion to scams last year worldwide, according to the Global Anti-Scam Alliance.

The scale of that is hard to picture, but people’s day-to-day scam experience is easier to recognize: Our research found that 44% of people say they encounter mobile scams every single day. Two in three say it’s hard to “tell apart a scam from the real thing” and only 15% strongly agree they could detect a scam.

A year ago, we said we were stepping away from April Fools’ Day. Not because we don’t like a joke, but because the jokes were starting to look too similar to the things people are already worried about.

A few people may have called us humorless. But a year on, we’re more certain than ever that it was the right call. We want to explain why, with a bit more data behind us this time. ]]></description><pubDate>Thu, 02 Apr 2026 05:00:02 +0300</pubDate><guid>https://www.malwarebytes.com/blog/scams/2026/04/why-were-still-not-doing-april-fools-day</guid><category>North Korea</category><category>Security design</category><category>Threat intelligence</category></item><item><title>Kuntosaliketju Elixian tietomurrossa on vuotanut asiakkaiden nimiä ja yhteystietoja</title><link>https://yle.fi/a/74-20218659?origin=rss</link><description><![CDATA[ Kuntosaliketju Elixia kertoi keskiviikkona sen emoyhtiö SATS-konsernin joutuneen tietoturvaloukkauksen kohteeksi.

SATS kertoi alun perin viime viikolla epäilleensä, että sen it-ympäristöön on kohdistunut luvaton pääsy. Nyt vahvistuneesta tietoturvaloukkauksesta on ilmoitettu viranomaisille, Elixian tiedotteessa sanotaan.

Loukkauksessa on päästy käsiksi jaettua tallennustilaa käyttävään tiedostopalvelimeen. Osa palvelimella olleista asiakirjoista on sisältänyt muun muassa kuntosalien jäsenten nimiä ja yhteystietoja. ]]></description><pubDate>Thu, 02 Apr 2026 05:00:03 +0300</pubDate><guid>https://yle.fi/a/74-20218659?origin=rss</guid><category>Breach</category><category>Cybercrime</category><category>Data leak</category><category>Finland</category></item><item><title>Apple expands iOS 18 updates to more iPhones to block DarkSword attacks</title><link>https://www.bleepingcomputer.com/news/security/apple-expands-ios-18-updates-to-more-iphones-to-block-darksword-attacks/</link><description><![CDATA[ Apple has now made it possible for more iPhones still running iOS 18 to receive security updates that protect against the actively exploited DarkSword exploit kit.

"We enabled the availability of iOS 18.7.7 for more devices on April 1, 2026, so users with Automatic Updates turned on can automatically receive important security protections from web attacks called DarkSword," reads a note in today's iOS 18.7.7 security update changelog.

"The fixes associated with the DarkSword exploit first shipped in 2025."

In March, researchers at Lookout, iVerify, and Google Threat Intelligence revealed a new "DarkSword" exploit kit that targeted iPhones running iOS 18.4 through 18.7. ]]></description><pubDate>Thu, 02 Apr 2026 05:00:04 +0300</pubDate><guid>https://www.bleepingcomputer.com/news/security/apple-expands-ios-18-updates-to-more-iphones-to-block-darksword-attacks/</guid><category>Apple</category><category>Malware</category><category>Mobile</category><category>Russia</category><category>Vulnerability</category><category>iOS</category></item><item><title>Mitigating the Axios npm supply chain compromise</title><link>https://www.microsoft.com/en-us/security/blog/2026/04/01/mitigating-the-axios-npm-supply-chain-compromise/</link><description><![CDATA[ On March 31, 2026, two new npm packages for updated versions of Axios, a popular HTTP client for JavaScript that simplifies making HTTP requests to a REST endpoint with over 70 million weekly downloads, were identified as malicious. These versions (1.14.1 and 0.30.4) were injected with a malicious dependency to download payloads from known actor command and control (C2). Microsoft Threat Intelligence has attributed this infrastructure and the Axios npm compromise to Sapphire Sleet, a North Korean state actor.

Following successful connection to the malicious C2, a second-stage remote access trojan (RAT) payload was automatically deployed based on the operating system of the compromised device, including macOS, Windows, and Linux. This activity follows the pattern of recent high-profile supply chain attacks, where other adversaries poison widely adopted open-source frameworks and their distribution channels to achieve broad downstream impact.

Users who have installed Axios version 1.14.1 or 0.30.4 should rotate their secrets and credentials immediately and downgrade to a safe version (1.14.0 or 0.30.3). Users should also follow the mitigation and protection guidance provided in this blog, including disabling auto-updates for Axios npm packages, since the malicious payload includes a hook that will continue to attempt to update. ]]></description><pubDate>Thu, 02 Apr 2026 05:00:05 +0300</pubDate><guid>https://www.microsoft.com/en-us/security/blog/2026/04/01/mitigating-the-axios-npm-supply-chain-compromise/</guid><category>Analysis</category><category>Backdoor</category><category>Cyber defence</category><category>Exploit</category><category>Microsoft</category><category>Supply chain</category><category>Threat intelligence</category><category>Write-up</category></item><item><title>Google Drive ransomware detection now on by default for paying users</title><link>https://www.bleepingcomputer.com/news/security/google-drive-ransomware-detection-now-on-by-default-for-paying-users/</link><description><![CDATA[ Google announced that the AI-powered Google Drive ransomware detection feature has reached general availability and is now enabled by default for all paying users.

Announced in September 2025, a beta version of this feature began rolling out to Google Workspace customers worldwide in early October.

Google Drive will immediately pause file syncing when it detects a ransomware attack, notifying users and IT admins of the breach and drastically minimizing the impact of such incidents.

While this will not prevent the files on the compromised computer from being encrypted, documents stored in Google Drive will be protected and can be quickly restored once the malware infection is resolved.

After an attack is blocked, users are also provided with detailed instructions for restoring corrupted files using the Drive restoration tool to undo ransomware changes. ]]></description><pubDate>Thu, 02 Apr 2026 05:00:06 +0300</pubDate><guid>https://www.bleepingcomputer.com/news/security/google-drive-ransomware-detection-now-on-by-default-for-paying-users/</guid><category>Cyber defence</category><category>Google</category><category>Malware</category><category>Ransomware</category></item><item><title>Weaponizing the Protectors: TeamPCP’s Multi-Stage Supply Chain Attack on Security Infrastructure</title><link>https://unit42.paloaltonetworks.com/teampcp-supply-chain-attacks/</link><description><![CDATA[ Between late February and March 2026, threat group TeamPCP conducted a highly calculated, escalating sequence of supply chain threats. It systematically compromised widely trusted open-source security tools, including the vulnerability scanners Trivy and KICS and the popular AI gateway LiteLLM. The affected software also includes the official Python SDK of Telnyx.

These ongoing supply chain attacks injected malicious infostealer payloads directly into GitHub Actions and Python Package Index (PyPI) registries. Once executed during routine automated workflows, the malware silently extracts highly sensitive data. These attacks also establish persistent backdoors for lateral movement across clusters.

Attackers are believed by sources such as vx-underground to have already exfiltrated data from 500,000 infected machines over 300 GB of data and secrets from 500,000 machines, exposing major organizations across all business verticals to severe follow-on attacks.

Unlike past supply chain attacks, this operation explicitly weaponizes security and developer infrastructure that inherently require elevated privileges. This allows attackers unimpeded access to production secrets. They then have the ability to hold compromised organizations for ransom, demanding extortion payments. ]]></description><pubDate>Thu, 02 Apr 2026 05:00:07 +0300</pubDate><guid>https://unit42.paloaltonetworks.com/teampcp-supply-chain-attacks/</guid><category>Analysis</category><category>Cyber operations and campaigns</category><category>Cybercrime</category><category>Information operations</category><category>Research</category><category>Supply chain</category><category>Threat intelligence</category><category>Write-up</category></item><item><title>Pegasus Spyware: How to Detect, Prevent and Remove It</title><link>https://www.pandasecurity.com/en/mediacenter/pegasus-spyware/</link><description><![CDATA[ Pegasus spyware can get into a phone without you tapping a thing — no weird app or warning. Once inside, it can quietly watch your messages, calls and more. And that makes it a real concern for everyone.

Recent cases show this isn’t limited to criminals or terrorists. In 2025, courts moved to block NSO Group from targeting WhatsApp users with Pegasus after reports of misuse against journalists and private individuals. It’s a clear sign the risk has spread beyond government investigations.

Learn more about Pegasus spyware and how it works. We will also discuss how to detect Pegasus spyware, the warning signs to watch for and ways to make your device harder to spy on. ]]></description><pubDate>Thu, 02 Apr 2026 05:00:08 +0300</pubDate><guid>https://www.pandasecurity.com/en/mediacenter/pegasus-spyware/</guid><category>Android</category><category>Cyber defence</category><category>Guidance</category><category>Malware</category><category>Mobile</category><category>Spyware</category><category>Threat intelligence</category><category>Write-up</category><category>iOS</category></item><item><title>The Open Back Door: Industrial Remote Access</title><link>https://www.databreachtoday.com/blogs/open-back-door-industrial-remote-access-p-4067</link><description><![CDATA[ Industrial operations have never been more connected - or more exposed. As plants modernize and depend on third-party vendors, integrators and remote experts, access practices haven't kept pace with the threat landscape.

The connectivity that drives uptime and efficiency has quietly become one of the largest unmanaged attack surfaces in operational technology. Adversaries - including nation-state actors - are actively probing these pathways. Recent CISA advisories have called out insecure remote access as a primary entry point into critical infrastructure.

It's time to rethink remote access from the ground up - with zero trust network access purpose-built for OT. ]]></description><pubDate>Thu, 02 Apr 2026 05:00:09 +0300</pubDate><guid>https://www.databreachtoday.com/blogs/open-back-door-industrial-remote-access-p-4067</guid><category>Cyber defence</category><category>Cyber risk</category><category>ICS</category><category>Networking</category></item><item><title>The Real Risk of Vibecoding</title><link>https://www.trendmicro.com/en_us/research/26/c/the-real-risk-of-vibecoding.html</link><description><![CDATA[ That’s the promise of vibecoding, describing what you want in plain language and letting AI generate the code for you. For many teams, it feels like magic. Development moves faster. Prototypes become products almost overnight. Barriers to building software are lower than they’ve ever been. By dramatically lowering the cost of producing code, AI increases the volume and speed of software change, faster than most teams can review, govern, or fully understand it.

But here’s the uncomfortable truth:

Vibecoding doesn’t just accelerate development, it accelerates risk. ]]></description><pubDate>Thu, 02 Apr 2026 05:00:10 +0300</pubDate><guid>https://www.trendmicro.com/en_us/research/26/c/the-real-risk-of-vibecoding.html</guid><category>AI</category><category>Cyber defence</category><category>Government</category><category>Social engineering</category><category>Threat intelligence</category></item><item><title>Asking AI for personal advice is a bad idea, Stanford study shows</title><link>https://www.malwarebytes.com/blog/ai/2026/03/asking-ai-for-personal-advice-is-a-bad-idea-stanford-study-shows</link><description><![CDATA[ Stanford computer scientists just proved what therapists already suspected: AI chatbots will agree with almost anything you say to keep you happy. The researchers caught these systems validating dangerous decisions just to maintain user engagement.

That’s a worrying development, especially given Pew research figures showing nearly one in eight (12%) of American teenagers have turned to chatbots for emotional support.

The Stanford scientists tested 11 major models including ChatGPT, Claude, and Gemini. They fed them data from existing databases of personal advice, along with questions on Reddit’s popular r/AmITheAsshole subreddit, where people ask the community for opinions on how they handled personal disputes.

The bots validated user behavior 49% more often than humans did, according to the Stanford paper. The researchers also tested the AIs on statements with potentially harmful actions toward self or others, spanning 20 categories such as relational harm, self-harm, irresponsibility, and deception. The bots backed these statements 47% of the time.

AI bots tend to agree with people because it makes users feel good. These systems emphasize user satisfaction, and they take their lead directly from how users respond to them, using a system called reinforcement learning from human feedback (RHLF). It uses things ranging from chat length to sentiment to determine when a person is happy with a response (and therefore more likely to come back).

Chatting with a silicon sycophant also tends to make people more certain of their beliefs, which by implication means less open-minded, the study found. For instance, after talking with sycophantic bots, 2,400 test subjects became more stubborn and less willing to apologize. ]]></description><pubDate>Thu, 02 Apr 2026 05:00:11 +0300</pubDate><guid>https://www.malwarebytes.com/blog/ai/2026/03/asking-ai-for-personal-advice-is-a-bad-idea-stanford-study-shows</guid><category>AI</category><category>Information society</category><category>Research</category><category>Threat intelligence</category></item></channel></rss>