Week in Review: Claude Mythos Finds 271 Firefox Vulnerabilities; Vercel Reports Breach
Summary
A weekly cybersecurity roundup covers the Vercel breach, NGate malware in Brazil, ProxySmart-linked SIM farm networks, AI security developments, and significant vulnerability disclosures and defenses.
Key points
- Vercel says attackers accessed some internal systems and compromised credentials belonging to a limited subset of customers.
- ESET Research identified an NGate campaign targeting Android users in Brazil through a trojanized HandyPay app and attributed two samples to the same threat actor.
- Infrawatch traced many commercial SIM farm proxy deployments across at least 94 locations in 17 countries to the ProxySmart platform.
- Mozilla reports that Claude Mythos identified 271 vulnerabilities in Firefox 150; an earlier scan with Opus 4.6 led to fixes for 22 security-sensitive bugs in Firefox 148.
- CISA and the UK NCSC warned that suspected state-sponsored attackers are using a custom backdoor to persistently compromise Cisco security devices; CISA also shared threat-hunting rules.
- CISA added Cisco Catalyst SD-WAN Manager CVE-2026-20133 to its Known Exploited Vulnerabilities catalog, while Apple patched CVE-2026-28950, a notification logging issue affecting deleted Signal messages.
Article Details
- Event Type
- Weekly cybersecurity news roundup covering breaches, malware and phishing campaigns, vulnerability disclosures, cybercrime, and security products.
- Impact
- Vercel reported that attackers accessed some internal systems and compromised credentials belonging to a limited subset of customers. France Titres said a breach may have exposed user data, with the incident still under investigation. Other reported risks include NGate payment fraud targeting Android users in Brazil, phishing and ransomware activity, and vulnerabilities including one CISA identified as exploited.
MITRE ATT&CK
T1102.002 · Bidirectional CommunicationGopherWhisper is reported to hide command-and-control traffic in Slack and Discord.T1528 · Steal Application Access TokenResearchers found that attackers could steal and reuse Apple Intelligence access tokens on another device.T1566.002 · Spearphishing LinkA British national tied to Scattered Spider pleaded guilty to hacking companies via SMS phishing.T1566.004 · Spearphishing VoiceATHR is described as enabling automated voice-phishing operations.
CVE
CVE-2026-20133Cisco · Catalyst sd-wan managerCISA flags another Cisco Catalyst SD-WAN Manager bug as exploited (CVE-2026-20133)CVE-2026-21876coreruleset · corerulesetProgress Software fixes sneaky WAF bypass vulnerability (CVE-2026-21876)CVE-2026-28950Apple · iOS and iPadOS; Apple · iPadOSApple fixes iPhone bug that let FBI retrieve deleted Signal messages(CVE-2026-28950)
People
Adrian CheekFlare senior cybercrime researcher who described ways organizations can identify North Korean operatives using fake identities and AI tools in job interviews.Kaja CiglicMicrosoft Senior Director for Cybersecurity Policy and Diplomacy interviewed about changes in nation-state cyber programs and policy responses.Sandra McLeodZoom CISO interviewed about security leadership, incident management, and balancing security with business needs.
Threat Actors
GopherWhisperDescribed as a newly identified China-aligned APT group that uses Slack, Discord, Outlook drafts, and file.io in its command-and-control operations.HexDexAlias used by a suspected hacker arrested in France and linked by authorities, as reported by Le Parisien, to a series of data breaches affecting organizations in the country.Scattered SpiderA British national tied to the cybercrime group pleaded guilty to hacking multiple companies via SMS phishing and stealing over $8 million in virtual currency from US victims.
Malware
MiraiNotable items include the NGate NFC campaign in Brazil, new Mirai variants like “tuxnokill”, ProxySmart-powered SIM farm proxy networks, the Vercel breach, and defensive tools such as SmokedMeat and Scenario.NGateNotable items include the NGate NFC campaign in Brazil, new Mirai variants like “tuxnokill”, ProxySmart-powered SIM farm proxy networks, the Vercel breach, and defensive tools such as SmokedMeat and Scenario.tuxnokillNotable items include the NGate NFC campaign in Brazil, new Mirai variants like “tuxnokill”, ProxySmart-powered SIM farm proxy networks, the Vercel breach, and defensive tools such as SmokedMeat and Scenario.
Vendors
AnthropicThe Mozilla Foundation tested Claude Mythos, an Anthropic AI model that has stirred debate in the cybersecurity community. Before granting access to Mythos, Mozilla scanned Firefox using Opus 4.6, which led to fixes forAppleApple fixes iPhone bug that let FBI retrieve deleted Signal messages(CVE-2026-28950)CiscoCISA flags another Cisco Catalyst SD-WAN Manager bug as exploited (CVE-2026-20133)MozillaClaude Mythos finds 271 Firefox flaws, Mozilla believes it shifts security toward defendersProgress SoftwareProgress Software fixes sneaky WAF bypass vulnerability (CVE-2026-21876)TencentTencent’s QClaw AI agent app arrives on Windows and macOSVercelNotable items include the NGate NFC campaign in Brazil, new Mirai variants like “tuxnokill”, ProxySmart-powered SIM farm proxy networks, the Vercel breach, and defensive tools such as SmokedMeat and Scenario.
Products
AndroidNGate NFC malware was distributed via a trojanized HandyPay app targeting Android users in Brazil.Apple IntelligenceApple Intelligence flaw kept stolen tokens reusable on another deviceCisco Catalyst SD-WAN ManagerCISA flags another Cisco Catalyst SD-WAN Manager bug as exploited (CVE-2026-20133)Claude MythosAI is accelerating both offensive tools (ATHR, PentAGI) and defensive capabilities (Scenario, Privacy Filter, Claude Mythos).HandyPayNGate NFC malware was distributed via a trojanized HandyPay app targeting Android users in Brazil.iPhoneApple fixes iPhone bug that let FBI retrieve deleted Signal messages(CVE-2026-28950)LoadMasterProgress Software has fixed a slew of high-severity vulnerabilities in MOVEit WAF and LoadMaster, including a flaw (CVE-2026-21876) that may allow attackers to bypass firewall detection.MOVEit WAFProgress Software has fixed a slew of high-severity vulnerabilities in MOVEit WAF and LoadMaster, including a flaw (CVE-2026-21876) that may allow attackers to bypass firewall detection.Mozilla FirefoxClaude Mythos finds 271 Firefox flaws, Mozilla believes it shifts security toward defendersSignalApple fixes iPhone bug that let FBI retrieve deleted Signal messages(CVE-2026-28950)VercelNotable items include the NGate NFC campaign in Brazil, new Mirai variants like “tuxnokill”, ProxySmart-powered SIM farm proxy networks, the Vercel breach, and defensive tools such as SmokedMeat and Scenario.
Tools
ATHRAI is accelerating both offensive tools (ATHR, PentAGI) and defensive capabilities (Scenario, Privacy Filter, Claude Mythos).Burp Suiteimprove vulnerability discovery. The initiative combines Meta’s bug bounty program with PortSwigger’s Burp Suite, reflecting a shared focus on improving both tooling and education for the global security community.PentAGIAI is accelerating both offensive tools (ATHR, PentAGI) and defensive capabilities (Scenario, Privacy Filter, Claude Mythos).Privacy FilterAI is accelerating both offensive tools (ATHR, PentAGI) and defensive capabilities (Scenario, Privacy Filter, Claude Mythos).ScenarioNotable items include the NGate NFC campaign in Brazil, new Mirai variants like “tuxnokill”, ProxySmart-powered SIM farm proxy networks, the Vercel breach, and defensive tools such as SmokedMeat and Scenario.SilentGlassgovernments and businesses from malicious activity carried through display connections. Called SilentGlass, the plug-and-play tool is designed to protect HDMI and DisplayPort links from potential cyberattacks.SmokedMeatNotable items include the NGate NFC campaign in Brazil, new Mirai variants like “tuxnokill”, ProxySmart-powered SIM farm proxy networks, the Vercel breach, and defensive tools such as SmokedMeat and Scenario.
Countries
Belarusof those deployments to a shared software platform called ProxySmart, built and operated out of Minsk, Belarus.BrazilNotable items include the NGate NFC campaign in Brazil, new Mirai variants like “tuxnokill”, ProxySmart-powered SIM farm proxy networks, the Vercel breach, and defensive tools such as SmokedMeat and Scenario.ChinaChina-linked threat actors have shifted from individually procured infrastructure to large-scale covert networks, botnets built from compromised routers and other edge devices, the National Cyber Security Centre (NCSC)FranceFrance Titres, a French government agency, has disclosed a data breach that may have exposed user data from its online portal. According to the agency, the incident was detected on Wednesday, April 15, and remains underUnited StatesUS CISA and the UK National Cyber Security Centre warned on Thursday. CISA also shared threat hunting rules US federal civilian agencies should use to search for evidence of the malware on their own systems.