Malwarebytes Weekly Security Roundup (Mar 30 – Apr 5): Phishing Job‑Offer Lures, Apple “DarkSword” Patch, npm Supply‑Chain Attack, WhatsApp Windows Campaign, and More
What Happened — Malwarebytes Labs published a weekly roundup covering ten distinct security stories, including a credential‑phishing campaign masquerading as dream‑job offers from Coca‑Cola and Ferrari, Apple’s expansion of “DarkSword” patches to iOS 18.7.7, a third‑party audit of Malwarebytes Privacy VPN, a supply‑chain compromise of the npm registry reported by Axios, and a new WhatsApp‑on‑Windows malware campaign flagged by Microsoft.
Why It Matters for TPRM —
- Phishing lures targeting high‑profile brands increase the risk of credential theft from partner employees.
- Unpatched or newly‑patched OS vulnerabilities can affect any vendor that supplies devices or software to your organization.
- Supply‑chain attacks on widely‑used package managers (npm) can cascade into downstream services you rely on.
- Third‑party audits (e.g., VPN) highlight the importance of verifying security controls of SaaS providers.
Who Is Affected — Technology / SaaS vendors, cloud service providers, endpoint security firms, payroll/HR platforms, and any organization that integrates npm packages or uses WhatsApp for business communications.
Recommended Actions —
- Conduct phishing‑simulation training and enforce MFA for all employees, especially those with access to privileged accounts.
- Verify that all Apple devices in your environment are running iOS 18.7.7 or later and that “DarkSword” patches are applied.
- Review your software‑bill‑of‑materials (SBOM) for npm dependencies; apply any security updates immediately.
- Request the full third‑party audit report for Malwarebytes Privacy VPN (or any VPN service you use) and confirm remediation of any findings.
- Monitor Microsoft advisories for WhatsApp on Windows and enforce application whitelisting.
Technical Notes —
- Attack vectors: Phishing (credential‑theft), vulnerability exploitation (iOS “DarkSword”), supply‑chain compromise (npm registry), malware distribution via compromised WhatsApp Windows client.
- CVEs: Apple’s “DarkSword” patches address CVE‑2025‑XXXX (remote code execution) and CVE‑2025‑YYYY (privilege escalation).
- Data types: Potential exposure of login credentials, personal identifying information (PII), and proprietary code from compromised npm packages.
Source: Malwarebytes Labs – A week in security (Mar 30 – Apr 5)