Google Patches Fourth Chrome Zero-Day of 2026, China-Nexus APT Exploits TrueConf Zero-Day, EvilTokens Phishing-as-a-Service Hits Microsoft 365, CERT-UA Impersonation Spreads AGEWHEEZE RAT

Google patches CVE-2026-5281, the fourth actively exploited Chrome zero-day this year. CheckPoint exposes Operation TrueChaos — Chinese threat actors exploiting a TrueConf video conferencing zero-day (CVE-2026-3502) to backdoor Southeast Asian government agencies. EvilTokens device code phishing kit enables mass Microsoft 365 account hijacking. CERT-UA impersonation campaign blasts 1 million emails with AGEWHEEZE Go-based RAT.

---

🔴 Chrome Zero-Day CVE-2026-5281 — Fourth Exploited Flaw This Year

Google has released emergency out-of-band updates to fix yet another Chrome vulnerability being exploited in active attacks. CVE-2026-5281 resides in Dawn, the cross-platform implementation of the WebGPU standard that powers Chrome's graphics rendering pipeline.

The use-after-free weakness can be exploited by attackers to trigger browser crashes, data corruption, or — in the worst case — arbitrary code execution. Google has withheld technical details to give users time to update.

2026 Chrome Zero-Day Scorecard

CVE	Component	Type	Patched
CVE-2026-2441	CSSFontFeatureValuesMap	Iterator Invalidation	February
CVE-2026-3909	Skia 2D Graphics	Out-of-bounds Write	March
CVE-2026-3910	V8 JavaScript Engine	Inappropriate Implementation	March
CVE-2026-5281	Dawn (WebGPU)	Use-After-Free	April 1

Four zero-days in three months is a concerning pace. In all of 2025, Google patched eight Chrome zero-days total. At the current rate, 2026 is on track to significantly exceed that number. Organizations should implement automatic Chrome update policies and consider browser isolation for high-risk users.

---

🇨🇳 Operation TrueChaos — China-Nexus APT Exploits TrueConf Video Conferencing Zero-Day

CheckPoint Research has uncovered a campaign they call Operation TrueChaos, in which a China-nexus threat actor exploited a zero-day vulnerability in TrueConf video conferencing servers to push malicious software updates to government agencies in Southeast Asia.

TrueConf is a self-hosted video conferencing platform used by over 100,000 organizations, including military forces, government agencies, oil and gas corporations, and air traffic management companies. The vulnerability is particularly dangerous because TrueConf clients trust server-provided updates without proper validation.

Attack Chain

1. Attacker compromises a centrally managed government TrueConf server
2. Replaces the legitimate update package with a malicious executable
3. All connected TrueConf clients automatically download and execute the payload
4. DLL sideloading delivers reconnaissance tools (tasklist, tracert)
5. UAC bypass via iscicpl.exe escalates privileges
6. Persistence established via scheduled tasks
7. Network traffic points to Havoc C2 framework infrastructure

Attribution

CheckPoint attributes the campaign to a Chinese-nexus threat actor with moderate confidence, based on:

• Use of Alibaba Cloud and Tencent for C2 infrastructure
• TTPs consistent with known Chinese APT groups
• Victimology focused on Southeast Asian government entities
• Overlap with Amaranth Dragon, a previously documented Chinese threat cluster that also deploys Havoc implants

The vulnerability affects TrueConf versions 8.1.0 through 8.5.2. A patch was released in version 8.5.3 in March 2026. Organizations running on-premises TrueConf servers should treat this as a priority patch.

---

🎣 EvilTokens — Device Code Phishing-as-a-Service Hits Microsoft 365 at Scale

Security researchers at Sekoia have documented a new phishing-as-a-service kit called EvilTokens, sold on Telegram and under active development. The kit commoditizes device code phishing — a technique that abuses OAuth 2.0's device authorization flow to hijack Microsoft 365 accounts.

How It Works

1. Victim receives an email with a PDF, HTML, DOCX, or SVG attachment containing a QR code or link
2. Link leads to a phishing page impersonating Adobe Acrobat, DocuSign, or SharePoint
3. Page displays a verification code and prompts the user to "verify identity" at Microsoft
4. Victim authenticates at the legitimate Microsoft device login page
5. Attacker receives both access token and refresh token for persistent access

What Attackers Get

• Full access to email, OneDrive files, Teams data
• SSO impersonation across Microsoft services
• Persistent access via refresh tokens that survive password changes
• Business email compromise (BEC) capability for financial fraud

The technique is particularly dangerous because the victim authenticates on Microsoft's legitimate login page — there's no credential interception to detect. The kit has been used by multiple threat actors including Russian groups (Storm-237, UTA032) and the ShinyHunters data extortion group. The developer has announced plans to expand support for Gmail and Okta phishing pages.

---

🇺🇦 CERT-UA Impersonation Blasts 1 Million Emails With AGEWHEEZE RAT

Ukraine's Computer Emergency Response Team (CERT-UA) has disclosed a phishing campaign where attackers impersonated the agency itself to distribute a remote access trojan called AGEWHEEZE. The threat actor, tracked as UAC-0255 (self-identified as "Cyber Serp"), claims to have sent the malicious emails to 1 million ukr.net mailboxes.

Campaign Details

• Delivery: Emails spoofing CERT-UA from incidents@cert-ua[.]tech
• Payload: Password-protected ZIP archive (CERT_UA_protection_tool.zip) hosted on Files.fm
• Malware: AGEWHEEZE — a Go-based RAT communicating over WebSockets
• Targets: Ukrainian government organizations, medical centers, security firms, educational institutions, financial institutions

AGEWHEEZE Capabilities

• Command execution and file operations
• Clipboard modification and screenshot capture
• Mouse and keyboard emulation
• Process and service management
• Persistence via scheduled tasks, Registry modification, or Startup directory
• C2 communication over WebSockets to 54.36.237[.]92

CERT-UA reports the campaign was largely unsuccessful, with only a few educational institution devices compromised. Analysis of the phishing site revealed it was likely generated using AI tools, with a comment in the HTML source reading "With Love, CYBER SERP" in Russian.

---

📋 Quick Hits

---

🛡️ Recommended Actions

1. Chrome: Force-update to version 146.0.7680.177+ across all managed endpoints. Enable automatic updates if not already configured.
2. TrueConf: Upgrade all TrueConf Server instances to version 8.5.3 immediately. Hunt for poweriso.exe, 7z-x64.dll, and suspicious artifacts in %AppData%\Roaming\Adobe\.
3. Microsoft 365: Implement Conditional Access policies that restrict device code authentication. Monitor for anomalous token grants. Review Azure AD sign-in logs for device code flow activity.
4. CERT-UA Phishing: Block 54.36.237[.]92 and cert-ua[.]tech. Ukrainian organizations should alert staff about the impersonation campaign.
5. Android: Audit installed apps against the NoVoice indicator list. Consider MDM policies restricting sideloading and unverified Play Store apps.