← Back to Blog

Security Briefing, April 27 2026: Snow Malware via Teams, Itron’s Utility Network Breach, FakeWallet on the App Store, and LMDeploy’s 13-Hour Warning

The pattern this morning is ugly and consistent: trusted support channels, trusted infrastructure, trusted app stores, and trusted AI tooling are all being turned into high-speed attack paths.

---

---

1. Snow malware turns Microsoft Teams helpdesk trust into a domain-compromise path

Google Mandiant says UNC6692 is mixing email bombing with fake Microsoft Teams helpdesk outreach to push victims into installing a bogus anti-spam patch. That patch drops the Snow toolset: SnowBelt for browser persistence, SnowGlaze for tunneling, and SnowBasin for command execution. From there the operators dump LSASS, move laterally, and exfiltrate Active Directory material. This is not ordinary phishing anymore. It is support-channel trust being weaponized for deep network access.

• Treat unexpected Teams-based IT support as hostile until verified out-of-band.
• Correlate Quick Assist, scheduled task, browser extension, and credential-theft telemetry together.
• Assume lateral movement risk immediately if the fake patch was launched.

---

2. Itron’s internal IT breach is a critical-infrastructure warning even without confirmed customer impact

Itron disclosed unauthorized access to certain internal systems and says it has blocked the activity, launched an investigation, and currently sees no material operational disruption. That is good news, but not a reason for complacency. Itron sits inside utility technology for energy and water environments at global scale. When a vendor this embedded reports internal compromise, utilities and adjacent operators should read it as a segmentation, supplier-access, and response-readiness warning.

• Recheck segmentation between corporate IT, utility operations, and vendor-managed systems.
• Review incident-response playbooks for utility suppliers and critical third-party platforms.
• Audit privileged and remote access paths that could turn an internal IT breach into operational risk.

---

3. FakeWallet on Apple’s App Store shows trusted mobile distribution is still a live theft channel

Researchers found 26 FakeWallet apps on Apple’s App Store targeting crypto recovery phrases and private keys, including lookalikes for major wallets. In some cases the apps redirected users into trojanized wallet-install flows, with China-region App Store availability called out in reporting. The lesson is bigger than crypto: even trusted app stores can become delivery channels for credential and asset theft when brand mimicry and mobile trust are good enough.

• Warn users never to enter seed phrases into “verification” flows or replacement wallet prompts.
• Use MDM and mobile threat defense to restrict risky installs, sideloading patterns, and untrusted profiles.
• Treat both hot-wallet and cold-wallet recovery workflows as high-value targets for phishing and overlay abuse.

---

4. Watchlist: LMDeploy proves AI exploit windows are collapsing

LMDeploy CVE-2026-33626, an SSRF flaw in an open-source LLM serving stack, was reportedly exploited within 12 hours and 31 minutes of disclosure. That should scare anyone shipping AI infrastructure like ordinary internal software. Advisories are now close enough to exploit prompts that patch latency itself becomes exposure.

---

What security teams should do today

1. Re-verify every Teams-based support workflow and force out-of-band confirmation for urgent helpdesk requests.
2. Review critical-infrastructure and internal-network segmentation assumptions, especially around suppliers and remote administration.
3. Push mobile wallet hygiene guidance now and block risky install patterns where device management allows it.
4. Patch AI-serving components fast and block metadata, loopback, and unnecessary egress from model infrastructure by default.

---

---

Bottom line: The pattern this morning is ugly and consistent: trusted support channels, trusted infrastructure, trusted app stores, and trusted AI tooling are all being turned into high-speed attack paths.