Microsoft Patches Two Zero-Days in March Update; Actively Exploited Android Flaw and Global APT Campaigns Emerge

The OpenClaw AI Agent Framework is experiencing an escalated security crisis. A widespread supply chain attack has been confirmed, with over 1,184 malicious 'skills' flooding the ClawHub marketplace, capable of full system compromise. The existing CVE-2026-25253 RCE vulnerability is now detailed to include sandbox escape capabilities. Additionally, a new flaw, 'ClawJacked,' allows covert hijacking of local AI agent instances. Users are urged to update to version 2026.2.26 or later immediately and treat all previously installed skills as untrusted due to the confirmed widespread compromise.

AkzoNobel has provided an update on the Anubis ransomware attack, clarifying that the operational impact at the affected U.S. site was minimal. This refines earlier reports which indicated the attack caused disruption, suggesting effective containment and incident response limited the overall business impact. The core details of the attack, including the 170GB data exfiltration by the Anubis group, remain consistent.

Further analysis of the UAT-9244 campaign indicates the group has been active since at least 2024 and shows operational overlaps with the known threat cluster 'FamousSparrow'. New technical details specify that 'TernDoor' is a Windows backdoor, a variant of 'CrowDoor', utilizing DLL Side-Loading (T1574.002) for evasion. 'PeerTime' is designed for Linux systems and embedded network devices, notably employing the BitTorrent protocol for C2 communications (T1071.003) to blend with legitimate traffic. 'BruteEntry' is described as a brute-force scanning tool installed on compromised network edge devices, turning them into scanning platforms. These details highlight increased sophistication and a broader attack surface.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added the actively exploited Qualcomm zero-day vulnerability, CVE-2026-21385, to its Known Exploited Vulnerabilities (KEV) catalog. This critical update mandates all U.S. federal agencies to apply the patch by March 24, 2026, underscoring the severe and immediate threat posed by this flaw. The vulnerability, an integer overflow in a graphics driver, affects over 235 Qualcomm chipsets and can lead to full device compromise. This CISA action highlights the widespread risk and urgency for all Android users to update their devices as soon as patches are available from their manufacturers.