This week brought a wave of serious cyber threats hitting everything from your phone to your bank account to the AI tools businesses are building with. From malicious browser extensions to ransomware targeting major U.S. banks, to a critical flaw baked into the AI tools millions of developers are using: the threat landscape is wide, active, and getting more creative. Here’s what you need to know.
1. 108 Malicious Chrome Extensions Were Stealing Your Google & Telegram Data
Cybersecurity researchers discovered a network of 108 Chrome browser extensions secretly harvesting login credentials, Google account data, and Telegram session information from over 20,000 users. The extensions disguised themselves as games, translation tools, and Telegram clients; all while routing stolen data to the same criminal server in the background. Some even opened hidden URLs automatically when your browser started.
BET-R Actions: Open Chrome, go to Settings → Extensions, and review everything you have installed. If you don’t recognize it or haven’t used it in months, remove it. If you use Telegram, log out of all active web sessions from the Telegram mobile app immediately.
2. Microsoft’s Record Patch Tuesday: 169 Vulnerabilities, Including a SharePoint Zero-Day
Microsoft released its largest single Patch Tuesday update in years this April, fixing 169 security flaws, including an actively exploited zero-day in Microsoft SharePoint (CVE-2026-32201). CISA ordered federal agencies to patch this specific flaw by April 28, 2026. SharePoint is used by businesses of all sizes for file sharing and internal collaboration.
BET-R Actions: If your organization uses Microsoft 365 or SharePoint, confirm with your IT team or provider that this month’s updates have been applied. Home users with Windows should ensure automatic updates are enabled in Settings → Windows Update.
3. Cisco Network Infrastructure Under Active Attack; CISA Adds 8 New Exploited Flaws
CISA added eight new vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog this week, including three actively exploited flaws in Cisco Catalyst SD-WAN Manager, the software that controls routing and networking for businesses and government agencies. Attackers are using these vulnerabilities to overwrite files, steal stored credentials, and gain administrative access to networks.
BET-R Actions: If you use Cisco networking equipment or your business relies on Cisco-managed WAN services, verify with your network provider that these patches have been applied. Federal deadlines were set for April 23, and private sector businesses should treat that same urgency as their own.
4. Mirax Android Malware Is Turning Phones Into Criminal Proxy Servers
A sophisticated new Android banking trojan called Mirax has infected over 220,000 devices, spreading through fraudulent ads on Meta’s platforms (Facebook and Instagram). Once installed, it steals banking credentials and silently turns your phone into a proxy node, meaning criminals route their illegal internet traffic through your device, using your IP address to cover their tracks.
BET-R Actions: Only download apps from official stores (Google Play), and even then, be cautious of apps promoted through social media ads. If your phone is behaving strangely (unusual battery drain, unexplained data usage, or overheating), it may be compromised. A trusted mobile security scan can help identify threats.
5. A Critical Flaw in Anthropic’s AI Framework Could Let Hackers Take Over Servers
Security researchers discovered a serious architectural vulnerability in Anthropic’s Model Context Protocol (MCP), a framework used by thousands of developers to build AI-powered applications. The flaw enables Remote Code Execution (RCE), meaning attackers could potentially take full control of servers running MCP-based tools. With 150 million+ downloads, this affects a massive portion of the AI development ecosystem.
BET-R Actions: If your business is building or using custom AI tools powered by MCP, have your development team review OX Security’s advisory immediately. If you’re using off-the-shelf AI tools, ask your vendor about their MCP exposure and patching status.
Recent Incidents This Week
This week’s incident reports show that no organization is too big or too “secure” to avoid a breach. Third-party vendors continue to be the weakest link.
- Citizens Financial Group and Frost Bank
both claimed as victims by the Everest ransomware group, which says it stole millions of records containing sensitive financial data. Both banks deny their internal networks were breached, pointing instead to a shared third-party vendor as the source of the compromise.
What this means for you: You don’t have to be a customer of a breached company to be affected: your data can be exposed through any vendor that handles it. Monitor your financial accounts closely and consider placing a credit freeze if you have accounts with either bank.
How Individuals and Small Businesses Can Respond
This week’s threats hit browsers, phones, networks, and AI platforms all at once, and should serve as a reminder that cybersecurity can’t be treated as a one-time fix. Here’s what you should prioritize right now:
- Audit your Chrome extensions today: remove anything you don’t recognize or actively use
- Apply all pending Windows and Microsoft 365 updates, especially the SharePoint patch
- Never install apps through social media ads: go directly to official app stores
- Ask your IT provider or MSP whether your Cisco gear has received this week’s CISA-flagged patches
- If you’re using AI development tools, ask your vendor about MCP exposure
- Check your bank and credit card statements for unusual activity, especially if you bank with Citizens or Frost
- Consider enrolling in a credit monitoring service if you haven’t already
Citations:
108 Malicious Chrome Extensions Campaign
Microsoft April 2026 Patch Tuesday — SharePoint Zero-Day
CISA Adds 8 Exploited Flaws to KEV Catalog
Mirax Android RAT Spreads via Meta Ads
Anthropic MCP Design Flaw Enables RCE
Citizens Financial Group & Frost Bank Breach Claims