Cybersecurity Daily Digest: Cloud Breaches, MFA Bypass & Persistent Malware Threats

Good evening and a warm welcome to the Heal Security Dispatch Daily Digest, your go-to source for the latest in cybersecurity trends and expert insights, proudly presented by Heal Security. I'm Ed Hall, joining you from London, ready to explore the vital nexus of healthcare and cybersecurity intelligence today. Today is Tuesday, the 7th of April, 2026. Join me as we explore the complex terrain of cybersecurity in the digital world, A wave of data theft attacks has impacted customers of Snowflake after hackers exploited credentials obtained through a compromised third-party SaaS integrator.

The attackers leveraged stolen login data to access sensitive cloud-stored information across multiple organisations, in some cases remaining undetected for extended periods. The incidents highlight ongoing risks tied to weak authentication practices, lack of multi-factor enforcement and the growing exposure introduced by third-party service providers in modern cloud ecosystems. Threat actors are targeting Microsoft 365 accounts through sophisticated phishing campaigns designed to bypass multi authentication protections By leveraging adversary in the middle techniques and session hijacking attackers are able to capture authentication tokens and gain persistent access to user accounts without needing passwords.

This enables them to move laterally within corporate environments, access sensitive communications and carry out further attacks while evading traditional security controls. A newly discovered Android malware strain is infecting millions of devices with advanced persistence capabilities that make it particularly difficult to remove. Unlike typical threats, this malware can survive factory resets by embedding itself deeply within the system, allowing it to regain control even after users attempt to wipe their devices.

Its widespread impact raises serious concerns about mobile security, especially in regions with high numbers of unpatched or low-cost devices. Hackers have been observed distributing Monero mining malware disguised as tools intended for non developers abusing the trust associated with open and community platforms Once installed the malware silently hijacks system resources to mine cryptocurrency significantly degrading device performance and increasing energy consumption. The campaign underscores how threat actors continue to exploit legitimate channels to deliver malicious payloads while remaining under the radar.

Meanwhile, researchers have launched Project Glasswing, an initiative aimed at identifying and addressing vulnerabilities within widely used open-source software components. The project seeks to proactively scan and analyse dependencies that form the backbone of countless applications, many of which remain insufficiently audited. This effort highlights the systemic risks posed by insecure open-source code and the urgent need for improved visibility and security practices across the software supply chain.

In the healthcare sector, a significant data breach has exposed sensitive patient information after attackers compromised a system responsible for storing medical records. The breach has raised concerns about the security of healthcare infrastructure where critical systems often rely on outdated technology and remain attractive targets for cybercriminals Such incidents not only risk patient privacy but can also disrupt essential medical services and erode trust in healthcare providers.

Security experts are warning that a critical remote code execution vulnerability in FlowEyes is now actively being exploited in real-world attacks. The flaw allows attackers to execute arbitrary code on vulnerable systems, potentially leading to full system compromise and unauthorised access to sensitive data. With exploitation already underway, organisations are being urged to apply patches immediately and review their environments for signs of intrusion to mitigate further risk.

Thank you for listening. I'm Ed Hall. We appreciate your time and listening. I'm excited to have you with us again tomorrow for more insightful updates Remember to hit the like button, subscribe for continuous coverage and expert analysis and sign up for a free trial of Heal Security Desktop at healsecurity.