Cybersecurity Weekly Report – Week 12 of 2026

Coverage: March 15 – March 22, 2026

This week saw several major cybersecurity developments, including a large-scale spyware campaign targeting iPhones, critical vulnerabilities affecting network infrastructure, and continued supply-chain attacks targeting developers and open-source ecosystems.

1. DarkSword Spyware Campaign Targeting iPhones

Security researchers revealed a sophisticated spyware framework known as DarkSword targeting Apple iPhones.

The framework leverages multiple chained iOS vulnerabilities to perform:

• Remote code execution
• Persistent device compromise
• Data exfiltration
• Surveillance capabilities

The attack is primarily delivered through compromised websites. When users visit malicious pages, exploit chains trigger automatically and deploy spyware modules.

Known malware components include:

• GhostKnife
• GhostBlade
• GhostSaber

These tools are capable of stealing:

• Browser history
• Account credentials
• Messages and contacts
• Location data
• Cryptocurrency wallet information

Researchers estimate that over 200 million iPhones could potentially be affected. Apple has since released security patches and recommends that users update their devices immediately.

2. Juniper PTX Router Root RCE Vulnerability

Researchers disclosed a critical vulnerability affecting Juniper Junos OS Evolved on PTX routers.

The vulnerability, tracked as CVE-2026-21902, exists in the On-Box Anomaly Detection REST service.

Attackers can exploit the flaw to:

• Send crafted requests without authentication
• Gain root-level privileges
• Take full control of the network device

Affected routers are commonly deployed in large-scale infrastructure environments such as telecom networks and cloud providers.

Due to the potential impact on critical infrastructure, the vulnerability is considered highly severe.

3. Wing FTP Server Vulnerability Actively Exploited

Security agencies have warned that a vulnerability in Wing FTP Server is being actively exploited.

The vulnerability is tracked as CVE-2025-47813.

It allows attackers to expose the server’s installation path through specially crafted requests that trigger error messages.

Although the vulnerability itself is moderate in severity, attackers are combining it with other vulnerabilities to build more complex exploitation chains.

Many enterprises rely on Wing FTP Server for file transfer services, increasing the potential impact.

4. Compromised WordPress Sites Deliver Infostealer Malware

Researchers observed widespread malware campaigns using compromised WordPress websites as distribution platforms.

Attackers inject malicious scripts that display fake CAPTCHA or ClickFix prompts, tricking visitors into executing malicious commands.

The campaign deploys several infostealer families, including:

• Vidar Stealer
• Impure Stealer
• VodkaStealer

These malware strains can steal:

• Stored browser passwords
• Cryptocurrency wallet data
• Email client credentials
• VPN access tokens

Hundreds of infected websites across multiple countries have been identified.

5. Developer Supply Chain Attacks Increasing

Security researchers also discovered new supply-chain attacks targeting developer ecosystems.

A campaign known as PhantomRaven published dozens of malicious packages on npm.

These packages were designed to harvest:

• Developer email addresses
• CI/CD tokens
• API keys
• Environment variables

In addition, malicious Rust crates disguised as time-utility libraries were found exfiltrating .env files.

As open-source dependencies continue to grow in modern software development, supply-chain attacks remain a major cybersecurity concern.

6. Key Threat Trends This Week

Several key cybersecurity trends emerged during the week:

Mobile Attacks Becoming More Sophisticated

Mobile devices are increasingly targeted by advanced spyware.

Infrastructure Vulnerabilities Remain Critical

Router and network infrastructure vulnerabilities can impact large-scale systems.

Supply Chain Attacks Expanding

Developer ecosystems are becoming major attack vectors.

Infostealer Malware Continues to Rise

Data theft remains one of the primary goals of cybercriminal groups.

7. Security Recommendations

Organizations should consider implementing the following measures:

• Update mobile devices and operating systems immediately
• Patch network infrastructure devices
• Audit open-source dependencies
• Deploy web application firewalls for public services
• Monitor endpoints using EDR or XDR tools

Conclusion

The cybersecurity landscape in 2026 continues to evolve rapidly. Attackers are increasingly combining mobile exploits, infrastructure vulnerabilities, and supply-chain attacks to compromise organizations. Continuous vulnerability management and threat intelligence monitoring remain essential to defend against modern cyber threats.