Daily Threat Briefing – April 15, 2026

This briefing reports multiple high-impact and actively exploited threats: an actively exploited SharePoint zero-day within Microsoft’s Patch Tuesday (167 CVEs), a Russian state-sponsored router-based campaign harvesting Office authentication tokens at scale, the Mirax Android RAT infecting 220,000+ devices to act as SOCKS5 proxies, and critical Composer supply-chain command-injection flaws — it recommends immediate patching, router inventory and remediation, mobile threat defenses, and CI/CD/hardening controls.