Tag: Cyber Threats

The Hacker NewsFeb 17, 2026Cloud Security / Digital Forensics

Cloud attacks move fast — faster than most incident response teams.

In data centers, investigations had time. Teams could collect disk images, review logs, and build timelines over days. In the cloud, infrastructure is short-lived. A compromised instance can disappear in minutes. Identities rotate. Logs expire. Evidence can vanish before analysis even begins.

Cloud forensics is fundamentally different from traditional forensics. If investigations still rely on manual log stitching, attackers already have the advantage.

Register: See Context-Aware Forensics in Action ➜

Why Traditional Incident Response Fails in the Cloud

Most teams face the same problem: alerts without context.

You might detect a suspicious API call, a new identity login, or unusual data access — but the full attack path remains unclear across the environment.

Attackers use this visibility gap to move laterally, escalate privileges, and reach critical assets before responders can connect the activity.

To investigate cloud breaches effectively, three capabilities are essential:

• Host-Level Visibility: See what occurred inside workloads, not just control-plane activity.
• Context Mapping: Understand how identities, workloads, and data assets connect.
• Automated Evidence Capture: If evidence collection starts manually, it starts too late.

What Modern Cloud Forensics Looks Like

In this webinar session, you will see how automated, context-aware forensics works in real investigations. Instead of collecting fragmented evidence, incidents are reconstructed using correlated signals such as workload telemetry, identity activity, API operations, network movement, and asset relationships.

This allows teams to rebuild complete attack timelines in minutes, with full environmental context.

Cloud investigations often stall because evidence lives across disconnected systems. Identity logs reside in one console, workload telemetry in another, and network signals elsewhere. Analysts must pivot across tools just to validate a single alert, slowing response and increasing the chance of missing attacker movement.

Modern cloud forensics consolidates these signals into a unified investigative layer. By correlating identity actions, workload behavior, and control-plane activity, teams gain clear visibility into how an intrusion unfolded — not just where alerts triggered.

Investigations shift from reactive log review to structured attack reconstruction. Analysts can trace sequences of access, movement, and impact with context attached to every step.

The result is faster scoping, clearer attribution of attacker actions, and more confident remediation decisions — without relying on fragmented tooling or delayed evidence collection.

Register for the Webinar ➜

Join the session to see how context-aware forensics makes cloud breaches fully visible.

Presentation of the KTU Consortium Mission ‘A Safe and Inclusive Digital Society’ at the Innovation Agency event ‘Innovation Breakfast: How Mission-Oriented Science and Innovation Programmes Will Address Societal Challenges’.

Technologies are evolving fast, reshaping economies, governance, and daily life. Yet, as innovation accelerates, so do digital risks. Technological change is no longer abstract for such a country as Lithuania, as well. From e-signatures to digital health records, the country depends on secure systems. 

Cybersecurity has become not only a technical challenge but a societal one – demanding the cooperation of scientists, business leaders, and policymakers. In Lithuania, this cooperation has taken a concrete form – the government-funded national initiative. Coordinated by the Innovation Agency Lithuania, the project aims to strengthen the country’s e-security and digital resilience. 

Under this umbrella, universities and companies with long-standing expertise are working hand in hand to transform scientific knowledge into market-ready, high-value innovations. Several of these solutions are already being tested in real environments, for example, in public institutions and critical infrastructure operators. As Martynas Survilas, Director of the Innovation Development Department at the Innovation Agency Lithuania, explains:

“Our goal is to turn Lithuania’s scientific potential into real impact – solutions that protect citizens, reinforce trust in digital services, and help build an inclusive, innovative economy. The era of isolated research is over. In practice, science and business must work together to keep pace with complex, multilayered threats.”

A National Mission: Safe and Inclusive E-Society

Among three strategic national missions launched under this program, one stands out for its relevance to the global digital landscape: “Safe and Inclusive E-Society”, coordinated by Kaunas University of Technology (KTU).

The mission aims to increase cyber resilience and reduce the risks of personal data breaches, with a focus on everyday users of public and private e-services, contributing directly to Lithuania’s transformation into a secure, digitally empowered society. Its total value exceeds €24.1 million.

The KTU consortium includes top Lithuanian universities – Vilnius Tech and Mykolas Romeris University – as well as leading cybersecurity companies such as NRD Cyber Security, Elsis PRO, Transcendent Group Baltics, and the Baltic Institute of Advanced Technology, together with industry association Infobalt and the Lithuanian Cybercrime Competence, Research and Education Center. 

Criminals today, Dr. Brūzgienė warns, have access to a broad arsenal of AI tools. They use models such as GPT-4, GPT-5, Claude, and open-source alternatives like Llama, Falcon, and Mistral – as well as darker variants such as FraudGPT, WormGPT, or GhostGPT, specifically designed for malicious activities. “They can clone voices using ElevenLabs or Microsoft’s VALL-E from just a few seconds of someone speaking. For creating fake faces and videos, they use StyleGAN, Stable Diffusion, DALL-E, and DeepFaceLab, along with lip-sync solutions like Wav2Lip and First-Order-Motion,” she notes.

Even more concerning, she adds, is how these tools are orchestrated together: “Criminals produce photorealistic face photos, deepfake videos, and document copies with meticulously edited metadata. LLMs generate high-quality, personalized phishing texts and onboarding dialogues, TTS and voice-cloning models recreate a victim’s or employee’s voice, and image generation tools produce ‘liveness’ videos that fool verification systems. Automated AI agents then handle the rest – creating accounts, uploading documents, and responding to challenges. These multimodal chains can bypass both automated and human verification based on trust.”

“The scary part,” Dr. Brūzgienė concludes, “is how accessible all of this has become. Commercial TTS solutions like ElevenLabs and open-source implementations of VALL-E provide high-quality voice cloning to anyone. Stable Diffusion, DeepFaceLab, and similar tools make it easy to generate photorealistic images or deepfakes quickly. Because of this accessibility, a single operator can create hundreds of convincing, different, yet interconnected fake profiles in a short time. We are already seeing such cases in attempts to open fake accounts in financial institutions and crypto platforms.”

AI-Powered Social Engineering

Another new frontier is adaptive AI-driven social engineering. Attackers no longer rely on static scripts – they use LLMs that adapt to a victim’s reactions in real time.

Bots start with automated reconnaissance, scraping social media, professional directories, and leaked databases to build personalized profiles. Then, the LLM crafts initial messages that mirror a person’s professional tone or institutional language. If there’s no response, the system automatically switches channels – from email to SMS or Slack – and changes tone from formal to urgent. If a target hesitates, the AI generates plausible reassurance, quoting real internal policies or procedures.

In one typical scenario, a “colleague” writes via work email, follows up on LinkedIn, and then calls using a cloned voice – all orchestrated by connected AI tools. Dr. Brūzgienė describes this as a new stage of cybercrime evolution: “Social engineering has become scalable, intelligent, and deeply personal. Each victim experiences a unique, evolving deception designed to exploit their psychological and behavioral weak points.”

Lithuania’s Cyber Defense Leadership

Lithuania’s digital ecosystem – known for its advanced e-government architecture and centralized electronic identity (eID) systems – faces unique challenges. However, it also demonstrates remarkable progress. The country has risen steadily in international indices, ranking 25th globally in the Chandler Good Government Index (CGGI) and 33rd in the Government AI Readiness Index (2025).

Lithuania’s AI strategy (2021–2030), updated in 2025, has prioritized AI-driven cyber defense, anomaly detection, and resilience-building. The National Cyber Security Centre (NKSC) integrates AI into threat monitoring, reducing ransomware incidents by fivefold between 2023 and 2024. Collaboration with NATO, ENISA, and EU partners further enhances Lithuania’s hybrid defense capabilities.

“We see cyber resilience not just as a technical task but as a foundation for democracy and economic growth,” says Survilas. “Through the safe and inclusive e-society mission, we are not only protecting our digital infrastructure but also empowering citizens to trust and participate in the digital world. AI will inevitably be used for malicious purposes, but we can also use AI to defend. The key is collaboration across sectors and continuous education. This mission is one of the tools helping us turn that idea into concrete projects, pilots, and services for people in Lithuania.”

Ravie LakshmananFeb 16, 2026

This week’s recap shows how small gaps are turning into big entry points. Not always through new exploits, often through tools, add-ons, cloud setups, or workflows that people already trust and rarely question.

Another signal: attackers are mixing old and new methods. Legacy botnet tactics, modern cloud abuse, AI assistance, and supply-chain exposure are being used side by side, whichever path gives the easiest foothold.

Below is the full weekly recap — a condensed scan of the incidents, flaws, and campaigns shaping the threat landscape right now.

⚡ Threat of the Week

Malicious Outlook Add-in Turns Into Phishing Kit — In an unusual case of a supply chain attack, the legitimate AgreeTo add-in for Outlook has been hijacked and turned into a phishing kit that stole more than 4,000 Microsoft account credentials. This was made possible by seizing control of a domain associated with the now-abandoned project to serve a fake Microsoft login page. The incident demonstrates how overlooked and abandoned assets turn into attack vectors. “What makes Office add-ins particularly concerning is the combination of factors: they run inside Outlook, where users handle their most sensitive communications, they can request permissions to read and modify emails, and they’re distributed through Microsoft’s own store, which carries implicit trust,” Koi Security’s Idan Dardikman said. Microsoft has since removed the add-in from its store. 

• Google Releases Fixes for Actively Exploited Chrome 0-Day — Google shipped security updates for its Chrome browser to address a flaw that it said has been exploited in the wild. The high-severity vulnerability, tracked as CVE-2026-2441 (CVSS score: 8.8), has been described as a use-after-free bug in CSS that could result in arbitrary code execution. Google did not disclose any details about how the vulnerability is being exploited in the wild, by whom, or who may have been targeted, but it acknowledged that “an exploit for CVE-2026-2441 exists in the wild.” CVE-2026-2441 is the first actively exploited Chrome flaw patched by Google this year.
• BeyondTrust Flaw Comes Under Active Exploitation — A newly disclosed critical vulnerability in BeyondTrust Remote Support and Privileged Remote Access products has come under active exploitation in the wild less than 24 hours after the publication of a proof-of-concept (PoC) exploit. The vulnerability in question is CVE-2026-1731 (CVS score: 9.9), which could allow an unauthenticated attacker to achieve remote code execution by sending specially crafted requests. According to BeyondTrust, successful exploitation of the shortcoming could allow an unauthenticated remote attacker to execute operating system commands in the context of the site user, resulting in unauthorized access, data exfiltration, and service disruption. Data from GreyNoise revealed that a single IP accounted for 86% of all observed reconnaissance sessions so far.
• Apple Ships Patches for Actively Exploited 0-Day — Apple released iOS, iPadOS, macOS Tahoe, tvOS, watchOS, and visionOS updates to address a zero-day flaw that it said has been exploited in sophisticated cyber attacks against specific individuals on versions of iOS before iOS 26. The vulnerability, tracked as CVE-2026-20700 (CVSS score: 7.8), has been described as a memory corruption issue in dyld, Apple’s Dynamic Link Editor. Successful exploitation of the vulnerability could allow an attacker with memory write capability to execute arbitrary code on susceptible devices. Google Threat Analysis Group (TAG) has been credited with discovering and reporting the bug. The issue has been addressed in iOS 26.3, iPadOS 26.3, macOS Tahoe 26.3, tvOS 26.3, watchOS 26.3, and visionOS 26.3.
• SSHStalker Uses IRC for C2 — A newly documented Linux botnet named SSHStalker is using the Internet Relay Chat (IRC) communication protocol for command-and-control (C2) operations. The SSHStalker botnet relies on classic IRC mechanics, prioritizing resilience, scale, and low-cost C2 over stealth and technical novelty. The toolkit achieves initial access through automated SSH scanning and brute forcing, using a Go binary that masquerades as the popular open-source network discovery utility nmap. Compromised hosts are then used to scan for additional SSH targets, allowing it to spread in a worm-like manner. Also dropped to infected hosts are payloads to escalate privileges using a catalog of 15-year-old CVEs, perform AWS key harvesting, and cryptocurrency mining. “What we actually found was a loud, stitched-together botnet kit that mixes old-school IRC control, compiling binaries on hosts, mass SSH compromise, and cron-based persistence,” Flare said, describing it as a “scale-first operation that favors reliability over stealth.”
• TeamPCP Turns Cloud Infrastructure into Cybercrime Bots — A threat cluster known as TeamPCP is systematically targeting misconfigured and exposed cloud native environments to hijack infrastructure, expand its scale, and monetize its operations through cryptocurrency mining, proxyware, data theft, and extortion. TeamPCP’s modus operandi involves scanning broad IP ranges for exposed Docker APIs, Kubernetes clusters, Redis servers, Ray dashboards, and systems susceptible to the React2Shell vulnerability in React Server Components. Once it gains access to a system, the threat actor deploys malicious Python and Shell scripts that pull down additional payloads to install proxies, tunneling software, and other components that enable persistence even after server reboots. The varied end goals of the operation ensure that TeamPCP has several revenue streams as “every compromised system becomes a scanner, a proxy, a miner, a data exfiltration node, and a launchpad for further attacks,” Flare said. “Kubernetes clusters are not merely breached; they are converted into distributed botnets.”
• State-Sponsored Hackers Use AI at All Stages of Attack Cycle — Google said it found evidence of nation-state hacking groups using its artificial intelligence (AI) chatbot Gemini at nearly every stage of the cyber attack cycle. The findings once again underscore how such tools are being increasingly integrated into malicious operations, even if they don’t equip bad actors with novel capabilities. One major area of concern with AI abuse is automating the development of vulnerability exploitation, allowing attackers to move faster than the defenders, necessitating that companies respond quickly and fix security weaknesses. Gemini is being weaponized in other ways too, Google said, with some bad actors embedding its APIs directly into malicious code. This includes a new malware family called HONESTCUE that sends prompts to generate working code that the malware compiles and executes in memory. The prompts appear benign in isolation and “devoid of any context related to malware,” allowing them to bypass Gemini’s safety filters.
• Nation-State Hackers Go After Defense Industrial Base — Digital threats targeting the defense industrial base (DIB) sector are expanding beyond traditional espionage into supply chain attacks, workforce infiltration, and cyber operations that lend nations a strategic advantage on the battlefield. The development comes as the cyber domain becomes increasingly intertwined with national defense. Google Threat Intelligence Group said the DIB sector faces a “relentless barrage” of cyber operations conducted by state-sponsored actors and criminal groups. These activities are primarily driven by Chinese, Iranian, North Korean, and Russian threat actors. This is also complemented by pre-positioning efforts to gain covert access through zero-day vulnerabilities in edge network devices to maintain persistent access for future strategic advantage. “In modern warfare, the front lines are no longer confined to the battlefield; they extend directly into the servers and supply chains of the industry that safeguards the nation,” the tech giant said.

‎️‍🔥 Trending CVEs

New vulnerabilities surface daily, and attackers move fast. Reviewing and patching early keeps your systems resilient.

Here are this week’s most critical flaws to check first — CVE-2026-2441 (Google Chrome), CVE-2026-20700 (Apple iOS, iPadOS, macOS Tahoe, tvOS, watchOS, and visionOS), CVE-2026-21510, CVE-2026-21513, CVE-2026-21514, CVE-2026-21519, CVE-2026-21525, CVE-2026-21533 (Microsoft Windows), CVE-2026-1731 (BeyondTrust Remote Support and Privileged Remote Access), CVE-2026-1774 (CASL Ability), CVE-2026-25639 (Axios), CVE-2026-25646 (libpng), CVE-2026-1357 (WPvivid Backup & Migration plugin), CVE-2026-0969 (next-mdx-remote), CVE-2026-25881 (SandboxJS), CVE-2025-66630 (Fiber v2), and a path traversal vulnerability in PyMuPDF (no CVE).

🎥 Cybersecurity Webinars

• Quantum-Ready Security: Preparing for Post-Quantum Cryptography Risks — Quantum computing is advancing fast and it could soon break today’s encryption. Attackers are already collecting encrypted data to decrypt later using quantum power. In this webinar, learn how post-quantum cryptography (PQC) protects sensitive data, ensures compliance, and prepares your organization for future threats. Discover practical strategies, hybrid encryption models, and real solutions from Zscaler to secure your business for the quantum era.
• AI Agents Are Expanding Your Attack Surface — Learn How to Secure Them — AI agents are no longer just chatbots; they browse the web, run code, and access company systems. This creates new security risks beyond prompts. In this session, Rahul Parwani explains how attackers target AI agents and what teams can do to protect them in real-world use.
• Faster Cloud Breach Analysis With Context-Aware Forensics — Cloud attacks don’t leave clear evidence, and traditional forensics can’t keep up. In this webinar, learn how context-aware forensics and AI help security teams investigate cloud incidents faster, capture the right host-level data, and reconstruct attacks in minutes instead of days, so you understand what happened and respond with confidence.

📰 Around the Cyber World

• DragonForce Ransomware Cartel Detailed — In a new analysis, S2W detailed the workings of DragonForce, a ransomware group active since December 2023 that operates under a Ransomware-as-a-Service (RaaS) model and promotes itself as a cartel to expand its influence. The group has carried out attacks against 363 companies from December 2023 to January 2026, while affiliating with LockBit and Qilin. DragonForce also maintains the RansomBay service to support affiliates with customized payload generation and configuration options. In addition, it is active on several dark web forums, including BreachForums, RAMP, and Exploit to advertise its RaaS operations and recruit pentesters. “DragonForce has been expanding its operational scope through attacks on other groups as well as through cooperative relationships, which is assessed as an effort to strengthen its position within the ransomware ecosystem,” S2W said.
• New Browser Fingerprinting Technique Uses Ad Block Filters — Aș browser fingerprinting techniques continue to evolve, new research has found that country-specific adblock filter lists installed on the browser can be used to de-anonymize VPN users. The approach has been codenamed Adbleed by security researcher Melvin Lammerts. “Users of ad blockers with country-specific filter lists (e.g., EasyList Germany, Liste FR) can be partially de-anonymized even when using a VPN,” the researcher said. “By probing blocked domains unique to each country’s filter list, we can identify which lists are active, revealing the user’s likely country or language. If 20+ out of 30 probed domains are blocked instantly, we conclude that the country’s filter list is active.”
• China’s Tianfu Cup Makes a Quiet Return in 2026 — China’s Tianfu Cup hacking contest made its return in 2026, and is now being overseen by the government. Tianfu Cup was launched in 2018 as an alternative to the Zero Day Initiative’s Pwn2Own competition to demonstrate critical vulnerabilities in consumer and enterprise hardware and software, industrial control systems, and automotive products. Tianfu Cup attracted attention in 2021 when participants earned a total of $1.88 million for exploits targeting Windows, Ubuntu, iOS, Safari, Google Chrome, Microsoft Exchange, Adobe Reader, Docker, and VMware. While Tianfu Cup skipped 2022, 2024, and 2025, it popped up in 2023 with a focus on domestic products from companies such as Huawei, Xiaomi, Tencent, and Qihoo 360. After a two-year hiatus in 2024 and 2025, Tianfu Cup once again reappeared late last month. According to Natto Thoughts, the hacking competition is now organized by China’s Ministry of Public Security (MPS). With regulations implemented by China in 2021 requiring citizens to report zero-day vulnerabilities to the government, it has raised concerns that Chinese nation-state threat actors have been leveraging the law to stockpile zero-days for cyber espionage operations.
• DoD Employee Indicted for Moonlighting as a Money Mule — A Department of Defense (DoD) employee, Samuel D. Marcus, has been indicted in the U.S. for allegedly serving as a money mule and laundering millions of dollars on behalf of Nigerian scammers. Marcus has been charged with one count of conspiracy to commit money laundering, six counts of illegal monetary transactions, and one count of money laundering. “From approximately July 2023 to December 2025, while employed as a Logistics Specialist with the Department of Defense, the defendant was in direct and regular contact with a group of Nigeria-based fraudsters, who operated under the aliases ‘Rachel Jude’ and ‘Ned McMurray,’ among others,” the U.S. Justice Department (DoJ) said. “These fraudsters engaged in a variety of wire fraud schemes that targeted victims based in the United States, including romance fraud, cyber fraud, tax fraud, financing fraud, and business email compromise schemes, to which victims lost millions of dollars.” The indictment alleged that the defendant and other money mules conducted a series of financial transactions to convert fraud victim funds deposited into their accounts into cryptocurrency and to move those funds into foreign accounts. If convicted, Marcus faces a maximum possible sentence of 100 years’ imprisonment, three years’ supervised release, and a $2 million fine.
• Palo Alto Networks Chose Not to tie TGR-STA-1030 to China — In a report published last week, Reuters said Palo Alto Networks Unit 42 opted not to attribute China to a sprawling cyber espionage campaign dubbed TGR-STA-1030 that it said broke into the networks of at least 70 government and critical infrastructure organizations across 37 countries over the past year. The decision was motivated “over concerns that the cybersecurity company or its clients could face retaliation from Beijing,” the news agency said. It’s worth noting that the campaign exhibits typical hallmarks associated with a typical China-nexus espionage effort, not least because of the use of tools like Behinder, neo-reGeorg, and Godzilla, which have been primarily identified as used by Chinese hacking groups in the past.
• Trend Micro Details New Threat Actor Taxonomy — Trend Micro has outlined a new threat attribution framework that applies standardized evidence scoring, relationship mapping, and bias testing to reduce the risk of misattribution. The naming convention includes Earth for espionage, Water for financially motivated operations, Fire for destructive or disruptive actors, Wind for hacktivists, Aether for unknown motivation, and Void for mixed motivation. “Strong attribution comes from weighing evidence correctly,” Trend Micro said. “Not all evidence carries the same weight, and effective attribution depends on separating high-value intelligence from disposable indicators. Attribution confidence comes from signals that persist over time. Quantifying evidence quality through consistent scoring prevents analysts from overvaluing noise or intuition, helps challenge assumptions, and keeps the focus on signals that genuinely strengthen the overall attribution case rather than isolated data points that do not move it forward.”
• Cryptocurrency Flows to Suspected Human Trafficking Services Surge — Cryptocurrency flows to suspected human trafficking services, largely based in Southeast Asia, grew 85% in 2025, reaching a scale of hundreds of millions across identified services. “This surge in cryptocurrency flows to suspected human trafficking services is not happening in isolation, but is closely aligned with the growth of Southeast Asia–based scam compounds, online casinos and gambling sites, and Chinese-language money laundering (CMLN) and guarantee networks operating largely via Telegram, all of which form a rapidly expanding local illicit ecosystem with global reach and impact,” Chainalysis said.
• Security Flaw in Munge — A high-severity vulnerability has been disclosed in Munge that could allow a local attacker to leak cryptographic key material from process memory, and use it to forge arbitrary Munge credentials to impersonate any user, including root, to services that rely on it for authentication. Munge is an authentication service for creating and validating user credentials that’s designed for use in high-performance computing (HPC) cluster environments. The vulnerability, tracked as CVE-2026-25506 (CVSS score: 7.7), has been present in the codebase for approximately 20 years, per Lexfo. It affects every version up to 0.5.17, and has been addressed in version 0.5.18, released on February 10, 2026. “This vulnerability can be exploited locally to leak the Munge secret key, allowing an attacker to forge arbitrary Munge tokens, valid across the cluster,” Lexfo said. “In a way, this is a local privilege escalation in the context of high-performance computers.”
• New Campaign Distributes Lumma Stealer and Trojanized Chromium-Based Ninja Browser — A large-scale malware campaign has been exploiting trusted Google services, including Google Groups, Google Docs, and Google Drive, to distribute Lumma Stealer and a trojanized Chromium-based Ninja Browser on Windows and Linux systems. The attack chain involves the threat actor embedding malicious download links disguised as software updates, often using URL shorteners, in Google Groups to trick users into installing malware. Central to the attack is the abuse of the inherent trust associated with Google-hosted platforms to bypass conventional security controls and increase the likelihood of successful compromise. “The operation leverages more than 4,000 malicious Google Groups and 3,500 Google-hosted URLs to embed deceptive download links within legitimate-looking discussions, targeting organizations worldwide,” CTM360 said. “The campaign dynamically redirects victims based on the operating system, delivering an oversized, obfuscated Lumma payload to Windows users and a persistence-enabled malicious browser to Linux systems.”
• Disney Agrees to $2.75M Fine for Data Privacy Violations — Walt Disney has agreed to a $2.75 million fine with the U.S. state of California in response to allegations that it broke the state’s privacy law, the California Consumer Protection Act, by making it difficult for consumers to opt out of having their data shared and sold. The company has also agreed to implement opt-out methods that fully stop Disney’s sale or sharing of consumers’ personal information. “Consumers shouldn’t have to go to infinity and beyond to assert their privacy rights,” said California Attorney General Rob Bonta. “California’s nation-leading privacy law is clear: A consumer’s opt-out right applies wherever and however a business sells data — businesses can’t force people to go device-by-device or service-by-service. In California, asking a business to stop selling your data should not be complicated or cumbersome. My office is committed to the continued enforcement of this critical privacy law.”
• Leaked Credentials Exposed Airport Systems to Security Risks — CloudSEK said it discovered login credentials for a European fourth-party airport service portal being circulated on underground forums, potentially allowing threat actors unauthorized access to an unnamed vendor’s Next Generation Operations Support System (NGOSS) systems at approximately 200 airports across multiple countries. “The portal, which served as the central control panel for over 200 client airports, lacked Multi-Factor Authentication (MFA),” CloudSEK said. “No breach occurred — but the potential for one was immediate and severe.”

🔧 Cybersecurity Tools

• SCAM (Security Comprehension Awareness Measure) — It is a benchmark by 1Password that tests how safely AI agents handle sensitive information in real workplace situations. Instead of asking agents to identify obvious scams, it places them inside everyday tasks—email, credentials, web forms—where hidden threats like phishing links and fake domains appear naturally. The goal is to measure whether AI can recognize, avoid, and report risks before damage happens.
• Quantickle — It is a browser-based graph visualization tool designed to help analysts map and explore threat intelligence data. It turns complex relationships—IPs, domains, malware, actors—into interactive network graphs, making patterns, connections, and attack paths easier to see, investigate, and explain.

Disclaimer: These tools are provided for research and educational use only. They are not security-audited and may cause harm if misused. Review the code, test in controlled environments, and comply with all applicable laws and policies.

Conclusion

Taken together, these incidents show how threat activity is spreading across every layer. User tools, enterprise software, cloud infrastructure, and national systems are all in scope. The entry points differ, but the objective stays the same: gain access quietly, then scale impact over time.

The stories above are not isolated alerts. Read as a whole, they outline where pressure is building next and where defenses are most likely to be tested in the weeks ahead.

Ravie LakshmananFeb 16, 2026Vulnerability / Encryption

A new study has found that multiple cloud-based password managers, including Bitwarden, Dashlane, and LastPass, are susceptible to password recovery attacks under certain conditions.

“The attacks range in severity from integrity violations to the complete compromise of all vaults in an organization,” researchers Matteo Scarlata, Giovanni Torrisi, Matilda Backendal, and Kenneth G. Paterson said. “The majority of the attacks allow the recovery of passwords.”

It’s worth noting that the threat actor, per the study from ETH Zurich and Università della Svizzera italiana, supposes a malicious server and aims to examine the password manager’s zero-knowledge encryption (ZKE) promises made by the three solutions. ZKE is a cryptographic technique that allows one party to prove knowledge of a secret to another party without actually revealing the secret itself.

ZKE is also a little different from end-to-end encryption (E2EE). While E2EE refers to a method of securing data in transit, ZKE is mainly about storing data in an encrypted format such that only the person with the key can access that information. Password manager vendors are known to implement ZKE to “enhance” user privacy and security by ensuring that the vault data cannot be tampered with.

However, the latest research has uncovered 12 distinct attacks against Bitwarden, seven against LastPass, and six against Dashlane, ranging from integrity violations of targeted user vaults to a total compromise of all the vaults associated with an organization. Collectively, these password management solutions serve over 60 million users and nearly 125,000 businesses.

“Despite vendors’ attempts to achieve security in this setting, we uncover several common design anti-patterns and cryptographic misconceptions that resulted in vulnerabilities,” the researchers said in an accompanying paper.

• Attacks that exploit the “Key Escrow” account recovery mechanism to compromise the confidentiality guarantees of Bitwarden and LastPass, resulting from vulnerabilities in their key escrow designs.
• Attacks that exploit flawed item-level encryption — i.e., encrypting data items and sensitive user settings as separate objects and often combine with unencrypted or unauthenticated metadata, to result in integrity violations, metadata leakage, field swapping, and key derivation function (KDF) downgrade.
• Attacks that exploit sharing features to compromise vault integrity and confidentiality.
• Attacks that exploit backwards compatibility with legacy code that result in downgrade attacks in Bitwarden and Dashlane.

The study also found that 1Password, another popular password manager, is vulnerable to both item-level vault encryption and sharing attacks. However, 1Password has opted to treat them as arising from already known architectural limitations.

Summary of attacks (BW stands for Bitwarden, LP for LastPass, and DL for Dashlane)

When reached for comment, Jacob DePriest, Chief Information Security Officer and Chief Information Officer at 1Password, told The Hacker News that the company’s security reviewed the paper in detail and found no new attack vectors beyond those already documented in its publicly available Security Design White Paper.

“We are committed to continually strengthening our security architecture and evaluating it against advanced threat models, including malicious-server scenarios like those described in the research, and evolving it over time to maintain the protections our users rely on,” DePriest added.

“For example, 1Password uses Secure Remote Password (SRP) to authenticate users without transmitting encryption keys to our servers, helping mitigate entire classes of server-side attacks. More recently, we introduced a new capability for enterprise-managed credentials, which from the start are created and secured to withstand sophisticated threats.”

As for the rest, Bitwarden, Dashlane, and LastPass have all implemented countermeasures to mitigate the risks highlighted in the research, with LastPass also planning to harden its admin password reset and sharing workflows to counter the threat posed by a malicious intermediary. There is no evidence that any of these issues has been exploited in the wild.

Specifically, Dashlane has patched an issue where a successful compromise of its servers could have allowed a downgrade of the encryption model used to generate encryption keys and protect user vaults. The issue was fixed by removing support for legacy cryptography methods with Dashlane Extension version 6.2544.1 released in November 2025.

“This downgrade could result in the compromise of a weak or easily guessable Master Password, and the compromise of individual ‘downgraded’ vault items,” Dashlane said. “This issue was the result of the allowed use of legacy cryptography. This legacy cryptography was supported by Dashlane in certain cases for backwards compatibility and migration flexibility.”

Bitwarden said all identified issues are being addressed. “Seven of which have been resolved or are in active remediation by the Bitwarden team,” it said. “The remaining three issues have been accepted as intentional design decisions necessary for product functionality.”

In a similar advisory, LastPass said it’s “actively working to add stronger integrity guarantees to better cryptographically bind items, fields, and metadata, thereby helping to maintain integrity assurance.”

Ravie LakshmananFeb 16, 2026Artificial Intelligence / Threat Intelligence

Cybersecurity researchers disclosed they have detected a case of an information stealer infection successfully exfiltrating a victim’s OpenClaw (formerly Clawdbot and Moltbot) configuration environment.

“This finding marks a significant milestone in the evolution of infostealer behavior: the transition from stealing browser credentials to harvesting the ‘souls’ and identities of personal AI [artificial intelligence] agents,” Hudson Rock said.

Alon Gal, CTO of Hudson Rock, told The Hacker News that the stealer was likely a variant of Vidar based on the infection details. Vidar is an off-the-shelf information stealer that’s known to be active since late 2018.

That said, the cybersecurity company said the data capture was not facilitated by a custom OpenClaw module within the stealer malware, but rather through a “broad file-grabbing routine” that’s designed to look for certain file extensions and specific directory names containing sensitive data.

This included the following files –

• openclaw.json, which contains details related to the OpenClaw gateway token, along with the victim’s redacted email address and workspace path.
• device.json, which contains cryptographic keys for secure pairing and signing operations within the OpenClaw ecosystem.
• soul.md, which contains details of the agent’s core operational principles, behavioral guidelines, and ethical boundaries.

“While the malware may have been looking for standard ‘secrets,’ it inadvertently struck gold by capturing the entire operational context of the user’s AI assistant,” Hudson Rock added. “As AI agents like OpenClaw become more integrated into professional workflows, infostealer developers will likely release dedicated modules specifically designed to decrypt and parse these files, much like they do for Chrome or Telegram today.”

The disclosure comes as security issues with OpenClaw prompted the maintainers of the open-source agentic platform to announce a partnership with VirusTotal to scan for malicious skills uploaded to ClawHub, establish a threat model, and add the ability to audit for potential misconfigurations.

Last week, the OpenSourceMalware team detailed an ongoing ClawHub malicious skills campaign that uses a new technique to bypass VirusTotal scanning by hosting the malware on lookalike OpenClaw websites and using the skills purely as decoys, instead of embedding the payload directly in their SKILL.md files.

“The shift from embedded payloads to external malware hosting shows threat actors adapting to detection capabilities,” security researcher Paul McCarty said. “As AI skill registries grow, they become increasingly attractive targets for supply chain attacks.”

Another security problem highlighted by OX Security concerns Moltbook, a Reddit-like internet forum designed exclusively for artificial intelligence agents, mainly those running on OpenClaw. The research found that an AI Agent account, once created on Moltbook, cannot be deleted. This means that users who wish to delete the accounts and remove the associated data have no recourse.

What’s more, an analysis published by SecurityScorecard’s STRIKE Threat Intelligence team has also found hundreds of thousands of exposed OpenClaw instances, likely exposing users to remote code execution (RCE) risks.

Fake OpenClaw Website Serving Malware

“RCE vulnerabilities allow an attacker to send a malicious request to a service and execute arbitrary code on the underlying system,” the cybersecurity company said. “When OpenClaw runs with permissions to email, APIs, cloud services, or internal resources, an RCE vulnerability can become a pivot point. A bad actor does not need to break into multiple systems. They need one exposed service that already has authority to act.”

OpenClaw has had a viral surge in interest since it first debuted in November 2025. As of writing, the open-source project has more than 200,000 stars on GitHub. On February 15, 2026, OpenAI CEO Sam Altman said OpenClaw’s founder, Peter Steinberger, would be joining the AI company, adding, “OpenClaw will live in a foundation as an open source project that OpenAI will continue to support.”

Ravie LakshmananFeb 16, 2026Zero-Day / Browser Security

Google on Friday released security updates for its Chrome browser to address a security flaw that it said has been exploited in the wild.

The high-severity vulnerability, tracked as CVE-2026-2441 (CVSS score: 8.8), has been described as a use-after-free bug in CSS. Security researcher Shaheen Fazim has been credited with discovering and reporting the shortcoming on February 11, 2026.

“Use after free in CSS in Google Chrome prior to 145.0.7632.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page,” according to a description of the flaw in the NIST’s National Vulnerability Database (NVD).

Google did not disclose any details about how the vulnerability is being exploited in the wild, by whom, or who may have been targeted, but it acknowledged that “an exploit for CVE-2026-2441 exists in the wild.”

While Google Chrome is no stranger to actively exploited vulnerabilities, the development once again highlights how browser-based flaws are an attractive target for malicious actors, given that they are installed everywhere and expose a broad attack surface.

The disclosure of CVE-2026-2441 makes it the first actively exploited zero-day in Chrome that Google has patched in 2026. Last year, the tech giant addressed eight zero-day flaws in Chrome that were either actively exploited or demonstrated as a proof-of-concept (PoC).

Last week, Apple also shipped iOS, iPadOS, macOS Tahoe, tvOS, watchOS, and visionOS updates to address a zero-day flaw (CVE-2026-20700, CVSS score: 7.8) that had been weaponized as a zero-day to execute arbitrary code on susceptible devices as part of an “extremely sophisticated attack” targeting specific individuals who were running iOS versions before iOS 26.

For optimal protection, users are advised to update their Chrome browser to versions 145.0.7632.75/76 for Windows and Apple macOS, and 144.0.7559.75 for Linux. To make sure the latest updates are installed, users can navigate to More > Help > About Google Chrome and select Relaunch.

Users of other Chromium-based browsers, such as Microsoft Edge, Brave, Opera, and Vivaldi, are also advised to apply the fixes as and when they become available.

Cybersecurity researchers have disclosed details of a new mobile spyware platform dubbed ZeroDayRAT that’s being advertised on Telegram as a way to grab sensitive data and facilitate real-time surveillance on Android and iOS devices.

“The developer runs dedicated channels for sales, customer support, and regular updates, giving buyers a single point of access to a fully operational spyware panel,” Daniel Kelley, security researcher at iVerify, said. “The platform goes beyond typical data collection into real-time surveillance and direct financial theft.”

ZeroDayRAT is designed to support Android versions 5 through 16 and iOS versions up to 26. It’s assessed that the malware is distributed via social engineering or fake app marketplaces. The malicious binaries are generated through a builder that’s provided to buyers along with an online panel that they can set up on their own server.

Once the malware infects a device, the operator gets to see all the details, including model, location, operating system, battery status, SIM, carrier details, app usage, notifications, and a preview of recent SMS messages, through a self-hosted panel. This information allows the threat actor to profile the victim and glean more about who they talk to and the apps they use the most.

The panel also extracts their current GPS coordinates and plots them on Google Maps, along with the history of all locations they have been to over time, effectively turning it into spyware.

“One of the more problematic panels is the accounts tab,” Kelley added. “Every account registered on the device is enumerated: Google, WhatsApp, Instagram, Facebook, Telegram, Amazon, Flipkart, PhonePe, Paytm, Spotify, and more, each with its associated username or email.”

Some of the other capabilities of ZeroDayRAT include logging keystrokes, gathering SMS messages — including one-time passwords (OTPs) to defeat two-factor authentication, as well as allowing hands-on operations, such as activating real-time surveillance via live camera streaming and a microphone feed that allows the adversary to remotely monitor a victim.

To enable financial theft, the malware incorporates a stealer component that scans for wallet apps like MetaMask, Trust Wallet, Binance, and Coinbase, and substitutes wallet addresses copied to the clipboard to reroute transactions to a wallet under the attacker’s control.

There also exists a bank stealer module to target online mobile wallet platforms like Apple Pay, Google Pay, PayPal, along with PhonePe, an Indian digital payments application that allows instant money transfers with the Unified Payments Interface (UPI), a protocol to facilitate inter-bank peer-to-peer and person-to-merchant transactions.

“Taken together, this is a complete mobile compromise toolkit, the kind that used to require nation-state investment or bespoke exploit development, now sold on Telegram,” Kelley said. “A single buyer gets full access to a target’s location, messages, finances, camera, microphone, and keystrokes from a browser tab. Cross-platform support and active development make it a growing threat to both individuals and organizations.”

The ZeroDayRAT malware is similar to numerous others that have targeted mobile device users, either via phishing or by infiltrating official app marketplaces. Over the past few years, bad actors have repeatedly managed to find various ways to bypass security protections put in place by Apple and Google to trick users into installing malicious apps.

Attacks targeting Apple’s iOS have typically leveraged an enterprise provisioning capability that allows organizations to install apps without the need for publishing them to the App Store. By marketing tools that combine spyware, surveillance, and information-stealing capabilities, they further lower the barrier of entry for less skilled hackers. They also highlight the evolving sophistication and persistence of mobile-focused cyber threats.

News of the commercial spyware platform coincides with the emergence of various mobile malware and scam campaigns that have come to light in recent weeks –

• An Android remote access trojan (RAT) campaign has used Hugging Face to host and distribute malicious APK files. The infection chain begins when users download a seemingly harmless dropper app (e.g., TrustBastion) that, when opened, prompts users to install an update, which causes the app to download the APK file hosted on Hugging Face. The malware then requests accessibility permissions and access to other sensitive controls to enable surveillance and credential theft.
• An Android RAT called Arsink has been found to use Google Apps Script for media and file exfiltration to Google Drive, in addition to relying on Firebase and Telegram for C2. The malware, which allows data theft and complete remote control, is distributed via Telegram, Discord, and MediaFire links, while impersonating various popular brands. Arsink infections have been concentrated in Egypt, Indonesia, Iraq, Yemen, and Türkiye.
• A document reader app named All Document Reader (package name: com.recursivestd.highlogic.stellargrid) uploaded to the Google Play Store has been flagged for acting as an installer for the Anatsa (aka TeaBot and Toddler) banking trojan. The app attracted over 50,000 downloads before it was taken down.
• An Android banking trojan called deVixor has been actively targeting Iranian users through phishing websites that impersonate legitimate automotive businesses since October 2025. Besides harvesting sensitive information, the malware includes a remotely triggered ransomware module capable of locking devices and demanding cryptocurrency payments. It uses Google Firebase for command delivery and Telegram-based bot infrastructure for administration.
• A malicious campaign codenamed ShadowRemit has exploited fake Android apps and pages mimicking Google Play app listings to enable unlicensed cross-border money transfers. These bogus pages have been found to promote unauthorized APKs as trusted remittance services with zero fees and improved exchange rates. “Victims are instructed to send payments to beneficiary accounts/eWallet endpoints and provide transaction screenshots as proof for verification,” CTM360 said. “This approach can bypass regulated remittance corridors and aligns with mule-account collection patterns.”
• An Android malware campaign targeting users in India has abused the trust associated with government services and official digital platforms to distribute malicious APK files through WhatsApp, leading to the deployment of malware that can steal data, establish persistent control, and run a cryptocurrency miner.
• The operators of an Android trojan and cybercrime tool called Triada have been observed using phishing landing pages disguised as Chrome browser updates to trick users into downloading malicious APK files hosted on GitHub. According to an analysis by Alex, attackers are “actively taking over long-standing, fully verified advertiser accounts to distribute malicious redirects.”
• A WhatApp-oriented scam campaign has leveraged video calls, in which the threat actor poses as a bank representative or a Meta support and instructs them to share their phone’s screen to address a purported unauthorized charge on their credit card, and install a legitimate remote access app, such as AnyDesk or TeamViewer, to steal sensitive data.
• An Android spyware campaign has leveraged romance scam tactics to target individuals in Pakistan to distribute a malicious dating chat app dubbed GhostChat to exfiltrate victims’ data. It’s currently not known how the malware is distributed. The threat actors behind the operation are also suspected to be running a ClickFix attack that infects victims’ computers with a DLL payload that can gather system metadata and run commands issued by an external server, as well as a WhatsApp device-linking attack called GhostPairing to gain access to their WhatsApp accounts.
• A new family of Android click fraud trojans called Phantom has been found to leverage TensorFlow.js, a JavaScript machine learning library, to automatically detect and interact with specific advertisement elements on a site loaded in a hidden WebView. An alternative “signaling” mode uses WebRTC to stream a live video feed of the virtual browser screen to the attackers’ server and allow them to click, scroll, or enter text. The malware is distributed via mobile games published to Xiaomi’s GetApps store and other unofficial, third-party app stores.
• An Android malware family called NFCShare has been distributed via a Deutsche Bank phishing campaign to deceive users into installing a malicious APK file (“deutsche.apk”) under the pretext of an update, which reads NFC card data and exfiltrates it to a remote WebSocket endpoint. The malware shares similarities with NFC relay malware families like NGate, ZNFC, SuperCard X, PhantomCard, and RelayNFC, with its command-and-control (C2) server previously flagged as associated with SuperCard X activity in November 2025.

In a report published last month, Group-IB said it has witnessed a surge in NFC-enabled Android tap-to-pay malware, most of which is advertised within Chinese cybercrime communities on Telegram. The NFC-based relay technique is also referred to as Ghost Tap.

“At least $355,000 in illegitimate transactions have been recorded from one POS vendor alone throughout November 2024 – August 2025,” the Singapore-headquartered cybersecurity company said. “In another observed scenario, mobile wallets preloaded with compromised cards are used by mules across the globe to make purchases.”

Group-IB also said it identified three major vendors of Android NFC relay apps, including TX-NFC, X-NFC, and NFU Pay, with TX-NFC amassing over 25,000 subscribers on Telegram since commencing operations in early January 2025. X-NFC and NFU Pay have more than 5,000 and 600 subscribers on the messaging platform, respectively.

The end goal of these attacks is to trick victims into installing NFC-enabled malware and tapping their physical payment cards on their smartphone, causing the transaction data to be captured and relayed to the cybercriminal’s device through an attacker-controlled server. This is achieved by means of a dedicated app installed on the money mule’s device to complete payments or cash-out as though the victims’ cards were physically present.

Calling tap-to-pay scams a growing concern, Group-IB said it observed a steady increase in the detection of malware artifacts between May 2024 and December 2025. “At the same time, different families and variants are also appearing, while the old ones remain active,” it added. “This indicates the spread of this technology among fraudsters.”

Microsoft has disclosed details of a new version of the ClickFix social engineering tactic in which the attackers trick unsuspecting users into running commands that carry out a Domain Name System (DNS) lookup to retrieve the next-stage payload.

Specifically, the attack relies on using the “nslookup” (short for nameserver lookup) command to execute a custom DNS lookup triggered via the Windows Run dialog.

ClickFix is an increasingly popular technique that’s traditionally delivered via phishing, malvertising, or drive-by download schemes, often redirecting targets to bogus landing pages that host fake CAPTCHA verification or instructions to address a non-existent problem on their computers by running a command either through the Windows Run dialog or the macOS Terminal app.

The attack method has become widespread over the past two years since it hinges on the victims infecting their own machines with malware, thereby allowing the threat actors to bypass security controls. The effectiveness of ClickFix has been such that it has spawned several variants, such as FileFix, JackFix, ConsentFix, CrashFix, and GlitchFix.

“In the latest DNS-based staging using ClickFix, the initial command runs through cmd.exe and performs a DNS lookup against a hard-coded external DNS server, rather than the system’s default resolver,” the Microsoft Threat Intelligence team said in a series of posts on X. “The output is filtered to extract the `Name:` DNS response, which is executed as the second-stage payload.”

Microsoft said this new variation of ClickFix uses DNS as a “lightweight staging or signaling channel,” enabling the threat actor to reach infrastructure under their control, as well as erect a new validation layer before executing the second-stage payload.

“Using DNS in this way reduces dependency on traditional web requests and can help blend malicious activity into normal network traffic,” the Windows maker added.

The downloaded payload subsequently initiates an attack chain that leads to the download of a ZIP archive from an external server (“azwsappdev[.]com”), from which a malicious Python script is extracted and run to conduct reconnaissance, run discovery commands, and drop a Visual Basic Script (VBScript) responsible for launching ModeloRAT, a Python-based remote access trojan previously distributed through CrashFix.

The disclosure comes as Bitdefender warned of a surge in Lumma Stealer activity, driven by ClickFix-style fake CAPTCHA campaigns that deploy an AutoIt-version of CastleLoader, a malware loader associated with a threat actor codenamed GrayBravo (formerly TAG-150).

CastleLoader incorporates checks to determine the presence of virtualization software and specific security programs before decrypting and launching the stealer malware in memory. Outside of ClickFix, websites advertising cracked software and pirated movies serve as bait for CastleLoader-based attack chains, deceiving users into downloading rogue installers or executables masquerading as MP4 media files.

Other CastleLoader campaigns have also leveraged websites promising cracked software downloads as a starting point to distribute a fake NSIS installer that also runs obfuscated VBA scripts prior to running the AutoIt script that loads Lumma Stealer. The VBA loader is designed to run scheduled tasks responsible for ensuring persistence.

“Despite significant law enforcement disruption efforts in 2025, Lumma Stealer operations continued, demonstrating resilience by rapidly migrating to new hosting providers and adapting alternative loaders and delivery techniques,” the Romanian cybersecurity company said. “At the core of many of these campaigns is CastleLoader, which plays a central role in helping LummaStealer spread through delivery chains.”

Interestingly, one of the domains on CastleLoader’s infrastructure (“testdomain123123[.]shop”) was flagged as a Lumma Stealer command-and-control (C2), indicating that the operators of the two malware families are either working together or sharing service providers. The majority of Lumma Stealer infections have been recorded in India, followed by France, the U.S., Spain, Germany, Brazil, Mexico, Romania, Italy, and Canada.

“The effectiveness of ClickFix lies in its abuse of procedural trust rather than technical vulnerabilities,” Bitdefender said. “The instructions resemble troubleshooting steps or verification workarounds that users may have encountered previously. As a result, victims often fail to recognize that they are manually executing arbitrary code on their own system.”

CastleLoader is not the only loader that’s being used to distribute Lumma Stealer. Campaigns observed as early as March 2025 have leveraged another loader dubbed RenEngine Loader, with the malware propagated under the guise of game cheats and pirated software like CorelDRAW graphics editor. In these attacks, the loader makes way for a secondary loader named Hijack Loader, which then deploys Lumma Stealer.

According to data from Kaspersky, RenEngine Loader attacks have primarily affected users in Russia, Brazil, Turkey, Spain, Germany, Mexico, Algeria, Egypt, Italy, and France since March 2025.

The developments coincide with the emergence of various campaigns using social engineering lures, including ClickFix, to deliver a variety of stealers and malware loaders –

• A macOS campaign that has used phishing and malvertising ploys to deliver Odyssey Stealer, a rebrand of Poseidon Stealer, which itself is a fork of Atomic macOS Stealer (AMOS). The stealer exfiltrates credentials and data from 203 browser wallet extensions and 18 desktop wallet applications to facilitate cryptocurrency theft.
• “Beyond credential theft, Odyssey operates as a full remote access trojan,” Censys said. “A persistent LaunchDaemon polls the C2 every 60 seconds for commands, supporting arbitrary shell execution, reinfection, and a SOCKS5 proxy for tunneling traffic through victim machines.”
• A ClickFix attack chain targeting Windows systems that uses fake CAPTCHA verification pages on legitimate-but-compromised websites to trick users into executing PowerShell commands that deploy the StealC information stealer.
• An email phishing campaign that uses a malicious SVG file contained within a password‑protected ZIP archive to instruct the victim to run a PowerShell command using ClickFix, ultimately resulting in the deployment of an open-source .NET infostealer called Stealerium.
• A campaign that exploits the public sharing feature of generative artificial intelligence (AI) services like Anthropic Claude to stage malicious ClickFix instructions on how to perform a variety of tasks on macOS (e.g., “online DNS resolver”), and distribute these links via sponsored results on search engines like Google to deploy Atomic Stealer and MacSync Stealer.
• A campaign that directs users searching for “macOS cli disk space analyzer” to a fake Medium article impersonating Apple’s Support Team to deceive them into running ClickFix instructions that deliver next-stage stealer payloads from an external server “raxelpak[.]com.”
• “The C2 domain raxelpak[.]com has URL history going back to 2021, when it appeared to host a safety workwear e-commerce site,” MacPaw’s Moonlock Lab said. “Whether the domain was hijacked or simply expired and re-registered by the [threat actor] is unclear, but it fits the broader pattern of leveraging aged domains with existing reputation to avoid detection.”
• A variation of the same campaign that stages ClickFix instructions for supposedly installing Homebrew on links associated with Claude and Evernote through sponsored results to install stealer malware.
• “The ad shows a real, recognized domain (claude.ai), not a spoof or typo-squatted site,” AdGuard said. “Clicking the ad leads to a real Claude page, not a phishing copy. The consequence is clear: Google Ads + a well-known trusted platform + technical users with high downstream impact = a potent malware distribution vector.”
• A macOS email phishing campaign that prompts recipients to download and run an AppleScript file to address supposed compatibility issues, resulting in the deployment of another AppleScript designed to steal credentials and retrieve additional JavaScript payloads.
• “The malware does not grant permissions to itself; instead, it forges TCC authorizations for trusted Apple-signed binaries (Terminal, osascript, Script Editor, and bash) and then executes malicious actions through these binaries to inherit their permissions,” Darktrace said.
• A ClearFake campaign that employs fake CAPTCHA lures on compromised WordPress sites to trigger the execution of an HTML Application (HTA) file and deploy Lumma Stealer. The campaign is also known to use malicious JavaScript injections to take advantage of a technique known as EtherHiding to execute a contract hosted on the BNB Smart Chain and fetch an unknown payload hosted on GitHub.
• EtherHiding offers attackers several advantages, allowing malicious traffic to blend with legitimate Web3 activity. Because blockchain is immutable and decentralized, it offers increased resilience in the face of takedown efforts.

A recent analysis published by Flare has found that threat actors are increasingly targeting Apple macOS with infostealers and sophisticated tools.

“Nearly every macOS stealer prioritizes cryptocurrency theft above all else,” the company said. “This laser focus reflects economic reality. Cryptocurrency users disproportionately use Macs. They often hold significant value in software wallets. Unlike bank accounts, crypto transactions are irreversible. Once seed phrases are compromised, funds disappear permanently with no recourse.”

“The ‘Macs don’t get viruses’ assumption is not just outdated but actively dangerous. Organizations with Mac users need detection capabilities for macOS-specific TTPs: unsigned applications requesting passwords, unusual Terminal activity, connections to blockchain nodes for non-financial purposes, and data exfiltration patterns targeting Keychain and browser storage.”

Cybersecurity researchers have discovered a malicious Google Chrome extension that’s designed to steal data associated with Meta Business Suite and Facebook Business Manager.

The extension, named CL Suite by @CLMasters (ID: jkphinfhmfkckkcnifhjiplhfoiefffl), is marketed as a way to scrape Meta Business Suite data, remove verification pop-ups, and generate two-factor authentication (2FA) codes. The extension has 33 users as of writing. It was first uploaded to the Chrome Web Store on March 1, 2025.

However, the browser add-on also exfiltrates TOTP codes for Facebook and Meta Business accounts, Business Manager contact lists, and analytics data to infrastructure controlled by the threat actor, Socket said.

“The extension requests broad access to meta.com and facebook.com and claims in its privacy policy that 2FA secrets and Business Manager data remain local,” security researcher Kirill Boychenko said.

“In practice, the code transmits TOTP seeds and current one-time security codes, Meta Business ‘People’ CSV exports, and Business Manager analytics data to a backend at getauth[.]pro, with an option to forward the same payloads to a Telegram channel controlled by the threat actor.”

By targeting users of Meta Business Suite and Facebook Business Manager, the threat actor behind the operation has leveraged the extension to conduct data collection and exfiltration without users’ knowledge or consent.

While the extension does not have capabilities to steal password-related information, the attacker could obtain such information beforehand from other sources, such as infostealer logs or credential dumps, and then use the stolen codes to gain unauthorized access to victims’ accounts.

The full scope of the malicious add-on’s capabilities is listed below –

The disclosure comes as Koi Security found that about 500,000 VKontakte users have had their accounts silently hijacked through Chrome extensions masquerading as VK customization tools. The large-scale campaign has been codenamed VK Styles.

The malware embedded in the extensions is designed to engage in active account manipulation by automatically subscribing users to the attacker’s VK groups, resetting account settings every 30 days to override user preferences, manipulating Cross-Site Request Forgery (CSRF) tokens to bypass VK’s security protections, and maintaining persistent control.

The activity has been traced to a threat actor operating under the GitHub username 2vk, who has relied on VK’s own social network to distribute malicious payloads and build a follower base through forced subscriptions. The names of the extensions are listed below –

• VK Styles – Themes for vk.com (ID: ceibjdigmfbbgcpkkdpmjokkokklodmc)
• VK Music – audio saver (ID: mflibpdjoodmoppignjhciadahapkoch)
• Music Downloader – VKsaver (ID: lgakkahjfibfgmacigibnhcgepajgfdb)
• vksaver – music saver vk (ID: bndkfmmbidllaiccmpnbdonijmicaafn)
• VKfeed – Download Music and Video from VK (ID: pcdgkgbadeggbnodegejccjffnoakcoh)

One of the defining traits of the campaign is the use of a VK profile’s (“vk[.]com/m0nda”) HTML metadata tags as a dead drop resolver to conceal the next-stage payload URLs and, therefore, evade detection. The next-stage payload is hosted in a public repository named “-” that’s associated with 2vk. Present in the payload is obfuscated JavaScript that’s injected into every VK page the victim visits.

The repository is still accessible as of writing, with the file, simply named “C,” receiving a total of 17 commits between June 2025 and January 2026, as the operator refined and added new functionality.

“Each commit shows deliberate refinement,” security researcher Ariel Cohen said. “This isn’t sloppy malware – it’s a maintained software project with version control, testing, and iterative improvements.”

VK Styles has primarily affected Russian-speaking users, who are VK’s main demographic, as well as users across Eastern Europe, Central Asia, and Russian diaspora communities globally. The campaign is assessed to be active since at least June 22, 2025, when the initial version of the payload was pushed to the “-” repository.

Fake AI Chrome Extensions Steal Credentials, Emails

The findings also coincide with the discovery of another coordinated campaign dubbed AiFrame, where a cluster of 32 browser add-ons advertised as artificial intelligence (AI) assistants for summarization, chat, writing, and Gmail assistance are being used to siphon sensitive data. These extensions have been collectively installed by more than 260,000 users.

“While these tools appear legitimate on the surface, they hide a dangerous architecture: instead of implementing core functionality locally, they embed remote, server-controlled interfaces inside extension-controlled surfaces and act as privileged proxies, granting remote infrastructure access to sensitive browser capabilities,” LayerX researcher Natalie Zargarov said. 

The names of the malicious extensions are as follows –

• AI Assistant (ID: nlhpidbjmmffhoogcennoiopekbiglbp)
• Llama (ID: gcfianbpjcfkafpiadmheejkokcmdkjl)
• Gemini AI Sidebar (ID: fppbiomdkfbhgjjdmojlogeceejinadg)
• AI Sidebar (ID: djhjckkfgancelbmgcamjimgphaphjdl)
• ChatGPT Sidebar (ID: llojfncgbabajmdglnkbhmiebiinohek)
• AI Sidebar (ID: gghdfkafnhfpaooiolhncejnlgglhkhe)
• Grok (ID: cgmmcoandmabammnhfnjcakdeejbfimn)
• Asking Chat Gpt (ID: phiphcloddhmndjbdedgfbglhpkjcffh)
• ChatGBT (ID: pgfibniplgcnccdnkhblpmmlfodijppg)
• Chat Bot GPT (ID: nkgbfengofophpmonladgaldioelckbe)
• Grok Chatbot (ID: gcdfailafdfjbailcdcbjmeginhncjkb)
• Chat With Gemini (ID: ebmmjmakencgmgoijdfnbailknaaiffh)
• XAI (ID: baonbjckakcpgliaafcodddkoednpjgf)
• Google Gemini (ID: fdlagfnfaheppaigholhoojabfaapnhb)
• Ask Gemini (ID: gnaekhndaddbimfllbgmecjijbbfpabc)
• AI Letter Generator (ID: hgnjolbjpjmhepcbjgeeallnamkjnfgi)
• AI Message Generator (ID: lodlcpnbppgipaimgbjgniokjcnpiiad)
• AI Translator (ID: cmpmhhjahlioglkleiofbjodhhiejhei)
• AI For Translation (ID: bilfflcophfehljhpnklmcelkoiffapb)
• AI Cover Letter Generator (ID: cicjlpmjmimeoempffghfglndokjihhn)
• AI Image Generator Chat GPT (ID: ckneindgfbjnbbiggcmnjeofelhflhaj)
• Ai Wallpaper Generator (ID: dbclhjpifdfkofnmjfpheiondafpkoed)
• Ai Picture Generator (ID: ecikmpoikkcelnakpgaeplcjoickgacj)
• DeepSeek Download (ID: kepibgehhljlecgaeihhnmibnmikbnga)
• AI Email Writer (ID: ckicoadchmmndbakbokhapncehanaeni)
• Email Generator AI (ID: fnjinbdmidgjkpmlihcginjipjaoapol)
• DeepSeek Chat (ID: gohgeedemmaohocbaccllpkabadoogpl)
• ChatGPT Picture Generator (ID: flnecpdpbhdblkpnegekobahlijbmfok)
• ChatGPT Translate (ID: acaeafediijmccnjlokgcdiojiljfpbe)
• AI GPT (ID: kblengdlefjpjkekanpoidgoghdngdgl)
• ChatGPT Translation (ID: idhknpoceajhnjokpnbicildeoligdgh)
• Chat GPT for Gmail (ID: fpmkabpaklbhbhegegapfkenkmpipick)

Once installed, these extensions render a full-screen iframe overlay pointing to a remote domain (“claude.tapnetic[.]pro”), allowing the attackers to remotely introduce new capabilities without requiring a Chrome Web Store update. When instructed by the iframe, the add-ons query the active browser tab and invoke a content script to extract readable article content using Mozilla’s Readability library.

The malware also supports the capability to start speech recognition and exfiltrate the resulting transcript to the remote page. What’s more, a smaller set of the extensions contain functionality to specifically target Gmail by reading visible email content directly from the document object model (DOM) when a victim visits mail.google[.]com.

“When Gmail-related features such as AI-assisted replies or summaries are invoked, the extracted email content is passed into the extension’s logic and transmitted to third-party backend infrastructure controlled by the extension operator,” LayerX said. “As a result, email message text and related contextual data may be sent off-device, outside of Gmail’s security boundary, to remote servers.”

287 Chrome Extensions Exfiltrate Browsing History

The developments show how web browser extensions are increasingly being abused by bad actors to harvest and exfiltrate sensitive data by passing them off as seemingly legitimate tools and utilities.

A report published by Q Continuum last week found a huge collection of 287 Chrome extensions that exfiltrate browsing history to data brokers. These extensions have 37.4 million installations, representing roughly 1% of the global Chrome userbase.

“It was shown in the past that Chrome extensions are used to exfiltrate user browser history that is then collected by data brokers such as Similarweb and Alexa,” the researcher said.

Given the risks involved, users are recommended to adopt a minimalist approach by only installing necessary, well-reviewed tools from official stores. It’s also essential to periodically audit installed extensions for any signs of malicious behavior or excessive permission requests.

Other ways that users and organizations can ensure greater security include using separate browser profiles for sensitive tasks and implementing extension allowlisting to block those that are malicious or non-compliant.

Ravie LakshmananFeb 13, 2026Malware / Critical Infrastructure

Several state-sponsored actors, hacktivist entities, and criminal groups from China, Iran, North Korea, and Russia have trained their sights on the defense industrial base (DIB) sector, according to findings from Google Threat Intelligence Group (GTIG).

The tech giant’s threat intelligence division said the adversarial targeting of the sector is centered around four key themes: striking defense entities deploying technologies on the battlefield in the Russia-Ukraine War, directly approaching employees and exploitation of the hiring process by North Korean and Iranian actors, use of edge devices and appliances as initial access pathways for China-nexus groups, and supply chain risk stemming from the breach of the manufacturing sector.

“Many of the chief state-sponsors of cyber espionage and hacktivist actors have shown an interest in autonomous vehicles and drones, as these platforms play an increasing role in modern warfare,” GTIG said. “Further, the ‘evasion of detection’ trend […] continues, as actors focus on single endpoints and individuals, or carry out intrusions in a manner that seeks to avoid endpoint detection and response (EDR) tools altogether.”

Some of the notable threat actors that have participated in the activity include –

• APT44 (aka Sandworm) has attempted to exfiltrate information from Telegram and Signal encrypted messaging applications, likely after securing physical access to devices obtained during on-ground operations in Ukraine. This includes the use of a Windows batch script called WAVESIGN to decrypt and exfiltrate data from Signal’s desktop app.
• TEMP.Vermin (aka UAC-0020) has used malware like VERMONSTER, SPECTRUM (aka SPECTR), and FIRMACHAGENT using lure content revolving around drone production and development, anti-drone defense systems, and video surveillance security systems.
• UNC5125 (aka FlyingYeti and UAC-0149) has conducted highly targeted campaigns focusing on frontline drone units. It has used a questionnaire hosted on Google Forms to conduct reconnaissance against prospective drone operators, and distributed via messaging apps malware like MESSYFORK (aka COOKBOX) to an Unmanned Aerial Vehicle (UAV) operator based in Ukraine.
• UNC5125 is also said to have leveraged an Android malware called GREYBATTLE, a bespoke version of the Hydra banking trojan, to steal credentials and data by distributing it via a website spoofing a Ukrainian military artificial intelligence company.
• UNC5792 (aka UAC-0195) has exploited secure messaging apps to target Ukrainian military and government entities, as well as individuals and organizations in Moldova, Georgia, France, and the U.S. The threat actor is notable for weaponizing Signal’s device linking feature to hijack victim accounts.
• UNC4221 (aka UAC-0185) has also targeted secure messaging apps used by Ukrainian military personnel, using tactics similar to UNC5792. The threat actor has also leveraged an Android malware called STALECOOKIE that mimics Ukraine’s battlefield management platform DELTA to steal browser cookies. Another tactic employed by the group is the use of ClickFix to deliver the TINYWHALE downloader that, in turn, drops the MeshAgent remote management software.
• UNC5976, a Russian espionage cluster that has conducted a phishing campaign delivering malicious RDP connection files that are configured to communicate with actor-controlled domains mimicking a Ukrainian telecommunications company.
• UNC6096, a Russian espionage cluster that has conducted malware delivery operations via WhatsApp using DELTA-related themes to deliver a malicious LNK shortcut within an archive file that downloads a secondary payload. Attacks aimed at Android devices have been found to deliver malware called GALLGRAB that collects locally stored files, contact information, and potentially encrypted user data from specialized battlefield applications.
• UNC5114, a suspected Russian espionage cluster that has delivered a variant of an off-the-shelf Android malware called CraxsRAT by masquerading it as an update for Kropyva, a combat control system used in Ukraine.
• APT45 (aka Andariel) has targeted South Korean defense, semiconductor, and automotive manufacturing entities with SmallTiger malware.
• APT43 (aka Kimsuky) has likely leveraged infrastructure mimicking German and U.S. defense-related entities to deploy a backdoor called THINWAVE.
• UNC2970 (aka Lazarus Group) has conducted the Operation Dream Job campaign to target aerospace, defense, and energy sectors, in addition to relying on artificial intelligence (AI) tools to conduct reconnaissance on its targets.
• UNC1549 (aka Nimbus Manticore) has targeted aerospace, aviation, and defense industries in the Middle East with malware families like MINIBIKE, TWOSTROKE, DEEPROOT, and CRASHPAD. The group is known to orchestrate Lazarus Group-style Dream Job campaigns to trick users into executing malware or giving up credentials under the guise of legitimate employment opportunities.
• UNC6446, an Iranian-nexus threat actor that has used resume builder and personality test applications to distribute custom malware to targets in the aerospace and defense vertical across the U.S. and the Middle East.
• APT5 (aka Keyhole Panda and Mulberry Typhoon) has targeted current and former employees of major aerospace and defense contractors with tailored phishing lures.
• UNC3236 (aka Volt Typhoon) has conducted reconnaissance activity against publicly hosted login portals of North American military and defense contractors, while using the ARCMAZE obfuscation framework to conceal its origin.
• UNC6508, a China-nexus threat cluster that targeted a U.S.-based research institution in late 2023 by leveraging a REDCap exploit to drop a custom malware named INFINITERED that’s capable of persistent remote access and credential theft after intercepting the application’s software upgrade process.

In addition, Google said it has also observed China-nexus threat groups utilizing operational relay box (ORB) networks for reconnaissance against defense industrial targets, thereby complicating detection and attribution efforts.

“While specific risks vary by geographic footprint and sub-sector specialization, the broader trend is clear: the defense industrial base is under a state of constant, multi-vector siege,” Google said. “Financially motivated actors carry out extortion against this sector and the broader manufacturing base, like many of the other verticals they target for monetary gain.”

“The campaigns against defense contractors in Ukraine, threats to or exploitation of defense personnel, the persistent volume of intrusions by China-nexus actors, and the hack, leak, and disruption of the manufacturing base are some of the leading threats to this industry today.”