The FBI warns of a sharp rise in ATM jackpotting across the United States, reporting over 1,900 incidents since 2020 and more than 700 in 2025 that have caused over $20 million in losses. Attackers are exploiting physical access and software flaws—most notably the Ploutus family targeting the XFS layer—to force…
Category: Cyber Security News
CISA flagged two Roundcube Webmail vulnerabilities as actively exploited—CVE-2025-49113 and CVE-2025-68461—and ordered U.S. federal agencies to patch them within three weeks. Shadowserver and Shodan data show tens of thousands of internet-exposed Roundcube instances, and past exploitation has involved groups such as Winter Vivern (TA473) and APT28. #CVE-2025-49113 #CVE-2025-68461
![Threat Research | Weekly Recap [22 Feb 2026]](https://www.hendryadrian.com/tweet/image/WeeklyRecap.png "Threat Research | Weekly Recap [22 Feb 2026]")
Cybersecurity Threat Research ‘Weekly’ Recap: This overview highlights infostealers, RATs, supply-chain and CI/AI toolchain compromises, vulnerabilities, ransomware activity, and phishing campaigns, featuring notable actors and families such as CharlieKirk, XWorm, SANDWORM_MODE, QakBot, and Lynx. It also emphasizes trends like AI-driven C2 abuse, adaptive phishing via Telegram, firmware and mobile backdoors, and notable incidents involving Dell RecoverPoint, Ivanti EPMM, BeyondTrust, and SolarWinds WHD. #CharlieKirk #ArkanixStealer #MIMICRAT #ClickFix #LunarApplication #XWorm #TrustConnect #DocConnect #Foxveil #GrayCharlie #AtlassianJira #SANDWORM_MODE #Notepad++ #LotusBlossom #Chrysalis #UNC6201 #DellRecoverPoint #BeyondTrust #IvantiEPMM #SolarWindsWHD #IngressNGINX #QakBot #SinobiRansomware #LynxRansomware #Keenadu #Velociraptor #Cloudflared #DaisyCloud #Redline
Arkanix Stealer, an information‑stealing operation promoted on dark web forums in late 2025, offered modular Python and premium C++ builds with VMProtect and extensive data‑theft capabilities across browsers, wallets, messengers, and gaming platforms. Kaspersky researchers found indicators of LLM‑assisted development, a short‑lived Discord community and referral program, and published IoCs while the operator abruptly took down the project two months after launch. #ArkanixStealer #Kaspersky
A Russian-speaking threat actor used multiple generative AI services to breach more than 600 FortiGate firewalls across 55 countries in five weeks by targeting exposed management interfaces and weak credentials rather than exploiting zero-days. The campaign leveraged AI-assisted tooling (including a custom MCP server and LLMs) to automate reconnaissance, lateral movement, and attacks against backup infrastructure like Veeam, prompting recommendations to close exposed interfaces, enable MFA, and harden backups. #FortiGate #Veeam
Intellexa’s Predator spyware can suppress iOS recording indicators to secretly stream camera and microphone feeds from infected devices. Jamf’s analysis shows Predator hooks SpringBoard’s sensor update path (HiddenDot::setupHook) to nullify SBSensorActivityDataProvider and prevent the green/orange dots from appearing, while using ARM64 pattern matching and PAC redirection to enable camera access. #Predator #Intellexa
A Russian-speaking, financially motivated actor used commercial generative AI to automate scanning and brute-force attacks against exposed FortiGate management interfaces, compromising over 600 devices in 55 countries. Amazon Threat Intelligence found the campaign leveraged multiple AI tools to scale credential harvesting, Active Directory compromise, and targeting of backup infrastructure consistent with…
A critical stack-based buffer overflow in Grandstream GXP1600 phones (CVE-2026-2329) can allow unauthenticated attackers to execute code as root and intercept calls. Rapid7 reported the flaw and Grandstream issued a firmware patch (1.0.7.81), though exploitation requires skill. #Grandstream #CVE2026-2329…
PayPal has notified customers that a software error in its PayPal Working Capital (PPWC) loan application exposed sensitive personal information—including names, email addresses, phone numbers, business addresses, Social Security numbers, and dates of birth—between July 1, 2025 and December 13, 2025. PayPal says it rolled back the code change that caused the exposure, reset impacted passwords, issued refunds for unauthorized transactions to a small number of customers, and is offering two years of Equifax credit monitoring and identity restoration. #PayPal #PPWC
Businesses’ demand for speed and developers’ heavy workloads have undermined “shift left” security efforts, leading to unsafe use of public container images and loss of control over deployments. Qualys’ analysis of over 34,000 public images found roughly 7.3% malicious with many containing cryptominers and exposed secrets, prompting a recommendation to move security “down” into platform-level automation and golden paths. #DockerHub #AWS
Thieves stole over $20 million from compromised ATMs last year using ATM jackpotting, a malware-assisted technique that forces machines to dispense cash without bank authorization. The FBI warns of more than 1,900 incidents since 2020 (700+ in 2025), noting Ploutus exploits the XFS API and listing digital and physical indicators for…
Multiple critical vulnerabilities (CVE-2026-25715, CVE-2026-24455, CVE-2026-26049, CVE-2026-26048) in the Jinan USR IOT PUSR USR-W610 (…
EC-Council Expands AI Certification Portfolio to Strengthen U.S. AI Workforce Readiness and Security
EC-Council launched the Enterprise AI Credential Suite with four new role-based AI certifications and an updated Certified CISO v4 to close the gap between rapid AI adoption and workforce readiness. The programs align to an Adopt.Defend.Govern framework and U.S. AI workforce priorities to reduce AI risk exposure and address significant reskilling…
CISA added two actively exploited Roundcube vulnerabilities (CVE-2025-49113 and CVE-2025-68461) to its Known Exploited Vulnerabilities catalog after observing evidence of active exploitation. CVE-2025-49113 allows authenticated remote code execution and was weaponized within 48 hours of disclosure, and federal agencies must remediate the flaws by March 13, 2026 to protect FCEB networks….
Anthropic has begun rolling out Claude Code Security, an AI-powered feature that scans codebases for vulnerabilities and suggests targeted patches for human review. Available in a limited research preview to Enterprise and Team customers, it uses human-like reasoning, multi-stage verification, severity and confidence ratings, and a human-in-the-loop workflow to help defenders…