Washington Hotel in Japan reported a ransomware attack that breached its servers on February 13, 2026, exposing various business data and causing limited operational impacts such as temporary credit card terminal outages. The company has formed an internal task force, engaged external cybersecurity experts, and says customer data is unlikely to be affected because it is stored on separate systems; the investigation is ongoing and no extortion claims have appeared on monitored dark-web portals. #WashingtonHotel #FileZen
Category: Cyber Security News
ReversingLabs uncovered a modular fake recruitment campaign named graphalgo that uses deceptive blockchain job tasks to distribute malicious npm and PyPI packages to JavaScript and Python developers. The operation, attributed to the North Korea-linked Lazarus Group, deploys fake companies like Veltrix Capital, staged interview repositories, and delayed malicious package updates that…
Figure confirmed a data breach after an employee fell for a social engineering attack that allowed hackers to steal a limited number of files. ShinyHunters claimed responsibility and released about 2.5GB of stolen data while Figure notifies affected individuals and offers free credit monitoring. #Figure #ShinyHunters…
Passkeys, built on FIDO2 and WebAuthn, replace passwords with device-bound cryptographic authentication that reduces phishing, support costs, and improves user experience. For ISO/IEC 27001 organizations, a compliant transition requires risk-based prioritization, mapping passkey deployment to Annex A controls, documented recovery procedures, and monitoring for new attack vectors. #Passkeys #ISOIEC27001
Since last year, Western websites have experienced a sustained surge of automated traffic traced to China and Singapore, with analytics showing near-zero engagement and behavior consistent with bots. Much of the traffic appears routed through servers linked to Tencent and repeatedly geolocated to Lanzhou, prompting speculation about large-scale scraping—possibly for AI…
Hudson Rock detected a live ClawdBot infection that exfiltrated an OpenClaw user’s workspace and configuration, demonstrating a shift from stealing browser credentials to harvesting AI agent identities. The attacker obtained openclaw.json, device.json (including a private key), and soul.md/memory files, enabling impersonation, unauthorized access, and a comprehensive view of the victim’s personal context. #ClawdBot #OpenClaw #HudsonRock
Google released emergency updates to fix a high-severity Chrome zero-day, CVE-2026-2441, that has been exploited in the wild. The vulnerability is a use-after-free caused by an iterator invalidation in CSSFontFeatureValuesMap, and Google backported fixes to Stable Desktop releases for Windows, macOS, and Linux while noting further related work remains. #CVE-2026-2441 #Chrome
CISA ordered federal civilian agencies to secure their BeyondTrust Remote Support instances within three days after a critical remote code execution vulnerability was found to be actively exploited. BeyondTrust patched SaaS instances but on-premises customers must apply manual fixes amid warnings that thousands of exposed deployments may already be compromised. #BeyondTrust #CVE-2026-1731
Ad fraud has evolved into a cybersecurity threat, with malware, agentic browsers, and distributed “ghost click farms” compromising devices and manipulating ad systems at scale. Mike Schrobo warns platforms underreport the risk and urges coordinated security-marketing defenses, real-time intent verification, and new “Know Your Agent” guardrails to combat threats like OpenClaw….
Microsoft has resolved a Windows 11 bug that caused some commercial systems running 25H2 and 24H2 to fail to boot with an “UNMOUNTABLE_BOOT_VOLUME” error after recent security updates. The full fix was delivered in the February 10, 2026 Patch Tuesday update KB5077181, though devices made unbootable before the fix may still need manual remediation and enterprises should contact Microsoft Support for Business. #Windows11 #KB5077181
Threat actors are now abusing DNS queries in ClickFix social engineering attacks to deliver malware, marking the first known use of DNS as a channel in these campaigns. Victims are tricked into running an nslookup against an attacker-controlled DNS server that returns a NAME field containing a PowerShell script which downloads additional payloads and ultimately installs the ModeloRAT remote access trojan. #ClickFix #ModeloRAT
ShinyHunters claims to have published a 1.67 GB dataset containing over 600,000 historical Canada Goose customer records with names, contact details, partial payment card information, IP addresses, and order histories. Canada Goose says it has found no evidence of a breach of its own systems, is reviewing the dataset’s accuracy and scope, and the exposed data could still be abused for phishing, social engineering, fraud, and profiling of high-value customers. #ShinyHunters #CanadaGoose
Unit 42 revealed that Lotus Blossom, a state-sponsored group, compromised Notepad++’s shared hosting to hijack update traffic and deliver targeted malicious updates between June and December 2025. The attackers used an Adversary-in-the-Middle capability to selectively serve payloads—deploying the Chrysalis backdoor via DLL side-loading or a Cobalt Strike Beacon via injected Lua…
Threat actors are abusing Pastebin comments to lure cryptocurrency users into executing malicious JavaScript that hijacks Bitcoin swap transactions and redirects funds to attacker-controlled wallets. Promoted via Pastebin and a fake Google Doc promising Swapzone.io arbitrage gains, this ClickFix-style campaign injects obfuscated scripts into the Swapzone page to replace deposit addresses and manipulate rates, making theft effectively irreversible. #ClickFix #Swapzone
CTM360 reports an active global campaign abusing over 4,000 malicious Google Groups and 3,500 Google-hosted URLs to distribute credential‑stealing malware and establish persistent access on compromised devices. Windows users are targeted with an oversized, password‑protected archive delivering the Lumma infostealer, while Linux users are redirected to a trojanized Chromium “Ninja Browser” that silently installs malicious extensions and persistence mechanisms. #LummaStealer #NinjaBrowser