Microsoft disclosed a new ClickFix variant that tricks users into running nslookup via the Windows Run dialog and cmd.exe to perform DNS-based staging and fetch a second-stage payload. The chain downloads a ZIP from azwsappdev[.]com that leads to a Python script, VBScript and ModeloRAT persistence, while related campaigns use CastleLoader, Lumma…
Category: Cyber Security News
Cisco Talos reports that the threat actor UAT-9921 is using a new modular framework called VoidLink to conduct post-compromise C2 operations, internal and external scanning, and lateral movement against technology and financial services. VoidLinkāwritten in Zig with C plugins and a Go backend, and possibly developed with LLM assistanceāincludes kernel-level rootkits,…
Google Threat Intelligence Group reports that state-sponsored, hacktivist, and criminal groups from China, Iran, North Korea, and Russia are conducting sustained, multi-vector campaigns against the defense industrial base, targeting drones, autonomous systems, supply chains, and personnel. These actors exploit messaging apps, device-linking features, hiring processes, edge devices, ORB networks, and diverse…
Google’s Threat Intelligence Group has attributed attacks against Ukrainian defense, military, government, and energy organizations to a previously undocumented threat actor that deploys the obfuscated JavaScript malware CANFAIL. The group, possibly linked to Russian intelligence, uses LLMs to craft reconnaissance and socialāengineering lures that deliver CANFAIL via spoofed phishing emails and…
European Commission Executive Vice President Henna Virkkunen warned that Europe can no longer be naive about adversariesā ability to disable critical infrastructure, noting cyberattacks are often paired with physical sabotage, disinformation and economic pressure. She called for tougher rules and investmentāincluding a revision of the EU Cybersecurity Act to phase out…
Ring has canceled its planned integration with Flock Safety after public backlash over a Super Bowl ad that raised privacy concerns about AI-enabled image recognition and neighborhood surveillance. Amazon said the integration was never live and no videos were shared, while lawmakers and communities criticized Ringās partnerships and surveillance features. #Ring…
![Cybersecurity News | Daily Recap [14 Feb 2026]](https://www.hendryadrian.com/tweet/image/DailyRecap.png "Cybersecurity News | Daily Recap [14 Feb 2026]")
Daily Recap, fake recruiters distribute a modular RAT named Graphalgo attributed to Lazarus (North Korea) that enables MetaMask theft, token-protected C2, remote command execution and data exfiltration across 192 packages. MacSync is promoted via ClickFix campaigns that abuse Claude artifacts and Google Ads to coax macOS users into pasting shell commands that install the MacSync infostealer, with multiple variants sharing C2 infrastructure, while Louis Vuitton, Christian Dior Couture, and Tiffany were fined $25 million for breaches tied to ShinyHunters exploiting Salesforce SaaS access. #Graphalgo #ShinyHunters
Speakers at the Munich Cyber Security Conference warned that space has become a contested domain where satellites and the global undersea cable network create critical vulnerabilities for modern life. Industry figures like Declan Ganley argued for resilient “outernet” constellations that can operate independently of ground gateways and subsea cables to ensure…
North Korean threat actor UNC1069 used AI-generated deepfakes and sophisticated custom malware to target a FinTech company in the cryptocurrency sector. Mandiantās investigation revealed a Telegram account hijack, a spoofed Calendly/Zoom call that lured the victim into a ClickFix routine, and deployment of seven malware families including SILENCELIFT, DEEPBREATH, and CHROMEPUSH….
Google’s GTIG warns the defense industrial base is under a constant, multi-vector siege from state-sponsored actors and criminal syndicates that aim to steal secrets, disrupt supply chains, and undermine national security. The report details attacks ranging from Russian groups targeting UAS and battlefield apps (e.g., APT44 using INFAMOUSCHISEL and TEMP.Vermin lures),…
The notorious North Korean Lazarus Group has launched “Graphalgo,” a sophisticated fake-recruiter campaign targeting Python and JavaScript developers in the cryptocurrency sector by luring them with lucrative job offers. The operation uses a modular, multi-stage infection chain that hides malicious payloads in open-source packagesāmost notably the npm package bigmathutilsāand leverages public…
Check Point reported strong Q4 and full-year 2025 results while announcing acquisitions of Cyata, Cyclops, and Rotate to accelerate its AI-driven security and exposure management strategy. The company reportedly paid about $150 million for the three deals (including $85 million for Cyclops) as Q4 revenue hit $745 million and full-year revenue…
Threat actors are sending physical letters that impersonate Trezor and Ledger, urging recipients to complete bogus “Authentication Check” or “Transaction Check” steps by scanning QR codes. Those phishing sites prompt users to enter wallet recovery phrases, which are transmitted to attackers and enable theft of the victims’ funds. #Trezor #Ledger
Two critical Ivanti Endpoint Manager Mobile vulnerabilities, CVE-2026-21962 and CVE-2026-24061, are being actively exploited for unauthenticated remote code execution, with vendor hotfixes released and full patches promised in EPMM 12.8.0.0. Most exploitation activity (over 83%) traces to a single IP hosted on bulletproof infrastructure, prompting recommendations to apply temporary RPM mitigations or migrate to a rebuilt EPMM instance. #IvantiEPMM #PROSPERO_OOO
A data breach at Conduent has impacted at least 25 million people, far more than initially reported, with sensitive personal data including names, addresses, dates of birth, Social Security numbers, and health and insurance information stolen. The Safepay group claimed the attack, which affected clients including Volvo Group North America (about…