NIST’s single photon chip will likely make QKD an option for a wider range of companies. The post NIST’s Quantum Breakthrough: Single Photons Produced on a Chip appeared first on SecurityWeek .
A sophisticated ClickFix campaign has been uncovered, compromising legitimate websites to deliver a multi-stage malware chain. The attack culminates in MIMICRAT, a custom remote access trojan with advanced capabilities. The campaign uses compromised sites across industries and geographies for delivery, employing a five-stage PowerShell chain that bypasses security measures before deploying a Lua-scripted shellcode loader. MIMICRAT, the final payload, is a native C++ RAT featuring malleable C2 profiles, Windows token theft, and SOCKS5 proxy functionality. The attack chain involves multiple compromised websites, obfuscated scripts, and sophisticated evasion techniques, demonstrating a high level of operational sophistication.
This entry describes a Maltrail Indicator of Compromise (IOC) dated February 20, 2026, sourced from the CIRCL OSINT feed. It is categorized as malware-related network activity with a medium risk level. No specific affected product versions, exploits in the wild, or patches are identified. The information is derived from open-source intelligence and manual collection methods, indicating ongoing monitoring rather than a newly discovered vulnerability or active exploit. The lack of technical details and indicators limits actionable insights. Organizations should consider this as a medium-risk observation that may reflect suspicious network behavior but does not currently represent an active or widespread threat. Vigilance in network monitoring and threat intelligence correlation is advised. Given the absence of exploit details and patch availability, the suggested severity is medium.
The KRVTZ-NET IDS alerts from February 20, 2026, report observed network reconnaissance activity primarily involving scanning from IP 125.209.235.172, associated with the Naver Webcrawler user-agent, and probing localhost (::1) addresses. These activities represent automated, unsupervised scanning rather than targeted exploitation attempts, with no known vulnerabilities or exploits linked. The alerts are classified as low severity and serve mainly as situational awareness for network defenders to recognize benign or low-risk scanning. While the immediate impact is minimal, persistent reconnaissance can aid attackers in mapping networks and identifying future attack vectors. Organizations with exposed internet-facing services, especially in regions where Naver is popular, may see more frequent scanning and should monitor accordingly. Mitigation focuses on detection tuning, network segmentation, and threat intelligence integration rather than patching. Countries with significant risk include South Korea, United States, Japan, China, Germany, United Kingdom, France, Canada, and Australia.
Savvy Seahorse, a DNS threat actor, employs sophisticated techniques to lure victims into fake investment platforms through Facebook ads. They use DNS CNAME records to create a traffic distribution system, enabling dynamic IP address updates and evasion of detection. The campaigns target multiple languages and involve fake ChatGPT and WhatsApp bots. Victims are convinced to create accounts, make deposits, and unknowingly transfer funds to Russian banks. The actor has been operating since August 2021, using dedicated hosting and frequently changing IP addresses. Their infrastructure includes approximately 4,200 base domains with CNAME records linked to subdomains of b36cname[.]site. The campaigns are short-lived, typically lasting 5-10 days per subdomain.
Infoblox security researchers have discovered a group of malicious domains hosting cryptocurrency scams, some linked to hacked YouTube channels. The domains, initially registered under CryptDesignBot, frequently change registrars to conceal information. They use lookalike domains to impersonate legitimate brands. Hacked YouTube channels are exploited to promote scam crypto domains through fake livestreams. The scams often claim to double cryptocurrency, mimicking old RuneScape scams. Many domains use keywords associated with celebrities and brands like Elon Musk and Tesla. Protective measures include implementing protective DNS, securing cookies, using HTTPS, generating random session IDs, and setting session timeouts. Infoblox's BloxOne Threat Defense offers protective DNS capabilities to combat sophisticated threats.
A malicious fork of the MacOS app Triton was discovered on GitHub, containing Windows-targeted malware disguised as the legitimate application. The attacker modified the repository, redirecting download links to a ZIP file hosting the malware. Analysis revealed sophisticated evasion techniques, anti-analysis features, and potential cryptocurrency functionality. The low detection rate and peculiar implementation suggest either an amateur attempt or a possible AI-generated attack. The incident highlights broader concerns about GitHub's security practices and Microsoft's priorities, prompting a call for developers to consider alternative code hosting platforms that better align with open-source values and user privacy.
A new phishing tactic involving fake Microsoft and Google Calendar invites has been identified, aimed at stealing login credentials. These sophisticated attacks mimic designs from well-known platforms, exploiting routine business activities like scheduling meetings. Threat actors use email spoofing and create fake urgent calendar invitations to deceive employees. The phishing emails often contain buttons or links that redirect to fake login pages, closely resembling official Microsoft or Google login screens. The campaigns exploit the popularity of calendar invitations in corporate environments, allowing attackers to gather sensitive information if users are not vigilant. To prevent falling victim to these attacks, it is crucial to verify the authenticity of calendar invites, carefully check sender details, and avoid clicking suspicious links from unknown senders.
The blockchain-based lender has confirmed a data breach after ShinyHunters leaked over 2GB of data allegedly stolen from the company. The post Nearly 1 Million User Records Compromised in Figure Data Breach appeared first on SecurityWeek .
Arkanix Stealer, a newly discovered malware operating under a Malware-as-a-Service model, targets a wide range of user data including cryptocurrencies, gaming, and online banking information. The stealer, available in both Python and C++ versions, offers configurable features and employs various techniques to evade detection. It can extract data from multiple browsers, VPNs, and gaming platforms, as well as capture screenshots and RDP connection details. The malware authors promoted their product through a Discord server and implemented a referral program to attract customers. The campaign appears to have been short-lived, with infrastructure taken down around December 2025.
A new malware-as-a-service (MaaS) called TrustConnect has been discovered masquerading as a legitimate remote monitoring and management (RMM) tool. The malware, classified as a remote access trojan (RAT), uses a fake business website as its command and control center and MaaS portal. Priced at $300 per month, it offers features like a web-based C2 dashboard, automated payload generation with digital signatures, and remote desktop capabilities. The malware has been distributed through various email campaigns, often alongside legitimate RMM tools. Proofpoint researchers identified links between TrustConnect's creator and previous users of Redline stealer. The emergence of this new MaaS demonstrates the ongoing evolution of the cybercrime market and the thriving ecosystem of RMM abuse.
This analysis reveals the growing threat of malicious OAuth applications in Microsoft Entra ID, which attackers use for persistence and privilege escalation. The report details how these apps blend in with legitimate integrations, making detection challenging. It describes the creation of OAuth Apps Scout, an automated detection pipeline that identifies emerging malicious OAuth apps. The research uncovered multiple campaigns, including one involving 19 apps impersonating well-known brands. The report compares tactics from 2019 to 2025, showing an evolution in attacker strategies from Microsoft impersonation to third-party SaaS spoofing. It concludes with actionable defense strategies for organizations to protect against these threats.
This entry describes a Maltrail Indicator of Compromise (IOC) dated February 19, 2026, categorized as malware with a medium risk level. The information is sourced from the CIRCL OSINT feed and is labeled as an unsupervised, manual collection of network activity observations. No specific affected versions, exploits in the wild, or patches are noted, and no detailed technical indicators or vulnerabilities are provided. The threat is primarily an OSINT observation without concrete actionable details or known active exploitation. Given the lack of detailed technical data, the threat appears to be of medium severity, reflecting potential but unconfirmed risk. Organizations should remain vigilant for related network anomalies but no immediate critical action is mandated. The threat's global impact is uncertain due to the absence of affected products or sectors. Countries with significant use of network monitoring tools and high cyber threat exposure may be more attentive to such IOC feeds. Overall, this represents a medium-level malware-related network activity observation without direct exploit evidence.
This entry describes a Maltrail Indicator of Compromise (IOC) dated February 18, 2026, sourced from the CIRCL OSINT feed. It is categorized as malware-related network activity with a medium risk level. No specific affected product versions, exploits in the wild, or patches are identified. The IOC appears to be an observation from open-source intelligence without detailed technical indicators or attack vectors. Given the lack of detailed exploit information and absence of known active exploitation, the threat is assessed as medium severity. Organizations should monitor network traffic for suspicious activity consistent with Maltrail detections and maintain vigilance in threat intelligence updates. The threat is relevant globally due to the generic nature of network-based malware activity but lacks specificity to target particular countries or sectors. Practical mitigation involves enhancing network monitoring, deploying anomaly detection tools, and ensuring timely threat intelligence integration. No direct CVSS score is available, so severity is inferred from available data.
The KRVTZ-NET IDS alerts dated 2026-02-17 represent observed network reconnaissance activity detected by an intrusion detection system. These alerts are categorized as low severity and are derived from open-source intelligence (OSINT) feeds, indicating preliminary scanning or probing rather than active exploitation. No specific vulnerabilities, exploits, or affected product versions are identified, and no patches or mitigations are currently available. The activity is likely part of the reconnaissance phase in the cyber kill chain, aiming to gather information about network assets. Given the lack of known exploits and the low severity rating, the immediate risk to organizations is limited but should not be ignored as reconnaissance often precedes more targeted attacks. Organizations worldwide using network IDS solutions and monitoring OSINT feeds may observe similar alerts. The threat does not require authentication or user interaction and has a limited impact on confidentiality, integrity, or availability at this stage. Suggested severity is low, reflecting the preliminary nature of the activity and the absence of direct exploitation.
The KRVTZ-NET IDS alerts dated 2026-02-11 represent network reconnaissance activity detected by an intrusion detection system. The alerts are categorized as low severity and are based on open-source intelligence (OSINT) observations without specific exploit details or affected product versions. No known exploits or patches are associated with this activity, indicating it is likely preliminary scanning or probing rather than an active attack. The threat is primarily informational, highlighting reconnaissance efforts that could precede more targeted attacks. Organizations should monitor for unusual network activity and strengthen detection capabilities to identify potential follow-on threats. Given the lack of specific vulnerabilities or exploits, the immediate risk is low but warrants vigilance. The threat is relevant globally, especially in regions with high network infrastructure usage and strategic importance. Due to the reconnaissance nature and low severity, the suggested severity is low. Defenders should focus on improving network visibility and anomaly detection to mitigate potential escalation.
Felix Markets is a fraudulent forex broker platform engaging in reputation laundering by presenting false regulatory credentials and leveraging sports sponsorship to appear legitimate. It impersonates other companies, repackages authentic legal documents, and falsely claims regulatory ties to Australia, the UK, and Comoros. The platform sponsors the Spanish football team Levante U. D.for the 2025-26 season to enhance its perceived legitimacy. Hosting and metadata suggest possible Turkish involvement, while the scam exploits the identity of a legitimate Australian company. This campaign exemplifies sophisticated regulatory fraud and reputation laundering tactics in investment scams, posing risks to investors and financial institutions. European organizations should exercise heightened due diligence, especially in sectors vulnerable to such deceptive legitimacy claims. The threat is assessed as medium severity due to its potential financial impact and moderate ease of exploitation without direct technical system compromise. Spain is notably affected given the sponsorship link and geographic focus.
Salt Typhoon, a China-linked cyber espionage group, exploited a zero-day vulnerability (CVE-2024-40766) in Citrix NetScaler Gateway appliances to target a European telecommunications organization. The attackers used DLL sideloading to deploy the SNAPPYBEE backdoor and leveraged LightNode VPS endpoints for command and control. The intrusion involved lateral movement from the compromised gateway to Citrix VDA hosts with the intent of data exfiltration. Darktrace detected the attack early through anomaly-based detection, enabling containment before significant damage occurred. No known exploits are currently in the wild. The threat demonstrates sophisticated stealth techniques by state-sponsored actors targeting critical infrastructure. Organizations using Citrix infrastructure, especially in telecommunications, should monitor proactively and apply patches when available. The suggested severity is medium due to the targeted nature and exploitation complexity.
