This entry describes a Maltrail Indicator of Compromise (IOC) dated February 19, 2026, categorized as malware with a medium risk level. The information is sourced from the CIRCL OSINT feed and is labeled as an unsupervised, manual collection of network activity observations. No specific affected versions, exploits in the wild, or patches are noted, and no detailed technical indicators or vulnerabilities are provided. The threat is primarily an OSINT observation without concrete actionable details or known active exploitation. Given the lack of detailed technical data, the threat appears to be of medium severity, reflecting potential but unconfirmed risk. Organizations should remain vigilant for related network anomalies but no immediate critical action is mandated. The threat's global impact is uncertain due to the absence of affected products or sectors. Countries with significant use of network monitoring tools and high cyber threat exposure may be more attentive to such IOC feeds. Overall, this represents a medium-level malware-related network activity observation without direct exploit evidence.
KRVTZ-NET IDS alerts from February 19, 2026, report reconnaissance activity targeting web applications using React Server Components and vulnerable JavaScript code. The alerts focus on attempts to exploit CVE-2025-55182, known as React2Shell, which allows unsafe property access, and JavaScript prototype pollution attacks via the __proto__ property in HTTP request bodies. These activities are preliminary probes without confirmed active exploitation or available patches. The vulnerabilities could enable remote code execution, privilege escalation, data manipulation, or denial of service if exploited. Multiple suspicious IPs suggest coordinated scanning, with European organizations using these technologies at particular risk. The threat is currently assessed as low severity but carries significant risk if unmitigated. Early detection, input validation, and network monitoring are recommended to reduce potential impact.
This analysis examines the evolution of Remcos, a Remote Access Trojan that has become a significant global threat. Originally a commercial tool, Remcos now provides attackers with capabilities such as credential theft, keylogging, screen capture, and webcam control. The latest variant exhibits real-time command-and-control communication, enabling immediate surveillance. The malware uses sophisticated techniques like dynamic API resolution, encrypted configurations, and modular plugins to evade detection. It establishes persistence through registry modifications and employs cleanup routines to remove traces of its activity. The report details Remcos' infection vectors, data exfiltration methods, and its network interactions with command-and-control servers.
GrayCharlie, a threat actor active since mid-2023, compromises WordPress sites to inject links redirecting visitors to NetSupport RAT payloads via fake browser updates or ClickFix mechanisms. These infections often lead to Stealc and SectopRAT deployments. The group's infrastructure is primarily linked to MivoCloud and HZ Hosting Ltd. A cluster of US law firm sites was compromised around November 2025, possibly through a supply-chain attack. GrayCharlie uses two main attack chains: one involving fake browser updates and another using ClickFix-style lures. The group's objectives appear to focus on data theft and financial gain, with potential access selling to other threat actors.
The malware has been preinstalled on many devices but it has also been distributed through Google Play and other app stores. The post New Keenadu Android Malware Found on Thousands of Devices appeared first on SecurityWeek .
A sophisticated spam campaign exploited Atlassian Jira Cloud to bypass security controls and target government and corporate entities. The attackers used legitimate Atlassian Cloud infrastructure to create disposable Jira instances, leveraging the platform's trusted domain reputation. The campaign targeted specific language groups, including English, French, German, Italian, Portuguese, and Russian speakers, with tailored emails redirecting to investment scams and online casinos. The operation demonstrated high automation and abuse of SaaS workflows, highlighting the need for reassessing trust assumptions in cloud-generated emails. The campaign utilized Keitaro Traffic Distribution System for redirects and focused on organizations already using Atlassian Jira, exploiting their familiarity with Jira-related emails.
A few days ago I wrote a diary called "Malicious Script Delivering More Maliciousness"[1]. In the malware infection chain, there was a JPEG picture that embedded the last payload delimited with "BaseStart-" and "-BaseEnd" tags.
This entry describes a Maltrail Indicator of Compromise (IOC) dated February 18, 2026, sourced from the CIRCL OSINT feed. It is categorized as malware-related network activity with a medium risk level. No specific affected product versions, exploits in the wild, or patches are identified. The IOC appears to be an observation from open-source intelligence without detailed technical indicators or attack vectors. Given the lack of detailed exploit information and absence of known active exploitation, the threat is assessed as medium severity. Organizations should monitor network traffic for suspicious activity consistent with Maltrail detections and maintain vigilance in threat intelligence updates. The threat is relevant globally due to the generic nature of network-based malware activity but lacks specificity to target particular countries or sectors. Practical mitigation involves enhancing network monitoring, deploying anomaly detection tools, and ensuring timely threat intelligence integration. No direct CVSS score is available, so severity is inferred from available data.
The KRVTZ-NET IDS alerts from February 18, 2026, report reconnaissance activity targeting Fortigate VPN devices by sending repeated GET requests to the /remote/logincheck endpoint. This activity is consistent with attempts to exploit CVE-2023-27997, a vulnerability that allows unauthenticated attackers to bypass authentication and potentially execute arbitrary commands. Although no confirmed exploitation is reported, network traffic associated with SysJoker malware was also detected, indicating potential follow-on malware deployment. The alert is classified as low severity due to its reconnaissance nature and lack of confirmed exploitation. Organizations, especially in Europe, are advised to monitor for such activity and ensure Fortigate VPN devices are patched and secured.
A Chinese-speaking cybercrime group, REF4033, has orchestrated a massive SEO poisoning campaign, compromising over 1,800 Windows web servers worldwide using the BADIIS malware. The campaign operates in two phases: serving keyword-stuffed HTML to search engine crawlers and redirecting victims to illicit websites. The group deploys BADIIS, a malicious IIS module, to hijack legitimate servers for manipulating search engine rankings and facilitating financial fraud. The campaign primarily targets the APAC region, with China and Vietnam accounting for 82% of compromised servers. Victims span various sectors, including government agencies, educational institutions, and financial services. The attackers use sophisticated techniques for stealth and anti-tampering, employing Chinese encryption standards and commercial obfuscation tools.
This analysis examines a sophisticated attack chain targeting Windows systems through social engineering. It uses fake CAPTCHA verification pages to trick users into executing malicious PowerShell commands. The multi-stage infection process ultimately deploys the StealC information stealer, a commodity malware designed to harvest sensitive data. The attack chain includes PowerShell scripts, position-independent shellcode, and a PE downloader, utilizing techniques like reflective PE loading, API hashing, and process injection to evade detection. StealC's capabilities include stealing browser credentials, cryptocurrency wallets, Steam accounts, Outlook credentials, and system information. The malware uses encrypted C2 communication and operates without persistence, making it particularly stealthy.
Eurail has confirmed that the stolen data is up for sale, but it’s still trying to determine how many individuals are impacted. The post Hackers Offer to Sell Millions of Eurail User Records appeared first on SecurityWeek .
Key Points Introduction AI is rapidly becoming embedded in day-to-day enterprise workflows, inside browsers, collaboration suites, and developer tooling. As a result, AI service domains increasingly blend into normal corporate traffic, often allowed by default and rarely treated as sensitive egress. Threat actors are already capitalizing on this shift. Across the malware ecosystem, AI is […] The post AI in the Middle: Turning Web-Based AI Services into C2 Proxies & The Future Of AI Driven Attacks appeared first on Check Point Research .
As nation-state actors, ransomware groups, and aging infrastructure collide, organizations must rethink how they defend critical operations through resilience, visibility, and modern security strategies. The post Cyber Insights 2026: The Ongoing Fight to Secure Industrial Control Systems appeared first on SecurityWeek .
New research shows attackers increasingly abusing APIs at machine speed as AI-driven systems widen exposure and amplify impact. The post API Threats Grow in Scale as AI Expands the Blast Radius appeared first on SecurityWeek .
Polish police said they found evidence of cybercrime on the 47-year-old suspect’s devices. The post Man Linked to Phobos Ransomware Arrested in Poland appeared first on SecurityWeek .
Industrial cybersecurity firm Dragos has published its 9th Year in Review OT/ICS Cybersecurity Report. The post 3 Threat Groups Started Targeting ICS/OT in 2025: Dragos appeared first on SecurityWeek .
