A few days ago I wrote a diary called "Malicious Script Delivering More Maliciousness"[1]. In the malware infection chain, there was a JPEG picture that embedded the last payload delimited with "BaseStart-" and "-BaseEnd" tags.
This entry describes a Maltrail Indicator of Compromise (IOC) dated February 18, 2026, sourced from the CIRCL OSINT feed. It is categorized as malware-related network activity with a medium risk level. No specific affected product versions, exploits in the wild, or patches are identified. The IOC appears to be an observation from open-source intelligence without detailed technical indicators or attack vectors. Given the lack of detailed exploit information and absence of known active exploitation, the threat is assessed as medium severity. Organizations should monitor network traffic for suspicious activity consistent with Maltrail detections and maintain vigilance in threat intelligence updates. The threat is relevant globally due to the generic nature of network-based malware activity but lacks specificity to target particular countries or sectors. Practical mitigation involves enhancing network monitoring, deploying anomaly detection tools, and ensuring timely threat intelligence integration. No direct CVSS score is available, so severity is inferred from available data.
The KRVTZ-NET IDS alerts from February 18, 2026, report reconnaissance activity targeting Fortigate VPN devices by sending repeated GET requests to the /remote/logincheck endpoint. This activity is consistent with attempts to exploit CVE-2023-27997, a vulnerability that allows unauthenticated attackers to bypass authentication and potentially execute arbitrary commands. Although no confirmed exploitation is reported, network traffic associated with SysJoker malware was also detected, indicating potential follow-on malware deployment. The alert is classified as low severity due to its reconnaissance nature and lack of confirmed exploitation. Organizations, especially in Europe, are advised to monitor for such activity and ensure Fortigate VPN devices are patched and secured.
A Chinese-speaking cybercrime group, REF4033, has orchestrated a massive SEO poisoning campaign, compromising over 1,800 Windows web servers worldwide using the BADIIS malware. The campaign operates in two phases: serving keyword-stuffed HTML to search engine crawlers and redirecting victims to illicit websites. The group deploys BADIIS, a malicious IIS module, to hijack legitimate servers for manipulating search engine rankings and facilitating financial fraud. The campaign primarily targets the APAC region, with China and Vietnam accounting for 82% of compromised servers. Victims span various sectors, including government agencies, educational institutions, and financial services. The attackers use sophisticated techniques for stealth and anti-tampering, employing Chinese encryption standards and commercial obfuscation tools.
This analysis examines a sophisticated attack chain targeting Windows systems through social engineering. It uses fake CAPTCHA verification pages to trick users into executing malicious PowerShell commands. The multi-stage infection process ultimately deploys the StealC information stealer, a commodity malware designed to harvest sensitive data. The attack chain includes PowerShell scripts, position-independent shellcode, and a PE downloader, utilizing techniques like reflective PE loading, API hashing, and process injection to evade detection. StealC's capabilities include stealing browser credentials, cryptocurrency wallets, Steam accounts, Outlook credentials, and system information. The malware uses encrypted C2 communication and operates without persistence, making it particularly stealthy.
Eurail has confirmed that the stolen data is up for sale, but it’s still trying to determine how many individuals are impacted. The post Hackers Offer to Sell Millions of Eurail User Records appeared first on SecurityWeek .
Key Points Introduction AI is rapidly becoming embedded in day-to-day enterprise workflows, inside browsers, collaboration suites, and developer tooling. As a result, AI service domains increasingly blend into normal corporate traffic, often allowed by default and rarely treated as sensitive egress. Threat actors are already capitalizing on this shift. Across the malware ecosystem, AI is […] The post AI in the Middle: Turning Web-Based AI Services into C2 Proxies & The Future Of AI Driven Attacks appeared first on Check Point Research .
As nation-state actors, ransomware groups, and aging infrastructure collide, organizations must rethink how they defend critical operations through resilience, visibility, and modern security strategies. The post Cyber Insights 2026: The Ongoing Fight to Secure Industrial Control Systems appeared first on SecurityWeek .
New research shows attackers increasingly abusing APIs at machine speed as AI-driven systems widen exposure and amplify impact. The post API Threats Grow in Scale as AI Expands the Blast Radius appeared first on SecurityWeek .
Polish police said they found evidence of cybercrime on the 47-year-old suspect’s devices. The post Man Linked to Phobos Ransomware Arrested in Poland appeared first on SecurityWeek .
A new Android backdoor called Keenadu has been discovered embedded in the firmware of several tablet brands. It infects the libandroid_runtime.so library during firmware building, injecting itself into every app launched on the device. Keenadu provides attackers unrestricted control over victims' devices, primarily for ad fraud purposes. The investigation revealed connections between Keenadu and other major Android botnets like Triada, BADBOX, and Vo1d. The malware was found in system apps, Google Play apps, and modified versions of popular apps. Over 13,000 users worldwide have been affected, with Russia, Japan, Germany, Brazil and the Netherlands seeing the highest number of infections.
Industrial cybersecurity firm Dragos has published its 9th Year in Review OT/ICS Cybersecurity Report. The post 3 Threat Groups Started Targeting ICS/OT in 2025: Dragos appeared first on SecurityWeek .
Researchers at ETH Zurich have tested the security of Bitwarden, LastPass, Dashlane, and 1Password password managers. The post Password Managers Vulnerable to Vault Compromise Under Malicious Server appeared first on SecurityWeek .
This morning, I received an interesting phishing email. I&#;x26;#;xe2;&#;x26;#;x80;&#;x26;#;x99;ve a &#;x26;#;xe2;&#;x26;#;x80;&#;x26;#;x9c;love &#;x26; hate&#;x26;#;xe2;&#;x26;#;x80;&#;x9d; relation with such emails because I always have the impression to lose time when reviewing them but sometimes it&#;x26;#;xe2;&#;x26;#;x80;&#;x26;#;x99;s a win because you spot interesting &#;x26;#;xe2;&#;x26;#;x80;&#;x26;#;x9c;TTPs&#;x26;#;xe2;&#;x26;#;x80;&#;x9d; (&#;x26;#;xe2;&#;x26;#;x80;&#;x26;#;x9c;tools, techniques &#;x26;&#;xc2;&#;xa0; procedures&#;x26;#;xe2;&#;x26;#;x80;&#;x9d;). Maybe one day, I&#;x26;#;39;ll try to automate this process!
The KRVTZ-NET IDS alerts dated 2026-02-17 represent observed network reconnaissance activity detected by an intrusion detection system. These alerts are categorized as low severity and are derived from open-source intelligence (OSINT) feeds, indicating preliminary scanning or probing rather than active exploitation. No specific vulnerabilities, exploits, or affected product versions are identified, and no patches or mitigations are currently available. The activity is likely part of the reconnaissance phase in the cyber kill chain, aiming to gather information about network assets. Given the lack of known exploits and the low severity rating, the immediate risk to organizations is limited but should not be ignored as reconnaissance often precedes more targeted attacks. Organizations worldwide using network IDS solutions and monitoring OSINT feeds may observe similar alerts. The threat does not require authentication or user interaction and has a limited impact on confidentiality, integrity, or availability at this stage. Suggested severity is low, reflecting the preliminary nature of the activity and the absence of direct exploitation.
For the latest discoveries in cyber research for the week of 16th February, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES Dutch telecom provider Odido was hit by a data breach following unauthorized access to its customer management system. Attackers extracted personal data of 6.2 million customers, including names, addresses, phone numbers, email […] The post 16th February – Threat Intelligence Report appeared first on Check Point Research .
Luxury brands were among the dozens of major companies whose Salesforce instances were targeted by Scattered LAPSUS$ Hunters. The post Dior, Louis Vuitton, Tiffany Fined $25 Million in South Korea After Data Breaches appeared first on SecurityWeek .
A coordinated campaign of Chrome extensions posing as AI assistants has been uncovered, affecting over 260,000 users. These extensions, while appearing legitimate, embed remote, server-controlled interfaces inside extension-controlled surfaces, granting access to sensitive browser capabilities. The campaign consists of 30 different extensions sharing the same codebase, permissions, and backend infrastructure. Key features include remote iframe as the core UI, page content extraction, voice recognition capability, and Gmail integration. The extensions communicate with infrastructure under the tapnetic.pro domain, using subdomain segmentation for logical separation. The campaign employs extension spraying tactics to evade takedowns and quickly restore distribution. This approach breaks the browser security model, potentially allowing data harvesting and user behavior monitoring.
