PayPal blamed an application error for the exposure of customer personal information for nearly 6 months. The post PayPal Data Breach Led to Fraudulent Transactions appeared first on SecurityWeek .
For the latest discoveries in cyber research for the week of 23rd February, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES France’s Ministry of Economy has disclosed a data breach resulted from an unauthorized access to the national bank account registry FICOBA, impacting information tied to 1.2 million accounts. Exposed data includes names, […] The post 23rd February – Threat Intelligence Report appeared first on Check Point Research .
The KRVTZ-NET IDS alerts from 2026-02-23 report reconnaissance activity targeting Fortigate VPN devices via repeated GET requests to the /remote/logincheck endpoint linked to CVE-2023-27997. This vulnerability allows unauthenticated attackers to bypass authentication and potentially execute arbitrary commands. The alerts also note scanning for hidden environment files and PHP info pages to gather sensitive configuration data. No active exploitation or ransomware campaigns are currently associated with these activities. The threat is considered low severity and represents broad scanning efforts from diverse global sources.
A series of targeted phishing campaigns in Taiwan have been observed disseminating Winos 4.0 (ValleyRat) malware and associated plugins. The attacks exploit local business processes using themes like tax audits and e-invoices. The campaigns employ various techniques including malicious LNK files, DLL sideloading, and Bring Your Own Vulnerable Driver (BYOVD) attacks. The malware utilizes UAC bypassing, driver loading, and process termination to evade detection and disable security software. The attacks are attributed to a subgroup of the Silver Fox APT, showing sophisticated localization and evolving evasion techniques. The campaigns have been active since at least January 2026, using consistent infrastructure and development identifiers.
This entry describes a Maltrail Indicator of Compromise (IOC) dated February 22, 2026, sourced from the CIRCL OSINT feed. It is categorized as malware-related network activity with a medium severity rating. The information is based on open-source intelligence (OSINT) and represents an observation rather than a confirmed exploit or active campaign. No specific affected versions, exploits in the wild, or patches are associated with this IOC. The lack of detailed technical indicators or exploit data limits actionable insights. Organizations should consider this as a medium-risk intelligence input for network monitoring and threat detection. The threat does not currently appear to target specific products or regions. Defenders should remain vigilant but note the absence of immediate exploit evidence.
The Maltrail IOC for 2026-02-21 is an open-source intelligence (OSINT) observation related to malware network activity, published by CIRCL. It is classified as a medium-risk threat with no specific affected versions or known exploits in the wild. The information is derived from manual collection and is intended for broad, unsupervised automation use. No patches or direct remediation links are available, indicating this is primarily an intelligence feed rather than a vulnerability or active exploit. The threat relates to network activity patterns detected by Maltrail, a network traffic detection system. Due to the lack of detailed technical indicators or exploit data, the threat's impact is assessed as medium, with potential risks to network monitoring and detection capabilities. Organizations relying on Maltrail or similar network monitoring tools should remain vigilant and integrate this IOC into their threat detection processes. Countries with significant internet infrastructure and cybersecurity monitoring deployments are more likely to be affected. The threat does not require authentication or user interaction for detection but also lacks evidence of active exploitation, leading to a medium severity rating.
NIST’s single photon chip will likely make QKD an option for a wider range of companies. The post NIST’s Quantum Breakthrough: Single Photons Produced on a Chip appeared first on SecurityWeek .
The company is investigating whether any customer or employee data was stolen by hackers. The post Chip Testing Giant Advantest Hit by Ransomware appeared first on SecurityWeek .
The malware leverages Gemini to analyze on-screen elements and ensure that it remains on the device even after a reboot. The post PromptSpy Android Malware Abuses Gemini AI at Runtime for Persistence appeared first on SecurityWeek .
This entry describes a Maltrail Indicator of Compromise (IOC) dated February 20, 2026, sourced from the CIRCL OSINT feed. It is categorized as malware-related network activity with a medium risk level. No specific affected product versions, exploits in the wild, or patches are identified. The information is derived from open-source intelligence and manual collection methods, indicating ongoing monitoring rather than a newly discovered vulnerability or active exploit. The lack of technical details and indicators limits actionable insights. Organizations should consider this as a medium-risk observation that may reflect suspicious network behavior but does not currently represent an active or widespread threat. Vigilance in network monitoring and threat intelligence correlation is advised. Given the absence of exploit details and patch availability, the suggested severity is medium.
The KRVTZ-NET IDS alerts from February 20, 2026, report observed network reconnaissance activity primarily involving scanning from IP 125.209.235.172, associated with the Naver Webcrawler user-agent, and probing localhost (::1) addresses. These activities represent automated, unsupervised scanning rather than targeted exploitation attempts, with no known vulnerabilities or exploits linked. The alerts are classified as low severity and serve mainly as situational awareness for network defenders to recognize benign or low-risk scanning. While the immediate impact is minimal, persistent reconnaissance can aid attackers in mapping networks and identifying future attack vectors. Organizations with exposed internet-facing services, especially in regions where Naver is popular, may see more frequent scanning and should monitor accordingly. Mitigation focuses on detection tuning, network segmentation, and threat intelligence integration rather than patching. Countries with significant risk include South Korea, United States, Japan, China, Germany, United Kingdom, France, Canada, and Australia.
This intelligence report details a hybrid cryptocurrency investment scam campaign targeting users in Asia, particularly Japan. The scam combines malvertising techniques to attract victims with pig butchering tactics using AI-powered chatbots for sustained engagement. Victims are lured through social media ads impersonating financial experts, directed to lure websites, and then to messaging apps where automated bots manipulate them into making increasingly large investments. The campaign uses over 23,000 domains, many generated algorithmically, and shows signs of expanding globally. This approach represents a scalable, automated evolution of traditional investment fraud methods, potentially transforming labor-intensive scams into more efficient operations.
Infoblox security researchers have discovered a group of malicious domains hosting cryptocurrency scams, some linked to hacked YouTube channels. The domains, initially registered under CryptDesignBot, frequently change registrars to conceal information. They use lookalike domains to impersonate legitimate brands. Hacked YouTube channels are exploited to promote scam crypto domains through fake livestreams. The scams often claim to double cryptocurrency, mimicking old RuneScape scams. Many domains use keywords associated with celebrities and brands like Elon Musk and Tesla. Protective measures include implementing protective DNS, securing cookies, using HTTPS, generating random session IDs, and setting session timeouts. Infoblox's BloxOne Threat Defense offers protective DNS capabilities to combat sophisticated threats.
A malicious fork of the MacOS app Triton was discovered on GitHub, containing Windows-targeted malware disguised as the legitimate application. The attacker modified the repository, redirecting download links to a ZIP file hosting the malware. Analysis revealed sophisticated evasion techniques, anti-analysis features, and potential cryptocurrency functionality. The low detection rate and peculiar implementation suggest either an amateur attempt or a possible AI-generated attack. The incident highlights broader concerns about GitHub's security practices and Microsoft's priorities, prompting a call for developers to consider alternative code hosting platforms that better align with open-source values and user privacy.
A new phishing tactic involving fake Microsoft and Google Calendar invites has been identified, aimed at stealing login credentials. These sophisticated attacks mimic designs from well-known platforms, exploiting routine business activities like scheduling meetings. Threat actors use email spoofing and create fake urgent calendar invitations to deceive employees. The phishing emails often contain buttons or links that redirect to fake login pages, closely resembling official Microsoft or Google login screens. The campaigns exploit the popularity of calendar invitations in corporate environments, allowing attackers to gather sensitive information if users are not vigilant. To prevent falling victim to these attacks, it is crucial to verify the authenticity of calendar invites, carefully check sender details, and avoid clicking suspicious links from unknown senders.
