A coordinated campaign of Chrome extensions posing as AI assistants has been uncovered, affecting over 260,000 users. These extensions, while appearing legitimate, embed remote, server-controlled interfaces inside extension-controlled surfaces, granting access to sensitive browser capabilities. The campaign consists of 30 different extensions sharing the same codebase, permissions, and backend infrastructure. Key features include remote iframe as the core UI, page content extraction, voice recognition capability, and Gmail integration. The extensions communicate with infrastructure under the tapnetic.pro domain, using subdomain segmentation for logical separation. The campaign employs extension spraying tactics to evade takedowns and quickly restore distribution. This approach breaks the browser security model, potentially allowing data harvesting and user behavior monitoring.
Operation MacroMaze, attributed to APT28 (Fancy Bear), targets entities in Western and Central Europe from September 2025 to January 2026. The campaign utilizes basic tools and legitimate services for infrastructure and data exfiltration. Multiple documents with varying macro variants act as droppers, establishing a foothold by creating files in the %USERPROFILE% folder. The attack chain involves VBScript execution, scheduled task creation for persistence, and a multi-stage process using batch files. Exfiltration is achieved through HTML-based techniques, leveraging webhook.site for data transmission. Despite its simplicity, the campaign demonstrates effective operational tradeoffs, making detection and attribution challenging.
The latest Android version continues to improve security and privacy, according to its developers. The post Android 17 Beta Strengthens Secure-by-Default Design for Privacy and App Security appeared first on SecurityWeek .
CISA is currently operating at roughly 38% capacity (888 out of 2,341 staff) due to the DHS shutdown that began February 14, 2026. The post CISA Navigates DHS Shutdown With Reduced Staff appeared first on SecurityWeek .
Attackers are using DNS requests to deliver a RAT named ModeloRAT to targeted users. The post Microsoft Warns of ClickFix Attack Abusing DNS Lookups appeared first on SecurityWeek .
A malicious campaign exploiting Google Groups to distribute Lumma Stealer and Ninja Browser malware has been uncovered. The attackers infiltrate industry-related forums, posting seemingly legitimate technical discussions with embedded malicious download links. For Windows users, the payload is Lumma Stealer, a credential-harvesting malware. Linux users are directed to download a trojanized Chromium-based browser called Ninja Browser, which installs malicious extensions and persistence mechanisms. The campaign utilizes Google's trusted ecosystem to bypass security measures and increase user confidence. Over 4,000 malicious Google Groups and 3,500 Google-hosted URLs have been identified in this global operation, posing significant risks to organizations including credential theft, account takeover, and remote command execution.
In 2022 (time flies!), I wrote a diary about the 32-bits VS.64-bits malware landscape[1]. It demonstrated that, despite the growing number of 64-bits computers, the "old-architecture" remained the standard. In the SANS malware reversing training (FOR610[2]), we quickly cover the main differences between the two architectures. One of the conclusions is that 32-bits code is still popular because it acts like a comme denominator and allows threat actors to target more Windows computers. Yes, Microsoft Windows can smoothly execute 32-bits code on 64-bits computers. It is still the case in 2026? Did the situation evolved?
The KRVTZ-NET IDS alerts dated February 16, 2026, indicate network reconnaissance activity detected by intrusion detection systems and reported via the CIRCL OSINT feed. The activity involves network traffic from IP address 43.130.26.3, characterized by unusual User-Agent strings labeled as "_TEST_", suggesting automated scanning or probing. This reconnaissance is an early phase in the cyber kill chain, aimed at gathering information rather than exploiting vulnerabilities. No specific affected products, CVEs, or patches are associated with this alert, and no known exploits are in the wild. The threat is classified as low severity due to the absence of direct exploitation or immediate compromise. However, such reconnaissance can precede more advanced attacks, making detection and monitoring crucial. The alert is primarily relevant to organizations with internet-facing assets, especially in Europe, where the IP origin and historical patterns suggest higher scanning likelihood.
The KRVTZ-NET IDS alerts from February 15, 2026, report ongoing reconnaissance activity targeting Fortinet FortiOS VPN devices via repeated GET requests to the /remote/logincheck endpoint. This activity is linked to CVE-2023-27997, a vulnerability that allows unauthenticated attackers to probe VPN login endpoints remotely. While no active exploits or ransomware campaigns are currently tied to these alerts, the scanning indicates attackers are gathering information for potential future exploitation. The immediate severity is low, but unpatched vulnerabilities could lead to unauthorized access or denial of service. Organizations, particularly in Europe where Fortinet VPNs are prevalent, should prioritize patching and hardening VPN infrastructure to mitigate risk.
With more than 37 million combined downloads, the extensions expose users to tracking and personal information theft. The post Over 300 Malicious Chrome Extensions Caught Leaking or Stealing User Data appeared first on SecurityWeek .
Hackers stole personal information such as names, addresses, and phone numbers from a customer contact system. The post Dutch Carrier Odido Discloses Data Breach Impacting 6 Million appeared first on SecurityWeek .
Netskope Threat Labs has identified multiple phishing campaigns exploiting video conference invitations from Zoom, Microsoft Teams, and Google Meet. The attackers use fake meeting invites to trick users into downloading malicious payloads disguised as software updates. These payloads are actually legitimate, digitally signed remote monitoring and management (RMM) tools like Datto RMM, LogMeIn, or ScreenConnect. By leveraging these tools, attackers gain administrative remote access to victims' machines, potentially leading to data theft or further malware deployment. The campaigns use convincing phishing pages that mimic legitimate video conferencing platforms, exploiting users' urgency to join scheduled calls. This sophisticated approach allows attackers to bypass traditional security measures and establish a persistent foothold in corporate networks.
Rewards for exploits are reportedly much smaller than in the contest’s glory days. The post China Revives Tianfu Cup Hacking Contest Under Increased Secrecy appeared first on SecurityWeek .
