Cisco Talos uncovered 'DKnife', a sophisticated gateway-monitoring and adversary-in-the-middle (AitM) framework comprising seven Linux-based implants. Used since 2019, DKnife performs deep-packet inspection, traffic manipulation, and malware delivery via routers and edge devices. It targets various devices, including PCs, mobile devices, and IoT, delivering ShadowPad and DarkNimbus backdoors. The framework primarily targets Chinese-speaking users, with evidence suggesting China-nexus threat actors as operators. DKnife's capabilities include DNS hijacking, Android application update hijacking, Windows binary hijacking, anti-virus traffic disruption, and user activity monitoring. A link to the WizardNet campaign was also discovered, indicating a shared development or operational lineage.
Marco Stealer, discovered in June 2025, is an information stealer targeting browser data, cryptocurrency wallets, and sensitive files. It employs anti-analysis techniques, string encryption, and terminates security tools. The malware collects system information, exfiltrates browser data using embedded files, and extracts cryptocurrency wallet data from browser extensions. It also targets popular services and cloud storage. Marco Stealer uses AES-256 encryption for C2 communication over HTTP. Despite recent law enforcement actions against similar threats, information stealers continue to pose significant risks to corporate environments.
A new evolution in the ClickFix campaign, dubbed CrashFix, has been identified. This variant deliberately crashes victims' browsers and uses social engineering to lure users into executing malicious commands. The attack begins with a malicious ad redirecting users to install a harmful browser extension impersonating a legitimate ad blocker. The payload causes delayed browser issues and presents a fake security warning. It misuses the Windows utility finger.exe to execute malicious commands and downloads additional payloads, including a Python-based Remote Access Trojan (RAT). The RAT, named ModeloRAT, establishes persistence and performs extensive reconnaissance. The campaign targets domain-joined systems and employs multiple obfuscation techniques to evade detection.
The hacker claims to have stolen nearly 700,000 Substack user records, including email addresses and phone numbers. The post Substack Discloses Security Incident After Hacker Leaks Data appeared first on SecurityWeek .
Criminals are using AI to clone professional websites at an industrial scale. A new report shows how one AI-powered network grew to 150+ domains by hiding behind Cloudflare and rotating IP ranges. The post Researchers Expose Network of 150 Cloned Law Firm Websites in AI-Powered Scam Campaign appeared first on SecurityWeek .
VS Code-integrated configuration files are automatically executed in Codespaces when the user opens a repository or pull request. The post VS Code Configs Expose GitHub Codespaces to Attacks appeared first on SecurityWeek .
SystemBC is a malware strain that has recently infected over 10,000 devices despite previous law enforcement efforts to dismantle its infrastructure. It is primarily known for deploying ransomware and other malicious payloads, as well as using compromised machines to proxy traffic, which can facilitate further attacks or anonymize threat actor activities. The malware's persistence and ability to evade takedown attempts highlight its resilience and ongoing threat. Although no specific affected software versions or exploits are detailed, the infection scale and functionality suggest a significant risk to organizations. The threat is rated medium severity due to its impact on confidentiality and availability, moderate ease of exploitation, and broad infection scope. European organizations, especially those with extensive networked environments, could face operational disruptions and data breaches. Mitigation requires focused network monitoring, blocking known proxy traffic patterns, and rapid incident response to infected hosts. Countries with high technology adoption and critical infrastructure are more likely targets. Defenders should prioritize detection of SystemBC-related traffic and strengthen endpoint protections to prevent initial infection and lateral movement.
The Cyberspy Group is an advanced persistent threat (APT) actor that has conducted cyber espionage operations targeting governments and critical infrastructure across 37 countries. Although Palo Alto Networks has not officially attributed this group, evidence suggests a likely connection to China. The campaign involves sophisticated intrusion techniques aimed at compromising sensitive governmental and infrastructure systems, potentially leading to significant confidentiality and operational impacts. No specific affected software versions or vulnerabilities have been disclosed, and no known exploits are currently reported in the wild. The threat is assessed as critical due to the broad scope, high-value targets, and potential for severe disruption. European organizations, especially those involved in government and critical infrastructure sectors, face heightened risk. Mitigation requires enhanced network monitoring, threat intelligence sharing, and rigorous access controls tailored to detect and prevent APT intrusions. Countries with significant government and critical infrastructure digital footprints, such as Germany, France, the UK, Italy, and the Netherlands, are most likely to be affected given their strategic importance and historical targeting patterns. The threat's complexity and stealthy nature necessitate proactive defense measures beyond standard patching and antivirus solutions.
For a few days, many phishing emails that landed into my mailbox contain strange URLs. They are classic emails asking you to open a document, verify your pending emails, …
A malicious email attachment containing a . bat script is delivering a multi-stage malware payload designed to steal data via a Chrome injector. The initial script is a fork of publicly available GitHub code but includes obfuscated Base64-encoded payloads executed through PowerShell. The payload fetches additional components from a compromised website, including a . NET program that establishes persistence via scheduled tasks and communicates with a Telegram-based command and control (C2) server. This malware, identified as XWorm V7.x, uses sophisticated obfuscation and evasion techniques to avoid detection. It targets Windows systems and aims to steal sensitive information silently. The attack does not require user interaction beyond opening the malicious attachment and does not currently have known widespread exploitation but poses a medium risk. European organizations using Windows and Chrome browsers are potential targets, especially those with less mature email security controls.
The KRVTZ-NET IDS alerts from February 5, 2026, report reconnaissance activities targeting Fortigate VPN devices and web applications vulnerable to JavaScript prototype pollution. The reconnaissance includes scanning and probing from multiple IP addresses, with repeated attempts to exploit CVE-2023-27997, which allows unauthenticated attackers to bypass authentication on Fortigate VPNs. No active exploitation or lateral movement has been observed. The overall severity of this reconnaissance phase is low, but it indicates ongoing threat actor interest. Organizations, particularly in Europe, using Fortigate VPNs or vulnerable web applications should prioritize patching and hardening to mitigate future risks.
CVE-2026-25538 is a high-severity vulnerability in Devtron versions 2.0.0 and earlier, where an authorization bypass in the Attributes API allows any authenticated user, including low-privileged CI/CD developers, to retrieve the global API token signing key. With this key, attackers can forge JWT tokens for any user identity, gaining full control over the Devtron platform and enabling lateral movement into the underlying Kubernetes cluster. The vulnerability requires no user interaction and can be exploited remotely with low complexity. This flaw has been patched in later versions. European organizations using Devtron for Kubernetes integration are at risk of severe confidentiality, integrity, and availability impacts if unpatched. Mitigation involves immediate upgrading to patched versions and restricting access to the Attributes API endpoint. Countries with significant Kubernetes adoption and Devtron usage, such as Germany, the UK, France, and the Netherlands, are most likely affected.
In early February 2026, an intrusion was detected where threat actors exploited compromised SonicWall SSLVPN credentials for initial network access. The attackers deployed an EDR killer utilizing a legitimate but revoked EnCase forensic driver to terminate security processes from kernel mode. This technique, known as Bring Your Own Vulnerable Driver (BYOVD), bypasses Windows Driver Signature Enforcement. The attack was halted before ransomware deployment, but it highlights the growing trend of weaponizing signed, legitimate drivers to disable endpoint security. The intrusion involved aggressive network reconnaissance, deployment of a sophisticated EDR killer with an encoded kernel driver payload, and attempts to establish persistence. The case underscores the importance of multi-factor authentication, VPN log monitoring, and implementing Microsoft's recommended driver block rules.
An AWS environment was targeted in a sophisticated attack, with the threat actor gaining administrative privileges in under 10 minutes. The operation showed signs of leveraging large language models for automation and decision-making. Initial access was obtained through credentials found in public S3 buckets, followed by rapid privilege escalation via Lambda function code injection. The attacker moved laterally across 19 AWS principals, abused Amazon Bedrock for LLMjacking, and launched GPU instances for potential model training. The attack involved extensive reconnaissance, data exfiltration, and attempts to establish persistence. Notable techniques included IP rotation, role chaining, and the use of AI-generated code.
Transparent Tribe, also known as APT36, has expanded its targeting to include India's startup ecosystem, particularly those in the cybersecurity domain. The group is using startup-oriented themed lure material delivered via ISO container-based files to deploy Crimson RAT. This campaign deviates from their typical government and defense targets, suggesting a shift in strategy towards companies providing open-source intelligence services and collaborating with law enforcement agencies. The attack chain involves spear-phishing emails, malicious LNK files, and batch scripts to execute the Crimson RAT payload. The malware employs extensive obfuscation techniques and uses a custom TCP protocol for command and control communications. This activity demonstrates the group's adaptation of proven tooling for new victim profiles while maintaining its core behavioral tactics, techniques, and procedures.
A shadow DNS network and HTTP-based traffic distribution system (TDS) hosted in Aeza International, a sanctioned bulletproof hosting company, has been discovered. The system compromises routers, altering their DNS settings to use shadow resolvers. These resolvers selectively modify responses, directing users to malicious content. The TDS incorporates a clever DNS trick to evade detection by security groups. The system, operational since mid-2022, appears to be run by a financially motivated actor in affiliate marketing. It has the potential to interfere with devices on the network, alter DNS records, and conduct adversary-in-the-middle operations. The threat actor's ability to control DNS resolution poses significant risks beyond delivering unwanted advertising.
A major cybercriminal operation called Rublevka Team has generated over $10 million through cryptocurrency theft since 2023. The group employs a network of social engineering specialists who direct victims to malicious pages impersonating legitimate crypto services. Using custom JavaScript scripts, they trick users into connecting wallets and authorizing fraudulent transactions. Rublevka Team's infrastructure is fully automated, offering affiliates access to tools for launching high-volume scams. Their model poses a growing threat to cryptocurrency platforms and brands, with potential for reputational and legal risks. The group's agility in rotating domains and targeting lower-cost chains like Solana undermines traditional fraud detection efforts.
While both cyberwar and cyberwarfare will increase through 2026, cyberwarfare is likely to increase more dramatically. We hope it will never boil over – but we should be aware of the possibility and its consequences. The post Cyber Insights 2026: Cyberwar and Rising Nation State Threats appeared first on SecurityWeek .
A massive malware campaign dubbed ClawHavoc has been uncovered in the ClawHub marketplace, targeting OpenClaw bots and their users. An AI bot named Alex, working with security researcher Oren Yomtov, discovered 341 malicious skills, including 335 from a single campaign. The malware, identified as Atomic Stealer (AMOS), uses sophisticated techniques to evade detection and steal sensitive data. The attack exploits users' trust in AI assistants, potentially compromising personal and financial information. In response, a new tool called Clawdex has been developed to help bots and users scan for malicious skills before installation.
