For a few days, many phishing emails that landed into my mailbox contain strange URLs. They are classic emails asking you to open a document, verify your pending emails, …
A malicious email attachment containing a . bat script is delivering a multi-stage malware payload designed to steal data via a Chrome injector. The initial script is a fork of publicly available GitHub code but includes obfuscated Base64-encoded payloads executed through PowerShell. The payload fetches additional components from a compromised website, including a . NET program that establishes persistence via scheduled tasks and communicates with a Telegram-based command and control (C2) server. This malware, identified as XWorm V7.x, uses sophisticated obfuscation and evasion techniques to avoid detection. It targets Windows systems and aims to steal sensitive information silently. The attack does not require user interaction beyond opening the malicious attachment and does not currently have known widespread exploitation but poses a medium risk. European organizations using Windows and Chrome browsers are potential targets, especially those with less mature email security controls.
CVE-2026-25538 is a high-severity vulnerability in Devtron versions 2.0.0 and earlier, where an authorization bypass in the Attributes API allows any authenticated user, including low-privileged CI/CD developers, to retrieve the global API token signing key. With this key, attackers can forge JWT tokens for any user identity, gaining full control over the Devtron platform and enabling lateral movement into the underlying Kubernetes cluster. The vulnerability requires no user interaction and can be exploited remotely with low complexity. This flaw has been patched in later versions. European organizations using Devtron for Kubernetes integration are at risk of severe confidentiality, integrity, and availability impacts if unpatched. Mitigation involves immediate upgrading to patched versions and restricting access to the Attributes API endpoint. Countries with significant Kubernetes adoption and Devtron usage, such as Germany, the UK, France, and the Netherlands, are most likely affected.
In early February 2026, an intrusion was detected where threat actors exploited compromised SonicWall SSLVPN credentials for initial network access. The attackers deployed an EDR killer utilizing a legitimate but revoked EnCase forensic driver to terminate security processes from kernel mode. This technique, known as Bring Your Own Vulnerable Driver (BYOVD), bypasses Windows Driver Signature Enforcement. The attack was halted before ransomware deployment, but it highlights the growing trend of weaponizing signed, legitimate drivers to disable endpoint security. The intrusion involved aggressive network reconnaissance, deployment of a sophisticated EDR killer with an encoded kernel driver payload, and attempts to establish persistence. The case underscores the importance of multi-factor authentication, VPN log monitoring, and implementing Microsoft's recommended driver block rules.
An AWS environment was targeted in a sophisticated attack, with the threat actor gaining administrative privileges in under 10 minutes. The operation showed signs of leveraging large language models for automation and decision-making. Initial access was obtained through credentials found in public S3 buckets, followed by rapid privilege escalation via Lambda function code injection. The attacker moved laterally across 19 AWS principals, abused Amazon Bedrock for LLMjacking, and launched GPU instances for potential model training. The attack involved extensive reconnaissance, data exfiltration, and attempts to establish persistence. Notable techniques included IP rotation, role chaining, and the use of AI-generated code.
Transparent Tribe, also known as APT36, has expanded its targeting to include India's startup ecosystem, particularly those in the cybersecurity domain. The group is using startup-oriented themed lure material delivered via ISO container-based files to deploy Crimson RAT. This campaign deviates from their typical government and defense targets, suggesting a shift in strategy towards companies providing open-source intelligence services and collaborating with law enforcement agencies. The attack chain involves spear-phishing emails, malicious LNK files, and batch scripts to execute the Crimson RAT payload. The malware employs extensive obfuscation techniques and uses a custom TCP protocol for command and control communications. This activity demonstrates the group's adaptation of proven tooling for new victim profiles while maintaining its core behavioral tactics, techniques, and procedures.
A shadow DNS network and HTTP-based traffic distribution system (TDS) hosted in Aeza International, a sanctioned bulletproof hosting company, has been discovered. The system compromises routers, altering their DNS settings to use shadow resolvers. These resolvers selectively modify responses, directing users to malicious content. The TDS incorporates a clever DNS trick to evade detection by security groups. The system, operational since mid-2022, appears to be run by a financially motivated actor in affiliate marketing. It has the potential to interfere with devices on the network, alter DNS records, and conduct adversary-in-the-middle operations. The threat actor's ability to control DNS resolution poses significant risks beyond delivering unwanted advertising.
A major cybercriminal operation called Rublevka Team has generated over $10 million through cryptocurrency theft since 2023. The group employs a network of social engineering specialists who direct victims to malicious pages impersonating legitimate crypto services. Using custom JavaScript scripts, they trick users into connecting wallets and authorizing fraudulent transactions. Rublevka Team's infrastructure is fully automated, offering affiliates access to tools for launching high-volume scams. Their model poses a growing threat to cryptocurrency platforms and brands, with potential for reputational and legal risks. The group's agility in rotating domains and targeting lower-cost chains like Solana undermines traditional fraud detection efforts.
Amaranth-Dragon is a targeted espionage campaign exploiting CVE-2025-8088, focusing on government entities in Southeast Asia. The threat actor demonstrates geopolitical motivations, aiming to gather intelligence through weaponizing this vulnerability. Although no known exploits are currently active in the wild, the medium severity rating indicates moderate risk. The campaign's focus on sensitive government targets suggests potential for significant confidentiality breaches if exploited. European organizations are not directly targeted but could face indirect risks through geopolitical spillover or supply chain connections. Mitigation requires proactive vulnerability management, network segmentation, and enhanced monitoring for suspicious activity related to CVE-2025-8088 exploitation attempts. Countries with strong geopolitical ties or intelligence-sharing agreements with Southeast Asia, such as the UK, Germany, and France, may have heightened interest or exposure. Given the medium severity, the threat poses moderate risk with potential confidentiality impact but limited scope and no current active exploitation. Defenders should prioritize awareness and readiness to respond to any emerging exploitation attempts.
While both cyberwar and cyberwarfare will increase through 2026, cyberwarfare is likely to increase more dramatically. We hope it will never boil over – but we should be aware of the possibility and its consequences. The post Cyber Insights 2026: Cyberwar and Rising Nation State Threats appeared first on SecurityWeek .
A massive malware campaign dubbed ClawHavoc has been uncovered in the ClawHub marketplace, targeting OpenClaw bots and their users. An AI bot named Alex, working with security researcher Oren Yomtov, discovered 341 malicious skills, including 335 from a single campaign. The malware, identified as Atomic Stealer (AMOS), uses sophisticated techniques to evade detection and steal sensitive data. The attack exploits users' trust in AI assistants, potentially compromising personal and financial information. In response, a new tool called Clawdex has been developed to help bots and users scan for malicious skills before installation.
Almost 400 fake crypto trading add-ons in the Moltbot/OpenClaw AI assistant project have been discovered, potentially leading users to install information-stealing malware. These add-ons, known as skills, masquerade as cryptocurrency trading automation tools and target various platforms. The malicious skills share the same command-and-control infrastructure and use social engineering to convince users to execute commands that steal crypto assets. The supply chain attack relies on social engineering and lacks security review in the skills publication process. Security experts warn about the inherent risks of endpoint-native AI agents and emphasize the need for proper security controls and architectural design considerations.
Two IP addresses accounted for the majority of the 1.4 million exploitation attempts observed over the past week. The post Cryptominers, Reverse Shells Dropped in Recent React2Shell Attacks appeared first on SecurityWeek .
Wiz and Permiso have analyzed the AI agent social network and found serious security issues and threats. The post Security Analysis of Moltbook Agent Network: Bot-to-Bot Prompt Injection and Data Leaks appeared first on SecurityWeek .
CVE-2026-20981 is a medium severity vulnerability in Samsung Mobile devices caused by improper input validation in the FacAtFunction component prior to the SMR February 2026 Release 1. This flaw allows a privileged physical attacker to execute arbitrary commands with system-level privileges. Exploitation requires physical access and privileged status, with no user interaction needed. The vulnerability impacts confidentiality, integrity, and availability due to the potential for full system compromise. No known exploits are currently in the wild, and no patches have been linked yet. European organizations using Samsung Mobile devices could be at risk, especially in countries with high Samsung market penetration and critical infrastructure relying on these devices. Mitigation involves restricting physical access, monitoring for unusual system commands, and promptly applying Samsung's security updates once released. Countries like Germany, the UK, France, Italy, and Spain are most likely affected due to their large Samsung user bases and strategic importance. The vulnerability's medium severity reflects the balance between high impact and the requirement for physical privileged access.
CVE-2026-20980 is a high-severity vulnerability affecting Samsung Mobile devices due to improper input validation in the PACM component prior to the SMR Feb-2026 Release 1. This flaw allows a physical attacker to execute arbitrary commands on the device without requiring authentication or user interaction. The vulnerability has a CVSS 4.0 score of 7.0, reflecting its significant impact on confidentiality, integrity, and availability. Although no known exploits are currently reported in the wild, the ease of exploitation and the critical nature of mobile devices make this a serious threat. European organizations using Samsung Mobile devices, especially those with sensitive data or critical communications, could face risks of device compromise and data breaches. Mitigation requires timely application of Samsung’s security updates once available, physical device security controls, and monitoring for unusual device behavior. Countries with high Samsung mobile market penetration and strategic importance in technology sectors, such as Germany, the UK, France, and Italy, are most likely to be affected. Defenders should prioritize patch management and physical security to reduce exposure to this vulnerability.
CVE-2026-1791 is a vulnerability in Hillstone Networks Operation and Maintenance Security Gateway version V5.5ST00001B113 that allows unrestricted upload of files with dangerous types, potentially enabling an attacker to upload a web shell to the web server. The vulnerability is categorized under CWE-434 and affects Linux-based deployments of the product. Although the CVSS score is low (2.7) due to the requirement of high privileges and no direct impact on confidentiality or integrity, it can cause availability issues by allowing denial of service or unauthorized code execution. No known exploits are currently reported in the wild. European organizations using this product should be aware of the risk, especially those with critical infrastructure relying on Hillstone security gateways. Mitigation involves applying vendor patches once available, restricting file upload permissions, and monitoring for suspicious file uploads. Countries with higher adoption of Hillstone products and strategic infrastructure reliance on these gateways, such as Germany, France, and the UK, are more likely to be affected. Overall, the threat is low severity but should be addressed promptly to prevent potential exploitation.
On February 4, 2026, KRVTZ-NET IDS detected network reconnaissance activity targeting Fortigate VPN devices, specifically scanning the /remote/logincheck endpoint associated with CVE-2023-27997. This vulnerability could allow unauthorized access or remote code execution. No active exploitation or payload delivery was observed, and no patches are currently available for this specific alert. The activity is low severity and likely represents early-stage reconnaissance. European organizations using Fortigate VPNs, especially in critical infrastructure and government sectors, should be aware of this scanning activity.
