TECHZONE™

Safe and Inclusive E‑Society: How Lithuania Is Bracing for AI‑Driven Cyber Fraud https://thehackernews.com/2026/02/safe-and-inclusive-esociety-how.html Presentation of the KTU Consortium Mission ‘A Safe and Inclusive Digital Society’ at the Innovation Agency event ‘Innovation Breakfast: How Mission-Oriented Science and Innovation Programmes Will Address Societal Challenges’. Technologies are evolving fast, reshaping economies, governance, and daily life. Yet, as innovation accelerates, so do digital risks. Technological change is no longer

New ZeroDayRAT Mobile Spyware Enables Real-Time Surveillance and Data Theft https://thehackernews.com/2026/02/new-zerodayrat-mobile-spyware-enables.html Cybersecurity researchers have disclosed details of a new mobile spyware platform dubbed ZeroDayRAT that's being advertised on Telegram as a way to grab sensitive data and facilitate real-time surveillance on Android and iOS devices. "The developer runs dedicated channels for sales, customer support, and regular updates, giving buyers a single point of access to a fully operational spyware

New Chrome Zero-Day (CVE-2026-2441) Under Active Attack — Patch Released https://thehackernews.com/2026/02/new-chrome-zero-day-cve-2026-2441-under.html Google on Friday released security updates for its Chrome browser to address a security flaw that it said has been exploited in the wild. The high-severity vulnerability, tracked as CVE-2026-2441 (CVSS score: 8.8), has been described as a use-after-free bug in CSS. Security researcher Shaheen Fazim has been credited with discovering and reporting the shortcoming on February 11, 2026. "Use after

Microsoft Discloses DNS-Based ClickFix Attack Using Nslookup for Malware Staging https://thehackernews.com/2026/02/microsoft-discloses-dns-based-clickfix.html Microsoft has disclosed details of a new version of the ClickFix social engineering tactic in which the attackers trick unsuspecting users into running commands that carry out a Domain Name System (DNS) lookup to retrieve the next-stage payload. Specifically, the attack relies on using the "nslookup" (short for nameserver lookup) command to execute a custom DNS lookup triggered via the Windows

Google Ties Suspected Russian Actor to CANFAIL Malware Attacks on Ukrainian Orgs https://thehackernews.com/2026/02/google-ties-suspected-russian-actor-to.html A previously undocumented threat actor has been attributed to attacks targeting Ukrainian organizations with malware known as CANFAIL. Google Threat Intelligence Group (GTIG) described the hack group as possibly affiliated with Russian intelligence services. The threat actor is assessed to have targeted defense, military, government, and energy organizations within the Ukrainian regional and

Google Links China, Iran, Russia, North Korea to Coordinated Defense Sector Cyber Operations https://thehackernews.com/2026/02/google-links-china-iran-russia-north.html Several state-sponsored actors, hacktivist entities, and criminal groups from China, Iran, North Korea, and Russia have trained their sights on the defense industrial base (DIB) sector, according to findings from Google Threat Intelligence Group (GTIG). The tech giant's threat intelligence division said the adversarial targeting of the sector is centered around four key themes: striking defense

UAT-9921 Deploys VoidLink Malware to Target Technology and Financial Sectors https://thehackernews.com/2026/02/uat-9921-deploys-voidlink-malware-to.html A previously unknown threat actor tracked as UAT-9921 has been observed leveraging a new modular framework called VoidLink in its campaigns targeting the technology and financial services sectors, according to findings from Cisco Talos. "This threat actor seems to have been active since 2019, although they have not necessarily used VoidLink over the duration of their activity," researchers Nick

Malicious Chrome Extensions Caught Stealing Business Data, Emails, and Browsing History https://thehackernews.com/2026/02/malicious-chrome-extensions-caught.html Cybersecurity researchers have discovered a malicious Google Chrome extension that's designed to steal data associated with Meta Business Suite and Facebook Business Manager. The extension, named CL Suite by @CLMasters (ID: jkphinfhmfkckkcnifhjiplhfoiefffl), is marketed as a way to scrape Meta Business Suite data, remove verification pop-ups, and generate two-factor authentication (2FA) codes.

npm’s Update to Harden Their Supply Chain, and Points to Consider https://thehackernews.com/2026/02/npms-update-to-harden-their-supply.html In December 2025, in response to the Sha1-Hulud incident, npm completed a major authentication overhaul intended to reduce supply-chain attacks. While the overhaul is a solid step forward, the changes don’t make npm projects immune from supply-chain attacks. npm is still susceptible to malware attacks – here’s what you need to know for a safer Node community. Let’s start with the original

Researchers Observe In-the-Wild Exploitation of BeyondTrust CVSS 9.9 Vulnerability https://thehackernews.com/2026/02/researchers-observe-in-wild.html Threat actors have started to exploit a recently disclosed critical security flaw impacting BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) products, according to watchTowr. "Overnight we observed first in-the-wild exploitation of BeyondTrust across our global sensors," Ryan Dewhurst, head of threat intelligence at watchTowr, said in a post on X. "Attackers are abusing

Naming and shaming: How ransomware groups tighten the screws on victims https://www.welivesecurity.com/en/ransomware/naming-shaming-ransomware-groups-tighten-screws-victims/ When corporate data is exposed on a dedicated leak site, the consequences linger long after the attack fades from the news cycle

Google Reports State-Backed Hackers Using Gemini AI for Recon and Attack Support https://thehackernews.com/2026/02/google-reports-state-backed-hackers.html Google on Thursday said it observed the North Korea-linked threat actor known as UNC2970 using its generative artificial intelligence (AI) model Gemini to conduct reconnaissance on its targets, as various hacking groups continue to weaponize the tool for accelerating various phases of the cyber attack life cycle, enabling information operations, and even conducting model extraction attacks. "The

Lazarus Campaign Plants Malicious Packages in npm and PyPI Ecosystems https://thehackernews.com/2026/02/lazarus-campaign-plants-malicious.html Cybersecurity researchers have discovered a fresh set of malicious packages across npm and the Python Package Index (PyPI) repository linked to a fake recruitment-themed campaign orchestrated by the North Korea-linked Lazarus Group. The coordinated campaign has been codenamed graphalgo in reference to the first package published in the npm registry. It's assessed to be active since May 2025. "

ThreatsDay Bulletin: AI Prompt RCE, Claude 0-Click, RenEngine Loader, Auto 0-Days & 25+ Stories https://thehackernews.com/2026/02/threatsday-bulletin-ai-prompt-rce.html Threat activity this week shows one consistent signal — attackers are leaning harder on what already works. Instead of flashy new exploits, many operations are built around quiet misuse of trusted tools, familiar workflows, and overlooked exposures that sit in plain sight. Another shift is how access is gained versus how it’s used. Initial entry points are getting simpler, while post-compromise

The CTEM Divide: Why 84% of Security Programs Are Falling Behind https://thehackernews.com/2026/02/the-ctem-divide-why-84-of-security.html A new 2026 market intelligence study of 128 enterprise security decision-makers (available here) reveals a stark divide forming between organizations – one that has nothing to do with budget size or industry and everything to do with a single framework decision. Organizations implementing Continuous Threat Exposure Management (CTEM) demonstrate 50% better attack surface visibility, 23-point

83% of Ivanti EPMM Exploits Linked to Single IP on Bulletproof Hosting Infrastructure https://thehackernews.com/2026/02/83-of-ivanti-epmm-exploits-linked-to.html A significant chunk of the exploitation attempts targeting a newly disclosed security flaw in Ivanti Endpoint Manager Mobile (EPMM) can be traced back to a single IP address on bulletproof hosting infrastructure offered by PROSPERO. Threat intelligence firm GreyNoise said it recorded 417 exploitation sessions from 8 unique source IP addresses between February 1 and 9, 2026. An estimated 346

Apple Fixes Exploited Zero-Day Affecting iOS, macOS, and Apple Devices https://thehackernews.com/2026/02/apple-fixes-exploited-zero-day.html Apple on Wednesday released iOS, iPadOS, macOS Tahoe, tvOS, watchOS, and visionOS updates to address a zero-day flaw that it said has been exploited in sophisticated cyber attacks. The vulnerability, tracked as CVE-2026-20700 (CVSS score: N/A), has been described as a memory corruption issue in dyld, Apple's Dynamic Link Editor. Successful exploitation of the vulnerability could allow an

First Malicious Outlook Add-In Found Stealing 4,000+ Microsoft Credentials https://thehackernews.com/2026/02/first-malicious-outlook-add-in-found.html Cybersecurity researchers have discovered what they said is the first known malicious Microsoft Outlook add-in detected in the wild. In this unusual supply chain attack detailed by Koi Security, an unknown attacker claimed the domain associated with a now-abandoned legitimate add-in to serve a fake Microsoft login page, stealing over 4,000 credentials in the process. The activity has been

APT36 and SideCopy Launch Cross-Platform RAT Campaigns Against Indian Entities https://thehackernews.com/2026/02/apt36-and-sidecopy-launch-cross.html Indian defense sector and government-aligned organizations have been targeted by multiple campaigns that are designed to compromise Windows and Linux environments with remote access trojans capable of stealing sensitive data and ensuring continued access to infected machines. The campaigns are characterized by the use of malware families like Geta RAT, Ares RAT, and DeskRAT, which are often

Over 60 Software Vendors Issue Security Fixes Across OS, Cloud, and Network Platforms https://thehackernews.com/2026/02/over-60-software-vendors-issue-security.html It's Patch Tuesday, which means a number of software vendors have released patches for various security vulnerabilities impacting their products and services. Microsoft issued fixes for 59 flaws, including six actively exploited zero-days in various Windows components that could be abused to bypass security features, escalate privileges, and trigger a denial-of-service (DoS) condition. Elsewhere