TECHZONE™

APT28 Uses Microsoft Office CVE-2026-21509 in Espionage-Focused Malware Attacks https://thehackernews.com/2026/02/apt28-uses-microsoft-office-cve-2026.html The Russia-linked state-sponsored threat actor known as APT28 (aka UAC-0001) has been attributed to attacks exploiting a newly disclosed security flaw in Microsoft Office as part of a campaign codenamed Operation Neusploit. Zscaler ThreatLabz said it observed the hacking group weaponizing the shortcoming on January 29, 2026, in attacks targeting users in Ukraine, Slovakia, and Romania, three

Mozilla Adds One-Click Option to Disable Generative AI Features in Firefox https://thehackernews.com/2026/02/mozilla-adds-one-click-option-to.html Mozilla on Monday announced a new controls section in its Firefox desktop browser settings that allows users to completely turn off generative artificial intelligence (GenAI) features. "It provides a single place to block current and future generative AI features in Firefox," Ajit Varma, head of Firefox, said. "You can also review and manage individual AI features if you choose to use them. This

Notepad++ Hosting Breach Attributed to China-Linked Lotus Blossom Hacking Group https://thehackernews.com/2026/02/notepad-hosting-breach-attributed-to.html A China-linked threat actor known as Lotus Blossom has been attributed with medium confidence to the recently discovered compromise of the infrastructure hosting Notepad++. The attack enabled the state-sponsored hacking group to deliver a previously undocumented backdoor codenamed Chrysalis to users of the open-source editor, according to new findings from Rapid7. The development comes shortly

A slippery slope: Beware of Winter Olympics scams and other cyberthreats https://www.welivesecurity.com/en/cybersecurity/slippery-slope-winter-olympics-scams-cyberthreats/ It’s snow joke – sporting events are a big draw for cybercriminals. Make sure you’re not on the losing side by following these best practices.

Researchers Find 341 Malicious ClawHub Skills Stealing Data from OpenClaw Users https://thehackernews.com/2026/02/researchers-find-341-malicious-clawhub.html A security audit of 2,857 skills on ClawHub has found 341 malicious skills across multiple campaigns, according to new findings from Koi Security, exposing users to new supply chain risks. ClawHub is a marketplace designed to make it easy for OpenClaw users to find and install third-party skills. It's an extension to the OpenClaw project, a self-hosted artificial intelligence (AI) assistant

OpenClaw Bug Enables One-Click Remote Code Execution via Malicious Link https://thehackernews.com/2026/02/openclaw-bug-enables-one-click-remote.html A high-severity security flaw has been disclosed in OpenClaw (formerly referred to as Clawdbot and Moltbot) that could allow remote code execution (RCE) through a crafted malicious link. The issue, which is tracked as CVE-2026-25253 (CVSS score: 8.8), has been addressed in version 2026.1.29 released on January 30, 2026. It has been described as a token exfiltration vulnerability that leads to

Microsoft Begins NTLM Phase-Out With Three-Stage Plan to Move Windows to Kerberos https://thehackernews.com/2026/02/microsoft-begins-ntlm-phase-out-with.html Microsoft has announced a three-phase approach to phase out New Technology LAN Manager (NTLM) as part of its efforts to shift Windows environments toward stronger, Kerberos-based options. The development comes more than two years after the tech giant revealed its plans to deprecate the legacy technology, citing its susceptibility to weaknesses that could facilitate relay attacks and allow bad

⚡ Weekly Recap: Proxy Botnet, Office Zero-Day, MongoDB Ransoms, AI Hijacks & New Threats https://thehackernews.com/2026/02/weekly-recap-proxy-botnet-office-zero.html Every week brings new discoveries, attacks, and defenses that shape the state of cybersecurity. Some threats are stopped quickly, while others go unseen until they cause real damage. Sometimes a single update, exploit, or mistake changes how we think about risk and protection. Every incident shows how defenders adapt — and how fast attackers try to stay ahead. This week’s recap brings you the

Securing the Mid-Market Across the Complete Threat Lifecycle https://thehackernews.com/2026/02/securing-mid-market-across-complete.html For mid-market organizations, cybersecurity is a constant balancing act. Proactive, preventative security measures are essential to protect an expanding attack surface. Combined with effective protection that blocks threats, they play a critical role in stopping cyberattacks before damage is done. The challenge is that many security tools add complexity and cost that most mid-market businesses

Notepad++ Official Update Mechanism Hijacked to Deliver Malware to Select Users https://thehackernews.com/2026/02/notepad-official-update-mechanism.html The maintainer of Notepad++ has revealed that state-sponsored attackers hijacked the utility's update mechanism to redirect update traffic to malicious servers instead. "The attack involved [an] infrastructure-level compromise that allowed malicious actors to intercept and redirect update traffic destined for notepad-plus-plus.org," developer Don Ho said. "The compromise occurred at the hosting

eScan Antivirus Update Servers Compromised to Deliver Multi-Stage Malware https://thehackernews.com/2026/02/escan-antivirus-update-servers.html The update infrastructure for eScan antivirus, a security solution developed by Indian cybersecurity company MicroWorld Technologies, has been compromised by unknown attackers to deliver a persistent downloader to enterprise and consumer systems. "Malicious updates were distributed through eScan's legitimate update infrastructure, resulting in the deployment of multi-stage malware to enterprise

Open VSX Supply Chain Attack Used Compromised Dev Account to Spread GlassWorm https://thehackernews.com/2026/02/open-vsx-supply-chain-attack-used.html Cybersecurity researchers have disclosed details of a supply chain attack targeting the Open VSX Registry in which unidentified threat actors compromised a legitimate developer's resources to push malicious updates to downstream users. "On January 30, 2026, four established Open VSX extensions published by the oorzc author had malicious versions published to Open VSX that embed the GlassWorm

Iran-Linked RedKitten Cyber Campaign Targets Human Rights NGOs and Activists https://thehackernews.com/2026/01/iran-linked-redkitten-cyber-campaign.html A Farsi-speaking threat actor aligned with Iranian state interests is suspected to be behind a new campaign targeting non-governmental organizations and individuals involved in documenting recent human rights abuses. The activity, observed by HarfangLab in January 2026, has been codenamed RedKitten. It's said to coincide with the nationwide unrest in Iran that began towards the end of 2025,

Mandiant Finds ShinyHunters-Style Vishing Attacks Stealing MFA to Breach SaaS Platforms https://thehackernews.com/2026/01/mandiant-finds-shinyhunters-using.html Google-owned Mandiant on Friday said it identified an "expansion in threat activity" that uses tradecraft consistent with extortion-themed attacks orchestrated by a financially motivated hacking group known as ShinyHunters. The attacks leverage advanced voice phishing (aka vishing) and bogus credential harvesting sites mimicking targeted companies to gain unauthorized access to victim

CERT Polska Details Coordinated Cyber Attacks on 30+ Wind and Solar Farms https://thehackernews.com/2026/01/poland-attributes-december-cyber.html CERT Polska, the Polish computer emergency response team, revealed that coordinated cyber attacks targeted more than 30 wind and photovoltaic farms, a private company from the manufacturing sector, and a large combined heat and power plant (CHP) supplying heat to almost half a million customers in the country. The incident took place on December 29, 2025. The agency has attributed the attacks to

This month in security with Tony Anscombe – January 2026 edition https://www.welivesecurity.com/en/videos/month-security-tony-anscombe-january-2026-edition/ The trends that emerged in January offer useful clues about the risks and priorities that security teams are likely to contend with throughout the year

DynoWiper update: Technical analysis and attribution https://www.welivesecurity.com/en/eset-research/dynowiper-update-technical-analysis-attribution/ ESET researchers present technical details on a recent data destruction incident affecting a company in Poland’s energy sector

Researchers Uncover Chrome Extensions Abusing Affiliate Links and Stealing ChatGPT Access https://thehackernews.com/2026/01/researchers-uncover-chrome-extensions.html Cybersecurity researchers have discovered malicious Google Chrome extensions that come with capabilities to hijack affiliate links, steal data, and collect OpenAI ChatGPT authentication tokens. One of the extensions in question is Amazon Ads Blocker (ID: pnpchphmplpdimbllknjoiopmfphellj), which claims to be a tool to browse Amazon without any sponsored content. It was uploaded to the Chrome

China-Linked UAT-8099 Targets IIS Servers in Asia with BadIIS SEO Malware https://thehackernews.com/2026/01/china-linked-uat-8099-targets-iis.html Cybersecurity researchers have discovered a new campaign attributed to a China-linked threat actor known as UAT-8099 that took place between late 2025 and early 2026. The activity, discovered by Cisco Talos, has targeted vulnerable Internet Information Services (IIS) servers located across Asia, but with a specific focus on targets in Thailand and Vietnam. The scale of the campaign is currently

Badges, Bytes and Blackmail https://thehackernews.com/2026/01/badges-bytes-and-blackmail.html Behind the scenes of law enforcement in cyber: what do we know about caught cybercriminals? What brought them in, where do they come from and what was their function in the crimescape? Introduction: One view on the scattered fight against cybercrime The growing sophistication and diversification of cybercrime have compelled law enforcement agencies worldwide to respond through increasingly