⚡ Google tracked multiple state groups using Gemini for vuln research, exploit debugging, and persona building across cyber operations.

One malware strain even generated second-stage code via the API, executed filelessly in memory.

🔗 Threat actor tactics, malware, and AI abuse cases → https://thehackernews.com/2026/02/google-reports-state-backed-hackers.html

Threat actors are actively exploiting CVE-2026-1731 (9.9) in BeyondTrust Remote Support & PRA.

Attackers extract portal data, then open WebSocket channels to trigger unauthenticated RCE.

🔗 Read → https://thehackernews.com/2026/02/researchers-observe-in-wild.html

Patches are out, but exploitation started fast.

npm killed long-lived tokens after the Sha1-Hulud attack, shifting to short-lived sessions and MFA by default.

Security improved — but MFA phishing and optional publish protections still leave gaps. Console access can still mean package compromise.

🔗 Where the new model still fails → https://thehackernews.com/2026/02/npms-update-to-harden-their-supply.html

⚠️ Security firms uncovered coordinated abuse of Chrome extensions across business, social, and AI tools.

From Meta ad accounts to Gmail inboxes, attackers used add-ons to scrape data, inject payloads, and persist inside sessions.

🔗 Read → https://thehackernews.com/2026/02/malicious-chrome-extensions-caught.html

🛑 Researchers track UAT-9921 using the VoidLink modular malware framework against tech and finance targets.

The Linux-focused toolkit enables stealth persistence, scanning, and lateral movement via post-compromise C2 implants.

🔗 Look inside the framework’s stealth and RBAC design → https://thehackernews.com/2026/02/uat-9921-deploys-voidlink-malware-to.html

The SANS State of ICS/OT Security 2025 Report reveals an industry advancing at two speeds. Detection is faster, but recovery still lags—with one in five incidents taking over a month to restore operations.

Get the intel 👉 https://thn.news/sans-ot-report

🌐🛡️ Google says defense contractors face sustained cyber targeting from China, Iran, North Korea, and Russia.

Campaigns span battlefield tech theft, hiring infiltration, and supply-chain breaches. Actors now focus on individuals and edge devices to bypass EDR visibility.

🔗 Threat clusters, malware families, intrusion paths → https://thehackernews.com/2026/02/google-links-china-iran-russia-north.html

A newly tracked actor tied to Russian intelligence is deploying CANFAIL against Ukraine.

Targets span defense, energy, and government, with spillover into drone and nuclear research. GTIG says LLM use now supports recon, phishing, and C2 setup despite limited resources.

🔗 Read → https://thehackernews.com/2026/02/google-ties-suspected-russian-actor-to.html

⚠️ Microsoft detailed a new ClickFix variant abusing DNS lookups via nslookup to stage malware.

Victims run commands that fetch payloads from attacker-controlled resolvers, bypassing web defenses and blending into normal traffic.

Leads to RAT deployment and persistence.

🔗 Read here → https://thehackernews.com/2026/02/microsoft-discloses-dns-based-clickfix.html

🚨 Google patched Chrome zero-day CVE-2026-2441, a CVSS 8.8 bug already exploited in attacks.

The CSS use-after-free flaw allows sandboxed remote code execution via malicious pages.

🔗 Read → https://thehackernews.com/2026/02/new-chrome-zero-day-cve-2026-2441-under.html

First active Chrome zero-day fixed this year. Update now.

Security teams have more telemetry than ever. They’re also falling further behind.

In a new exposure management analysis, Yochai Corem argues the gap isn’t visibility — it’s action. Attackers now scale faster than human response cycles, exploiting known exposures while remediation lags.

🔗 From dashboards to validated fixes → https://thehackernews.com/expert-insights/2026/02/the-uncomfortable-truth-about-more.html

⚠️ Researchers uncovered ZeroDayRAT, a commercial mobile spyware sold on Telegram targeting Android and iOS.

It enables live camera/mic feeds, GPS tracking, SMS and OTP theft, and wallet hijacking via a self-hosted panel — turning phones into full surveillance nodes.

🔗 Read → https://thehackernews.com/2026/02/new-zerodayrat-mobile-spyware-enables.html

⚡ Lithuania is investing €24.1M to harden its digital society against AI-era cybercrime.

The national mission links universities, industry, and government to build fraud detection, disinformation tracking, and critical infrastructure defenses as GenAI reshapes attack tactics.

🔗 Inside the program and threat shift → https://thehackernews.com/2026/02/safe-and-inclusive-esociety-how.html

The week in cyber:

📎 Add-in supply chain abuse
🧠 AI in attack workflows
🐛 Active zero-days patched
🔐 Privileged access exploits
☁️ Cloud infra hijacks
🤖 Crypto mining botnets
📡 IRC-based C2 returns
🛠️ PoC exploits weaponized
🏭 Defense sector targeting

🔗 Full Weekly Cybersecurity Recap → https://thehackernews.com/2026/02/weekly-recap-outlook-add-ins-hijack-0.html

🛑 A new academic study mapped password recovery attack paths across Bitwarden, LastPass, and Dashlane—testing zero-knowledge designs against a malicious server model.

Researchers identified 25 attack scenarios impacting vault integrity and recovery flows. No active exploitation reported.

🔗 Research scope, attack methods and vendor fixes → https://thehackernews.com/2026/02/study-uncovers-25-password-recovery.html