88% of AI pilots never reach production.

Security and IT teams stall not on tools—but execution. Intelligent workflows blend automation, AI decisions, and human review to move phishing response, service requests, and vuln tracking from manual to real time.

🔗 Pre-built workflow breakdowns → https://thehackernews.com/2026/02/3-ways-to-start-your-intelligent.html

⚠️ Four popular VS Code extensions expose developers to file theft and remote code execution.

Researchers say 125M+ installs are affected. Flaws in Live Server, Code Runner, and others enable localhost abuse, malicious configs, and code injection—some still unpatched.

🔗 Read → https://thehackernews.com/2026/02/critical-flaws-found-in-four-vs-code.html

Cybersecurity isn’t preparing for storms anymore. Instability is permanent.

AI threats, regulatory pressure, and geopolitical risk now shape how systems are built and run—not just defended.

🔗 What security looks like when volatility is baseline → https://thehackernews.com/2026/02/cybersecurity-tech-predictions-for-2026.html

🚨 There’s an extreme scarcity of skilled GenAI red teamers—experts estimate fewer than 10,000 globally, while one security industry analyst believes there are fewer than 10 capable of tackling frontier AI risks.

📽️ From TELUS Digital's Fuel iX team: Watch Uncharted: The AI Safety & Security Summit on demand to hear from top security leaders and industry experts as they uncover:

• Hidden vulnerabilities in GenAI models
• How automated red teaming is transforming risk detection
• Actionable strategies to safeguard your AI systems

👉 Watch now: https://thn.news/ai-security-summit-tg

Researchers found a stack overflow in Grandstream GXP1600 phones (CVE-2026-2329, 9.3 CVSS).

A crafted API request can overwrite memory and run code remotely—no login required. Post-exploitation includes credential theft and VoIP call interception via rogue SIP proxy.

🔗 Read → https://thehackernews.com/2026/02/grandstream-gxp1600-voip-phones-exposed.html

🛑 Citizen Lab found Cellebrite tools used on a Kenyan activist’s phone while it was in police custody.

Boniface Mwangi’s Samsung device was accessed in July 2025 and later returned without password protection. Full extraction could include messages, files, and passwords.

The findings follow similar cases in Jordan.

🔗 Read → https://thehackernews.com/2026/02/citizen-lab-finds-cellebrite-tool-used.html

🚨 Researchers tracked a new espionage campaign, CRESCENTHARVEST, targeting supporters of Iran’s protests.

Lures use protest media & reports to deliver RAT malware via disguised .LNK files, stealing credentials, Telegram data & keystrokes.

🔗Read → https://thehackernews.com/2026/02/crescentharvest-campaign-targets-iran.html

⚡ Android trojan "Massiv" is using fake IPTV apps to hijack devices and drain bank accounts.

It enables full remote control, screen streaming, SMS theft & banking overlays to capture credentials and run fraudulent transactions unnoticed.

🔗 Details → https://thehackernews.com/2026/02/fake-iptv-apps-spread-massiv-android.html

🔒 Today's encryption = Tomorrow's plaintext.

Quantum is closer than you think. Master hybrid PQC, zero-trust inspection & first-to-market solutions from Zscaler.

📢 Webinar: Post-Quantum Cryptography in Action for Security Leaders

🔗 Register now → https://thehacker.news/post-quantum-cryptography

Machine identities now outnumber humans 82 to 1.

AI attackers use that sprawl to hop from dev containers to production systems in seconds, chaining minor gaps into real attack paths. Critical flaws aren’t required.

Patch cycles can’t match machine speed.

🔗 AI-driven breach paths + CTEM response → https://thehackernews.com/2026/02/from-exposure-to-exploitation-how-ai.html

The SANS State of ICS/OT Security 2025 Report reveals an industry advancing at two speeds.

Detection is faster, but recovery still lags—with one in five incidents taking over a month to restore operations.

Get the intel 👉 https://thn.news/ics-security-25-x

⚠️ Android malware now uses Gemini AI.

Researchers say PromptSpy sends screen XML to Gemini, gets JSON tap steps, and pins itself in Recent Apps to stay alive.

It then enables VNC remote access.

🔗 Learn how the AI loop keeps it alive → https://thehackernews.com/2026/02/promptspy-android-malware-abuses-google.html

🛑 Microsoft patched a Windows Admin Center flaw enabling privilege escalation across managed systems.

CVE-2026-26119 (CVSS 8.8) stems from improper authentication and could grant rights equal to the running user.

🔗 Read → https://thehackernews.com/2026/02/microsoft-patches-cve-2026-26119.html

651 arrests across 16 African nations after an INTERPOL crackdown on online scams.

Operation Red Card 2.0 hit investment fraud, mobile loan apps, and telecom breaches. Investigators linked cases to $45M in victim losses and seized thousands of devices.

🔗 Read → https://thehackernews.com/2026/02/interpol-operation-red-card-20-arrests.html

This week’s ThreatsDay recap starts with core platform risk.

🔓 OpenSSL RCE flaws
📄 Foxit PDF exploits
🤖 Copilot DLP bypass
📬 Enterprise email exposure
🛠 Patches issued
🧪 ClickFix macOS hits
📦 Loaders → RATs/ransomware
🌐 Typosquat delivery chains
🏭 119 groups hit OT/ICS
🔗 Supply-chain entry tactics
🔑 LLM-made passwords
📊 Weak randomness patterns
🎯 Predictable outputs
🛡 Security workflow risk

🔗 Complete recap → https://thehackernews.com/2026/02/threatsday-bulletin-openssl-rce-foxit-0.html

Three former tech employees were indicted for allegedly stealing Google trade secrets and transferring them to Iran.

Prosecutors say the data involved Pixel Tensor processor security and cryptography. Files were copied, photographed, and concealed.

🔗 Details → https://thehackernews.com/2026/02/three-former-google-engineers-indicted.html

The FBI warns ATM “jackpotting” caused over $20M in losses in 2025.

Since 2020, 1,900 incidents have been reported, including 700 last year. Attackers use #malware like Ploutus to bypass bank authorization via the XFS layer & trigger rapid cash-outs.

🔗 Read → https://thehackernews.com/2026/02/fbi-reports-1900-atm-jackpotting.html

A 29-year-old Ukrainian was sentenced to prison for aiding North Korea’s IT job fraud scheme.

He admitted selling stolen U.S. identities through a site seized in 2024, helping overseas workers secure jobs.

🔗 Details → https://thehackernews.com/2026/02/ukrainian-national-sentenced-to-5-years.html

🛡️ One in three cyber-attacks starts with a compromised employee account, pushing insurers to 🔐 audit passwords, admin access, and full MFA enforcement.

Coverage now depends on proving identity risk is tightly controlled.

🔗 Why MFA gaps can cost millions → https://thehackernews.com/2026/02/identity-cyber-scores-new-metric.html

MIMICRAT, a new RAT, is spreading via compromised legitimate sites.

Hijacked services displayed fake Cloudflare checks, pushing a PowerShell command that disables logging and AV, then connects over HTTPS masked as analytics traffic.

🔗 Loader stages and 22-command toolkit → https://thehackernews.com/2026/02/clickfix-campaign-abuses-compromised.html

⚠️ WARNING: Cline CLI was silently altered for 8 hours after a stolen npm token was used to publish v2.3.0 with a hidden postinstall script that installed OpenClaw.

Roughly 4,000 downloads occurred before the release was pulled & the token revoked.

🔗 Read → https://thehackernews.com/2026/02/cline-cli-230-supply-chain-attack.html