Three former tech employees were indicted for allegedly stealing Google trade secrets and transferring them to Iran.

Prosecutors say the data involved Pixel Tensor processor security and cryptography. Files were copied, photographed, and concealed.

🔗 Details → https://thehackernews.com/2026/02/three-former-google-engineers-indicted.html

The FBI warns ATM “jackpotting” caused over $20M in losses in 2025.

Since 2020, 1,900 incidents have been reported, including 700 last year. Attackers use #malware like Ploutus to bypass bank authorization via the XFS layer & trigger rapid cash-outs.

🔗 Read → https://thehackernews.com/2026/02/fbi-reports-1900-atm-jackpotting.html

A 29-year-old Ukrainian was sentenced to prison for aiding North Korea’s IT job fraud scheme.

He admitted selling stolen U.S. identities through a site seized in 2024, helping overseas workers secure jobs.

🔗 Details → https://thehackernews.com/2026/02/ukrainian-national-sentenced-to-5-years.html

🛡️ One in three cyber-attacks starts with a compromised employee account, pushing insurers to 🔐 audit passwords, admin access, and full MFA enforcement.

Coverage now depends on proving identity risk is tightly controlled.

🔗 Why MFA gaps can cost millions → https://thehackernews.com/2026/02/identity-cyber-scores-new-metric.html

MIMICRAT, a new RAT, is spreading via compromised legitimate sites.

Hijacked services displayed fake Cloudflare checks, pushing a PowerShell command that disables logging and AV, then connects over HTTPS masked as analytics traffic.

🔗 Loader stages and 22-command toolkit → https://thehackernews.com/2026/02/clickfix-campaign-abuses-compromised.html

⚠️ WARNING: Cline CLI was silently altered for 8 hours after a stolen npm token was used to publish v2.3.0 with a hidden postinstall script that installed OpenClaw.

Roughly 4,000 downloads occurred before the release was pulled & the token revoked.

🔗 Read → https://thehackernews.com/2026/02/cline-cli-230-supply-chain-attack.html

⚠️ A 9.9-rated Roundcube RCE flaw is now on CISA’s KEV list after confirmed active exploitation.

Researchers say attackers diffed and weaponized the bug within 48 hours. An exploit was reportedly offered for sale in June 2025.

The issue lived in the code for more than 10 years.

A second XSS flaw is also being abused.

🔗 Read → https://thehackernews.com/2026/02/cisa-adds-two-actively-exploited.html

🔥 Anthropic is rolling out Claude Code Security, an AI tool that scans full codebases and suggests patches.

In limited preview for Enterprise and Team users, it analyzes code like a human, traces data flows, and reduces false positives in a review dashboard.

All fixes require human approval.

🔗 Learn how it works → https://thehackernews.com/2026/02/anthropic-launches-claude-code-security.html

Generative AI traffic is up 890%, and 87% of organizations report AI-driven attacks.

EC-Council has launched four AI certifications plus Certified CISO v4 to help teams handle adoption, security, and governance as AI risk grows.

🔗 Framework and certification details → https://thehackernews.com/2026/02/ec-council-expands-ai-certification.html

🚨 A financially driven actor breached 600+ FortiGate devices across 55 countries using commercial AI.

No zero-days. They scanned exposed management ports, brute-forced weak logins, accessed VPNs, ran DCSync in AD, and targeted Veeam backups.

🔗 Details here → https://thehackernews.com/2026/02/ai-assisted-threat-actor-compromises.html

⚡ Android 17 beta blocks cleartext traffic by default.

Apps targeting 17+ must define a Network Security Configuration; usesCleartextTraffic="true" alone won’t allow HTTP. Google also adds HPKE hybrid cryptography for stronger app communications.

🔗 Read → https://thehackernews.com/2026/02/threatsday-bulletin-openssl-rce-foxit-0.html#privacy-model-hardening

Iran’s MuddyWater launched Operation Olalampo on Jan 26, 2026, targeting organizations across MENA.

Group-IB says phishing Office macros drop new malware—GhostFetch, GhostBackDoor, HTTP_VIP, and the Rust backdoor CHAR.

Some variants use Telegram for control, with signs of AI-assisted development.

🔗 Read → https://thehackernews.com/2026/02/muddywater-targets-mena-organizations.html

Microsoft says a Copilot bug (CW1226324) let Microsoft 365 Copilot summarize confidential emails, bypassing DLP policies.

Since Jan 21, 2026, emails in Sent Items and Drafts with sensitivity labels were processed in Copilot Chat without permission.

Microsoft fixed the issue on Feb 3 but hasn’t disclosed impact.

🔗 Details → https://thehackernews.com/2026/02/threatsday-bulletin-openssl-rce-foxit-0.html#copilot-bypassed-dlp-safeguards

🤖 Researchers found 19 malicious npm packages spreading SANDWORM_MODE.

The worm 🐛 steals npm/GitHub tokens, SSH keys, API secrets, and crypto keys, then propagates using stolen identities. It also injects into AI coding tools to harvest LLM API keys.

🔗 Read → https://thehackernews.com/2026/02/malicious-npm-packages-harvest-crypto.html

⚠️ The real risk in enterprise AI isn’t the model — it’s the endpoint.

Every new LLM API, dashboard, or connector expands the attack surface. Many were built fast, not secure. Exposed endpoints can leak data or inherit powerful service account access.

🔗 Why endpoint privilege now matters in LLM stacks → https://thehackernews.com/2026/02/how-exposed-endpoints-increase-risk.html

The threat curve keeps climbing.

🛒 Store skimmers
🧠 WP RAT chains
🏭 508 ICS alerts
🌐 30Tbps DDoS
🤖 Bot surge
📦 2.5K Docker malware
📢 1T scam ads
🎰 NPM gambling backdoor
📱 Samsung fingerprinting
☎️ Teams spoof shield

🔗 Full Weekly Recap live: https://thehackernews.com/2026/02/weekly-recap-double-tap-skimmers.html

🚨 WARNING: A new Go-based RAT, #Moonrise, evades AVs and escalates from one infected endpoint to network-wide compromise.

The impact includes credential theft and hidden audio/video surveillance.

Protect your company with strong early detection: https://thn.news/enterprise-sec

🚨 Update Your Detection Rules: New Remote Access Trojan
We caught a Go-based RAT and named it #Moonrise. At the time of the analysis, the sample had not yet been submitted to VirusTotal ❗️

The level of access enables credential harvesting, sensitive data collection, and preparation for further compromise without triggering static detections, leaving SOCs with no clear signals to act on.

⚠️ Observed capabilities include:
🔹 Privilege-related functions and persistence mechanisms
🔹 Data theft and credential harvesting
🔹 Process control and command execution
🔹 File upload and execution
🔹 User activity monitoring: screen capture and streaming, webcam and microphone access, keystroke logging, clipboard monitoring

One compromised endpoint can disrupt operations and lead to financial and reputational damage.

👾 See sample execution in a live analysis session

✅ Behavior-first triage in #ANYRUN Sandbox lets security teams confirm attacker actions, like remote command execution, UAC bypass attempts, and persistence-related activity, within minutes. Security teams reduce Tier-1 overload and unnecessary escalations, while containing incidents earlier.

👨‍💻 Equip your SOC with faster decisions and lower workload. See how ANY.RUN fits your workflows
#ExploreWithANYRUN

IOCs:
193[.]23[.]199[.]88
c7fd265b23b2255729eed688a211f8c3bd2192834c00e4959d1f17a0b697cd5e
8a422b8c4c6f9a183848f8d3d95ace69abb870549b593c080946eaed9e5457ad
7609c7ab10f9ecc08824db6e3c3fa5cbdd0dff2555276e216abe9eebfb80f59b
Ed5471d42bef6b32253e9c1aba49b01b8282fd096ad0957abcf1a1e27e8f7551
082fdd964976afa6f9c5d8239f74990b24df3dfa0c95329c6e9f75d33681b9f4
8d7c1bbdb6a8bf074db7fc1185ffd59af0faffb08e0eb46a373c948147787268

⚠️ Researchers uncovered a cryptojacking campaign hiding in pirated software bundles 🏴‍☠️ It drops a custom XMRig miner and abuses a flawed driver (CVE-2020-14979) to boost hashrate by 15–50%.

It can spread via USB drives, even into air-gapped systems.

🔗 Details → https://thehackernews.com/2026/02/wormable-xmrig-campaign-uses-byovd.html

Russia-linked APT28 ran a campaign across Europe from Sept 2025 to Jan 2026.

A Word doc acted as a silent beacon — opening it pinged a webhook, confirming the target engaged 📄📡 From there, basic VBScript and batch files set persistence and funneled command output back via Edge.

🔗Read → https://thehackernews.com/2026/02/apt28-targeted-european-entities-using.html

⚠️ Anthropic says it blocked 16 million+ exchanges tied to model distillation campaigns targeting Claude.

The activity used 24,000 fake accounts and proxy networks to extract coding, reasoning, and tool-use capabilities. Three China-based AI labs were attributed.

Anthropic warns stripped safeguards could pose national security risks.

🔗 Read → https://thehackernews.com/2026/02/anthropic-says-chinese-ai-firms-used-16.html