60
February 2026 CVE Landscape: 13 Critical Vulnerabilities Mark 43% Drop from January
60
U.S. CISA adds SolarWinds Web Help Desk, Notepad++, Microsoft Configuration Manager, and Apple devices flaws to its Known Exploited Vulnerabilities catalog
60
57
PAPERMILL Hackers Abuse Signed Notepad++ to Deploy VenomRAT in Tax Audit Attacks
PAPERMILL phishing campaign abuses a signed Notepad++ copy and tax-audit lures to deploy VenomRAT against targets in India.
JUMPSEC tracks PAPERMILL as an emerging cluster whose emails pass SPF, DKIM, and DMARC and deliver tax-audit themed disk images. The mounted image pairs a legitimately signed, renamed executable with a rogue libcurl.dll for DLL sideloading, then uses a Donut shellcode loader to run VenomRAT 6.0.3 in memory with hidden VNC, data-stealing, and file-grabbing capabilities. The loader includes anti-analysis checks and RunOnce persistence, and lures plus China-connected infrastructure overlap with the Silver Fox ecosystem, though attribution remains unconfirmed.
55
60
Researchers Observe In-the-Wild Exploitation of BeyondTrust CVSS 9.9 Vulnerability
60
CISA orders federal agencies to patch exploited SolarWinds, Apple, Microsoft bugs within weeks
60
Week in review: Firmware-level Android backdoor found on tablets, Dell zero-day exploited since 2024
60
Microsoft Patch Tuesday for February 2026 — Snort rules and prominent vulnerabilities
60
60
Week in review: Exploited newly patched BeyondTrust RCE, United Airlines CISO on building resilience
60
60
57
Breeze Comet Executes Hundreds of Fraudulent Transactions via Brazilian Payment Systems
Google/Mandiant profile Breeze Comet, a Brazil-based e-crime group executing fraudulent Pix and STR payment transactions at banks, retailers, and fintechs.
Google Threat Intelligence Group and Mandiant describe Breeze Comet (formerly UNC5669), a financially motivated threat actor active since September 2023 targeting Brazilian financial services, retail, and e-commerce. The group gains access via password spraying, vishing impersonating IT support to install RMM tools like AnyDesk, WhatsApp social engineering, and exploitation of vulnerable JBoss AS servers for web shell deployment. It uses compromised government websites as C2, deploys the Rust-based COBALTSPIN tunneler and multiple custom backdoors (LIGHTPAINT, MILDFROST, KICKPLATE, BOATBEAM), then clears logs after executing hundreds of fraudulent transactions through Pix, STR, and Boleto payment systems. At least one heist yielded tens of thousands of dollars, with infrastructure suggesting expansion toward Latin America and Africa.
82
60
60
⚡ Weekly Recap: AI-Powered Phishing, Android Spying Tool, Linux Exploit, GitHub RCE & More
60
60
60
⚡ Weekly Recap: WhatsApp Worm, Critical CVEs, Oracle 0
60
60
60
60
60
Microsoft Releases Patch for Two New Actively Exploited Zero
60
60
60
60
57
60