VoidLink on DanSec Daily

Cybersecurity Brief – 2026-02-14

Sat, 14 Feb 2026 00:00:00 +0000

Major Incidents or Breaches

Dutch telecommunications provider Odido disclosed a data breach impacting 6 million customers, with hackers stealing personal information including names, addresses, and phone numbers from a customer contact system.
South Korea fined luxury brands Louis Vuitton, Christian Dior Couture, and Tiffany a combined $25 million for failing to implement adequate security measures, which resulted in unauthorized access and data breaches.
Researchers identified malicious Google Chrome extensions stealing data associated with Meta Business Suite and Facebook Business Manager; a total of 30 credential-stealing Chrome extensions have been uncovered.
Threat actors are abusing Claude LLM artifacts and Google Ads in ClickFix campaigns to deliver infostealer malware to macOS users.
Fake online shops are targeting fans of the Winter Olympics 2026, with nearly 20 fraudulent sites identified selling counterfeit merchandise.

Newly Discovered Vulnerabilities

Researchers observed active exploitation of CVE-2026-1731, a critical unauthenticated remote code execution vulnerability (CVSS 9.9) affecting BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) products. Exploitation began within 24 hours of public PoC release.
CISA flagged a critical Microsoft Configuration Manager (SCCM) vulnerability, patched in October 2024, as being exploited in the wild.
Chrome version 145 patched 11 vulnerabilities, including three high-severity flaws.
CISA warned of active exploitation of vulnerabilities in SolarWinds and Notepad++ products, including a SolarWinds flaw likely exploited as a zero-day since December 2025.

Notable Threat Actor Activity

North Korean threat actors are targeting software developers, particularly those with JavaScript and Python skills, using fake job recruiter campaigns. These campaigns employ social engineering and malicious coding challenges, often related to cryptocurrency, to deliver malware.
Google Threat Intelligence Group attributed malware attacks using the CANFAIL family to a previously undocumented Russian threat actor, targeting Ukrainian organizations.
Several state-sponsored actors from China, Iran, Russia, and North Korea are conducting coordinated cyber operations against the defense industrial base sector. Espionage groups have exploited at least two dozen zero-days in edge devices to infiltrate defense contractors.
A previously unknown threat actor, tracked as UAT-9921, is using a new modular malware framework called VoidLink to target technology and financial services sectors.

Trends, Tools, or Tactics of Interest

Threat actors are exploiting Windows drivers to carry out BYOVD (Bring Your Own Vulnerable Driver) attacks, terminating security processes in targeted networks.
AI agents are increasingly being deployed in coordinated, autonomous “swarms,” amplifying organizational attack surfaces and security complexity.
Integration of external IP-based threat intelligence (e.g., Criminal IP) into SIEM and SOAR platforms like IBM QRadar is enhancing automated detection and response workflows.
Threat actors are leveraging widely used platforms (such as Google Ads and Chrome extensions) for malware delivery and credential theft.
npm completed a major authentication overhaul in December 2025 to harden its supply chain in response to previous incidents.

Regulatory or Policy Developments Affecting the Security Industry

CISA announced new town halls to engage stakeholders on cyber incident reporting requirements for critical infrastructure.
Check Point acquired three Israeli cybersecurity firms-Cyata, Cyclops, and Rotate-reflecting ongoing consolidation in the cybersecurity sector.
South Korean regulatory action against major luxury brands for data protection failures underscores increased enforcement of data security obligations.
The US government (CISA) has issued new directives for federal agencies to secure systems against actively exploited vulnerabilities, including those in Microsoft Configuration Manager.

Cybersecurity Brief – 2026-01-15

Thu, 15 Jan 2026 00:00:00 +0000

Major Incidents or Breaches

Kyowon Group, a major South Korean conglomerate, confirmed a ransomware attack resulting in operational disruption and potential exposure of customer data.
Cloud marketplace Pax8 inadvertently exposed internal business information, including MSP customer data, to fewer than 40 UK-based partners via email.
Robo-advisor Betterment disclosed a breach where a threat actor accessed customer information and sent scam crypto-related messages.
Free Mobile and its parent company, Free, were fined €42 million by the French CNIL for inadequate protection of customer data related to a 2024 breach.

Newly Discovered Vulnerabilities

Fortinet patched a critical unauthenticated remote code execution vulnerability in FortiSIEM. Public exploit code and technical details for this flaw have been released.
Additional critical vulnerabilities in Fortinet products, including FortiFone, were disclosed and patched, with risks of configuration leaks and code execution.
Chrome 144 and Firefox 147 released patches for high-severity vulnerabilities, addressing 26 security defects including code execution risks.
Microsoft’s January 2026 Patch Tuesday addressed 114 Windows vulnerabilities, including one actively exploited in the wild.
A DLL side-loading vulnerability in the open-source c-ares library is being actively exploited to bypass security controls and deploy malware.

Notable Threat Actor Activity

Microsoft and law enforcement disrupted the RedVDS cybercrime-as-a-service platform, which facilitated phishing, BEC, account takeover, and fraud, and was linked to over $40 million in losses.
Researchers null-routed over 550 command-and-control servers associated with the AISURU/Kimwolf botnet, which had infected over two million devices since October 2025.
A major phishing campaign abused Google’s infrastructure, targeting over 3,000 organizations (primarily in manufacturing) to bypass email security defenses.
Magecart skimming attacks are targeting online checkouts using major payment networks such as AmEx, Diners Club, and Mastercard.
The newly emerged Sicarii Ransomware-as-a-Service operation began advertising across underground forums in December 2025.
Predator spyware has been found to use failed attacks for intelligence gathering to improve future exploit attempts.
Fake “account restricted” comments are being posted on LinkedIn as part of phishing campaigns to steal user credentials.

Trends, Tools, or Tactics of Interest

Microsoft was the most impersonated brand in phishing attacks during Q4 2025, followed by Facebook, Roblox, McAfee, and Steam.
OAuth phishing attacks using the ConsentFix technique are evolving, with attackers hijacking Microsoft accounts via browser-based authorization flows.
The “Reprompt” attack technique allowed hijacking of Microsoft Copilot sessions for sensitive data exfiltration.
AI agents are increasingly being integrated into core workflows, raising concerns about privilege escalation pathways.
64% of third-party applications on leading websites now access sensitive data without business justification, up from 51% in 2024.
Attackers are leveraging legitimate open-source software downloads to conceal remote backdoors.
The “VoidLink” modular malware framework is targeting Linux systems, designed for stealthy, long-term access in cloud-first environments.
Infection campaigns are repeatedly adding scheduled tasks and increasing communication with persistent C2 domains.

Regulatory or Policy Developments

The French CNIL imposed a €42 million fine on Free Mobile and Free for failing to adequately protect customer data in a 2024 breach incident.
An investor lawsuit related to the CrowdStrike outage was dismissed due to lack of evidence of investor fraud.

Cybersecurity Brief – 2026-01-13

Tue, 13 Jan 2026 00:00:00 +0000

Major Incidents or Breaches

Target Corporation: Hackers claim to have stolen and are selling internal source code from Target, with samples published online. Target’s development server has been taken offline.
University of Hawaii Cancer Center: Ransomware attack in August 2025 resulted in theft of participant data, including documents with Social Security numbers dating back to the 1990s.
Endesa (Spanish Energy Provider): Data breach disclosed, with hackers accessing customer contract-related information, including personal details.
BreachForums: The notorious cybercriminal forum was breached, exposing data on 324,000 administrators and members.
Manage My Health (New Zealand): Identified as a top breach in recent threat intelligence reporting, affecting patient portals and healthcare data.
Instagram: Data leak incident where user data appeared on the dark web, coinciding with a password reset vulnerability (see below).
Apex Legends: Live matches disrupted as threat actors hijacked player characters, disconnected users, and changed nicknames.

Newly Discovered Vulnerabilities

n8n Workflow Automation Platform:
- “Ni8mare” vulnerability impacts nearly 60,000 online instances; maximum-severity flaw remains largely unpatched.
- Supply chain attack observed, with malicious npm packages masquerading as integrations to steal OAuth credentials from developers.
Gogs (Git Service): High-severity remote code execution (RCE) flaw exploited in zero-day attacks. CISA has ordered US federal agencies to patch.
Instagram: Password reset vulnerability allowed third parties to send reset emails to users, contributing to a recent data leak.
Telegram: Hidden proxy links can expose user IP addresses with a single click due to how proxy links are handled. Telegram has announced plans for a fix.

Notable Threat Actor Activity

GoBruteforcer Botnet: New campaigns target over 50,000 Linux servers, especially those supporting cryptocurrency and blockchain projects, exploiting weak credentials and AI-generated configurations.
APT28 (Russia): Targeting energy research and defense collaboration entities by impersonating webmail and VPN portals (Microsoft OWA, Google, Sophos VPN).
Kimsuky (North Korea): FBI flagged QR-code phishing (“quishing”) campaigns targeting US and foreign government agencies, NGOs, and academia.
LLM/AI Service Exploitation: Multiple campaigns targeting exposed large language model (LLM) endpoints and misconfigured proxy servers to access sensitive APIs and data.
VoidLink Malware: Discovery of a stealthy, cloud-native Linux malware framework, attributed to a Chinese threat cluster, designed for persistence and evasion in cloud environments.
Facebook Credential Theft: Increased use of “browser-in-the-browser” (BitB) phishing techniques to steal Facebook login credentials over the past six months.

Trends, Tools, or Tactics of Interest

Supply Chain Attacks: Growing use of malicious npm packages for credential theft, specifically targeting workflow automation platforms.
Botnet Evolution: GoBruteforcer botnet demonstrates ongoing adaptation, now preying on servers with weak or AI-generated credentials.
AI and LLM Security: Surge in attacks against exposed LLM endpoints and APIs, highlighting expanding attack surfaces in organizations’ AI deployments.
Phishing Techniques: Rise in “quishing” (QR-code phishing) and “browser-in-the-browser” attacks, increasing the sophistication of credential theft campaigns.
Healthcare AI Adoption: Anthropic launched Claude AI for healthcare, introducing HIPAA-ready tools for providers and payers, reflecting broader AI integration in sensitive sectors.
Endpoint Security Expansion: Hexnode announced entry into endpoint security with its new XDR (Extended Detection and Response) platform.

Regulatory or Policy Developments Affecting the Security Industry

CISA Directive: US federal agencies ordered to patch Gogs RCE vulnerability exploited in active attacks.
EU Regulatory Review: The European Union set a February deadline for its verdict on Google’s $32B acquisition of Wiz, following US approval.
Deepfake Regulation: Global regulators are scrutinizing Grok, an AI tool, over its role in generating illegal sexual deepfake content, including child sexual abuse material.
Privacy and Cybersecurity Law Complexity: Ongoing analysis indicates compliance challenges will persist into 2026, with limited progress on comprehensive federal cybersecurity legislation.