Cybersecurity Brief – 2026-02-22

Sun, 22 Feb 2026 00:00:00 +0000

Major Incidents or Breaches

Over 600 FortiGate firewalls in 55 countries were compromised over a five-week period by a Russian-speaking, financially motivated threat actor. The campaign leveraged commercial generative AI services for various stages of the attack, including reconnaissance, exploit development, and scripting. Amazon has issued warnings regarding the scale and sophistication of the breaches.

A critical vulnerability (CVE-2026-2329) in Grandstream phone systems allows unauthenticated remote code execution with root privileges. Exploitation of this flaw could enable attackers to intercept calls and gain full control over affected devices.

The threat actor responsible for the FortiGate breaches utilised generative AI tools to enhance operational efficiency, automate reconnaissance, and develop custom exploits, demonstrating the increasing use of AI in advanced cybercriminal operations.
Intellexa’s Predator spyware has been observed hooking into iOS SpringBoard to suppress visual indicators of microphone and camera usage, enabling covert surveillance by streaming audio and video feeds to operators without alerting device users.

Commercial generative AI services are being actively used by threat actors to streamline and scale cyberattacks, as evidenced in the FortiGate firewall campaign.
Predator spyware’s ability to hide iOS recording indicators signals a trend towards more sophisticated evasion techniques in mobile surveillance tools.
Anthropic has announced the launch of Claude Code Security, an AI-powered vulnerability scanning tool capable of analysing codebases and recommending patches, highlighting ongoing industry movement towards AI-driven security solutions.
Research indicates that popular password managers share a common underlying weakness, though specific technical details were not provided in the headline summary.

Thu, 19 Feb 2026 00:00:00 +0000

Figure Technology Solutions suffered a data breach impacting nearly one million accounts, exposing personal and contact information.
Betterment’s data breach is more severe than initially reported, with leaked data including sensitive personal and financial details.
A vast online database containing billions of records, including Social Security Numbers, was found exposed and accessible, posing significant identity theft risks.

Grandstream GXP1600 series VoIP phones are affected by a critical unauthenticated remote code execution vulnerability (CVE-2026-2329), allowing attackers root-level access and enabling call interception, toll fraud, and user impersonation.
Four widely used Microsoft Visual Studio Code extensions (collectively over 125 million installs) were found to contain multiple vulnerabilities, potentially enabling threat actors to compromise developer environments.
Multiple Honeywell CCTV products used in critical infrastructure are vulnerable to an authentication bypass flaw, allowing unauthorized access to video feeds and account hijacking.
Dell RecoverPoint for Virtual Machines is affected by a maximum severity zero-day vulnerability (CVE-2026-22769), exploited since mid-2024 by a China-linked threat group (UNC6201) for lateral movement, persistence, and malware deployment.
Foxit and Apryse PDF platforms contained 16 vulnerabilities that could be exploited for account takeover and data exfiltration via malicious documents or URLs.
CISA has added a vulnerability in TeamT5’s ThreatSonar Anti-Ransomware to its Known Exploited Vulnerabilities (KEV) catalog; the issue was patched in 2024 but is being actively exploited.

The China-nexus threat actor UNC6201 has exploited Dell RecoverPoint for VMs zero-day since mid-2024.
Kenyan authorities reportedly used Cellebrite’s forensic extraction tool against a dissident’s mobile device while in custody.
Telegram underground channels rapidly weaponized SmarterMail vulnerabilities (e.g., CVE-2024-XXXX), sharing PoCs and stolen credentials shortly after public disclosure.
New Keenadu Android malware has been found preinstalled on thousands of devices and distributed via Google Play and other app stores.
Hackers are actively exploiting a vulnerability in TeamT5’s ThreatSonar Anti-Ransomware product.
AI platforms such as Grok and Microsoft Copilot are being abused as covert communication channels for malware command-and-control (C2) activity.

AI and quantum advancements are driving recommendations for substantially longer passwords (25+ characters) to withstand brute-force and future cryptanalytic attacks.
AI-powered chatbots are being weaponized for scams, including a fake “Gemini” chatbot used to pitch fraudulent “Google Coin” schemes.
Phishing campaigns are leveraging fake Google Forms sites to harvest Google login credentials from job seekers.
Anti-phishing heuristic rules in Microsoft Exchange Online mistakenly blocked legitimate emails and Teams messages, disrupting business communications.
Microsoft 365 Copilot bug has caused confidential emails to be summarized by the AI assistant, bypassing organizations’ data loss prevention policies.
A significant percentage (over 40%) of South Africans reported being scammed in 2025, highlighting the prevalence of scalable, low-friction scams.
Underground threat communities are accelerating the weaponization of disclosed vulnerabilities, as evidenced by rapid exploitation of SmarterMail flaws.
Malware campaigns are increasingly using steganography, such as embedding payloads in image files.

CISA has issued warnings regarding active exploitation of vulnerabilities in Honeywell CCTV products and TeamT5 ThreatSonar Anti-Ransomware, urging immediate patching and mitigation.
CISA’s KEV catalog continues to expand with newly exploited vulnerabilities, reinforcing mandatory remediation timelines for federal and critical infrastructure entities.