Cybersecurity Brief – 2026-02-17

Tue, 17 Feb 2026 00:00:00 +0000

Major Incidents or Breaches

Washington Hotel in Japan disclosed a ransomware attack that compromised its servers and exposed business data.
Eurail B.V. confirmed that data stolen in a breach earlier this year is now being sold on the dark web. The breach impacted traveler data for the European rail operator.
Dutch telecom provider Odido was hit by a data breach, as noted in Check Point’s weekly threat intelligence report.
Dior, Louis Vuitton, and Tiffany were fined $25 million in South Korea following data breaches linked to attacks on Salesforce instances by the Scattered LAPSUS$ Hunters group.

Google released emergency updates for Chrome, patching CVE-2026-2441, a high-severity vulnerability exploited in zero-day attacks. The flaw could allow arbitrary code execution and marks the first actively exploited Chrome zero-day patched in 2026.
CISA ordered US federal agencies to patch a vulnerability in BeyondTrust Remote Support within three days due to active exploitation.
A study identified 25 password recovery attack vectors in major cloud-based password managers, including Bitwarden, Dashlane, and LastPass, which could allow account compromise under certain conditions.

The GS7 cyberthreat group (Operation DoppelBrand) is targeting US financial institutions by creating highly convincing fake corporate portals to steal credentials and gain remote access.
A new mobile spyware platform, ZeroDayRAT, is being advertised on Telegram, offering real-time surveillance and data theft capabilities.
Information-stealing malware has been observed targeting OpenClaw (formerly Clawdbot/Moltbot) AI agent configuration files, exfiltrating API keys, authentication tokens, and gateway credentials.
Attackers are leveraging the ClickFix attack technique, abusing DNS lookups (nslookup commands) to deliver the ModeloRAT remote access trojan to targeted systems.
A phishing campaign has been observed using fake incident reports as lures.

Over 260,000 Chrome users were deceived by 30 fake AI browser extensions posing as legitimate tools, indicating a continued trend in leveraging AI-themed lures for malware distribution.
The ClickFix campaign’s use of nslookup for RAT delivery highlights increased abuse of built-in system tools for malware deployment.
Infostealer malware is adapting to target secrets and configuration files associated with widely adopted AI agentic frameworks such as OpenClaw.
There is a growing focus on passwordless authentication and passkey adoption, with organisations seeking to maintain ISO/IEC 27001 compliance while moving away from traditional passwords.
Android 17 Beta introduces further secure-by-default features, strengthening privacy and app security controls.
Apple is testing end-to-end encryption for RCS messaging in the iOS 26.4 developer beta, expanding secure messaging capabilities.

Dior, Louis Vuitton, and Tiffany were fined $25 million in South Korea for data breaches involving Salesforce, following regulatory action related to the Scattered LAPSUS$ Hunters attacks.
CISA is operating at 38% staff capacity due to the ongoing DHS shutdown, potentially impacting the agency’s ability to respond to cyber incidents.
Amazon’s Ring terminated its partnership with Flock Safety, a police surveillance technology company, following public backlash.
Lithuania is advancing national initiatives to address AI-driven cyber fraud, with the KTU Consortium outlining strategies for a safe and inclusive digital society.

Mon, 16 Feb 2026 00:00:00 +0000

ShinyHunters, a known data extortion group, claims to have stolen over 600,000 Canada Goose customer records containing personal and payment-related information. Canada Goose is investigating the incident.

Google released an emergency security update for Chrome to address CVE-2026-2441, a high-severity zero-day vulnerability that is being actively exploited in the wild.

ShinyHunters are responsible for the reported breach at Canada Goose, involving the leak of a large volume of customer records.
CTM360 identified a campaign leveraging over 4,000 malicious Google Groups and 3,500+ Google-hosted URLs to distribute Lumma Stealer infostealer malware and a trojanized “Ninja Browser.”
Multiple reports detail the ongoing use of ClickFix social engineering attacks. Recent variants abuse DNS (via nslookup) to retrieve PowerShell payloads and leverage Pastebin comments to distribute JavaScript targeting cryptocurrency users. These tactics are used for malware staging and to hijack crypto swaps.

ClickFix attacks are evolving, now incorporating DNS-based delivery mechanisms and leveraging legitimate services such as Pastebin and Google Groups to distribute malicious payloads.
The use of nslookup in ClickFix attacks to retrieve malware via DNS is reported as a first for this campaign type.
Attackers are increasingly abusing trusted cloud-based platforms (Google Groups, Google-hosted URLs, Pastebin) for malware distribution and command and control.

Microsoft released update KB5077181 to resolve Windows 11 boot failures linked to previous failed security updates, addressing an “UNMOUNTABLE_BOOT_VOLUME” error on commercial systems.