Snapchat on DanSec Daily

Cybersecurity Brief – 2026-02-07

Sat, 07 Feb 2026 00:00:00 +0000

Flickr has disclosed a potential data breach caused by a vulnerability at a third-party email service provider, exposing users’ real names, email addresses, IP addresses, and activity data.
An Illinois man has pleaded guilty to hacking nearly 600 women’s Snapchat accounts to steal, sell, or trade private photos.
Compromised npm and PyPI packages associated with dYdX have been used to deliver wallet stealers and remote access trojans (RATs) in a new software supply chain attack.
Germany’s domestic intelligence agency has warned of suspected state-sponsored phishing attacks targeting high-ranking individuals via the Signal messaging app.

CISA has issued a warning about CVE-2026-24423, an unauthenticated remote code execution vulnerability in SmarterMail, which has been exploited in ransomware attacks.
Security researchers have identified multiple insecurities in the OpenClaw AI assistant, including vulnerabilities related to malicious add-ons (“skills”) and problematic configuration settings.
ESET product vulnerabilities were noted in a roundup of recent security issues, though specific details were not provided.

A previously undocumented Asian state-backed group, tracked as TGR-STA-1030, has breached at least 70 government and critical infrastructure entities across 37 countries over the past year in a cyber espionage campaign.
China-linked threat actors have been operating the DKnife adversary-in-the-middle (AitM) framework since at least 2019, targeting routers and edge devices for traffic hijacking and malware delivery in espionage campaigns.
State-sponsored threat actors are suspected in the recent phishing campaign targeting senior figures in Germany via Signal.

A new malware-as-a-service kit called “Stanley” is offering guaranteed publication in the Chrome Web Store by bypassing Google’s security verification process.
Supply chain attacks continue to pose significant risk, as seen in the compromise of npm and PyPI packages and recent incidents involving self-propagating worms.
Modern browser-based attacks are increasingly able to evade detection by traditional EDR, email, and SASE solutions, operating entirely within the browser with minimal forensic evidence.
Apple Pay users are being targeted by phishing campaigns involving fake support calls designed to steal payment details.
Research highlights that attackers are evolving tradecraft to leverage AI assistants and agents in malicious operations (“living off the AI”).

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a binding operational directive requiring federal agencies to identify and remove unsupported or end-of-life network edge devices to reduce federal network risk.
Five bills aimed at boosting cybersecurity defenses for the U.S. energy sector have cleared a House panel.
The European Commission has announced that TikTok is facing a large fine for addictive platform design elements that may violate regulatory standards.
The Electronic Frontier Foundation has launched the “Encrypt It Already” campaign, urging major technology companies to implement end-to-end encryption by default across their services.

Sat, 10 Jan 2026 00:00:00 +0000

The Illinois Department of Human Services (IDHS) exposed personal and health data of nearly 700,000 residents due to incorrect privacy settings.
Gulshan Management Services, a Texas gas station operator, reported a data breach affecting 377,000 individuals following a ransomware attack.
An Illinois man has been charged with hacking nearly 600 Snapchat accounts via phishing to steal and sell private photos online.

Trend Micro patched a critical remote code execution vulnerability (CVSS 9.8) in on-premise versions of Apex Central for Windows, which could allow attackers to execute arbitrary code with SYSTEM privileges. Three vulnerabilities were addressed, and proof-of-concept code has been released.
VMware ESXi zero-day vulnerabilities have been exploited by threat actors, with evidence that exploits were developed up to a year prior to public disclosure. The flaws allow virtual machine escapes and were initially accessed via a compromised SonicWall VPN appliance.

Russian APT28 (state-sponsored) is conducting credential-stealing campaigns targeting individuals linked to Turkish energy and nuclear research agencies, as well as other policy organizations.
Chinese-speaking threat actors exploited VMware ESXi zero-days and used a compromised SonicWall VPN for initial access. Chinese cyberattacks against Taiwan have intensified.
North Korean Kimsuky group has been using spear-phishing campaigns featuring malicious QR codes to target government organizations, think tanks, and academic institutions.
Threat actors are systematically seeking out misconfigured proxy servers to gain unauthorized access to paid large language model (LLM) services.

“ClickFix”/ConsentFix attacks, a form of social engineering using fake prompts (e.g., Cloudflare), are being observed, relying on tricking users into clicking under false pretenses.
Researchers demonstrated the “ZombieAgent” attack, which can bypass ChatGPT protections to exfiltrate user data and implant persistent logic in the agent’s memory.
Deepfake-enabled fraud tools are increasing in realism and popularity, but defensive measures are currently keeping pace.
Email security analysis highlights that post-compromise impact and containment are more critical than traditional “click rate” metrics.
Process Environment Block (PEB) manipulation is being used by malware to evade detection and analysis.
There is a surge in illicit cryptocurrency transactions, particularly involving nation-state actors from sanctioned countries such as Russia and Iran.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has retired 10 emergency cybersecurity directives issued between 2019 and 2024, as their objectives have been met or are now covered by the Known Exploited Vulnerabilities (KEV) catalog.
Microsoft is testing a policy to allow IT administrators to uninstall Copilot on managed devices.
The founder of stalkerware provider pcTattletale pleaded guilty in a rare U.S. federal case as authorities increase enforcement actions against stalkerware vendors.
Tim Kosiba has been appointed as the new Deputy Director of the U.S. National Security Agency (NSA).