OpenAI updates Europe privacy policy, adding new data categories - Help Net Security
OpenAI has updated its Europe privacy policy to align with the November 2024 EU revision, expanding coverage to include more data categories like files, images, and audio, and detailing user controls for model training opt-outs, data management, and more.
Hackers Abuse ClawHub Skills to Evade VirusTotal via Social Engineering
Hackers are abusing ClawHub skills through social engineering by hosting malware on fake websites and using the skills as lures, bypassing VirusTotal scans. This new method avoids embedding malicious code directly into SKILL.md files, making detection more challenging.
www.bleepingcomputer.com/news/secu… A new open-source and cross-platform tool called Tirith can detect homoglyph attacks over command-line environments by analyzing URLs in typed commands and stopping their execution. The idea is to block deceptive attacks that rely on URLs containing symbols from different alphabets that appear identical or nearly identical to the user but are treated as different characters by the computer (homoglyph attacks).
unit42.paloaltonetworks.com/shadow-ca… This investigation unveils a new cyberespionage group that Unit 42 tracks as TGR-STA-1030. We refer to the group’s activity as the Shadow Campaigns. We assess with high confidence that TGR-STA-1030 is a state-aligned group that operates out of Asia. Over the past year, this group has compromised government and critical infrastructure organizations across 37 countries. This means that approximately one out of every five countries has experienced a critical breach from this group in the past year. Further, between November and December 2025, we observed the group conducting active reconnaissance against government infrastructure associated with 155 countries. This group primarily targets government ministries and departments. For example, the group has successfully compromised:
Five national-level law enforcement/border control entities Three ministries of finance and various other government ministries Departments globally that align with economic, trade, natural resources and diplomatic functions
thehackernews.com/2026/02/g… Germany’s Federal Office for the Protection of the Constitution (aka Bundesamt für Verfassungsschutz or BfV) and Federal Office for Information Security (BSI) have issued a joint advisory warning of a malicious cyber campaign undertaken by a likely state-sponsored threat actor that involves carrying out phishing attacks over the Signal messaging app. “The focus is on high-ranking targets in politics, the military, and diplomacy, as well as investigative journalists in Germany and Europe,” the agencies said. “Unauthorized access to messenger accounts not only allows access to confidential private communications but also potentially compromises entire networks.”
DKnife targets network gateways in long running AitM campaign | CSO Online
The DKnife framework, active since at least 2019 and linked to China-nexus actors, operates at network gateways to inspect and manipulate traffic, enabling tactics like redirecting updates and disrupting security tools. This adversary-in-the-middle (AitM) framework targets a wide range of devices by hijacking legitimate software updates to deliver secondary payloads and backdoors, while also actively interfering with antivirus and PC management communications.
SmarterTools Hit by Ransomware via Vulnerability in Its Own Product - SecurityWeek
IT management software company SmarterTools was hit by a ransomware attack through an unpatched vulnerability in its own SmarterMail product, specifically CVE-2026-24423. The attack, attributed to the Warlock ransomware group, impacted the company’s office network and a data center, but not its public-facing website or customer portal. SmarterTools has since patched the vulnerability and advises customers to update their SmarterMail instances immediately.
Anthropic Labs chief Mike Krieger revealed that Claude is now effectively writing itself, accelerating development and improving security by acting as a rigorous code reviewer. This aligns with CEO Dario Amodei’s prediction that AI will soon write the majority of code, though concerns remain about the security and potential flaws in AI-generated code.
Hackers Exploit Legitimate Apple and PayPal Invoice Emails in DKIM Replay Attacks
Hackers are exploiting legitimate Apple and PayPal invoice emails in DKIM replay attacks, using trusted platforms to send malicious messages with valid digital signatures that bypass security filters. These attacks trick users into calling fraudulent phone numbers by inserting them into seller notes, making it appear as though the communication is from a reputable source.
Microsoft Exchange Online Flags Customers Legitimate Email as Phishing
Microsoft Exchange Online is experiencing a service degradation where legitimate emails are incorrectly flagged as phishing, causing them to be quarantined and disrupting communications. This issue, identified as EX1227432, stems from an overly aggressive new URL rule and has led to past similar incidents, highlighting challenges in AI-driven email filtering.
Malware Hidden in Pirated Games Infects 400,000 Devices | PCMag
A new Windows-based malware strain, dubbed RenEngine loader, has infected over 400,000 devices by hiding within pirated PC games. This malware, which has been active since last April, can steal sensitive data like passwords and cryptocurrency wallet information, and has been observed with the highest concentration of victims in India, the United States, and Brazil.
Introducing Kingfisher: Real-Time Secret Detection And Validation | MongoDB
Kingfisher is a new, open-source secret scanning tool developed by MongoDB that goes beyond detection to validate the secrets it finds. It is designed to be high-performance, accurate, and secure, running entirely within a user’s infrastructure to prevent sensitive data from leaving their environment.
Bithumb Mistakenly Sends 620,000 Bitcoin ($40B) to Customer Accounts
On February 6, 2026, Bithumb mistakenly sent approximately 620,000 Bitcoin ($40 billion) to customer accounts due to a system configuration error during a promotional event, causing a temporary price crash on the exchange. Bithumb has since recovered nearly all the misplaced Bitcoin, stating the incident was an internal operational mistake, not a hack, and that customer assets remain secure.
State actor targets 155 countries in ‘Shadow Campaigns’ espionage op
A state-sponsored threat group, tracked as TGR-STA-1030/UNC6619 and believed to operate from Asia, has targeted 155 countries in a global espionage operation named ‘Shadow Campaigns’. The group successfully compromised 70 government and critical infrastructure organizations across 37 countries, focusing on entities involved in trade, politics, and elections, and has been active since at least January 2024.
Conduent data breach might have been much worse than initially expected | TechRadar
The Conduent data breach is now believed to be significantly larger than initially reported, potentially affecting tens of millions across multiple US states with stolen data including names, Social Security numbers, and medical information. The ransomware group SafePay claimed responsibility, stating they stole 8.5 TB of data.
How Much Do Cybersecurity Analysts Earn by City in 2026? - ProfessPost
The median salary for cybersecurity analysts varies significantly by city in 2026, with the San Francisco Bay Area typically offering the highest pay, though factors like cost of living and industry concentration impact real earnings. While cities like New York City, Washington, D.C., Seattle, and Boston also offer competitive salaries, understanding the balance between nominal pay and expenses is crucial for maximizing financial value.
AI Agents’ Most Downloaded Skill Is Discovered to Be an Infostealer | InfoStealers
A campaign involving a fraudulent VS Code extension impersonating the AI coding assistant Moltbot has been discovered, leading to Cognitive Context Theft by exfiltrating AI agent memories and configurations. This highlights how local-first AI agents like ClawdBot store sensitive data in plaintext, making them prime targets for infostealers that can lead to significant breaches, similar to the Change Healthcare ransomware attack.
We had sex in a Chinese hotel, then found we had been broadcast to thousands
A BBC investigation reveals the widespread existence of spy-cam porn in Chinese hotels, where unsuspecting guests are secretly filmed and their intimate moments broadcast and sold online. One couple, Eric and Emily, discovered their own sexual encounter in a Shenzhen hotel was captured and distributed on platforms like Telegram, causing them significant distress and trauma.
An Illinois man has pleaded guilty to hacking hundreds of Snapchat accounts to steal nude photos, facing decades in prison for charges including aggravated identity theft and wire fraud. He accessed at least 59 women’s accounts, sold the images online, and offered his hacking services for a fee.
Claude AI finds 500 high-severity software vulnerabilities | CSO Online
Anthropic’s new Claude Opus 4.6 has identified 500 high-severity software vulnerabilities in open-source projects during a trial, with humans verifying the findings before reporting them to developers. This demonstrates the growing capability of AI language models in software security and bug hunting.
The European Commission has notified TikTok of potential violations of the Digital Services Act, citing addictive design features like infinite scroll and autoplay that may harm users, especially minors. If found guilty, TikTok could face a fine of up to 6% of its global annual turnover, with the Commission suggesting changes to the platform’s core design and parental controls.
French lawmakers’ personal data leak: hack or doxxing?
In February 2026, personal data of French deputies was leaked online, but an investigation ruled out a hacking of the National Assembly’s databases, suggesting instead a case of doxxing through the aggregation of publicly available information. The incident highlights the vulnerability of public figures and the need to distinguish between transparency and overexposure, prompting legal action and a call for responsible online behavior.
Spain’s Ministry of Science shuts down systems after breach claims
Spain’s Ministry of Science has partially shut down its IT systems due to a technical incident, impacting services for citizens and companies. A threat actor claims to have breached the ministry, leaking data samples and alleging exploitation of an Insecure Direct Object Reference (IDOR) vulnerability.
South Korean e-commerce giant Coupang has confirmed that the personal data of an additional 165,000 users was compromised, bringing the total affected accounts to approximately 33.8 million. This breach, initially reported in November, involved stolen names, phone numbers, and delivery addresses, but not payment details or login credentials.
A study revealed that nearly 5 million web servers are exposing Git metadata, with over 250,000 leaking deployment credentials through .git/config files. This widespread vulnerability allows attackers to reconstruct source code, steal secrets, and gain unauthorized access.