TLDR INFORMATION SECURITY 2026-02-03

save your spot.

NOTEPAD++ HIJACKED BY STATE-SPONSORED HACKERS

Notepad++ confirmed that a suspected Chinese state-sponsored group compromised its shared hosting provider from June through December 2025, selectively redirecting update traffic to serve malicious installers by exploiting insufficient update verification controls. The attackers maintained persistent access through stolen internal service credentials even after losing direct server access in September 2025. Notepad++ has since migrated hosting providers and hardened its update mechanism with certificate and signature verification in v8.8.9, with full XMLDSig enforcement expected in v8.9.2.

WINDOWS MALWARE USES PULSAR RAT FOR LIVE CHATS WHILE STEALING DATA

A newly discovered Windows malware campaign combines the Pulsar RAT with Stealerv37, using Donut loader shellcode injection into explorer.exe to operate entirely in memory while evading traditional antivirus detection. The attack chain begins with an obfuscated batch file in %APPDATA%\Microsoft that leverages PowerShell for fileless execution, deploying capabilities including webcam/microphone surveillance, clipboard hijacking for crypto wallet address swapping, and credential theft from browsers, VPNs, and gaming platforms. Notably, attackers actively engage victims via a live chat window while simultaneously exfiltrating stolen data via Discord and Telegram, maintaining persistence through a watchdog mechanism and defensive evasion via Task Manager and UAC disabling.

1-CLICK RCE TO STEAL YOUR MOLTBOT DATA AND KEYS (CVE-2026-25253)

A critical 1-click RCE vulnerability (CVE-2026-25253) discovered in OpenClaw (formerly Moltbot), the popular open-source AI assistant with over 100,000 users, chains three logic flaws: unsanitized `gatewayUrl` query parameter acceptance, automatic gateway reconnection, and auth token leakage in the WebSocket handshake. The exploit bypasses localhost network restrictions via Cross-Site WebSocket Hijacking due to missing origin validation, then uses the stolen operator-scoped token to programmatically disable user confirmation prompts and container sandboxing before executing arbitrary commands on the host machine. Organizations deploying OpenClaw should immediately upgrade past v2026.1.24-1, rotate all auth tokens, and treat this as a broader warning about the attack surface introduced by AI agents granted extensive system permissions.

DISRUPTING THE WORLD'S LARGEST RESIDENTIAL PROXY NETWORK

Google Threat Intelligence Group disrupted the IPIDEA residential proxy network—believed to be the world's largest—by taking legal action against C2 domains, sharing intelligence with partners, and enforcing removals of Google Play Protect, reducing the available device pool by millions. The investigation revealed IPIDEA operated through 14+ proxy and VPN brands with four SDK families (PacketSDK, CastarSDK, HexSDK, and EarnSDK) sharing a two-tier C2 infrastructure and approximately 7,400 Tier Two servers, with over 550 threat groups from China, DPRK, Iran, and Russia observed using IPIDEA exit nodes in a single week. Organizations should monitor for published IOCs, block known IPIDEA-associated domains, and audit environments for traffic patterns consistent with residential proxy abuse, particularly from applications that monetize bandwidth.

YOUR PHONE SILENTLY SENDS GPS TO YOUR CARRIER — HERE'S HOW

Mobile carriers can silently ask modern phones to compute and send exact GPS coordinates using low-level RRLP and LPP protocols, bypassing iOS and Android permission systems entirely. This happens in the baseband processor, which talks directly to cell towers and the GPS chip, so operating system privacy settings, VPNs, and app-level toggles offer no protection. Law enforcement, intelligence agencies, and even data brokers have leveraged this capability for real-time tracking, often in murky legal territory. Apple's new C1 modem and iOS 26 add some visibility and consent controls on the iPhone 16e, but billions of other devices remain always-trackable whenever a SIM is active.

MACOS HARDENING: A NEW SERIES

Gabriel Biondo, a former CISO and pentester, introduces a practical macOS hardening series grounded in defense-in-depth principles, emphasizing that layered security controls across network, application, secrets, and operational layers dramatically reduce compromise likelihood compared to any single control. The series outlines a pragmatic threat modeling approach focused on identifying assets, threat agents, and value-vs-cost tradeoffs rather than over-engineered frameworks, with upcoming installments covering DNS filtering, browser compartmentalization, MFA/passkeys, and compensative controls. Security professionals are reminded that the goal is not invulnerability but raising the cost of attack above that of alternative targets while maintaining system usability.

REKO

Reko is a general-purpose, open-source decompiler for machine code binaries that supports multiple processor architectures and executable file formats with minimal user intervention. Built on .NET 6.0, it provides command-line, Windows GUI, and ASP.NET front ends for analyzing and decompiling binary executables. Licensed under GPL, it is particularly useful for reverse engineering and binary analysis workflows where legal rights to decompile are established.

MALCOLM

Malcolm is a powerful, easily deployable network traffic analysis tool suite for full packet capture artifacts (PCAP files), Zeek logs, and Suricata alerts.

INDUREX (PRODUCT LAUNCH)

Indurex provides an AI-powered platform that secures cyber-physical systems by ingesting OT and IT data, correlating industrial and network signals, and unifying the context.

THE PATH TO PWNING THE PS VR2 (PART 1) - "RECOVERY MODE"

A stack overflow vulnerability discovered in Sony's PS VR2 kernel-level USB authentication code allows arbitrary firmware downgrading by exploiting an unchecked `memcpy` in `usb_auth_set_auth1_data` that blindly trusts the USB request buffer length beyond the 64-byte structure size. Repeatedly triggering the overflow on device connection forces the PS VR2 into a hidden recovery mode running initial firmware v01.10, from which any firmware version can be installed despite no eFuse-based downgrade protection being present. The exploit tool "vr2jb" has been publicly released. Researchers recommend downgrading to v06.00 as a stepping stone toward a full jailbreak that could unlock features like eye tracking and haptics on PC.

STOPICE HACKED TO SEND ALARMING TEXT MESSAGES, ADMINS ACCUSE BORDER PATROL AGENT OF SABOTAGE

ICE-reporting service StopICE was compromised to send frightening texts falsely claiming user data was handed to authorities and smearing its developer. StopICE's team traced the attack to a US border agent's personal server. It says no usernames, addresses, or GPS data are stored. The service will use “bait” data to identify the alleged attackers.

BOOZ ALLEN TECH CONTRACTOR TOOK IRS JOB SPECIFICALLY TO LEAK TRUMP'S TAX RECORDS

The US Treasury Department announced that it was canceling all contracts it holds with Booz Allen Hamilton after their failure to prevent one of its contractors from stealing and leaking tax records years ago. The decision specifically deals with the case of a contractor, Charles Littlejohn, who leaked tax returns of more than 400k US taxpayers between 2018 and 2020. Littlejohn used a private server to siphon the tax returns of President Donald Trump, Jeff Bezos, Elon Musk, and other super-rich Americans.

MCDONALD'S NETHERLANDS TAKES PASSWORDS TO THE STREETS FOR CHANGE YOUR PASSWORD DAY

McDonald's Netherlands and TBWA\NEBOKO used digital billboards featuring popular menu items as passwords to spotlight how weak and predictable many online credentials are, as real leak data shows terms like “bigmac” and “frenchfries” are used tens of thousands of times.

MICROSOFT DISABLES NTLM IN WINDOWS

Microsoft is now disabling NTLM by default in Windows 11 and Windows Server as the next step in deprecating the decades-old authentication protocol, which has been frequently exploited in relay attacks to gain full network access.

PLEASE DON'T FEED THE SCATTERED LAPSUS SHINYHUNTERS

Unit 221B researchers warn that victims should refuse to pay or negotiate with the Scattered Lapsus ShinyHunters (SLSH) extortion group, whose tactics include swatting executives, threatening families, and manipulating media, as the Com-based gang's chaotic internal dynamics mean they cannot be trusted to honor any promises to delete stolen data.