TLDR INFORMATION SECURITY 2026-02-19

Register for the Feb 19 Scentry Webinar.

SUPPLY CHAIN ATTACK EMBEDS MALWARE IN ANDROID DEVICES

Keenadu is a firmware-level Android malware embedded via supply chain compromise that hijacks Android's Zygote process to inject itself into every app on infected devices. It affects 13,000 devices across Russia, Japan, Germany, Brazil, and the Netherlands. Operating as a multistage loader, Keenadu deploys modules targeting shopping platforms such as Amazon and Temu, monitors Chrome queries, and commits ad fraud. Organizations should cross-reference Kaspersky's published IoCs against managed Android fleets. Firmware-level infections require full firmware replacement, and system app infections are mitigated by disabling or replacing the compromised app.

SHINYHUNTERS ALLEGEDLY DROVE OFF WITH 1.7M CARGURUS RECORDS

Cybercrime gang ShinyHunters has claimed the theft of 1.7 million CarGurus corporate records, including personal and internal data, and is extorting the company with a February 20 deadline. The crew has chalked up 15 alleged breaches in 2026, hitting financial firms, retail brands, car marketplaces, and dating platforms, often via social engineering and SSO abuse.

STOP THE CAP: MAKING ENTRA ID CONDITIONAL ACCESS MAKE SENSE OFFLINE

CAPSlock is an offline Conditional Access Policy (CAP) analysis engine built on ROADrecon that simulates sign-in scenarios without generating tenant artifacts and distinguishes between definitively applied policies and signal-dependent ones. The tool addresses a critical gap in Entra ID assessments, overlapping CAPs create hard-to-reason enforcement behavior, particularly around MFA bypasses and platform-specific policy gaps, by modeling normalization, exclusion logic, and cumulative policy enforcement offline. Both red teamers and defenders should evaluate CAPSlock for CAP auditing workflows, with the caveat that pending AAD Graph deprecation will require elevated Microsoft Graph permissions for future policy collection.

CLICKFIX: STOPPED AT ⌘+V

This post details a lightweight macOS defense against ClickFix attacks — now integrated into BlockBlock v2.3.0 — that intercepts ⌘+V keystrokes via NSEvent global monitoring, pauses the terminal process with SIGSTOP, and prompts the user to review clipboard contents before execution. The approach works across major terminal emulators and is particularly effective given that most documented ClickFix campaigns — including recent campaigns by North Korean APT UNC1069 and LLM-propagated attacks — explicitly instruct victims to use the keyboard shortcut. Notable limitations include no coverage for right-click paste operations, a dependency on Accessibility permissions, and Apple's Endpoint Security framework lacking an equivalent ES_EVENT_TYPE_AUTH_PASTE event, making user-space interception the only practical approach.

THE CURIOUS CASE OF THE TRITON MALWARE FORK

A suspicious fork of the Triton macOS omg.lol client turns out not to be simple plagiarism, but a clumsy malware delivery attempt hosted on GitHub. The attacker floods the README with links to a Windows-only malware ZIP hidden in an Xcode asset path, then pads the GitHub contribution graph with fake backdated commits to appear legitimate. Sandbox analysis shows a multistage Windows infection chain using 7zip, LuaJIT, anti-analysis tricks, and C2 traffic masquerading as Microsoft and blockchain traffic.

ADWSDOMAINDUMP

ADWSDomainDump is an Active Directory domain dumper that uses ADWS (port 9389) instead of LDAP to enumerate AD objects, bypassing both Microsoft Defender for Endpoint and CrowdStrike Falcon detection.

NONO

Nono is a secure, kernel-enforced sandbox for AI agents, MCP, and LLM workloads. It features capability-based isolation with secure key management and blocking of destructive actions in a zero-trust environment.

COGENT SECURITY (PRODUCT LAUNCH)

Cogent Security is an agentic AI platform for vulnerability management that autonomously investigates, prioritizes, and orchestrates remediation of security issues.

PASSWORD MANAGERS LESS SECURE THAN PROMISED

ETH Zurich's Applied Cryptography Group demonstrated 25 total attacks across Bitwarden (12), LastPass (7), and Dashlane (6), collectively serving ~60 million users breaking their "zero-knowledge encryption" guarantees by operating a malicious server that deviates from expected client behavior during routine actions such as login, vault access, and sync. Attacks ranged from targeted vault integrity violations to full organizational vault compromise, requiring only lightweight server-impersonation tooling rather than significant computational resources, with the root cause attributed to feature-bloat complexity and reliance on obsolete 1990s-era cryptographic primitives. Security teams should evaluate password manager vendors against criteria of transparent vulnerability disclosure, third-party audits, and modern end-to-end encryption enabled by default, pending publication of full findings at USENIX Security 2026.

DUTCH SECRETARY OF DEFENSE THREATENS TO 'JAILBREAK' NATION'S F-35 JET FIGHTERS

Dutch defense chief Gijs Tuinman suggests F-35 fighter software could be “jailbroken,” raising sharp questions about European dependence on US control systems and cloud services. The question is whether there are hidden kill switches or how Lockheed's update and logistics infrastructure can effectively ground fleets.

FROM BRICKSTORM TO GRIMBOLT: UNC6201 EXPLOITING A DELL RECOVERPOINT FOR VIRTUAL MACHINES ZERO-DAY

Mandiant and GTIG described how UNC6201 exploited CVE-2026-22769 (CVSS 10.0), a hardcoded admin credential in Dell RecoverPoint's Apache Tomcat configuration located at /home/kos/tomcat9/tomcat-users.xml. This enabled unauthenticated deployment of WAR files via/manager/text/deploy and allowed root-level code execution. Persistence was maintained by hijacking convert_hosts.sh, which is run at boot via rc.local. GRIMBOLT, a C# backdoor replacing BRICKSTORM in September 2025, is compiled with native AOT to remove CIL metadata, making static analysis more difficult. It shares C2 infrastructure with its predecessor and introduces new lateral movement techniques in VMware, such as using "Ghost NICs" and iptables-based Single Packet Authorization on compromised vCenter appliances. Defenders should review /home/kos/auditlog/fapi_cl_audit_log.log for requests to /manager, search for GRIMBOLT using published YARA rules and IOCs, immediately apply Dell's patch, and monitor for changes to convert_hosts.sh.

Join the Event

ANTHROPIC'S LATEST SONNET GETS BETTER AT USING COMPUTERS, AMID BOUTS OF EXISTENTIAL ANGST

Claude Sonnet 4.6 features improved computer use, enhanced prompt injection resistance, and a 200K default context window.

NOTEPAD++ FIXES HIJACKED UPDATE MECHANISM USED TO DELIVER TARGETED MALWARE

Notepad++ 8.9.2 introduces a double-lock update design that verifies both signed installers and signed XML from its update server to prevent hijacked updates.

POLISH AUTHORITIES ARREST ALLEGED PHOBOS RANSOMWARE AFFILIATE

A 47-year-old man was arrested in Poland's Małopolskie province as part of the Europol-led "Phobos Aetor" operation.