Parse notes
Sponsored
Compliance doesn't end when you get your SOC 2 certificate. Security reviews, audits, and vendor questionnaires demand constant attention -- and leave GRC teams too overwhelmed to actually think about security strategy.
China's CNCERT warned that OpenClaw, an open-source self-hosted AI agent, poses significant risks due to weak default settings and privileged system access. These vulnerabilities can enable indirect prompt injection attacks, where malicious instructions embedded in web content can force the agent to exfiltrate sensitive data via attacker-constructed URLs shown as link previews in Telegram or Discord — no user click needed. Other attack points include malicious skills uploaded to ClawHub that can execute arbitrary commands or install malware, instruction misinterpretation leading to irreversible data deletion, and threat actors distributing trojanized OpenClaw installers on GitHub that deliver malware such as Atomic Stealer, Vidar Stealer, and the Golang proxy GhostSocks via ClickFix-style lures. Recommended mitigation steps include blocking OpenClaw's default management port from internet exposure, isolating the service in a container, avoiding plaintext credential storage, and restricting skill installations to trusted channels only.
Phishing sites impersonating Starbucks Partner Central captured employees' credentials, allowing an unauthorized third party to access staff accounts between January 19 and February 11. The intrusion exposed names, Social Security numbers, dates of birth, and bank and routing details for 889 employees.
Law enforcement shut down the SocksEscort proxy service, which sold traffic tunneled through 369,000 infected home and small-business routers in 163 countries since at least 2021. Operation Lightning seized 34 domains, 23 servers, and froze $3.5 million in crypto linked to more than €5 million in proxy sales. Criminals used the network for fraud, ransomware, DDoS, and CSAM, abusing RCE and command injection flaws in some 1,200 router models and, in some cases, flashing custom firmware that permanently disabled updates.
The Phexia Campaign, likely linked to APT28, deploys a four-stage macOS attack chain initiated via a ClickFix prompt that tricks users into pasting a base64-obfuscated osascript payload into Terminal, establishing LaunchAgent persistence at ~/Library/LaunchAgents/com.components.campaign-id.plist and polling a Telegram bot for live C2 domain updates. The implant uses tccutil reset All to clear TCC permissions and resurface permission dialogs, masquerades a credential-harvesting dialog as System Preferences with 150 retry loops to capture the macOS user password, then, every 60 seconds, pulls and executes a Phexia Stealer osascript payload targeting all crypto wallets, browsers, Keychain, and Telegram auth data. Defenders should alert on launchctl load activity writing to ~/Library/LaunchAgents, monitor for tccutil reset All execution, block vdsina[.]com-hosted domains at the DNS layer, and treat any Terminal paste prompt from a website as an immediate IOC.
Endor Labs identified 88 new malicious npm packages across three PhantomRaven waves (Waves 2–4) published between November 2025 and February 2026, with 81 packages still live and two C2 servers still active, both AWS EC2 instances running plaintext HTTP on port 80. The campaign abuses Remote Dynamic Dependencies (RDD) like HTTP URL entries in package.json that cause npm itself to fetch and execute a 259-line credential-harvesting payload from attacker infrastructure at install time, exfiltrating developer emails, CI/CD tokens, and full system fingerprints via triple-redundant GET/POST/WebSocket channels to PHP endpoints jpd.php and npm.php. Defenders should reject any npm package with non-registry URL dependencies, block outbound HTTP to domains matching the artifact-themed C2 pattern, and audit CI/CD pipelines for token exposure across the 50+ disposable npm accounts attributed to this operator.
MCP servers have rapidly become the default integration layer for AI agents, but large‑scale scanning of 1,808 servers shows that 66% expose security issues. The riskiest patterns are code execution, toxic cross‑server data flows, and tool‑description prompt injection, which enable data exfiltration, supply‑chain attacks, and even zero‑click RCE via clients like IDEs and desktop agents. Real incidents demonstrate that MCP01–MCP06‑style issues are already being exploited in production. Security‑minded teams should treat MCP as a live attack surface: check servers against the MCP Security Registry, tightly scope tokens, test system prompts, and rigorously review tool and config changes before granting autonomous access.
Sponsored
Most identity governance platforms add work instead of reducing it. Databricks took a different approach with Opal, USING AUTOMATION AND DEVELOPER-FRIENDLY POLICY CONTROLS to manage access at scale while maintaining visibility and control.
cartography is a CNCF Python tool that ingests infrastructure assets from 30+ platforms into a Neo4j graph database to map asset relationships and expose hidden attack paths. Security teams can query cross-tenant IAM relationships, network ingress/egress paths, and datastore access patterns, or run framework compliance checks via `cartography-rules`, with extensible plugin support for custom data sources.
Onyx Security provides an AI control plane that discovers, monitors, and governs autonomous AI agents across cloud, endpoints, code, and SaaS so enterprises can securely deploy, supervise, and scale large numbers of agents.
Runtime mobile application instrumentation toolkit powered by Frida. Inspect, hook, and modify mobile apps through a web-based interface.
Rapid7 Labs identified an active campaign compromising over 250 legitimate WordPress sites across 12 countries, injecting a fake Cloudflare CAPTCHA ClickFix lure that tricks Windows users into pasting a PowerShell command that downloads the DoubleDonut shellcode loader, ultimately delivering Vidar Stealer v2, a newly identified .NET stealer dubbed Impure Stealer, and a new campaign-specific C++ stealer named VodkaStealer. The attack chain runs almost entirely in memory, injecting payloads into svchost.exe via VirtualAllocEx and CreateRemoteThread to evade file-based detection, while the ClickFix JavaScript actively filters out WordPress admin cookies, known bot user agents, and wp-admin referrers to avoid tipping off site owners. WordPress administrators should restrict public access to wp-admin, enforce MFA, audit plugins for known-vulnerable versions, and review Rapid7's published YARA rules and IOCs to detect this campaign.
Google closed its $32 billion acquisition of Wiz this week, marking the largest acquisition in Google's history and the largest ever of a venture-backed startup. Index Ventures' Shardul Shah, Wiz's largest shareholder, attributes the outcome to the founding team's track record and Wiz's position at the intersection of AI, cloud, and security — the three dominant enterprise spending categories. The deal signals growing consolidation in cloud security, with hyperscalers moving to acquire best-of-breed CSPM platforms rather than build them in-house.
Operation Synergia III, a six-month INTERPOL-coordinated effort spanning 72 countries from July 2025 to January 2026, resulted in the seizure of 45,000 malicious IPs and servers, 94 arrests, 110 suspects under active investigation, and over 200 devices and servers confiscated—doubling the scope of 2024's Synergia II. The targeted infrastructure included phishing sites, ransomware networks, and social engineering operations, with notable actions in Macau (33,000 fraudulent websites identified), Bangladesh (40 arrests), and Togo (dismantling a romance scam and sextortion ring). A separate but concurrent operation by European and US authorities dismantled SocksEscort, a residential proxy network used to launder malicious traffic, seizing 34 domains, 23 servers, and approximately $3.5 million in cryptocurrency.
Sponsored
Hear directly from Cisco threat researchers on how they're implementing advanced threat research by correlating IPS rules to network telemetry, and delivering detection directly to Cisco
Microsoft re-released hotpatch KB5084597 for Windows 11 24H2/25H2 and Enterprise LTSC 2024 to address three RRAS RCE flaws (CVE-2026-25172, CVE-2026-25173, and CVE-2026-26111) that allow a domain-authenticated attacker to trick users into connecting to a malicious server via the RRAS Snap-in.
Google's 2025 VRPs paid out over 17 million USD to hundreds of researchers across Chrome, Android, and cloud products.
ShinyHunters claimed responsibility for a breach at Telus Digital, alleging theft of up to 1 petabyte of data, including customer support recordings, source code, and employee records with FBI background check results.