Good morning. This is your security briefing for Sunday, February 01, 2026, covering 14 articles analyzed overnight. All attribution is by the article authors. All article analysis is automated.
Foundation AI at Cisco has released Foundation-Sec-8B-Reasoning, an open-weight 8-billion parameter language model specialized for cybersecurity applications including vulnerability analysis, threat intelligence, and security policy generation. While the model represents a new defensive capability, it carries risks of potential misuse by malicious actors for generating sophisticated attacks or discovering vulnerabilities.
HullaBrian has released EventHorizon, a new open-source tool for security analysts that leverages Event Tracing for Windows telemetry and sigma-like rules to provide endpoint detection and response capabilities. The tool is explicitly designed for testing environments only and requires disabling Windows security features for installation.
Wiz has released SITF, the SDLC Infrastructure Threat Framework, an open-source framework designed to address threats targeting software development infrastructure. The framework includes over 70 attack techniques specific to SDLC components like CI/CD pipelines, version control systems, and registries, along with visualization tools and a security controls matrix.
Notepad++ reports that on June 10, 2025, state-sponsored Chinese hackers compromised their shared hosting provider to hijack the update mechanism, redirecting update traffic to malicious servers serving fake update manifests. The infrastructure-level attack exploited weaknesses in update verification controls to potentially deliver malware disguised as legitimate updates to targeted users until December 2, 2025.
The OpenSourceMalware team reports that attackers, exhibiting tactics similar to North Korean APT operations, are targeting small open-source maintainers by injecting malicious vscode tasks.json files into repositories. The malware automatically executes when projects are opened in VS Code, stealing credentials, cryptocurrency wallets, and browser data while establishing persistence for potential supply chain attacks, with at least 21 maintainers compromised in a 72-hour period.
Pulsedive reports that APT42, an Iranian state-sponsored threat group, uses TAMECAT, a PowerShell-based backdoor, for espionage operations targeting senior defense and government officials. The malware is deployed through social engineering and uses a multi-stage infection process, with VBScript initially checking for antivirus presence before downloading the PowerShell loader.
Trend Micro reports that China-aligned APT groups have been using PeckBirdy, a JScript-based command and control framework, since 2023 to target the gambling industry in China and government entities in Asia. The framework leverages Living off the Land Binaries for flexible deployment and has been observed in campaigns using modular backdoors HOLODONUT and MKDOOR, stolen code-signing certificates, and CVE-2020-16040 exploitation.
Stranded on Pylos reports that Poland's electric sector was attacked in December 2025 with conflicting attributions from security firms. CERT Poland attributes the attack to Berserk Bear, linked to the FSB, while Dragos and ESET attributed it to Sandworm, linked to the GRU, highlighting challenges in definitive nation-state attribution and potential shared infrastructure or collaboration between Russian intelligence-linked APT groups.
Stamatis Chatzimangou reports on ConsentFix, also known as AuthCodeFix, a phishing technique that exploits OAuth2 authorization code flow to gain unauthorized access to Microsoft accounts. The attack tricks victims into copying localhost URLs containing OAuth authorization codes from legitimate applications like Azure CLI and pasting them into malicious phishing sites, allowing attackers to exchange the codes for access tokens.
Manish Rawat analyzed a DLL hijacking attack executed by a non-administrator user through 37 Sysmon events. The attack used malicious DLLs placed in the temp directory and loaded by pollev.exe, exploiting Windows' DLL search order to execute malicious code without elevated privileges, demonstrating detection evasion through timestamp manipulation.
Cocomelonc demonstrates a macOS malware persistence technique that hijacks zsh shell configuration files to automatically execute malicious code during terminal sessions. The technique employs a Living off the Land approach using legitimate system features, similar to tactics used by APT groups like OceanLotus and Lazarus Group.
Cyble Research & Intelligence Labs discovered ShadowHS, a sophisticated fileless Linux post-exploitation framework built on a weaponized version of hackshell. The malware operates entirely in memory using multi-stage encrypted loaders, conducts aggressive fingerprinting of EDR and antivirus solutions, and includes capabilities for credential theft, lateral movement, privilege escalation, cryptocurrency mining, and covert data exfiltration through user-space tunnels.
Aikido Security discovered a malicious VS Code extension named ClawdBot Agent targeting developers by mimicking a legitimate AI coding assistant. Upon installation, the trojanized extension deploys a ConnectWise ScreenConnect RAT on Windows machines through a multi-stage payload delivery mechanism involving command and control communication and a Rust-based loader.
Broadcom's Symantec and Carbon Black Threat Hunter Team reports on PureRAT, a Vietnam-linked phishing campaign using AI to develop attack tools, lowering the barrier for less experienced threat actors. The campaign targets individuals via job offer phishing emails, using cloud-hosted malware, DLL sideloading, and Python scripts with signs of AI authorship to deliver PureRAT and HVNC payloads, with the ultimate goal of selling access to compromised organizations.
That concludes today's briefing.