Good morning. This is your security briefing for Monday, February 02, 2026, covering 9 articles analyzed overnight. All attribution is by the article authors. All article analysis is automated.
Rapid7 Labs has published a deep dive into the Chrysalis backdoor, attributed to the Chinese APT group Lotus Blossom. The malware was delivered through compromised Notepad++ distribution infrastructure and employs advanced evasion techniques including custom API hashing, layered obfuscation, and dynamic DLL loading to maintain persistent remote access with capabilities for command execution, file transfer, and self-removal.
In a historical perspective, researcher Oleg Shakirov has revealed a 1989 KGB directive that documented the Soviet intelligence agency's discovery of computer viruses as serious security threats. The directive shows the KGB suspected U.S. intelligence involvement and documented three active viruses affecting Soviet systems including the KGB itself, the Ministry of Radio Technology, and nuclear industry organizations since 1987.
VirusTotal reports that hundreds of malicious skills for the OpenClaw AI agent ecosystem have been detected, weaponizing the platform as a malware delivery channel. Attackers are disguising malicious skills as legitimate tools, instructing users to execute commands that install trojans and infostealers like Atomic Stealer, creating a new supply-chain attack surface.
NetSPI has disclosed a critical Remote Code Execution vulnerability in Quest Desktop Authority, tracked as CVE-2025-67813. Any authenticated domain user can exploit an insecurely exposed named pipe running with SYSTEM privileges to execute arbitrary code with local administrator privileges on affected endpoints.
RainbowDynamix has released GhostKatz, a credential dumping tool that extracts credentials from LSASS by exploiting signed vulnerable kernel drivers with physical memory read primitives. The tool bypasses user-mode detection by operating at the kernel level and works across multiple Windows versions, leveraging vulnerable drivers like Toshiba TPwSav to perform memory reads.
On the defensive side, security researcher a2awais has published a GitHub repository containing threat hunting queries for multiple security platforms including CrowdStrike and KQL. The repository serves as a resource for security teams to develop and utilize detection queries across different platforms.
The open-source project uxmal has released Reko, a binary decompiler that supports multiple processor architectures and executable formats for reverse engineering machine code. The tool is designed for security researchers and developers who have legal authorization to decompile software.
gVisor, an open-source project with connections to Google, has been highlighted as a Linux-compatible sandbox that provides container security by addressing risks associated with containers sharing the host operating system's kernel. The platform enables cloud-native container security and portability for organizations using containerized environments.
Finally, security researcher Gabriel Biondo has initiated a new series on macOS hardening, detailing a comprehensive defense-in-depth methodology for securing macOS systems. The approach focuses on threat modeling to identify assets and threat agents, implementing layered security controls rather than relying on perimeter-only defenses. That concludes this briefing.
That concludes today's briefing.