Yesterday's security developments from Thursday, February 12, 2026. We're covering 14 articles today. All attribution is by the article authors. All article analysis is automated.
We have a critical security alert. CVE-2025-40536, a vulnerability in SolarWinds Web Help Desk, has been added to the CISA Known Exploited Vulnerabilities catalog.
Reuters reports that Palo Alto Networks softened attribution of a global cyberespionage campaign, changing from explicitly naming China to describing it as a 'state-aligned group that operates out of Asia' due to fears of retaliation from Beijing. The campaign by threat group TGR-STA-1030 successfully breached government and critical infrastructure organizations in 37 countries, with reconnaissance activities targeting nearly every country globally.
DomainTools Investigations reveals that Lotus Blossom conducted a sophisticated supply-chain espionage campaign in late 2025 through early 2026, compromising Notepad++'s update infrastructure to selectively deliver the Chrysalis backdoor to high-value targets in government, financial, and IT sectors. The campaign primarily focused on Southeast Asian targets, particularly Vietnam and the Philippines, demonstrating advanced operational security with infrastructure-level compromise.
Okta Threat Intelligence warns that North Korean IT workers are orchestrating a sophisticated employment scheme using stolen identities, AI-generated profile pictures, and fabricated online profiles on LinkedIn and GitHub to gain employment at legitimate companies. Once employed, these actors conduct ransomware attacks, intellectual property theft, and intelligence gathering operations, targeting companies across multiple industries including critical national infrastructure.
CISA, NSA, and the Canadian Centre for Cyber Security report that China-linked state-sponsored cyber actors are using the BRICKSTORM backdoor to maintain persistent access in VMware vSphere environments and Windows systems. The malware employs sophisticated evasion techniques including multi-layered encryption and DNS-over-HTTPS, and exists in multiple variants, with agencies releasing IOCs and detection signatures for a new variant.
Wordfence has identified a critical arbitrary file upload vulnerability in the WPvivid Backup WordPress plugin affecting approximately 800,000 WordPress sites. Unauthenticated attackers can exploit improper error handling during RSA decryption and lack of path sanitization to upload malicious files and achieve remote code execution, potentially leading to complete site takeover. The vulnerability has been patched in version 0.9.124.
Cato CTRL discovered Foxveil, a new malware loader active since August 2025 that abuses legitimate cloud services including Cloudflare Pages, Netlify, and Discord attachments for staging infrastructure. The malware employs in-memory shellcode execution and string-mutation routines to evade detection, with two distinct variants observed and some malicious infrastructure already taken down following responsible disclosure.
Kaspersky Lab reports on the RenEngine campaign, which distributes stealer malware including Lumma and ACR Stealer through modified Ren'Py game launchers disguised as game cheats and pirated software. The RenEngine loader employs sandbox evasion techniques and leverages HijackLoader to inject malicious payloads into system processes, primarily affecting users in Russia, Brazil, Turkey, Spain, and Germany since March 2025.
Sekoia.io has unmasked OysterLoader, a sophisticated multi-stage C++ malware loader active since June 2024 that is distributed through fake websites impersonating legitimate software like PuTTy, WinSCP, and Google Authenticator. The loader facilitates delivery of secondary payloads including Rhysida ransomware and Vidar infostealer.
According to reports from LayerX and Q Continuum, malicious Chrome extensions are affecting tens of millions of users. LayerX identified the 'AiFrame' campaign with 30 malicious extensions impersonating AI assistants affecting over 260,000 users, while Q Continuum discovered 287 malicious extensions exfiltrating browsing history from approximately 37.4 million users. The extensions employ various techniques to steal data for purposes including targeted advertising, corporate espionage, and credential harvesting.
Koi Research documented the first case of a malicious Microsoft Outlook add-in used for credential theft in the 'AgreeToSteal' incident. An attacker hijacked an abandoned meeting scheduling add-in called 'AgreeTo' through its Vercel-hosted URL, deploying a phishing kit that compromised over 4,000 victims' Microsoft credentials, credit card numbers, and banking information by exploiting Microsoft's trusted add-in distribution channel.
Palo Alto Networks provides insight into Muddled Libra's operational playbook, also known as Scattered Spider or UNC3944. The group uses sophisticated techniques to target BPO and MSP providers by compromising VMware vSphere environments and deploying rogue VMs for stealth operations, leveraging social engineering for initial access before using living-off-the-land techniques and abuse of legitimate infrastructure to evade detection.
Melvin Lammerts describes the 'Adbleed' technique, which allows partial de-anonymization of VPN and Tor users by analyzing their country-specific adblock filter lists. By measuring request timing to domains blocked by specific filter lists using client-side JavaScript, attackers can infer a user's location or language, exploiting the privacy trade-off of localized adblock configurations to bypass anonymity tools.
Finally, a community discussion from moonpiedumplings seeks free or open-source alternatives to 0patch, a commercial micropatch service that provides security fixes for unsupported or unpatched software vulnerabilities. This reflects growing interest in alternative patching solutions for maintaining security on legacy or unsupported systems.
That concludes today's briefing.