Good morning. This is your security briefing for Saturday, February 14, 2026, covering 15 articles analyzed overnight. All attribution is by the article authors. All article analysis is automated.
Arctic Wolf reports active exploitation of CVE-2026-1731, a critical vulnerability in BeyondTrust Remote Support and Privileged Remote Access allowing unauthenticated remote command execution. Attackers are deploying SimpleHelp RMM for persistence, creating domain admin accounts, and performing lateral movement using PSexec across self-hosted deployments, with discovery activities targeting Active Directory environments.
Hudson Rock reports that the Qilin ransomware group attacked Romania's national oil pipeline operator Conpet on January 11, 2026, stealing approximately 1TB of sensitive data. The attack began with an infostealer infection on an IT administrator's personal computer that exfiltrated 268 credentials, which attackers then used to gain domain access and deploy ransomware via compromised Windows Server Update Services.
Microsoft reports that malicious actors are exploiting AI assistant features across 31 companies in 14 industries through AI Recommendation Poisoning, embedding hidden instructions via URL prompt parameters to manipulate AI memory. The technique targets Microsoft Copilot and ChatGPT users, exploiting MITRE ATLAS techniques for memory poisoning and prompt injection to bias future recommendations on critical topics including health, finance, and security, with publicly available tools enabling easy deployment.
Quarkslab and SpecterOps released ClickOnceBlobber, a toolkit that weaponizes legitimate signed .NET ClickOnce applications by replacing dependency DLLs with a malicious SOCKS5 proxy agent. The attack uses AppDomainManager injection to tunnel network traffic through Azure Blob Storage, evading detection by mimicking legitimate Azure traffic and bypassing security controls.
Datadog Security Labs reports threat actors are impersonating software companies on GitHub to distribute infostealers primarily targeting macOS users through a ClickFix technique. The campaign uses fake repositories with malicious download links that redirect victims through staging sites to pages instructing them to paste and execute base64-encoded malicious commands in their terminals, with Windows users also targeted through separate download pages.
A GitHub user released BSOD_bitlocker_recover, a Python script that extracts BitLocker Volume Master Keys from memory dump files created during Blue Screen of Death events. The tool uses pattern matching to identify VMK headers in memory dumps, enabling decryption of BitLocker-encrypted volumes if an attacker obtains such dumps, posing a security risk for organizations relying on BitLocker encryption.
Whitecat18 released LazyDLLSideload, a Rust-based automation tool that generates DLL sideloading and proxying implants for red team operations. The tool parses PE export tables and creates ready-to-compile projects that can hijack legitimate application processes through DLL replacement or proxy techniques, enabling attackers to deploy malware, establish persistence, and evade detection.
Security researcher 0xMatheuZ demonstrates how attackers with kernel-level root access can bypass eBPF-based security tools including Falco, Tracee, and GhostScan by hooking critical kernel functions using ftrace. The technique manipulates eBPF data flows to filter malicious activities before they reach userspace monitoring tools, highlighting the fundamental limitation that eBPF tools cannot defend against a compromised kernel.
Thomas Papaloukas provides detection methods for Kerberos abuse in Windows Active Directory environments by analyzing TicketOptions fields in Event ID 4768 TGT requests. The article includes KQL queries to decode hexadecimal TicketOptions values into binary flags, enabling defenders to hunt for anomalous ticket flag combinations that may indicate attacker tools like Metasploit.
Researchers Sri Durga Sai Sowmya Kadali and Evangelos Papalexakis discovered that jailbreak attacks against large language models leave distinct layer-dependent latent signatures in internal representations that can be detected using tensor decomposition techniques. A novel defense mechanism is proposed that identifies and selectively bypasses vulnerable layers during inference to disrupt jailbreak attempts without requiring additional training or auxiliary models.
Coinbase has integrated Multi-Party Computation encryption into its CoreKMS Encryption Service to protect customer PII including Social Security numbers, names, and addresses. The system uses Distributed Key Generation where cryptographic keys are split among multiple parties, combined with AES-GCM-SIV authenticated encryption for deterministic, tamper-resistant data protection, and is available as an open-source library.
The Canadian Institute for Cybersecurity released CIC-Trap4Phish, a comprehensive dataset for detecting phishing and quishing attacks across five file categories: Word, Excel, PDF, HTML, and QR codes. The research demonstrates that lexical analysis of decoded URLs is highly effective for QR code-based phishing detection, while static feature extraction pipelines using machine learning models achieve high accuracy for document attachments without file execution.
JD.com has open-sourced JoySafety, a production-grade security framework designed to protect generative AI applications from threats including content security issues, data leakage, and prompt injection attacks. The framework features modular architecture supporting multiple models including BERT, FastText, and Transformer, with orchestration engine capabilities and asynchronous detection mechanisms for enterprise AI deployments.
The JoySafeter Team released JoySafeter, an enterprise-grade AI orchestration platform that integrates over 200 security tools into a unified system for security operations teams. The platform offers dual-mode architecture for rapid deployment and visual orchestration of AI-driven security agents, with recent updates including enhanced reasoning capabilities, multi-tenant sandbox isolation, and glass-box observability features.
That concludes this security briefing for Saturday, February 14, 2026.
That concludes today's briefing.