InfoSec Briefing - February 17, 2026

🎧 Audio Briefing

Playback Speed:

Good morning. This is your security briefing for Monday, February 16, 2026, covering 6 articles analyzed overnight. All attribution is by the article authors. All article analysis is automated.

According to reports from Rekt News, Boring Security, and researcher Seongsu Park, North Korean and Chinese nation-state actors are conducting sophisticated infiltration campaigns targeting Western technology companies and IT professionals. The operations include using stolen identities to secure legitimate remote employment at over 300 U.S. companies where attackers exfiltrate code and sensitive data for months undetected, as well as the Contagious Interview campaign that uses fake job interviews to deliver BeaverTail and InvisibleFerret malware through malicious Visual Studio Code workspaces and NPM packages. These attacks specifically target cryptocurrency and Web3 professionals, deploying trojanized MetaMask extensions to steal wallet credentials, seed phrases, and private keys while exploiting economic anxieties in the job market.

The Canadian Centre for Cyber Security reports on emerging cyber threats targeting the marine transportation sector from multiple threat actor types including state-sponsored groups, financially motivated cybercriminals, and non-state actors. The sector's increasing digitalization has significantly expanded attack surfaces, creating substantial risks to Canada's economic and national security through various attack methods targeting shipping, ports, and logistics infrastructure.

Intego Security researchers have identified the Matryoshka variant of ClickFix, a social engineering campaign targeting macOS users through typosquatted domains that mimic software review sites. The attack uses a Traffic Distribution System to redirect victims to fake pages that instruct them to execute Terminal commands, downloading an encoded stealer payload that employs advanced evasion techniques including in-memory decoding and decompression to exfiltrate sensitive data while displaying fake error messages.

Researchers from ETH Zurich have discovered significant security vulnerabilities in three popular cloud-based password managers, Bitwarden, LastPass, and Dashlane, affecting approximately 60 million users. The vulnerabilities allow attackers to view and modify stored passwords through simple user interactions like logging in or syncing data, with researchers demonstrating 12 attacks on Bitwarden, 7 on LastPass, and 6 on Dashlane, challenging these providers' claims of absolute security through zero-knowledge encryption.

That concludes today's briefing.

📰 Articles Covered

Rekt - Digital Parasites - oper jobs at Western companies - then drawing salaries, accessing codebases, and exfiltrating data for months before anyone even noticed. - The content posted at https://rekt.news/digital-parasites is hosted on a public platform for anonymous authors, and REKT takes no responsibility for the views or content hosted there .

A new sophisticated cyber threat, dubbed "Digital Parasites," has emerged, primarily driven by nation-states like North Korea and China, as well as financially motivated groups 【1】. These attackers are moving beyond traditional hacking methods to infiltrate organizations by posing as legitimate employees or contractors 【1】.

**What Happened:**
Attackers are using stolen identities, fabricated work histories, and polished online profiles to successfully pass background checks and technical interviews for remote positions 【1】. Once employed, they operate undetected for extended periods, often months or years, to exfiltrate code, steal credentials, map infrastructure, and compromise private keys 【1】. Their objectives range from disrupting operations and stealing data to holding information for ransom or funding illicit activities, such as weapons programs 【1】.

**Who is Affected:**
The targets are extensive and include over **300 U.S. companies**, with notable mentions of **Fortune 500 companies**, **U.S. critical infrastructure** (including power grids and transportation systems), major **telecom providers** (AT&T, Verizon, T-Mobile, Lumen), and **crypto companies** 【1】.

**Security Implications:**
The "Digital Parasites" threat bypasses traditional security defenses that focus on code exploits 【1】. These attackers employ "living off the land" techniques, making their malicious activities indistinguishable from legitimate operations 【1】. Their strategy prioritizes stealth, persistence, and evasion over overt, destructive attacks like ransomware 【1】.

**Technical Details:**
Malware such as **BeaverTail** and **InvisibleFerret** have been identified in these operations 【1】. The infiltration process involves elaborate fake interview procedures that can include malicious code execution 【1】. Social engineering tactics are also employed, such as using disguised patch downloads and conducting fake video calls with looped footage 【1】.

**What Defenders Should Know:**
The primary threat is no longer solely external system breaches but **internal infiltration through human trust** 【1】. Defenders must shift their focus from securing code to **securing people and processes**, as attackers are exploiting the employment pipeline itself 【1】. The most dangerous threats are now **invisible, patient, and indistinguishable from legitimate operations** 【1】. This necessitates a re-evaluation of screening and security protocols to account for threats that may already be on the payroll 【1】.
Famous Chollima and Dragon Sickness - Boring Security

A cybersecurity campaign, dubbed "Contagious Interview," orchestrated by threat actors associated with the **Democratic People's Republic of Korea (DPRK)**, is exploiting the current global economic climate and job market anxieties to distribute malware. This campaign targets **IT professionals and developers**, particularly those who are "job hugging" (clinging to existing roles due to economic uncertainty) or have been affected by layoffs.

**What Happened:**
The DPRK-linked actors are posing as recruiters or interviewers and luring victims into participating in fake technical assessments. These assessments involve the use of malicious **Visual Studio Code (VSCode) workspaces**. When a user "trusts" a malicious workspace, a `tasks.json` file within the `.vscode` directory is executed, initiating a chain of events that ultimately leads to malware execution on the victim's device. The primary goal is to **steal cryptocurrency and harvest credentials** from developer workstations, which can then be used for further intrusions or to pivot to other systems.

**Who is Affected:**
The campaign specifically targets **developers and IT professionals** who are actively seeking employment or are vulnerable due to economic instability. The use of VSCode, a widely adopted development tool, broadens the potential victim pool.

**Security Implications:**
The primary security implications include:
- **Credential Theft:** Sensitive information such as API keys, cloud secrets (AWS, Azure), and GitHub Personal Access Tokens (PATs) can be exfiltrated if configured as environment variables.
- **System Compromise:** The harvested credentials can grant attackers access to cloud environments, code repositories, and other sensitive systems.
- **Supply Chain Risk:** The abuse of trusted hosting platforms like GitHub, Vercel, and OnRender, along with the exploitation of built-in VSCode features, highlights a significant supply chain risk.
- **Evasion of Detection:** The attackers employ various techniques to evade security software and human analysis, including visual indentation, Base64 encoding, JavaScript obfuscation, user agent detection, and the use of JWTs.

**Technical Details:**
The attack leverages a feature within VSCode where a `tasks.json` file can be configured to execute commands. Threat actors create malicious workspaces containing such files. When a user trusts the workspace, the `tasks.json` executes, fetching and running payloads from remote sources, often hosted on legitimate platforms to bypass web filtering and avoid immediate flagging by security tools. The lifecycle involves:
1. **Payload Fetching:** Malicious payloads are downloaded from trusted hosting providers.
2. **Execution:** Payloads are piped to shell interpreters (`bash` or `cmd`).
3. **Further Downloads:** Initial payloads may download more sophisticated final payloads.
4. **Exfiltration:** The final payload executes, aiming to exfiltrate credentials and other sensitive data.

Three categories of final payloads have been observed:
- **Pure NodeJS Exfiltration:** This payload harvests environment variables, including secrets, by sending them in POST requests to attacker-controlled endpoints. It can also install NodeJS if it's not present on the system.
- **BeaverTail:** This is a malware with a notably low detection rate by security software.
- **Etherhiding:** This payload executes scripts fetched from the blockchain and is associated with DPRK's known techniques.

**What Defenders Should Know:**
Defenders should be aware of the following:
- **Developer Education:** It is crucial to educate developers about the risks of trusting public VSCode workspaces, especially those containing `tasks.json` or `package.json` files with suspicious configurations. Encouraging the use of read-only mode for inspecting code before trusting is vital.
- **Detection Mechanisms:**
- **Canary Tokens:** Implementing CanaryTokens, particularly for cloud credentials (e.g., AWS keys exported to environment variables), can provide early warnings of credential harvesting.
- **Anomaly Monitoring:** Establishing baselines for environment behavior and monitoring for anomalies, such as new sessions or actions initiated with stolen credentials, is essential. This is particularly important for detecting threats on personal devices if BYOD policies are in place.
- **Credential Management:** Eliminate the use of long-lived, privileged credentials. Favor ephemeral credentials whenever possible to minimize the attacker's action window.
- **VSCode Trust Prompt:** Be aware that Microsoft has made changes to the "Trust Workspace" dialog in VSCode, which may offer some additional protection.
Beyond the Backdoor: How Contagious Interview Is Surgically Tampering with MetaMask Wallets - Seongsu Park

The **Contagious Interview** cybersecurity campaign, attributed to North Korean threat actors, has evolved to specifically target and tamper with **MetaMask wallets** 【1】.

**What Happened:**
Attackers are delivering malware, such as **BeaverTail** and **InvisibleFerret**, often disguised as technical assessments within fake NPM packages. These are presented to victims during job interviews. The malware executes JavaScript, downloads further malicious scripts, and ultimately replaces the legitimate MetaMask browser extension with a trojanized version. This fake extension is designed to capture the user's wallet unlock password and steal encrypted vault files, which contain seed phrases and private keys, thereby granting the attackers full access to the victim's cryptocurrency funds 【1】.

**Who is Affected:**
The campaign primarily targets **IT professionals** in the cryptocurrency, Web3, and AI sectors, with a specific focus on **developers and engineers** 【1】.

**Security Implications:**
The security implications are significant, leading to **direct theft of financial information and cryptocurrency funds** 【1】. The attackers' methods are sophisticated, making detection difficult. They employ a surgical approach by injecting minimal code into the MetaMask extension to maintain its functionality while exfiltrating sensitive credentials 【1】.

**Technical Details:**
The infection flow begins with the execution of JavaScript, followed by the download of additional malicious scripts and backdoors. A critical step involves the manipulation of the MetaMask browser extension. Attackers replace the legitimate extension with a trojanized version that captures the wallet unlock password and exfiltrates encrypted vault files. This process involves bypassing Chrome's security mechanisms to alter browser extensions. The malware used includes JavaScript and Python, and the campaign demonstrates aggressive, multi-stage data exfiltration and direct fund theft capabilities 【1】.

**What Defenders Should Know:**
Defenders need to be aware of the **evolving tactics** employed by these threat actors. This includes their use of sophisticated JavaScript and Python malware, delivery via NPM packages, and the specific techniques used to compromise browser extensions like MetaMask. The attackers' ability to surgically tamper with extensions while maintaining functionality makes detection challenging, highlighting the need for robust endpoint security and vigilant monitoring for unusual extension behavior 【1】.
The cyber threat to marine transportation - Canadian Centre for Cyber Security - Canadian Centre for Cyber Security

The cybersecurity threat to marine transportation (MTS) encompasses a range of actors and methods that pose substantial risks to Canada's economic and national security.

**What Happened:**
The article outlines a landscape of cyber threats targeting the marine transportation sector. These threats are carried out by various actors with different motivations, including financially motivated cybercriminals, state-sponsored actors, and non-state actors. The increasing digitalization of the sector has expanded its vulnerability to these threats.

**Who is Affected:**
The **marine transportation sector** is directly affected. This includes entities involved in shipping, ports, and logistics. The consequences can ripple outwards, affecting **Canada's economic and national security** due to potential disruptions in supply chains and trade.

**Security Implications:**
The security implications are significant and multifaceted:
- **Financial Losses:** Ransomware attacks can halt port operations and disrupt supply chains, leading to substantial financial losses, as exemplified by the Maersk NotPetya incident.
- **Espionage and Economic Advantage:** State-sponsored actors engage in espionage to steal logistical data and intellectual property, aiming for economic advantage.
- **Disruption:** State actors may pre-position capabilities to disrupt operations during times of conflict.
- **Service Interruption:** Non-state actors utilize Distributed Denial of Service (DDoS) attacks to overwhelm systems, impacting public-facing websites and operational technology interfaces.

**Technical Details:**
- **Ransomware:** Primarily used by financially motivated cybercriminals for extortion and data theft.
- **Espionage:** Employed by state-sponsored actors to gather intelligence.
- **DDoS Attacks:** Used by non-state actors to disrupt services.
- **Expanding Attack Surface:** The increasing digitalization of the sector, including the integration of operational technology (OT), broadens the avenues for cyberattacks.

**What Defenders Should Know:**
Defenders in the marine transportation sector need to be aware of:
- **Evolving Threats:** The dynamic nature of cyber threats and the motivations of different actor groups.
- **Expanded Attack Surface:** The vulnerabilities introduced by digitalization and the interconnectedness of systems, including OT.
- **Specific Tactics:** The methods employed by ransomware attackers, state-sponsored espionage groups, and non-state actors.
- **Mitigation Strategies:** The necessity of implementing robust cybersecurity measures, which include protecting operational technology, securing supply chains, and maintaining vigilance against ransomware and espionage attempts.
- **Business Continuity:** The importance of cybersecurity alongside strong business continuity planning to ensure resilience in the face of cyber incidents 【1】.
Unpacking the New “Matryoshka” ClickFix Variant: Typosquatting Campaign Delivers macOS Stealer - **Kape Technologies** controls the content posted at the URL https://www.intego.com/mac-security-blog/matryoshka-clickfix-macos-stealer/ . Kape Technologies acquired Intego in July 2018 .

The **Matryoshka** variant of the ClickFix campaign is a sophisticated social engineering attack targeting macOS users, employing advanced evasion techniques to deliver a stealer payload.

**What Happened:**
The attack begins with users mistyping URLs for legitimate software review sites, leading them to typosquatted domains. These sites then redirect visitors through a Traffic Distribution System (TDS) to a page that instructs them to copy and paste a command into the macOS Terminal. This bypasses normal security expectations, as users unknowingly authorize the execution of a malicious script. The initial script downloads a compressed, encoded payload that is decoded and decompressed in memory, hiding its true nature. This loader then executes an AppleScript payload designed to steal sensitive information. Finally, the malware displays a fake error message to mislead the victim and uploads the collected data.【1】

**Who is Affected:**
**macOS users** are the primary targets of this campaign. Users who mistype URLs for software review sites are particularly at risk, as are those who are tricked into executing commands in their Terminal application.【1】

**Security Implications:**
The Matryoshka variant poses significant security risks due to its ability to:
- **Steal sensitive credentials:** It targets browser credentials and sensitive information stored by crypto wallet applications.【1】
- **Bypass security measures:** The use of in-memory execution, obfuscation, and API-gated communication makes it difficult for traditional security tools to detect and analyze.【1】
- **Deceive users:** The social engineering tactics, including the fake "fix" command and misleading error messages, are designed to lower user suspicion and delay detection.【1】

**Technical Details:**
- **Typosquatting:** The campaign leverages typosquatted domains, such as `comparisions[.]org`, to lure victims.【1】
- **Traffic Distribution System (TDS):** A TDS is used to redirect users to the malicious landing page.【1】
- **"Paste-to-Execute" Social Engineering:** Users are tricked into pasting commands into Terminal, granting execution privileges.【1】
- **"Matryoshka" Wrapper:** A multi-layered obfuscation technique involving Base64 decoding, `gunzip` decompression, and `eval` execution in memory.【1】
- **API-Gated Communication:** The malware uses a custom `api-key` header for communication with its command-and-control (C2) infrastructure, hindering automated analysis.【1】
- **AppleScript Payload:** This payload is responsible for harvesting data and targeting wallet applications.【1】
- **Credential Harvesting:** It attempts programmatic retrieval of credentials and employs a phishing loop disguised as a "System Preferences" dialog.【1】
- **Crypto Wallet Targeting:** The malware specifically targets **Trezor Suite** (by deleting and replacing it) and **Ledger Live** (by patching its application files).【1】
- **Data Staging:** Collected data is staged in `/tmp/osalogging.zip` before exfiltration.【1】
- **Evasion Techniques:** Includes background detachment, output suppression, and conditional forwarding of arguments.【1】

**What Defenders Should Know:**
- **User Education is Crucial:** Users must be trained to recognize that legitimate software updates or fixes will **never** require pasting commands into the Terminal. Any website instructing users to do so should be treated as malicious.【1】
- **Monitor Network Activity:** Block and monitor typosquatting domains and TDS infrastructure.【1】
- **Detect Execution Patterns:** Alert on Terminal-initiated download-and-execute patterns and unexpected `osascript` executions.【1】
- **Observe File System Artifacts:** Watch for suspicious staging archives in `/tmp/` and any tampering or re-signing of wallet applications.【1】
- **Understand Evasion Tactics:** Be aware of the malware's use of in-memory execution, API-gated communication, and custom headers, which are designed to frustrate analysis.【1】
- **Detection Signatures:** Intego VirusBarrier detects components of this attack, including `trojan:OSX/Stealer.sh` and `trojan:AppleScript/Stealer.gen`.【1】

**Indicators of Compromise (IOCs):**
- **C2 Domain:** `barbermoo[.]xyz`【1】
- **Typosquatting Domain:** `comparisions[.]org`【1】
- **Gateway URL:** `macfilesendstream[.]com`【1】
- **Header:** `api-key: 5190ef17…` (truncated)【1】
- **File Path:** `/tmp/osalogging.zip`【1】
Password managers less secure than promised - ETH Zurich

Researchers from ETH Zurich have identified significant security vulnerabilities in three popular cloud-based password managers: **Bitwarden, LastPass, and Dashlane** 【1】. These password managers are used by millions of people worldwide, collectively serving around 60 million users and holding a 23% market share 【1】.

**What Happened:**
The researchers demonstrated that it is possible for hackers to **view and even change stored passwords** 【1】. They conducted a series of attacks, ranging from compromising individual user vaults to completely taking over all vaults within an organization 【1】.

**Who is Affected:**
**Millions of users** of Bitwarden, LastPass, and Dashlane are potentially affected by these vulnerabilities 【1】.

**Security Implications:**
Despite providers often promising absolute security with "zero-knowledge encryption," these findings reveal that the stored passwords are not as secure as advertised 【1】. The vulnerabilities allow unauthorized access and modification of sensitive data, which could lead to account takeovers and financial fraud.

**Technical Details:**
The attacks required only simple interactions that users or their browsers routinely perform, such as logging in, opening the vault, or synchronizing data 【1】. The complexity introduced by features like password recovery or sharing expands the attack surface, allowing hackers to impersonate the server with small programs 【1】. The researchers demonstrated 12 attacks on Bitwarden, 7 on LastPass, and 6 on Dashlane 【1】.

**What Defenders Should Know:**

* **For Users:** It is recommended to choose password managers that are **transparent about security vulnerabilities**, undergo **external audits**, and have **end-to-end encryption enabled by default** 【1】.
* **For Providers:** Password manager providers should **avoid making false security promises** and instead **communicate clearly and precisely** about the actual security guarantees their solutions offer 【1】.