Good morning. This is your security briefing for Thursday, February 19, 2026, covering 14 articles analyzed overnight. All attribution is by the article authors, and all article analysis is automated.
Adnan Khan reports on a sophisticated supply chain attack called Clinejection that exploited a prompt injection vulnerability in Cline's AI-powered issue triager to compromise the project's release pipeline. Attackers poisoned GitHub Actions caches to steal production credentials and published malicious versions of the Cline CLI containing postinstall scripts to NPMJS, potentially affecting millions of developers worldwide.
According to reports from GitLab Threat Intelligence Team and the U.S. Department of Justice, North Korean state actors are conducting multiple schemes targeting the technology sector. GitLab researchers detail campaigns where attackers pose as recruiters and use fake job interviews to deliver JavaScript-based malware like BeaverTail and Ottercookie, stealing credentials from thousands of developers globally across cryptocurrency, finance, and AI sectors. Separately, a Ukrainian national was sentenced for operating a laptop farm scheme that enabled North Korean IT workers, including those from the Reconnaissance General Bureau, to generate income through freelance platforms using stolen U.S. identities while evading sanctions.
Palo Alto Networks reports that critical zero-day vulnerabilities CVE-2026-1281 and CVE-2026-1340 in Ivanti Endpoint Manager Mobile are being actively exploited in the wild to achieve remote code execution and complete MDM infrastructure compromise. Attackers are leveraging insecure bash usage in Apache RewriteMap functionality to deploy backdoors like the Nezha agent, targeting state and local government, healthcare, manufacturing, legal services, and high-tech sectors in the US, Germany, Australia, and Canada, with CISA adding CVE-2026-1281 to its Known Exploited Vulnerabilities catalog.
SafeBreach Labs discovered CVE-2025-29969, a critical time-of-check-time-of-use vulnerability in the Windows Eventlog service's MS-EVEN RPC protocol affecting Windows 11 and Windows Server 2025. The flaw allows low-privileged users to achieve remote code execution by writing arbitrary files to remote systems, enabling lateral movement in domain environments, though Microsoft patched the vulnerability in May 2025.
The Federal Bureau of Investigation reports that threat actors are conducting ATM jackpotting attacks across the United States using the Ploutus malware family, which exploits physical access and the XFS layer to force ATMs to dispense cash without authorization. Over 700 incidents were reported in 2025, resulting in more than 20 million dollars in losses to financial institutions.
ESET Research has identified PromptSpy, the first Android malware to weaponize generative AI by using Google's Gemini for persistence and evasion. The malware deploys VNC modules for remote access, abuses Accessibility Services to prevent uninstallation and capture sensitive data, and primarily targets users in Argentina through dedicated distribution websites, communicating with command and control servers using VNC protocol with AES encryption.
Proofpoint researchers identified TrustConnect, a malware-as-a-service platform operating as a remote access trojan sold to cybercriminals for 300 dollars monthly in cryptocurrency. The service enables threat actors to generate malicious payloads, manage compromised devices, and uses EV certificates and legitimate RMM branding to evade security controls, with the operator developing a new variant called DocConnect following disruption efforts.
Elastic Security Labs reports on a ClickFix campaign delivering MIMICRAT, a custom Remote Access Trojan, through compromised legitimate websites by tricking users into executing obfuscated PowerShell commands. The multi-stage infection process bypasses ETW and AMSI protections, using a Lua-based loader to execute shellcode in memory that deploys the RAT with capabilities including persistent access, lateral movement, process control, privilege escalation, and SOCKS proxy tunneling.
Trend Micro reports that threat actors abused Atlassian Jira Cloud's email system between December 2025 and January 2026 to send targeted spam messages that bypassed traditional email security filters. The campaign targeted government and corporate entities globally by creating disposable Jira Cloud instances and using Jira Automation to send emails from legitimate atlassian.net domains with valid SPF and DKIM authentication, with malicious redirects leading victims to dubious investment schemes and online casinos.
Security researchers publishing in Irregular identified a critical flaw in Large Language Models being used for password generation, demonstrating that LLM-generated passwords possess predictable patterns and significantly reduced entropy of 20 to 27 bits versus over 100 bits for truly random passwords. Testing of models like Claude Opus 4.6, GPT-5.2, and Gemini 3 Flash revealed non-uniform character distributions and repeating patterns that make these passwords vulnerable to brute-force attacks, affecting end-users, developers using AI coding agents, and agentic browsers.
Security researchers discovered critical infrastructure vulnerabilities affecting RPKI Publication Points, with 48.4% susceptible to DNS spoofing attacks and 85.9% having nameservers lacking ROA registration. These weaknesses in DNS and routing infrastructure could cause connectivity loss for 65 to 83% of Autonomous Systems in worst-case scenarios, undermining RPKI's effectiveness in preventing BGP prefix hijacking.
DebuggerMan details a 12-phase process for constructing advanced Red Team command and control infrastructure designed to evade detection. The methodology covers domain acquisition through C2 beacon deployment, emphasizing traffic obfuscation and resilience against compromise, demonstrating sophisticated adversary capabilities relevant to both offensive security practitioners and defensive teams.
Texas Attorney General Ken Paxton filed a lawsuit against TP-Link Systems Inc., alleging the company's networking devices enabled Chinese Communist Party access to American consumers' devices. The lawsuit claims TP-Link products have been used by PRC state-sponsored hacking entities for cyber-attacks, and the company's supply chain connections subject it to Chinese national data laws that could compel sharing of American user data with PRC intelligence services.
That concludes today's briefing.