Good morning. This is your security briefing for Sunday, February 22, 2026, covering 12 articles analyzed overnight. All attribution is by the article authors. All article analysis is automated.
AdGuard VPN has released TrustTunnel, an open-source VPN protocol designed to obfuscate traffic as regular HTTPS to bypass deep-packet inspection and throttling. The protocol includes server endpoint software, CLI and library clients, and GUI applications available across Linux, macOS, Windows, Android, and iOS platforms.
fksvs has released Siper, an open-source XDP-based firewall that drops malicious traffic at the network driver level using eBPF programs. The tool is designed to mitigate DDoS attacks by blocking traffic before it reaches the Linux networking stack, reducing CPU overhead compared to traditional firewalls.
Ajay Kumar Dhyani at Kubefront published a technical comparison of eBPF Ring Buffer and Perf Buffer mechanisms for transferring data from Linux kernel to user space. The article recommends Ring Buffer for new eBPF development due to its efficiency and modern design.
ODCrawler is a search engine that indexes and makes searchable publicly available files hosted in open directories across the internet. The platform may surface improperly secured data including sensitive information that organizations have inadvertently left accessible.
The United States Department of Justice reports that Romanian national Catalin Dragomir pleaded guilty to gaining unauthorized access to an Oregon state government office network in June 2021 and selling that access to buyers, along with stolen PII samples. He also sold access to numerous other U.S. victim networks, causing losses exceeding $250,000.
La Repubblica reports that Chinese state-sponsored hackers conducted a sophisticated cyberattack against Italy's Ministry of Interior, stealing identities of approximately 5,000 Digos agents. The primary objective was intelligence gathering to map dissidents within Italy, indicating targeted espionage operations against individuals of interest to the Chinese government.
Cyber&Ramen reports on a sophisticated intrusion campaign active since December 2025 that leveraged Large Language Models to automate attacks against FortiGate devices across 106 countries. The operation used a custom Model Context Protocol server called ARXON and orchestrator called CHECKER2 to enable LLMs like DeepSeek and Claude to generate attack plans, analyze reconnaissance data, and automate backdoor creation, representing a significant shift toward AI-augmented cyberattacks.
dazzyddos has released LSA Whisperer BOF, a Cobalt Strike Beacon Object File tool that enables attackers to extract Windows authentication material including DPAPI credential keys, cloud SSO tokens, and Kerberos tickets. The technique bypasses traditional LSASS memory protection mechanisms like Protected Process Light and Credential Guard by communicating directly with LSA authentication packages instead of accessing LSASS process memory.
The Cofense Phishing Defense Center reports that threat actors are conducting phishing campaigns using fake Microsoft and Google Calendar invitations to steal employee credentials. The attacks employ email spoofing techniques with altered sender addresses and urgent-themed calendar invites that redirect victims to fake login pages designed to harvest credentials.
Security researcher Thomas Roccia critiques the current approach to building AI-powered Cyber Threat Intelligence agents, arguing the industry over-emphasizes AI capabilities while neglecting user interface design and threat visualization. Roccia advocates for better visual representations to help threat analysts understand complex security landscapes and make AI CTI tools more effective.
The U.S. Department of the Treasury concluded a public-private initiative to enhance cybersecurity and risk management for AI in financial services. The initiative developed practical resources covering AI governance, data management, transparency, fraud prevention, and digital identity, with six resources to be released throughout February to help financial institutions manage AI-specific cybersecurity risks.
The Sequence reports on a macOS malware campaign distributing information stealers, Odyssey and MacSyncStealer, through cracked music plugin DMG files. The attack employs a multistage loader-as-a-service model with ClickFix social engineering tactics, targeting Intel-based Macs through unsigned DMG files containing bash scripts and Mach-O binaries that communicate with command and control domains.
That concludes today's briefing.