Good morning. Yesterday's security developments from Saturday, February 28, 2026, covering 14 articles. All attribution is by the article authors. All article analysis is automated.
Kirk/Derp reports that attackers believed to originate from Colombia distributed Remcos and AsyncRAT malware through Archive.org using steganography in late February 2026. The campaign concealed .NET injector DLLs within 4K wallpaper JPEG files, with payloads hidden after the JPEG end-of-file marker and delivered via process hollowing using MSBuild LOLBin, distributed across four Gmail-linked accounts with daily recompilation to evade detection.
Veracode Threat Research discovered a malicious NPM package named 'buildrunner-dev' using typosquatting to target developers. The package deploys obfuscated batch files that establish persistence, bypass UAC via fodhelper.exe, and download PNG images containing steganographically hidden payloads that ultimately deliver the Pulsar Remote Access Trojan, employing sophisticated evasion techniques including AMSI bypass, memory patching, and multi-stage obfuscation.
HackMag provides a technical deep dive on an integer overflow vulnerability in Nginx web server versions 0.5.6 through 1.13.2 that allows attackers to exploit the Range HTTP header parsing mechanism. By sending requests with negative byte range values, attackers can bypass size checks and read data beyond intended boundaries, potentially extracting sensitive information like cache file contents, backend server details, or IP addresses.
Security researcher wh1te4ever successfully created a virtual iPhone environment by modifying the 'super-tart' VM project and integrating components from Apple's Private Cloud Compute firmware. The implementation involved extensive firmware patching, bootloader modifications, and Metal graphics acceleration to enable iOS kernel analysis and security research, allowing accelerated discovery of iOS vulnerabilities through advanced research into Apple's ecosystem internals.
The Zero Day Initiative disclosed CVE-2026-20841, an arbitrary code execution vulnerability in Microsoft Windows Notepad affecting users who open malicious Markdown files. The flaw stems from improper validation of links within .md files, allowing attackers to exploit specially crafted protocol URIs like file:// and ms-appinstaller:// to execute arbitrary commands via ShellExecuteExW, which Microsoft patched in their February 2026 release cycle.
Check Point Research disclosed two critical vulnerabilities in Anthropic's Claude Code, CVE-2025-59536 and CVE-2026-21852, that allowed remote code execution and API token exfiltration through malicious project configuration files. Attackers could exploit untrusted repositories by injecting malicious hooks in .claude/settings.json to execute arbitrary shell commands, bypass MCP user consent dialogs, or redirect API communications to attacker-controlled servers to steal Anthropic API keys, though all reported vulnerabilities have been patched.
watchTowr discovered a series of pre-authentication remote code execution vulnerabilities in SolarWinds Web Help Desk, designated CVE-2025-40552, CVE-2025-40553, and CVE-2025-40554. The vulnerabilities chain authentication bypass with Java deserialization flaws, allowing attackers to execute arbitrary commands on affected servers without credentials, even on systems patched against earlier RCE vulnerabilities.
VMRay reports on Hydra Saiga, also known as Yorotrooper or ShadowSilk, a sophisticated threat actor active since 2021 that has compromised at least 34 organizations across 8 countries, primarily targeting critical water and energy infrastructure in Central Asia. The group employs custom implants written in Rust, Go, and Python, uses Telegram Bot API for command and control, and leverages living-off-the-land techniques, with activities aligning with Kazakhstan's strategic interests.
crtvrffnrt released Apimspray, a Python toolkit for password spraying attacks against Microsoft Entra ID that uses Azure API Management gateways as a distributed proxy layer for IP rotation to evade detection. The tool supports multiple attack modes and configurable pacing profiles to avoid account lockouts, and defenders are advised to implement MFA, strong password policies, and monitor for suspicious login patterns and account lockout events.
Antonlovesdnb introduced TTPRunner, an open-source autonomous agent tool for purple team operations that automates the execution of Tactics, Techniques, and Procedures based on threat reports. The tool uses Large Language Models to parse threat intelligence in multiple formats including PDF, STIX, Markdown, and URLs, generates attack plans, and executes them via QMP guest agent, WinRM, or SSH after user approval, with integration to VECTR for campaign management.
Microsoft released LiteBox, an open-source library operating system designed to reduce attack surface by minimizing the interface to host systems through sandboxing. The security-focused tool supports running unmodified Linux programs on Windows, sandboxing Linux applications, and executing programs on SEV SNP and OP-TEE environments, featuring a Rust-based interface architecture available under MIT License.
acedef released SynthAPT, a framework designed for simulating advanced persistent threats through playbook-based attack scenarios. It enables security professionals to create realistic malware simulations featuring in-memory shellcode payloads and multi-stage infections without requiring command and control infrastructure, intended for red teamers, defenders, and researchers to test organizational security controls against sophisticated attack techniques.
SpecterOps released Nemesis 2.2, an open-source tool for security researchers and defenders to analyze compromised systems and exfiltrated data, with funding from the United Kingdom's National Cyber Security Centre. The update includes large container file processing, LLM-driven analysis agents, enhanced DPAPI decryption capabilities, and performance optimizations in this defensive-focused development effort.
The Internet Governance Project published an analysis examining how geopolitical fragmentation threatens the global cybersecurity threat intelligence sharing ecosystem. The article discusses the importance of threat intelligence provenance in maintaining international cooperation on cybersecurity amid increasing geopolitical tensions, focusing on preserving cross-border threat intelligence collaboration despite political divisions.
That concludes today's briefing.