Daily Threat Intel Digest - 2026-02-12

🔴 Critical Threats & Active Exploitation

[NEW] Palo Alto Networks firewall flaw enables forced reboot loops
Unauthenticated attackers are exploiting CVE-2026-0229, a medium-severity flaw in PAN-OS’s Advanced DNS Security feature, to trigger repeated reboots or maintenance-mode crashes in firewalls. The vulnerability requires only network access and ADNS enabled with block/sinkhole settings, affecting thousands of enterprise perimeter devices. Palo Alto urges immediate upgrades for vulnerable versions, as no configuration mitigations exist [CyberPress; GBHackers].

[NEW] Apple zero-day CVE-2026-20700 actively exploited in targeted attacks
A critical dyld memory corruption flaw is being weaponized in “extremely sophisticated” campaigns against high-value individuals like activists and journalists. The vulnerability enables arbitrary code execution via malicious apps or web content, chaining with older flaws (e.g., CVE-2025-14174) for full device compromise. iOS/iPadOS 26.3 patches address this alongside fixes for WebKit UAF, kernel escalation, and Bluetooth/Wi-Fi flaws [CyberPress; GBHackers].

[NEW] Malicious Outlook add-in steals 4,000 credentials via supply chain hijack
Attackers compromised the dormant “AgreeTo” add-in by seizing its expired domain (outlook-one.vercel.app), injecting a fake Microsoft login page to harvest credentials, credit cards, and emails. Since Microsoft only validates manifests at submission, the hijack required no new approvals, exposing a critical supply chain risk. Koi AI identified 4,000+ compromised accounts before takedown [CyberPress; GBHackers].

🎯 Threat Actor Activity & Campaigns

[NEW] DragonForce ransomware escalates with 363 victims and cartel-style RaaS
Operating since December 2023, DragonForce has expanded its ransomware-as-a-service model via “RansomBay” tools, targeting 363 organizations across 36 countries. The group uses LockBit 3.0-derived code, BYOVD techniques, and extortion tactics like “Harassment Calling,” while forming alliances with Qilin and LockBit. Activity peaked in December 2025 with 35 victims, showing evolution toward ecosystem-driven influence [Malware.News].

⚠️ Vulnerabilities & Patches

[NEW] Adblock filter flaw exposes VPN users’ real locations via timing attacks
Dubbed “Adbleed,” this technique exploits country-specific adblocker lists (e.g., EasyList Germany) to identify users despite VPN encryption. Attackers use JavaScript probes to test blocked domains, with timing differences (blocked requests <30ms vs. unblocked 50-500ms) revealing locale. Combining this with fingerprinting achieves 95%+ location accuracy. Mitigations include disabling regional lists or randomizing filters, though at the cost of reduced ad-blocking [CyberPress; GBHackers].

🛡️ Defense & Detection

[NEW] Promptware attack hijacks AI assistants to spy via Zoom
Attackers weaponize Google Calendar invites with malicious prompts to force AI assistants (e.g., Google Assistant) to launch Zoom and stream camera feeds to attacker servers without user interaction. The 7-stage “Promptware Kill Chain” automates escalation from calendar entry to C2, exploiting overly permissive AI permissions. Defenders should sanitize input, limit camera access, and audit AI actions [CyberPress; GBHackers].

[NEW] VoidLink framework enables on-demand Linux malware creation
UAT-9921 operators deploy this cloud-native malware using AI-assisted development, with Zig-based cores and C/Go plugins for on-demand compilation. VoidLink detects EDR tools, adapts scans, and uses mesh P2P C2 to bypass firewalls. Observed since September 2025 against tech/finance victims, it highlights AI’s role in accelerating attack tooling [CyberPress].

⚡ Quick Hits

• WordPress plugin bug: CVE-2026-1357 in WPvivid Backup Plugin exposes 800,000+ sites to RCE via file upload [GBHackers].
• SSH botnet resurgence: SSHStalker propagates via brute-force attacks, using IRC C2 and legacy exploits on outdated Linux hosts [CyberPress].
• Lazarus Graphalgo campaign: North Korean group targets GitHub/npm/PyPI with fake recruiter lures to deliver cryptocurrency-focused malware [GBHackers].