02/25/2026-03/04/2026 Actively Exploited VMware Aria Operations Flaw, 26 Suspicious npm Packages in New Cyber Campaign And More.

1. CISA Adds Actively Exploited VMware Aria Operations Flaw CVE-2026-22719 to KEV Catalog

 CISA has added a newly disclosed flaw affecting VMware Aria Operations to its KEV catalog, citing active attacks. Tracked as CVE-2026-22719 (CVSS 8.1), the high-severity bug is a command injection issue that allows unauthenticated attackers to execute arbitrary commands, potentially leading to remote code execution during support-assisted product migration. The vulnerability was patched alongside CVE-2026-22720 (stored XSS) and CVE-2026-22721 (privilege escalation). Affected products include VMware Cloud Foundation and VMware vSphere Foundation 9.x (fixed in 9.0.2.0) and VMware Aria Operations 8.x (fixed in 8.18.6). Customers unable to patch immediately can run the “aria-ops-rce-workaround.sh” script as root on each virtual appliance node. Broadcom acknowledged reports of in-the-wild exploitation but said it cannot independently confirm them. Federal Civilian Executive Branch agencies must apply fixes by March 24, 2026.

2. Fake Next.js Job Interview Tests Backdoor Developer’s Devices

A coordinated campaign is targeting software developers with job-themed lures, using malicious repositories disguised as legitimate Next.js projects and coding assessments. The operation aims to achieve remote code execution (RCE), steal sensitive data, and deploy additional payloads on compromised machines. According to Microsoft, attackers created fake web apps and hosted them on platforms like Bitbucket. When developers clone and open the projects, embedded malicious JavaScript executes automatically. The code downloads a backdoor from a remote server and runs it in memory via Node.js. To boost infection rates, the repositories include multiple triggers: a VS Code task that runs on folder open, a trojanized asset activated by “npm run dev,” and a backend module that exfiltrates environment variables and executes attacker-supplied code. The infection deploys staged payloads that profile hosts, connect to command-and-control servers, execute remote tasks, and enable file exfiltration. Developers are urged to enable Workspace Trust, apply security controls, and limit stored secrets.

3. North Korean-Linked Hackers Target Developers Through 26 Suspicious npm Packages in New Cyber Campaign

Cybersecurity researchers have warned of a new threat campaign allegedly tied to North Korean actors, involving 26 malicious packages uploaded to the npm registry. The packages were disguised as legitimate development tools and used typosquatting to mimic popular libraries, increasing the chances of accidental installation. Believed to be a variant of the “Contagious Interview” campaign, the operation reportedly used Pastebin-based steganography to hide command-and-control (C2) addresses inside seemingly harmless text files. Each package executed an installation script that launched a payload from “vendor/scrypt-js/version.js,” which decoded hidden server domains by stripping zero-width Unicode characters and extracting embedded data. The malware supported Windows, macOS, and Linux, and used WebSocket communication to receive commands. It included modules for data theft, VS Code persistence, keylogging, browser credential harvesting, and crypto wallet targeting, while scanning repositories for exposed secrets. The activity has been tentatively linked to the North Korea-associated group Famous Chollima. Developers are urged to verify npm packages carefully.

4. New Chrome Vulnerability Let Malicious Extensions Escalate Privileges via Gemini Panel

Cybersecurity researchers have detailed a patched high-severity flaw in Google Chrome that could have enabled privilege escalation and access to local files. Tracked as CVE-2026-0628 (CVSS 8.8), the issue stemmed from insufficient policy enforcement in the WebView tag and was fixed in version 143.0.7499.192/.193 for Windows, Mac, and Linux in January 2026. Discovered by Palo Alto Networks Unit 42 researcher Gal Weizman, the flaw—codenamed “Glic Jack”—affected Chrome’s Gemini Live side panel, which loads content via a WebView component. Attackers could trick users into installing a malicious extension with basic permissions, allowing script injection into the Gemini panel. Successful exploitation could have granted access to the camera, microphone, screenshots, and local files. The bug exposed risks tied to embedding AI agents directly into browsers, where privileged components may introduce new attack surfaces despite existing extension security controls.

5. Malicious StripeApi NuGet Package Mimicked Official Library and Stole API Tokens

Cybersecurity researchers have uncovered a malicious package on the NuGet Gallery impersonating a legitimate library from Stripe to target the financial sector. The package, named StripeApi.Net, mimicked the official Stripe.net library, which has over 75 million downloads. Uploaded on February 16, 2026, by a user called “StripePayments,” it copied the legitimate package’s icon and nearly identical documentation, subtly altering the name to “Stripe-net.” The attacker also inflated download numbers to more than 180,000 across 506 versions to boost credibility. According to ReversingLabs, the package preserved most legitimate functionality but modified key methods to steal sensitive data, including Stripe API tokens, and exfiltrate them to a remote server. Because applications continued to compile and run normally, developers were unlikely to notice the compromise. The package was reported and removed before causing significant harm.

02/18/2026-02/25/2026 SolarWinds Patches 4 Critical Serv-U 15.5 Flaws, Cline CLI 2.3.0 Supply Chain Attack And More.

1. SolarWinds Patches 4 Critical Serv-U 15.5 Flaws Allowing Root Code Execution

SolarWinds has released updates for Serv-U file transfer software to fix four critical vulnerabilities that could allow remote code execution. All are rated 9.1 on the CVSS scale:

• CVE-2025-40538: Broken access control letting attackers create admin users and run code as root;
  -CVE-2025-40539 & CVE-2025-40540: Type confusion flaws enabling execution of native code as root;
  -CVE-2025-40541: Insecure direct object reference (IDOR) allowing native code execution as root.

Exploitation requires administrative privileges, though risk is medium on Windows, as services often run under less-privileged accounts. These issues affect Serv-U version 15.5 and are fixed in 15.5.4. SolarWinds hasn’t reported active exploitation, but past Serv-U flaws (e. g., CVE-2021-35211, CVE-2021-35247, CVE-2024-28995) were targeted by hackers, including China-based group Storm-0322 (formerly DEV-0322).

2. Malicious npm Packages Harvest Crypto Keys, CI Secrets, and API Tokens

Cybersecurity researchers have disclosed an active supply chain worm campaign, dubbed SANDWORM_MODE, leveraging at least 19 malicious npm packages to steal credentials and cryptocurrency keys. The malware exfiltrates system information, tokens, environment secrets, and API keys, propagating via stolen npm and GitHub identities. Core features include a polymorphic engine, hook-based persistence, USB and SSH propagation fallbacks, and an “McpInject” module that targets AI coding assistants (Claude, Cursor, VS Code) to harvest SSH keys, environment files, and LLM API keys from providers like OpenAI, Anthropic, and Cohere. The attack unfolds in two stages, with a delayed secondary stage performing deeper harvesting, worm-like spread, and full exfiltration. Some packages include sleeper components or kill switches, which remain off by default. Users are urged to remove affected packages, rotate tokens and CI secrets, and review workflows. The campaign mirrors recent malicious npm activity, including buildrunner-dev and eslint-verify-plugin, which deliver RATs and agents targeting Windows, macOS, and Linux.

3. Cline CLI 2.3.0 Supply Chain Attack Installed OpenClaw on Developer Systems

On February 17, 2026, a supply chain attack targeted the Cline CLI open-source package, installing OpenClaw—an AI agent—on developer and CI/CD systems via the malicious [email protected] release. The attacker exploited a prompt injection vulnerability in the Cline GitHub Actions workflow, stealing a long-lived npm publish token to publish the compromised version. The post-install script silently installed OpenClaw globally, giving it system-level permissions, persistent presence, and potential access to credentials. The package was downloaded roughly 4,000 times over an eight-hour window. No evidence of data exfiltration or additional payloads was found, but OpenClaw’s unauthorized installation posed serious security risks, particularly in CI/CD environments. The attack was mitigated by deprecating [email protected], revoking the token, and releasing [email protected]. The incident highlights critical supply chain security weaknesses and the dangers of AI-driven automation in software workflows. Users are advised to remove OpenClaw and rotate any exposed credentials.

4. Wormable XMRig Campaign Leverages BYOVD and Timed Kill Switch For Stealth

Researchers uncovered a wormable cryptojacking campaign spreading via pirated software to deploy a custom XMRig miner. The malware uses a BYOVD exploit (Bring Your Own Vulnerable Driver) and a time-based logic bomb to evade detection and boost Monero mining efficiency by 15–50%. At the core is Explorer.exe, a persistent state machine that switches roles—installer, watchdog, payload manager, cleaner—based on command-line arguments. Payloads, including the miner, watchdogs, and a vulnerable driver (WinRing0x64.sys), are embedded in the binary, decompressed to hidden files, and disguised as legitimate software. A circular watchdog ensures the miner restarts if terminated, even killing Windows Explorer to maintain activity. The malware also spreads via USB drives, copying itself and creating malicious shortcuts. A kill switch set for December 23, 2025, triggers cleanup, suggesting a limited operational window. The campaign highlights evolving malware tactics, combining social engineering, worm-like propagation, kernel-level exploitation, and AI-like persistence to create a resilient, high-performance cryptojacking botnet.

02/11/2026-02/18/2026 Malicious npm and PyPI Packages Linked to Lazarus APT, Ivanti EPMM Exploit And More.

1. CISA Flags Four Security Flaws Under Active Exploitation in Latest KEV Update

CISA has added four actively exploited flaws to its KEV catalog. The vulnerabilities include CVE-2026-2441, a use-after-free bug in Google Chrome that can enable heap corruption via a crafted webpage; CVE-2024-7694, an arbitrary file upload flaw in TeamT5 ThreatSonar Anti-Ransomware; CVE-2020-7796, an SSRF issue in Zimbra Collaboration Suite; and CVE-2008-0015, a buffer overflow in Microsoft Windows Video ActiveX Control that allows remote code execution.

Google recently confirmed in-the-wild exploitation of CVE-2026-2441. Meanwhile, threat researchers previously observed large-scale abuse of the Zimbra flaw, and Microsoft warned the 2008 bug has been used to spread malware such as the Dogkild worm.

Federal agencies must apply patches by March 10, 2026, to mitigate risks.

2. Patch Immediately: BeyondTrust Remote Code Execution Flaw Exploited in the Wild

BeyondTrust has released urgent updates to fix a critical remote code execution vulnerability (CVE-2026-1731, CVSS 9.9) affecting its Remote Support (RS) and Privileged Remote Access (PRA) products, with evidence of active exploitation. The flaw allows unauthenticated attackers to execute arbitrary system commands through specially crafted requests, potentially leading to full compromise, data theft, or service disruption.

The issue was discovered by Hacktron AI using AI-driven variant analysis and disclosed in January 2026. Internet scans from Shodan indicate about 11,000 exposed instances, many of them on-premise deployments that remain vulnerable until patched.

BeyondTrust automatically updated SaaS environments, but on-premise customers must apply patches or upgrade manually. Administrators are urged to verify systems quickly, as the vulnerability is easy to exploit and attractive to attackers seeking ransomware or lateral movement within enterprise networks.

3. Malicious npm and PyPI Packages Linked to Lazarus APT Fake Recruiter Campaign

Researchers from ReversingLabs have uncovered malicious npm and PyPI packages tied to a fake recruitment campaign attributed to the North Korea-linked Lazarus Group. The operation, dubbed “graphalgo,” has been active since May 2025 and targets JavaScript and Python developers with fraudulent cryptocurrency-related job offers. Attackers pose as recruiters on LinkedIn, Facebook, and Reddit, directing victims to GitHub “interview tasks” that secretly depend on malicious packages. Some packages, such as bigmathutils, built trust and gained thousands of downloads before being updated to deliver malware.

The campaign uses a multi-stage approach: creating fake companies and websites, distributing poisoned open-source dependencies, and installing remote-access trojans capable of executing commands, accessing files, and searching for cryptocurrency wallets.

Researchers say the activity shows the hallmarks of Lazarus operations, including staged payloads, delayed malicious updates, encrypted communications, and a modular design that allows attackers to rotate front-end infrastructure while maintaining the same backend systems.

4. 83 % of Ivanti EPMM Exploits Linked to Single IP on Bulletproof Hosting Infrastructure

Most exploitation attempts against a critical flaw in Ivanti Endpoint Manager Mobile (EPMM) have been traced to a single IP address hosted on infrastructure run by PROSPERO. According to GreyNoise, 417 exploitation sessions were recorded between February 1 and 9, 2026, with 83% originating from one source. The activity targets CVE-2026-1281 (CVSS 9.8) and CVE-2026-1340, vulnerabilities that enable unauthenticated remote code execution. Ivanti confirmed limited real-world compromises, and several European organizations—including the Dutch Data Protection Authority and the European Commission—reported targeting attempts. Researchers also observed the same host exploiting unrelated flaws in Oracle WebLogic, GNU InetUtils, and GLPI, suggesting automated scanning. About 85% of probes used DNS callbacks to verify vulnerable systems without deploying malware, consistent with initial-access operations. Security experts advise patching immediately, auditing internet-facing MDM systems, reviewing DNS logs, and blocking PROSPERO’s network ranges to reduce risk.

5. Dell RecoverPoint for VMs Zero-Day CVE-2026-22769 Exploited Since Mid-2024

A critical zero-day vulnerability (CVE-2026-22769, CVSS 10.0) in Dell RecoverPoint for Virtual Machines has been exploited since mid-2024 by a suspected China-linked threat cluster, UNC6201, according to researchers from Google Mandiant and Google Threat Intelligence Group. The flaw involves hard-coded credentials that allow unauthenticated attackers to gain root-level access, deploy web shells, and install backdoors such as BRICKSTORM and its newer variant GRIMBOLT. Attacks have primarily targeted North American organizations and appliances that often lack endpoint detection tools, enabling long-term persistence. Investigators observed techniques such as temporary “Ghost NICs” to move laterally and erase evidence. UNC6201 shares tactics with another China-linked cluster, UNC5221, though they are considered distinct. Separately, Dragos reported activity by Volt Typhoon compromising cellular gateways in energy sectors, then pivoting into operational technology networks, highlighting growing risks to industrial systems.