Cyware Daily Threat Intelligence, February 18, 2026
The China-linked Iron Tiger (APT27) has ported its custom SysUpdate malware to Linux, disguising it as a persistent system service to maintain a silent foothold. This ELF64 binary uses a sophisticated, unknown packer and complex C2 encryption that requires full emulation to decode, successfully blinding traditional static analysis.
In a calculated move against the AI developer community, a new SmartLoader campaign has weaponized a trojanized version of the Oura MCP server. Attackers spent months building a "credibility infrastructure" on GitHub—using fake contributors and cross-linked forks—to lure users into downloading a tool meant to connect health data to AI assistants.
A massive security blind spot has been revealed in the VSCode ecosystem, where vulnerabilities in extensions like Code Runner and Live Preview have put millions of developers at risk. These flaws—found in tools with over 128 million combined installs—allow attackers to leap from a simple Markdown preview or a local server test to full remote code execution and local file theft.
Top Malware Reported in the Last 24 Hours
New SysUpdate malware variant discovered
A new variant of SysUpdate malware, linked to the APT27/Iron Tiger group, has been identified targeting Linux systems. Initially detected on a client’s machine, this malware functions as a system service and executes commands like the GNU/Linux id command. It is a packed ELF64 binary, dynamically linked, and employs an unknown obfuscated packer, complicating static analysis. The malware communicates with its command-and-control servers using encrypted traffic across multiple protocols. Researchers revealed that the malware's encryption routines are complex and require emulation to decrypt C2 traffic.
SmartLoader campaign uses trojanized Oura server
A new SmartLoader campaign has emerged, utilizing a trojanized version of the Oura MCP server to deploy the StealC infostealer. Cybercriminals cloned the legitimate Oura MCP server, which connects AI assistants to health data, and constructed a deceptive network of fake GitHub accounts and repositories to establish credibility. This method allowed them to distribute a malicious payload disguised as a legitimate server. Once downloaded, the trojan executes an obfuscated Lua script that installs SmartLoader, which subsequently deploys StealC to steal sensitive information such as credentials and cryptocurrency wallet data.
Infostealer targets OpenClaw
Security researchers have documented a significant shift in the infostealer landscape with the first live attack targeting OpenClaw, an AI assistant known for its insecure default settings and plaintext storage of sensitive data. The infostealer employed a comprehensive file-grabbing routine, capturing critical files such as openclaw.json and device.json, which contained users' email addresses, cryptographic keys, and sensitive logs. This information allows attackers to impersonate users, bypass security checks, and gain unauthorized access to local OpenClaw instances.
Top Vulnerabilities Reported in the Last 24 Hours
Vulnerabilities in popular VSCode extensions
Recent vulnerabilities in widely used VSCode extensions, collectively downloaded over 128 million times, pose significant security risks to developers. Flaws affecting extensions like Code Runner, Markdown Preview Enhanced, and Microsoft Live Preview could be exploited to steal local files and execute code remotely. Researchers identified these issues, including a critical vulnerability in the Live Server extension that allows file theft through malicious webpages. Additionally, the Code Runner vulnerability enables remote code execution via configuration changes. The Markdown Preview Enhanced extension is susceptible to executing JavaScript through crafted Markdown files. Despite attempts to notify maintainers since June 2025, no responses were received, leaving developers exposed to potential attacks that could lead to data exfiltration and system takeovers.
Chinese hackers exploit Dell zero-day flaw
A Chinese state-backed hacking group, known as UNC6201, has been exploiting a critical zero-day vulnerability (CVE-2026-22769) in Dell RecoverPoint for Virtual Machines since mid-2024. This vulnerability, caused by hardcoded credentials, allows unauthorized remote access, enabling attackers to gain root-level persistence on affected systems. Once inside the network, UNC6201 deployed various malware, including a newly identified backdoor called Grimbolt, which is designed to be faster and harder to analyze than its predecessor, Brickstorm. The group has also employed advanced techniques, such as creating hidden network interfaces, referred to as "Ghost NICs," on VMware ESXi servers to navigate stealthily within victims' networks. Researchers have noted overlaps between UNC6201 and another Chinese threat cluster, UNC5221, which has targeted U.S. organizations in various sectors.