Cyware Weekly Threat Intelligence, February 02–06, 2026
The Good
U.S. and Bulgarian authorities shut down three major piracy websites operating in the EU, targeting illegal distribution of copyrighted content. The seized websites generated millions of downloads, caused substantial financial losses, and profited from online advertisements. The domains zamunda[.]net, arenabg[.]com, and zelka[.]org are now under U.S. government custody, disrupting piracy networks and sending a strong warning. The operation involved collaboration between U.S. law enforcement, Bulgarian agencies, and Europol, showcasing global efforts to combat cybercrime.
The NSA released new Zero Trust Implementation Guidelines (ZIGs) to help organizations progress toward zero trust maturity. The guidelines are divided into two phases: Phase One focuses on foundational controls, and Phase Two integrates core zero trust solutions. Zero trust emphasizes continuous authentication and authorization, shifting away from perimeter-based security models. The guidelines highlight the importance of continuous evaluation after authentication to address post-login threats. The NSA's guidance incorporates established frameworks like NIST SP 800-207 and the CISA Zero Trust Maturity Model.
The Bad
The OpenClaw AI assistant ecosystem has been flooded with over 230 malicious skills that exploit the platform’s rapid rebranding and minimal security oversight. These malicious add-ons often masquerade as sophisticated crypto-trading tools. A high-stakes supply chain attack has struck at the heart of the decentralized finance world, poisoning official npm and PyPI libraries used by the dYdX exchange. A critical sandbox escape in the n8n automation platform, tracked as CVE-2026-25049, has transformed standard data workflows into high-risk gateways for server takeovers.
The AISURU/Kimwolf botnet executed a record-breaking DDoS attack that peaked at 31.4 Tbps for 35 seconds in November 2025. This surge is part of a trend where DDoS attacks increased by 121% in 2025, with Cloudflare mitigating 34.4 million network-layer attacks throughout the year. The botnet has compromised over 2 million Android devices, primarily off-brand TVs, by exploiting residential proxy networks like IPIDEA. In response to this growing threat, Google and Cloudflare disrupted IPIDEA's infrastructure, targeting domains used for command and control. The most affected sectors included telecommunications, IT, and gaming, while countries like China, Hong Kong, and Germany experienced the highest number of attacks.
Cybersecurity researchers have identified a supply chain attack involving compromised npm and PyPI packages that deliver wallet stealers and RATs. The affected packages, @dydxprotocol/v4-client-js and dydx-v4-client, are used for interacting with the dYdX v4 protocol, which manages sensitive cryptocurrency operations. Malicious versions of these packages were published using legitimate credentials, allowing attackers to insert harmful code targeting both JavaScript and Python ecosystems. The npm version focuses on stealing cryptocurrency wallet credentials, while the PyPI version includes a RAT that executes commands from an external server upon import.
A critical vulnerability, tracked as CVE-2026-25049, has been discovered in the n8n workflow automation platform, allowing attackers to execute arbitrary system commands through malicious workflows. This flaw stems from inadequate sanitization, which bypasses previous protections implemented for another vulnerability, CVE-2025-68613. An authenticated user with permission to create or modify workflows can exploit this vulnerability by crafting specific expressions that trigger unintended command execution on the host system. The issue is exacerbated by n8n's webhook feature, which can expose workflows to the public, enabling remote code execution. Security researchers have noted that the vulnerability allows attackers to compromise servers, steal sensitive credentials, and potentially install backdoors for persistent access.
Exploitation of the React2Shell vulnerability (CVE-2025-55182) has surged, with over 1.4 million attempts recorded in a single week. This critical vulnerability, found in version 19 of the React JavaScript library, allows unauthenticated remote code execution through a simple HTTP POST request. The exploitation activity intensified following the release of a Metasploit module, attracting both state-sponsored and cybercriminal actors. Notably, two IP addresses accounted for a significant portion of the attacks, with one responsible for deploying reverse shells and the other for launching XMRig cryptocurrency miners. These attacks targeted vulnerable instances, aiming to establish interactive access rather than simply stealing data.
Microsoft has warned that information-stealing attacks are increasingly targeting macOS systems, expanding beyond Windows. These attacks leverage Python-based malware, utilizing social engineering techniques like malvertising to distribute fake disk image installers. Notable malware families involved include Atomic macOS Stealer, MacSync, and PXA Stealer, which can harvest sensitive data such as web browser credentials, iCloud Keychain information, and financial details. Attackers often initiate these campaigns through malicious advertisements, redirecting users to counterfeit sites that deploy the malware. Additionally, bad actors have been observed using popular messaging apps for malware distribution, further complicating the threat landscape.
More than 230 malicious packages, known as skills, have been published for the OpenClaw AI assistant, posing significant security risks. These skills masquerade as legitimate tools, delivering malware that steals sensitive information such as API keys, cryptocurrency wallet credentials, and browser passwords. The project, which has undergone multiple name changes from ClawdBot to Moltbot and now OpenClaw, allows users to run a local AI assistant with persistent memory. Security researcher Jamieson O’Reilly revealed that many OpenClaw admin interfaces are misconfigured and exposed online. The malicious skills, attributed to a single campaign, often feature extensive documentation to appear credible, including references to a tool called ‘AuthTool,’ which is actually a malware delivery mechanism.
New Threats
The GlassWorm malware has resurfaced with a specialized focus on macOS, infiltrating the software supply chain by hijacking legitimate developer accounts on the OpenVSX marketplace. The ClickFix threat has evolved into a more aggressive variant dubbed CrashFix, which turns user frustration into a weapon for deploying the ModeloRAT trojan. A new RaaS group named Vect has quickly matured, targeting high-value infrastructure in Brazil and South Africa with custom C++ malware. The group can paralyze Windows, Linux, and VMware ESXi systems with remarkable efficiency.
A new variant of the ClickFix malware campaign, known as CrashFix, employs a malicious browser extension to intentionally crash users' browsers, tricking them into executing harmful commands. Users searching for ad blockers are lured to install a fake extension, such as NexShield, which, after lying dormant for about an hour, triggers a denial-of-service attack that freezes the browser. When users restart their browsers, they encounter a fake security warning prompting them to run a command that unknowingly downloads a RAT called ModeloRAT. This RAT allows attackers to gather network information, evade detection, and target corporate networks. The circular nature of the attack ensures repeated browser crashes, increasing the chances of user compliance as they seek a solution to the ongoing issue.
A new sophisticated malware threat, DesckVB RAT version 2.9, has emerged in early 2026, built on the .NET framework and designed for persistent control while evading traditional defenses. The malware uses a highly obfuscated Windows Script Host (WSH) JavaScript file as its initial stager, blending malicious activity with legitimate system processes. DesckVB RAT employs a multi-stage infection chain, including PowerShell scripts for anti-analysis checks and a fileless .NET loader for stealthy execution in memory. Its modular plugin-based architecture allows attackers to deploy specific functions like keylogging, webcam streaming, and antivirus enumeration, making it a versatile espionage tool.
Researchers have identified a new RaaS group called Vect, which has already targeted organizations in Brazil and South Africa. Launched in December 2025, Vect is actively recruiting affiliates and claims to use custom-built malware developed in C++, distinguishing itself from other groups that typically repurpose existing code. Its ransomware employs the ChaCha20-Poly1305 AEAD encryption algorithm, noted for its speed, and utilizes intermittent encryption techniques to enhance performance. Despite its recent emergence, Vect exhibits significant operational maturity, advertising cross-platform capabilities for Windows, Linux, and VMware ESXi. The group operates with strong security measures, including the use of Monero for payments and the TOX protocol for secure communications, indicating that it may be run by experienced threat actors. Vect employs a double extortion model, with its victims listed on a public leak site, suggesting a strategic approach to maximize pressure on targets.
A new GlassWorm malware attack has emerged, targeting macOS systems through compromised OpenVSX extensions. The threat actor gained access to the account of a legitimate developer, pushing malicious updates to four extensions that were downloaded over 22,000 times. First seen in late October, GlassWorm employs invisible Unicode characters to hide its code while stealing cryptocurrency wallet and developer account details. The malware also supports VNC-based remote access and SOCKS proxying. Recent campaigns have shown the malware evolving, specifically targeting macOS and pulling instructions from Solana transaction memos, while notably excluding Russian-locale systems. The malware establishes persistence on infected systems via a LaunchAgent, harvesting sensitive data from browsers and local files, ultimately exfiltrating the information to the attacker’s infrastructure.