← Cybersecurity Headlines
Cybersecurity Headlines
Ivanti actor identified, search overviews manipulated, ClickFix leverages Nslookup
00:07:46
Loading summary
Transcript3 lines
- [00:00]
A
From the ciso series, it's cybersecurity headlines.
- [00:08]
B
These are the cybersecurity headlines for Monday, February 16, 2026. I'm Steve Prentiss. One threat actor responsible for 83% of recent Ivanti RCE attacks a single IP address hosted on bulletproof infrastructure is responsible for more than 83% of exploitation activity related to vulnerabilities, says intelligence company Greynoise. The two CVE numbered vulnerabilities exist in Ivanti Endpoint Manager Mobile and have been flagged as actively exploited in zero day attacks in Ivanti's security advisory, where the company also announced hotfixes. End quote the source of these attacks is an IP address hosted by Prospero, which Census analysts marked as a bulletproof autonomous system used to target various software products Google's AI Search Overviews manipulated by scammers from the this is why we can't have nice things department Google's AI Overviews feature is being weaponized by scammers who have figured out how to inject deliberately harmful information into its AI generated search summaries by reverse engineering how Google's AI sources information. This allows them to plant malicious content such as links to phishing sites disguised as customer service portals, promoting counterfeit products as legitimate recommendations and spreading misinformation designed to build trust before hitting victims with financial scams. Experts emphasize that users should treat AI overviews as a starting point that requires verification rather than as a definitive answer. Microsoft warns of DNS based click fix attack that uses NSLookup. The increasingly popular click fix social engineering tactic has a new angle in which attackers trick users into running commands that carry out a domain name system, otherwise known as NSLookup, to retrieve the next stage payload. In this case, it performs a DNS lookup against a hard coded external DNS server rather than the system's default resolver, said Microsoft's threat intelligence team. They added, quote using DNS in this way reduces dependency on traditional web requests and can help blend malicious activity into normal network traffic. End quote Trezor and Ledger users targeted through snail mail campaign Physical letters sent through the postal service are urging users of the two cryptocurrency hardware wallets into submitting recovery phrases as part of a fictional authentication check. The letters include company logos and other letterhead features, as do the envelopes. The messages conveyed sufficient urgency, warning users to complete the process by yesterday, February 15th or risk losing functionality on their devices. It should be noted that both Trezor and Ledger suffered data breaches in the past couple of years that did expose customer contact information. Huge thanks to our sponsor Conveyor. I'll tell you two things Conveyor cannot help you with. Conveyor will not make security questionnaires fun and it will not make your sales team stop asking you questions. But it did help Alteryx support a half a billion dollars in enterprise deals with the same four person team. All they did was get an AI trust center and use Conveyor's AI agent to complete questionnaires. That's enough. You know where to go. Www.conveyor.com that is C O N V E-Y-O-R.com Estonia's spy chief tells Europe to invest in offensive cyber capabilities Kalpu Rosin, Estonia's foreign intelligence chief, called on European governments and industry to invest in homegrown offensive cyber capabilities, noting that the Continent relies too heavily on non European tools. Speaking on Friday at the Munich Cybersecurity Conference, he said Europe is focused on defence, while modern intelligence and security operations increasingly depend on the ability to penetrate the disrupt or manipulate adversaries digital systems. End quote. And he added that he would love to coordinate and cooperate with Europeans. More on that Ring ends partnership plans with Flock after privacy blowback from superbowl ad following backlash from consumers concerned about privacy, Amazon owned Ring has cancelled its partnership plans with Flock Safety, a police surveillance tech company best known for automated license plate reader cameras. The Ring super bowl ad showed how people's Ring cameras could be used to help locate lost dogs, but the wording of the ad raised questions about how the facial recognition enabled cameras could also be used to surveil and monitor the movements of people. Ring still maintains a community requests program with another major police surveillance company called Axon A Xon. Dutch telco Odido reveals data breach the Netherlands largest mobile network operator has stated that a breach of its customer contact system may have affected around 6.2 million people. The data affected includes PII and bank account numbers. The telco says, however, that passwords, call details, billing or location data, or scans of ID documents could not have been accessed. The breach was noticed last weekend and was reported to the Dutch Data Protection Authority. AI agents tricked into previewing malicious links in messaging apps According to researchers at Prompt Armorer, attackers are now starting to use malicious prompts inside messaging apps to trick an AI agent into generating a data leaking URL, which link previews may fetch automatically. These link previews can turn URLs generated by an AI agent and controlled by an attacker into a zero click data exfiltration channel, allowing sensitive information to be leaked without any user interaction. PromptArmor notes in its report that this technique removes the need for a victim to click a link, obviously, thus making the problem, especially inside messaging platforms like Slack and Telegram, where link previews are enabled by default, a whole lot worse. Managing and operationalizing log data is nothing new in cybersecurity, but are we only taking advantage of a fraction of its value? That's what we're talking about this week on Super Cyber Friday. We'll be digging into how you can view log data more holistically rather than keeping it siloed in the SIEM and in other IT tools. It all happens this Friday at 1pm Eastern, 10am Pacific. Head on over to the events page@cisoseries.com to register to join us. And if you have some thoughts on the news from today or about this show in general, please be sure to reach out to us at feedback@cisoseries.com we would love to hear from you. I'm Steve Prentiss reporting for the CISO series.
- [07:30]
A
Cybersecurity headlines are available every weekday. Head to CISoseries.com for the full stories behind the headlines.