← Cybersecurity Headlines
Cybersecurity Headlines
OpenClaw targets ClawHub users, Notepad++ update delivers malware, APT28 attackers abuse Microsoft Office zero-day
00:07:25
Loading summary
Transcript3 lines
- [00:00]
A
From the CISO series, it's Cybersecurity Headlines.
- [00:07]
B
These are the cybersecurity headlines for Tuesday, February 3, 2026. I'm Sarah Lane. OpenClaw targets crypto users on Clawhub Security researchers warn that OpenClaw, the self hosted AI assistant formerly known as Claudebot and Multbot, is being abused to distribute malware. Open source malware says at least 14 malicious skills posing as crypto trading or wallet tools were uploaded to Clawhub in late January, tricking Windows and macOS users into running obfuscated commands that fetch malware. The incident highlights how OpenClaw's UN sandboxed skills model and rapid rebranding have made it an easy target for social engineering. Notepad update delivers malware State sponsored Attackers hijacked Notepad update mechanism, redirecting some users to malicious servers that delivered malware, according to the project's maintainer. The compromise occurred at the hosting provider level, not in Notepad code, and involved targeted redirection of update traffic starting as early as last June. Security researchers link the activity to China Nexus Group Violet Typhoon, which targeted telecom and financial organizations in East Asia. Notepad has since moved hosting providers and hardened its update process. APT28 attackers abuse Microsoft Office 0day cert UA says Russia linked APT28, also known as Fancy Bear, is already exploiting a new disclosed Microsoft Office zero day to target Ukrainian government agencies and organizations across the eu. The bug went from disclosure to active exploitation in days, with phishing emails delivering malicious Word documents that quietly pull down malware and deploy the Covenant Post exploitation framework. Microsoft has released patches, but Cert UA warns attacks are likely to increase as many users delay or are unable to update. January Update affects more Windows PCs Microsoft says a shutdown bug introduced by January Updates affects more PCs than previously known, extending beyond Windows 11 to Windows 10 systems with virtual Secure Mode enabled. The issue causes affected devices to restart instead of shutting down or entering hibernation after installing recent updates, including secure launch capable machines. Microsoft has issued out of band fixes for some Windows 11 systems and advises impacted users to manually shut down via command line while it works on a broader fix. Huge thanks to our sponsor, Strike 48. It's no secret that AI is only as good as the data available to it. Strike 48 unifies agentic AI with unmatched log visibility while avoiding the typical hefty price tag. Build and deploy agents for phishing detection, alert, triage, threat correlation and more. Query existing logs where they currently live so you can keep keep the technology you already have Learn more at strike48.com Poland's energy infrastructure lacked security measures, SERT Polska says a December cyber attack linked to Russian threat actors compromised wind and solar farms and a heat and power plant in Poland, though it didn't disrupt electricity supplies. The agency claims the affected operators had basic security failures and including default credentials, unpatched perimeter devices and no multi factor authentication. While ISET and Dragos attribute the activity to the GRU linked Sandworm group, Sirtpolska ties it to a separate Russian cluster known as Berserk Bear or Dragonfly. This marks the first publicly described destructive activity linked to that group. Shiny Hunters expands scope of attacks Mandian says the Shiny Hunters cybercrime group has expanded its software as a service extortion campaign beyond Salesforce to platforms including Microsoft 365, SharePoint, Slack and Okta, using vishing and branded credential harvesting sites to steal SSO credentials and MFA codes. Google tracks multiple Shiny Hunters linked clusters that exfiltrate sensitive SaaS data and use it for aggressive extortion, including ransomware demands backed by data leaks and DDoS threats. Researchers warn the activity shows a clear escalation in both targeting and tactics, despite earlier law enforcement takedowns. Massive attack breaks records and no, I'm not talking about the band. Cloudflare reports that the Isuru botnet set a new DDoS record in December with an attack peaking at 31.4 terabits per second and and 200 million requests per second, primarily targeting telecom providers. The botnet, estimated to control 1 to 4 million compromised devices, including home routers, CCTV systems and Android TV devices, is sold as a botnet for hire and can also be used for credential stuffing, scraping and phishing. The scale highlights how poorly secured consumer devices are increasingly being weaponized for for Internet wide attacks. Stop ICE hacked admins accuse sabotage Stop ICE says it was targeted in an attack that sent fake text messages warning users their data had been sent to the authorities, which the group claims is false. The ICE tracking service says it doesn't store users names, addresses or GPS data, and alleges the attack originated from a personal server linked to a US Customs and Border Protection agent, an accusation as of this recording CBP has not yet commented on. Stop Ice says the attempted server attack was quickly contained and describes the incident as part of frequent DDoS and harassment campaigns against the service. Have you checked out the CISO Series podcast yet? If you enjoy getting the daily news from us, you will also enjoy our deeper dive discussions and into wider topics in cybersecurity this week we're digging into the challenges of trying to secure systems in a healthcare setting where creating any kind of user friction can mean impacting health outcomes. Look for the episode Take two Factor Authentication and call me in the morning wherever you get your podcasts, and check it out. If you have some thoughts on the news from today or about our show in general, be sure to reach out to us@feedbackisoseries.com we would love to hear from you. I'm Sarah Lane, reporting for the CISO series. Thank you for listening. We'll talk to you tomorrow.
- [07:09]
A
Cybersecurity headlines are available every weekday. Head to cisoseries.com for the full stories behind the headlines.