In the second half of February 2026 I collected 80 events (6.15 events/day) with a threat landscape dominated by malware with 42%, (it was 33% in the first half of the same month), ahead of account takeovers (up to 14% from 8%) and ransomware (down to 11% from 20%), which swapped their positions.
As always, cyber crime led the motivations chart with 62%, nearly the same value of the previous timeline, when it was 60%; once again ahead of cyber espionage stable at 21%, the same value of the first fortnight. Cyber warfare closes the podium at 4%, whilst no events related to hacktivism were recorded in this fortnight.
The initial access chart sees supply chain compromises on top with 19%, ahead of social engineering with 15% (it was and generic software vulnerabilities (12%).
And even in this timeline, targets belonging to the Information and Communication sector lead the chart with 13%, slightly down from 16%, but this time they share the first place with Public Administrations (slightly down from 14%). Targets belonging to the Finance & Insurance sector close the podium with 10%.
Besides these trends, as always the timeline is rich of interesting events, such as additional mega breaches , so my final suggestion does not change: browse the timeline for the details of all the events collected in this fortnight.
After the cyber attacks timelines (part I and part II), it’s time to publish the statistics for January 2026 where I collected and analyzed 178 events.
As always bear in mind that the sample refers exclusively to the attacks included in my timelines, available from public sources such as blogs and news sites. Obviously the sample cannot be complete, but only aims to provide an high level overview of the threat landscape.
In the first half of February 2026 I collected 96 events (6.4 events/day) with a threat landscape dominated by malware with 33%, (it was 38% in the second half of last month,
A live view of the month's vetted cyber incidents, updated as new events are confirmed. Explore the timeline, filter by attack type, and see motivations, techniques, initial access methods, targeted sectors and target countries on an interactive map.
Here’s a collection of the main mega breaches (that is data breaches with more than one million records compromised and possibly leaked) during 2026. The information is derived from the cyber attacks timelines that I published, normally, on a bi-weekly basis.
A live, continuously updated timeline of the cyber attacks reported in September 2026 — tracking threat actors, attack techniques, targeted sectors and countries as each incident is vetted and added.
A one-page visual briefing on August 2026's global cyber attack landscape: 218 confirmed incidents, a rising four-in-five share driven by profit-motivated crime, and a back-to-back spike that delivered 34 attacks in just two days.
ID
Date Reported
Date Occurred
Date Discovered
Author
Target
Description
Attack
Target Class
Attack Class
Country
Link
Initial Access
1
05/02/2026
Unspecified
Unspecified
Unknown
AI developers, specifically those utilizing Model Context Protocol (MCP) and Oura Ring integrations
Researchers at Straiker disclose details of a new SmartLoader campaign that involves distributing a trojanized version of a Model Context Protocol (MCP) server associated with Oura Health to deliver the information stealer known as StealC.
Malware
Information/Communication
Cyber Crime
Global
Supply Chain Compromise
2
10/02/2026
Between 01/07/2025 and 13/12/2025
12/12/2025
Unknown
Paypal customers
PayPal discloses a data breach that affected customers’ personal information and led to fraudulent transactions.
Government organizations in Western and Central Europe
Researchers at Lab52 identify "Operation MacroMaze," a campaign by APT28 using malicious documents to target European entities. The attack leverages legitimate infrastructure and basic macros to deploy stealthy malware.
Malware
Public Administration
Cyber Espionage
EU
ES
Phishing Email
4
16/02/2026
Unspecified
Unspecified
Unknown
AI developers and organizations using the OpenClaw framework
Researchers at Hudson Rock says they have documented the first in-the-wild instance of infostealers stealing files associated with OpenClaw to extract secrets stored within them.
Malware
Information/Communication
Cyber Crime
Global
Unknown
5
16/02/2026
Between December 2025 and January 2026
Between December 2025 and January 2026
GS7
Fortune 500 financial and technology firms including Wells Fargo, USAA, Navy Federal, Fidelity, Microsoft, Apple, and more
Researchers at SOCRadar discover "Operation DoppelBrand", a sophisticated cyber campaign targeting Fortune 500 companies via brand impersonation and using legitimate tools for data exfiltration.
Account Takeover
Multiple Industries
Cyber Crime
US
Social Engineering
6
17/02/2026
Since at least April 2025
During April 2025
Keenadu
Mobile users
Researchers at Kaspersky discover a new sophisticated Android malware called Keenadu embedded in firmware from multiple device brands, enabling it to compromise all installed applications and gain unrestricted control over infected devices.
Malware
Individual
Cyber Crime
RU
JP
DE
BR
NL
Supply Chain Compromise
7
17/02/2026
Since mid-2024
'Recently'
UNC6201
Organizations using Dell RecoverPoint for Virtual Machines
Researchers at Mandiant and the Google Threat Intelligence Group (GTIG) identify UNC6201 exploiting a zero-day vulnerability in Dell RecoverPoint for VMs (CVE-2026-22769). The threat actor utilized this flaw to gain initial access, deploy several malware payloads, including the BRICKSTORM backdoor, and a newly identified backdoor malware called GRIMBOLT. Two days later the U.S. Cybersecurity and Infrastructure Security Agency (CISA) ordered government agencies to patch their systems within three days.
Malware
Multiple Industries
Cyber Espionage
Global
Software Vulnerability
8
17/02/2026
Early February 2026
Early February 2026
Unnamed threat actors
Undisclosed organizations
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds CVE-2026-2441, a use-after-free vulnerability in Google Chrome, to its Known Exploited Vulnerability (KEV) catalog.
Unknown
Unknown
Unknown
US
Software Vulnerability
9
17/02/2026
Early February 2026
Early February 2026
Unnamed threat actors
Undisclosed organizations
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds CVE-2024-7694, an arbitrary file upload vulnerability in TeamT5 ThreatSonar Anti-Ransomware, to its Known Exploited Vulnerability (KEV) catalog.
Unknown
Unknown
Unknown
US
Software Vulnerability
10
17/02/2026
Early February 2026
Early February 2026
Unnamed threat actors
Undisclosed organizations
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds CVE-2020-7796, a server-side request forgery (SSRF) vulnerability in Synacor Zimbra Collaboration Suite (ZCS), to its Known Exploited Vulnerability (KEV) catalog.
Unknown
Unknown
Unknown
US
Public-facing App Vulnerability
11
17/02/2026
Early February 2026
Early February 2026
Unnamed threat actors
Undisclosed organizations
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds CVE-2008-0015, a stack-based buffer overflow vulnerability in Microsoft Windows Video ActiveX Control, to its Known Exploited Vulnerability (KEV) catalog.
Unknown
Unknown
Unknown
US
Software Vulnerability
12
17/02/2026
20/07/2025 and 21/07/2025
04/09/2025
Kenyan Authorities (using Cellebrite technology)
Boniface Mwangi (Kenyan activist and politician)
Citizen Lab details the forensic exploitation of Kenyan activist Boniface Mwangi’s mobile device using Cellebrite technology following his July 2025 arrest.
Malware
Individual
Cyber Espionage
KE
Physical Access
13
17/02/2026
Shortly after 09/01/2026
Shortly after 09/01/2026
Suspected Iranian threat actor
Iranian protestors, dissidents, and human rights activists
Researchers at Acronis identify the "CrescentHarvest" cyberespionage campaign targeting Iranian dissidents, exploiting recent geopolitical developments to lure victims into opening malicious .LNK files disguised as protest-related images or videos.
Malware
Other Service
Cyber Espionage
IR
Phishing Email
14
17/02/2026
17/02/2026
17/02/2026
Unknown
Deutsche Bahn
A large-scale DDoS attack targets Deutsche Bahn, causing significant disruptions to its digital services and passenger information systems.
DDoS
Transportation
Unknown
DE
Not Applicable
15
17/02/2026
17/02/2026
17/02/2026
Unknown
Metamask users
A poorly crafted phishing campaign uses a fake PDF security incident report hosted on AWS to scare victims into enabling 2FA.
Account Takeover
Fintech
Cyber Crime
Global
Phishing Email
16
17/02/2026
During 2025
During 2025
Unknown
Unnamed organization(s)
Researchers at Palo Alto Networks’ share findings about a low-skilled actor who used an LLM to script a professional extortion strategy, complete with deadlines and pressure tactics.
Unknown
Unknown
Cyber Crime
Unknown
Social Engineering
17
17/02/2026
Since November 2025
'Recently'
Unknown
High-performance computing environments and enterprise servers
Researchers at Trellix detail a sophisticated cryptojacking campaign utilizing the XMRig miner to illicitly mine Monero. The attackers use advanced evasion techniques, including process hollowing and packed payloads, to hijack system resources.
Malware
Information/Communication
Cyber Crime
Global
Rogue App
18
17/02/2026
During the autumn of 2025
During the autumn of 2025
UnsolicitedBooker (activity cluster of Chinese origin)
Telecommunications companies in Kyrgyzstan and Tajikistan
Researchers at Positive Technology observe the threat activity cluster known as UnsolicitedBooker targeting telecommunications companies in Kyrgyzstan and Tajikistan, via two distinct backdoors codenamed LuciDoor and MarsSnake.
Malware
Information/Communication
Cyber Espionage
KG
TJ
Phishing Email
19
17/02/2026
08/12/2025
08/12/2025
Rhysida
Government of the Cheyenne and Arapaho Tribes
The government of the Cheyenne and Arapaho Tribes is being extorted by the Rhysida gang, after a ransomware attack shut down its schools and critical systems in January.
Ransomware
Public Administration
Cyber Crime
US
Unknown
20
17/02/2026
During February 2026
During February 2026
Unknown
Organizations in state and local government, healthcare, manufacturing, professional and legal services, high technology in the United States, Germany, Australia and Canada,
Researchers at Palo Alto Networks observe widespread and mostly automated exploitation attempts of CVE-2026-1281 and CVE-2026-1340, two vulnerabilities targeting Ivanti Endpoint Manager Mobile (EPMM).
Malware
Reconnaissance
Multiple Industries
Cyber Espionage
US
DE
AU
CA
Software Vulnerability
21
17/02/2026
During February 2026
During February 2026
Threat actor with the moniker '26medias’ (in Clawhub) and ‘BobVonNeumann’ (in Moltbook and X)
Crypto users
Researchers at Straiker uncover an active agent-to-agent attack chain where malicious Claude Skills on ClawHub are spread via fake AI personas, enabling crypto scams and private key theft.
Malicious AI Skills
Fintech
Cyber Crime
Global
Supply Chain Compromise
22
18/02/2026
03/05/2024
Unspecified
State-sponsored actors using Predator spyware
Teixeira Cândido – an Angolan journalist, jurist, press freedom activist, and former Secretary-General of the Syndicate of Angolan Journalists (Sindicato dos Journalists Angolanos).
Researchers at Amnesty International uncover a targeted campaign using Predator spyware against an Angolan journalist.
Malware
Information/Communication
Cyber Espionage
AO
OS Vulnerability
23
18/02/2026
End of January 2026
End of January 2026
Unknown
French Ministry of Economy
The French Ministry of Economy says that a threat actor gained access to a national bank account database and consulted information on 1.2 million accounts.
Account takeover
Public Administration
Cyber Crime
FR
Compromised Credentials
24
18/02/2026
Early February 2026
Early February 2026
Unnamed threat actors
Undisclosed organizations
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds CVE-2021-22175 , a GitLab Server-Side Request Forgery (SSRF) Vulnerability, to its Known Exploited Vulnerability (KEV) catalog.
Unknown
Unknown
Unknown
US
Public-facing App Vulnerability
25
18/02/2026
Early February 2026
Early February 2026
Unnamed threat actors
Undisclosed organizations
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds CVE-2026-22769, a Dell RecoverPoint for Virtual Machines (RP4VMs) Use of Hard-coded Credentials Vulnerability, to its Known Exploited Vulnerability (KEV) catalog.
Unknown
Unknown
Unknown
US
Software Vulnerability
26
19/02/2026
Since January 2024
'Recently'
Unknown
Customers of European financial institutions and IPTV users
Researchers at ThreatFabric discover a new Android banking trojan named "Massiv," disguised as legitimate IPTV applications. The malware uses Accessibility Services to perform Automated Transfer Systems (ATS) attacks, enabling threat actors to drain bank accounts and bypass security measures without user interaction.
Malware
Finance & insurance
Cyber Crime
ES
PT
FR
TR
Social Engineering
27
19/02/2026
Unspecified
Unspecified
Unknown
Mobile users in Argentina
Researchers at ESET uncover PromptSpy, the first known Android malware to exploit Google’s Gemini AI to maintain persistence. The malware can capture lockscreen data, block uninstallation attempts, collect device information, take screenshots, and record screen activity as video, marking a concerning evolution in AI-assisted mobile threats.
Malware
Finance & insurance
Cyber Crime
AR
Social Engineering
28
19/02/2026
Since July 2025
Unspecified
GoldFactory
Mobile banking users and taxpayers in Indonesia
Researchers at Group-IB identify a sophisticated mobile banking campaign in Indonesia. Attackers impersonated tax authorities to deploy malware stealing biometric data and intercepting SMS, allowing threat actors to bypass security measures and perform unauthorized financial transactions through compromised banking applications.
Malware
Finance & insurance
Cyber Crime
ID
Social Engineering
29
19/02/2026
Since November 2025
During February 2026
Unknown
Technology, manufacturing, and financial organizations
Threat actors are targeting technology, manufacturing, and financial organizations in campaigns that combine device code phishing and voice phishing (vishing) to abuse the OAuth 2.0 Device Authorization flow and compromise Microsoft Entra accounts.
Account Takeover
Multiple Industries
Cyber Crime
Global
Social Engineering
30
19/02/2026
19/02/2026
19/02/2026
Unknown
University of Mississippi Medical Center (UMMC)
The University of Mississippi Medical Center (UMMC) closes all its clinic locations statewide on Thursday following a ransomware attack.
Ransomware
Human Health
Cyber Crime
US
Unknown
31
19/02/2026
15/02/2026
15/02/2026
Unknown
Advantest Corporation
Advantest Corporation discloses that its corporate network has been targeted in a ransomware attack that may have affected customer or employee data.
Ransomware
Manufacturing
Cyber Crime
JP
Unknown
32
19/02/2026
Between October 2025 and December 2025
During October 2025
Arkanix
Users interested in cryptocurrencies and online banking
Researchers at Kaspersky discover Arkanix, a sophisticated infostealer targeting browser data, crypto-wallets, and system information. The malware employs advanced obfuscation and anti-analysis techniques to evade detection. It exfiltrates stolen data via Telegram, highlighting a growing trend of utilizing legitimate platforms for malicious command-and-control communication and data theft.
Malware
Multiple Industries
Cyber Crime
Global
Phishing Email
33
19/02/2026
During 2025
During 2025
Unknown
Multiple Banks
The U.S. Federal Bureau of Investigation (FBI) warns of an increase in ATM jackpotting incidents across the country, leading to losses of more than $20 million in 2025.
Malware
Finance & insurance
Cyber Crime
US
Physical Vulnerability
Software Vulnerability
34
19/02/2026
Since at least early February 2026
Early February 2026
Unknown
Multiple organizations including a US-based university and multiple Chinese-speaking users
Researchers from Elastic disclose details of a new ClickFix campaign that abuses compromised legitimate sites to deliver a previously undocumented remote access trojan (RAT) called MIMICRAT (aka AstarionRAT).
Malware
Multiple Industries
Cyber Crime
US
CN
Global
Supply Chain Compromise
35
19/02/2026
'Recently'
'Recently'
Unknown
Multiple organizations in the U.S., France, Germany, Australia and Canada:
Researchers at Palo Alto Networks observe Threat actors exploiting a recently disclosed critical security flaw impacting CVE-2026-1731, BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) products to conduct a wide range of malicious actions, including deploying VShell.
Malware
Multiple Industries
Cyber Crime
US
FR
DE
AU
CA
Security Appliance Vulnerability
36
20/02/2026
During February 2026
During February 2026
Unknown
Multiple Organizations
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warns that threat actors are actively exploiting the CVE-2026-1731 vulnerability in the BeyondTrust Remote Support product in ransomware attacks.
Ransomware
Public Administration
Cyber Crime
US
Security Appliance Vulnerability
37
20/02/2026
Between 11/01/2026 and 18/02/2026
Between 11/01/2026 and 18/02/2026
Undisclosed Russian-speaking financially motivated threat actor
Multiple Organizations across South Asia, Latin America, the Caribbean, West Africa, Northern Europe, Southeast Asia, and additional regions.
Amazon warns that a Russian-speaking financially motivated threat actor used multiple generative AI services as part of a campaign that breached more than 600 FortiGate firewalls across 55 countries in five weeks.
Brute-force
Information/Communication
Cyber Crime
Global
Misconfiguration
38
20/02/2026
Since December 2025
Since December 2025
Unnamed threat actors
Undisclosed organizations
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds CVE-2025-49113 and CVE-2025-68461, two Roundcube Webmail vulnerabilities, to its Known Exploited Vulnerability (KEV) catalog.
Unknown
Unknown
Unknown
US
Public-facing App Vulnerability
39
20/02/2026
17/02/2026
17/02/2026
Unknown
Developers using Cline
In a software supply chain attack, the open-source, AI-powered coding assistant Cline CLI is updated to stealthily install OpenClaw, a self-hosted autonomous AI agent.
Organizations and individuals primarily across the MENA region
Researchers at Group-IB detail "Operation Olalampo," a campaign by MuddyWater, resulting in the deployment of new malware families that share overlapping samples previously identified as used by the threat actor. These include downloaders like GhostFetch and HTTP_VIP, along with a Rust backdoor called CHAR and an advanced implant codenamed GhostBackDoor that's dropped by GhostFetch.
Malware
Multiple Industries
Cyber Espionage
MENA
Phishing Email
41
20/02/2026
During February 2026
During February 2026
Unknown
AI/ML developers and researchers using npm ecosystems
Researchers at Socket identify a self-propagating "npm worm" targeting AI development toolchains. By poisoning widely used machine learning dependencies, the malware automates supply chain infiltration, exfiltrating environment variables and credentials.
Malware
Information/Communication
Cyber Crime
Global
Supply Chain Compromise
42
20/02/2026
During February 2026
During February 2026
Unknown
AI/ML developers
Researchers at Socket disclose what they say is an active "Shai-Hulud-like" supply chain worm campaign that has leveraged a cluster of at least 19 malicious npm packages to enable credential harvesting and cryptocurrency key theft. The campaign has been codenamed SANDWORM_MODE
Malware
Information/Communication
Cyber Crime
Global
Supply Chain Compromise
43
20/02/2026
20/02/2026
20/02/2026
Unknown
Ukraine’s central bank
Ukraine’s central bank says its online store for collectible coins and numismatic products was temporarily taken offline after a cyberattack exposed some customer information.
Unknown
Finance & insurance
Unknown
UA
Supply Chain Compromise
44
20/02/2026
08/02/2026
19/02/2026
INC
Air Côte d'Ivoire
Air Côte d'Ivoire, the main airline serving the West African nation of Côte d'Ivoire is hit with a cyberattack that forced it to institute business continuity plans.
Researchers at Akamai report that Russia-linked APT28 may have exploited CVE-2026-21513 CVSS score of 8.8), a high-severity MSHTML vulnerability (CVSS 8.8), before Microsoft patched it in February 2026.
Unknown
Unknown
Cyber Espionage
Unknown
Software Vulnerability
46
20/02/2026
Unspecified
Unspecified
Unknown
Unspecified organization
Researchers at Secuinfra discover a sophisticated Python-based malware deployment during a fraud investigation, revealing a layered attack involving obfuscation, disposable infrastructure and commercial offensive tools.
The ShinyHunters extortion group has published personal information in more than 12 million records allegedly stolen from CarGurus, a U.S.-based digital auto platform.
Account Takeover
Wholesale/Retail
Cyber Crime
US
Unknown
48
21/02/2026
21/02/2026
21/02/2026
Unknown
United Arab Emirates
The United Arab Emirates say it stopped a ransomware attack that allegedly targeted the country’s digital infrastructure.
Ransomware
Public Administration
Cyber Warfare
AE
Unknown
49
22/02/2026
During 2024
During 2024
Chinese threat actors known as Slime57 and Slime62
Multiple organizations in the United States, Japan, and Taiwan including government agencies
The Taiwan-based cybersecurity firm TeamT5 confirms that CVE-2024-7694, the vulnerability added recently by CISA to its Known Exploited Vulnerabilities (KEV) catalog was likely exploited by Chinese threat actors.
New York-based ad tech company Optimizely notifies an undisclosed number of customers of a data breach after threat actors compromised some of its systems in a voice phishing attack.
Account Takeover
Professional/Scientific
Cyber Crime
US
Social Engineering
51
23/02/2026
Between 12/08/2024 and 21/08/2024
'Recently'
'hamzazaheer'
ASP.NET web application developers
Researchers at Socket identify four malicious NuGet packages targeting ASP.NET developers. These packages utilize advanced JIT hooking and assembly manipulation to intercept sensitive data and exfiltrate credentials. By masquerading as legitimate development tools, the malware compromises the software supply chain and steals sensitive environment information.
Malware
Information/Communication
Cyber Crime
Global
Supply Chain Compromise
52
23/02/2026
Between 8/11/2025 and 9/11/2025
13/11/2025
Everest
Vikor Scientific
Nearly 140,000 people are affected by a data breach disclosed by healthcare diagnostic company Vikor Scientific. The Everest ransomware group claims responsibility for the attack.
Ransomware
Human Health
Cyber Crime
US
Compromised Credentials
53
23/02/2026
Unspecified
Unspecified
Unknown
BitPanda users
Researchers at Cofense discover a sophisticated phishing campaign impersonating cryptocurrency brokerage BitPanda has been uncovered by cybersecurity researchers.
Account takeover
Fintech
Cyber Crime
Global
Phishing Email
54
24/02/2026
During 2026
During 2026
Lazarus subgroup, possibly Andariel/Stonefly
Undisclosed organization
Researchers at Symantec reveal that a Lazarus subgroup, possibly Andariel/Stonefly, is now using Medusa in financially-motivated cyberattacks targeting U.S. healthcare providers.
Wynn Resorts confirms that a threat actor stole employee data from its systems after the company was listed on the ShinyHunters extortion gang's data leak site.
Account Takeover
Accommodation/Food
Cyber Crime
US
Social Engineering
56
24/02/2026
Between September 2025 and February 2026
During February 2026
Diesel Vortex (associated with Russian-speaking cybercriminals)
US and EU freight forwarding and logistics companies
A Russian cybercrime group dubbed Diesel Vortex, is targeting Western freight and logistics companies. Using typosquatted domains and phishing, the group hijacks "Load Boards" to steal cargo and redirect payments, causing significant financial losses and disrupting critical supply chain operations in the US and EU.
Account Takeover
Transportation
Cyber Crime
US
EU
Social Engineering
57
24/02/2026
Unspecified
Unspecified
Unknown
Software developers
Researchers from Microsoft reveal that a coordinated campaign targeting software developers with job-themed lures is using malicious repositories posing as legitimate Next.js projects and technical assessment materials, including recruiting coding tests.
Malware
Information/Communication
Cyber Espionage
Unspecified
Supply Chain Compromise
58
24/02/2026
Unspecified
14/02/2026
Unknown
UFP Technologies
American manufacturer of medical devices, UFP Technologies, discloses that a cybersecurity incident has compromised its IT systems and data.
Unknown
Manufacturing
Cyber Crime
US
Unknown
59
24/02/2026
During February 2026
23/02/2026
Unknown
Olympique de Marseille
French professional football club Olympique de Marseille confirms a cyberattack after a threat actor claimed that it breached the club's systems earlier this month.
Unknown
Arts/Entertainment
Cyber Crime
FR
Unknown
60
24/02/2026
09/02/2026
09/02/2026
Russia-aligned Mercenary Akula (tracked by CERT UA as UAC-0050)
Unnamed European financial institution
Researchers at BlueVoyant observer the Russia-aligned threat actor Akula targeting a European financial institution as part of a social engineering attack to likely facilitate intelligence gathering or financial theft.
Malware
Finance & insurance
Cyber Crime
Cyber Espionage
EU
Social Engineering
61
24/02/2026
Since December 2025
Since December 2025
Unnamed threat actors
Undisclosed organizations
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds CVE-2026-25108, a recently disclosed vulnerability in FileZen, to its Known Exploited Vulnerability (KEV) catalog.
Unknown
Unknown
Unknown
US
Software Vulnerability
62
24/02/2026
Since December 2025
Since December 2025
Unknown
Organizations using Sangoma FreePBX
The Shadowserver Foundation reveals that over 900 Sangoma FreePBX instances still remain infected with web shells as part of attacks that exploited CVE-2025-64328, a command injection vulnerability starting in December 2025.
Malware
Multiple Industries
Cyber Crime
US
BR
CA
DE
FR
Public-facing App Vulnerability
63
25/02/2026
Since at least 2023
Unspecified
UNC2814 (suspected People's Republic of China (PRC)-nexus cyber espionage group
53 telecom firms and govt agencies in 42 countries
Google’s Threat Intelligence Group (GTIG), Mandiant, and other partners disrupt a global espionage campaign attributed to a suspected Chinese threat actor that used SaaS API calls to hide malicious traffic in attacks targeting telecom and government networks, via a new C-based backdoor named ‘GRIDTIDE.’
Malware
Multiple Industries
Cyber Espionage
Global
Unknown
64
25/02/2026
Since 2023
'Recently'
UAT-8616
Undisclosed organizations
Cisco warns that a critical authentication bypass vulnerability in Cisco Catalyst SD-WAN, tracked as CVE-2026-20127, was actively exploited in zero-day attacks that allowed remote attackers to compromise controllers and add malicious rogue peers to targeted networks. In the same day cybersecurity agencies from the Five Eyes intelligence alliance warn that “an advanced threat actor” is actively exploiting CVE-2026-20127 and CVE-2022-20775, pressing organizations to look for signs their systems may already have been compromised.
Privilege Escalation
Unknown
Cyber Espionage
Unknown
Network appliance vulnerability
65
25/02/2026
Beginning November 2024
02/10/2025
Unknown
TriZetto Provider Solutions
More than 3 million of people across the U.S. had sensitive information leaked as a result of a 2024 data breach impacting healthcare technology company TriZetto Provider Solutions.
Account Takeover
Human Health
Cyber Crime
US
Misconfiguration
66
26/02/2026
During January 2026
During February 2026
'Indra'
ManoMano
DIY store chain ManoMano notifies customers of a data breach that was caused by threat actors compromising a third-party service provider and impacting 37.8 million user accounts.
Unknown
Wholesale/Retail
Cyber Crime
FR
Supply Chain Compromise
67
25/02/2026
'Recently'
'Recently'
Unknown (impersonating Stripe developers)
Developers and organizations using Stripe for payment processing
Researchers at ReversingLabs uncover a malicious NuGet package, "Stripe-Official," impersonating the legitimate Stripe SDK. The package contains a sophisticated downloader that executed a malicious script to exfiltrate sensitive system information and developer data.
Malware
Fintech
Cyber Crime
Global
Supply Chain Compromise
68
25/02/2026
Unspecified
Unspecified
Network of ChatGPT accounts linked to the pro-Kremlin media outlet Rybar
Individuals in Africa
OpenAI reveal the details of "Operation “Fish Food", where it banned a network of ChatGPT accounts on Telegram and X linked to the pro-Kremlin media outlet Rybar that used artificial intelligence to generate social media content and draft proposals for covert influence operations targeting Africa.
Coordinated inauthentic behavior
Individual
Cyber Warfare
Africa
Not Applicable
69
25/02/2026
During December 2025
During December 2025
Unknown
Ten Mexican government bodies and a financial institution
A threat actor exploits Anthropic's Claude chatbot to carry out attacks against Mexican government agencies and financial institutions. The threat actor used Claude to find vulnerabilities in government networks, to write scripts to exploit them, and also tasked the chatbot with finding ways to automate data theft
Unknown
Multiple Industries
Cyber Crime
MX
Public-facing App Vulnerability
70
26/02/2026
Since at least as early as December 2025
'Recently'
UAT-10027
Education and healthcare sectors in the U.S
Researchers at Cisco Talos identify a campaign deploying "DoHDoor" malware, which uses DNS-over-HTTPS for covert communication. The attack targets various education and healthcare sectors in the U.S to exfiltrate data and maintain persistence, leveraging legitimate cloud services to hide malicious traffic and bypass traditional network defenses.
Malware
Multiple Industries
Cyber Espionage
US
Unknown
71
26/02/2026
Unspecified
Unspecified
Unknown
Roblox players
Researchers at Microsoft reveal that threat actors are luring unsuspecting users into running trojanized gaming utilities that are distributed via browsers and chat platforms to distribute a remote access trojan (RAT).
Malware
Arts/Entertainment
Cyber Crime
Global
Social Engineering
72
26/02/2026
Since at least December 2025
During December 2025
APT37 (a.k.a. ScarCruft, Ruby Sleet, and Velvet Chollima)
Individuals and governments organizations
Researchers at Zscaler discover Ruby Jumper, a campaign designed to infiltrate air-gapped networks, leveraging USB drives for lateral movement and data exfiltration.
Malware
Multiple Industries
Cyber Espionage
Unspecified
Social Engineering
73
26/02/2026
Since 20/02/2025
16/12/2025
Unknown
Go developers working in cryptocurrency and blockchain
Researchers at Socket identify a malicious Go module targeting cryptocurrency developers. The package exfiltrates system passwords and deploys the Rekoobe backdoor. By mimicking legitimate cryptographic libraries, the attack enables remote command execution and long-term persistence on Linux systems.
Malware
Fintech
Cyber Crime
Global
Supply Chain Compromise
74
26/02/2026
25/02/2026 and 26/02/2026
25/02/2026 and 26/02/2026
Famous Chollima
Developers generally in the crypto space
Socket researchers identify "StegaBin," an additional interaction of the "Contagious Interview" campaign involving 26 malicious npm packages using steganography to hide malicious payloads in Pastebin. This sophisticated method evades traditional detection, allowing the malware to exfiltrate sensitive data from developers' environments while appearing as harmless dependency updates.
Malware
Fintech
Cyber Crime
Cyber Espionage
Global
Supply Chain Compromise
75
26/02/2026
Between 08/10/2025 and 21/10/2025
16/12/2025
Cl0p
Madison Square Garden
Madison Square Garden confirms being impacted by a data breach stemming from a cybercrime campaign targeting customers of Oracle’s E-Business Suite (EBS) solution.
Ransomware
Arts/Entertainment
Cyber Crime
US
Public-facing App Vulnerability
76
27/02/2026
27/02/2026
27/02/2026
Unknown
South Korea’s National Tax Service
South Korea’s National Tax Service exposes publicly the mnemonic recovery phrase of a seized cryptocurrency wallet and someone is able to steal $4.4 million in crypto assets.,
Misconfiguration
Public Administration
Cyber Crime
KR
Misconfiguration
77
27/02/2026
27/02/2026
27/02/2026
Unknown
Websites operated by Roskomnadzor (Russian communications watchdog) and the Russian Defense Ministry, as well as infrastructure belonging to the Main Radio Frequency Center (GRFC)
Russia’s internet regulator (Roskomnadzor) and defense ministry say their servers were hit by a large distributed denial-of-service (DDoS) attack that briefly disrupted access to several government websites.
DDoS
Public Administration
Unknown
RU
Not Applicable
78
28/02/2026
17/02/2026
17/02/2026
Unknown
Cryptocurrency users
A Chrome extension named "QuickLens - Search Screen with Google Lens" is removed from the Chrome Web Store after it was compromised to push malware and attempt to steal crypto from thousands of users.
Malware
Fintech
Cyber Crime
Global
Supply Chain Compromise
79
28/02/2026
During October 2025
During February 2026
Unknown
Canadian Tire
More than 38 million accounts are affected by an October 2025 data breach at Canadian giant Canadian Tire.
Unknown
Wholesale/Retail
Cyber Crime
CA
Unknown
80
28/02/2026
28/02/2026
28/02/2026
US and Israel
Critical infrastructure, official news sites, and security communications systems in Iran
Cyberattacks conducted by US-Israeli forces caused widespread disruptions in Iran, including to news/propaganda websites (such as IRNA news agency), communications infrastructure used by the Islamic Revolutionary Guard Corps (IRGC), local applications, and digital government services.
October 2026 Cyber Attacks Timeline
Mega Breaches in 2026
September 2026 Cyber Attacks Timeline
H1 2024 Cyber Attacks Statistics
August 2026 Cyber Attacks Statistics Infographic