Trust is doing a lot of heavy lifting this week. |
From browser add-ons and AI marketplaces to identity systems, developer platforms, and factory floors, familiar tools are quietly being repurposed in ways many teams won’t spot until it’s too late.
Read past newsletters here. |
|
| Here’s what you need to know: |
|
|
Chrome Add-On Caught Stealing Amazon Commissions |
A Chrome extension marketed as an Amazon ad blocker was caught quietly hijacking affiliate links and rerouting commissions to its developer.
Socket researchers found the Amazon Ads Blocker extension quietly replaced or injected affiliate tags across Amazon product pages without user consent, while appearing to function as a legitimate ad blocker. |
The extension is still available for use at the time of writing. Remove suspicious extensions, enforce allowlisting, and routinely audit browser add-ons for hidden URL rewriting, excessive permissions, or behavior that doesn’t match their stated purpose. |
Attackers Slip Malware Into AI Skill Marketplace |
A routine trust check exposed a large-scale AI supply chain attack involving hundreds of malicious skills hidden in a popular agent marketplace. Koi researchers audited OpenClaw’s ClawHub and found 341 malicious skills — 335 tied to the ClawHavoc campaign — masquerading as popular tools and delivering malware.
The attack exposed credentials, API keys, and sensitive data. The researchers have reported their findings to ClawHub’s security team.
Allowlist and vet AI skills before use, run agents in sandboxed environments with least-privilege access, and monitor for unauthorized updates, network connections, or credential access. |
Infostealers Target Enterprise Identity Systems |
A new Flare report shows infostealer malware has quietly evolved from a consumer nuisance into a serious enterprise identity threat.
Analysis of 18.7 million infostealer logs found that over 10% of infections exposed enterprise SSO credentials — peaking at 16% in late 2025 — even as overall infections declined. By capturing session cookies, browser data, and multiple identities, infostealers can bypass MFA and enable lateral movement across cloud and SaaS environments, with Microsoft Entra ID exposed in nearly 80% of cases.
Limit enterprise identity use to hardened devices, enforce phishing-resistant MFA with short session lifetimes, and continuously monitor for leaked credentials or tokens to contain infostealer impact. |
|
|
If an infostealer hit one employee's laptop today… |
|
|
Yesterday's Pulse Check Results |
An unapproved AI app is already in production — now what? |
|
|
Security Tools You Can Use |
|
|
Android RAT Hides on Hugging Face |
Researchers uncovered a large-scale Android malware campaign that abused Hugging Face’s trusted infrastructure to quietly deliver a remote access trojan. Bitdefender found attackers using a fake security app, TrustBastion, to sideload thousands of Android malware variants hosted on Hugging Face. |
Once installed, the RAT exploited Accessibility Services to capture screens, steal credentials, and display fake login prompts, giving attackers near-total device control. This is an active campaign in the wild. Block sideloaded apps by policy and restrict Accessibility Service permissions to approved, verified applications only. |
Researchers Flag Iconics SCADA Denial-of-Service Flaw |
Researchers at Palo Alto Networks Unit 42 identified a vulnerability in the Iconics Suite SCADA platform that can be abused to render Windows-based industrial systems unbootable.
CVE-2025-0921 allows attackers to abuse overly privileged file operations to overwrite critical Windows drivers, triggering denial-of-service after reboot. The flaw can be chained with weak permissions or legacy components to let non-admin users disrupt Iconics deployments and halt critical operations.
Patch or apply vendor workarounds for Iconics, lock down SCADA file permissions, and monitor for unauthorized file or configuration changes to prevent unbootable OT systems. |
|
|
ITSM complexity can slow teams down and limit visibility. Join Complexity to Clarity: ITSM Customer That Switched on February 11 at 1:00 PM ET for a live discussion with Freshworks and Ultradent on moving from legacy ITSM to a modern approach.
The session covers implementation challenges, change management, and how teams evaluate ITSM success. 👉 Join peers shaping the future of ITSM. |
|
|
How exposed is your attack surface? |
Your attack surface is expanding faster than most teams realize, fueled by cloud sprawl, shadow IT and shadow AI, forgotten subdomains, and quietly exposed services that often go unnoticed.
Attackers are finding weaknesses through basic asset discovery rather than zero-day exploits, which makes continuous attack surface management a practical necessity. |
How to reduce your external attack surface: |
- Continuously discover and map all internet-facing assets using attack surface management tools to identify unknown services, misconfigurations, and risky technologies from an attacker’s perspective.
-
Monitor for exposed credentials, API keys, and attack paths, prioritizing remediation on assets that provide direct access to sensitive systems or identities.
-
Reduce exposure by auditing cloud configurations and regularly decommissioning unused or unmaintained assets before they become entry points.
|
Effective attack surface management improves visibility into exposed assets, helping teams prioritize remediation, reduce unnecessary exposure, and focus security efforts where they have the most impact. |
|
|
|
Ken Underhill is an award-winning cybersecurity professional, bestselling author, and seasoned IT professional. He holds a graduate degree in cybersecurity and information assurance from Western Governors University, bringing years of hands-on experience to the field. |
|
|
Cybersecurity Insider is a TechnologyAdvice business |
© 2026 TechnologyAdvice, LLC. All rights reserved. |
TechnologyAdvice, 3343 Perimeter Hill Dr., Suite 215, Nashville, TN 37211, USA. |
|
|
|
