Daily Cybersecurity News - February 14, 2026

A major Indian pharmacy chain, DavaIndia, inadvertently exposed sensitive customer data and internal administrative controls due to a backend flaw in its web dashboards. The vulnerability, discovered by a security researcher, allowed potential access to thousands of online orders.

This incident highlights the critical need for robust security controls on administrative interfaces, as a single misconfiguration can lead to widespread data exposure.

A newly identified threat actor, UAT-9921, is deploying a modular malware framework named VoidLink against technology and financial service sectors. Active since at least 2019, the group uses the sophisticated, Linux-focused VoidLink for long-term stealth access and reconnaissance.

VoidLink is a polyglot framework written in Zig, a language chosen for its ability to cross-compile for Windows, Linux, and MIPS while defying standard reverse-engineering tools. This choice allows a single codebase to target diverse environments - from cloud containers to IoT edge devices, with high stealth.

A widespread campaign involving over 300 malicious Chrome extensions with more than 37 million downloads has been uncovered. These extensions are designed to steal sensitive user data, including credentials and session cookies, by tracking browsing activity and exfiltrating information.

This campaign highlights the significant threat posed by malicious browser extensions, which exploit user trust in official marketplaces. The large scale of downloads indicates a successful distribution strategy that leverages social engineering and abuse of the extension update process.

Nation-state actors from China, Russia, and Iran are aggressively targeting the Defense Industrial Base (DIB). These groups exploit zero-day vulnerabilities in network edge devices to gain initial access and maintain long-term persistence within contractor networks.

The high-volume use of valuable zero-day exploits signifies a strategic shift towards pre-positioning within critical networks for future intelligence gathering. This tactic allows threat actors to establish stealthy, long-term footholds that can go undetected for extended periods.

Threat actors are abusing public content generated by Anthropic's Claude LLM, promoted via Google Ads, to deliver infostealer malware to macOS users. This "ClickFix" campaign tricks users searching for technical help into executing malicious commands that install the MacSync infostealer.

This campaign represents a tactical evolution, weaponizing legitimate AI-generated content on trusted domains to increase the lure's credibility. The abuse of LLM artifacts from platforms like Claude and ChatGPT for malware delivery is a growing trend in social engineering attacks.

Meta is reportedly planning to integrate a facial recognition feature, internally codenamed "Name Tag," into its Ray-Ban smart glasses. This capability would allow the wearer's AI assistant to identify individuals and provide information about them in real-time.

The integration of facial recognition into smart glasses represents a significant escalation in ambient data collection, moving digital identity tracking into the physical world. This creates a persistent surveillance capability that could be abused by threat actors for stalking or harassment and poses a uniquely dire threat to personal anonymity in public spaces. For technical leaders, this development normalizes mass data capture, creating new attack surfaces and profound ethical and data governance challenges.

Threat actors are increasingly using a technique called "Bring Your Own Vulnerable Driver" (BYOVD) to gain kernel-level access on Windows systems. This allows them to terminate endpoint security products before deploying ransomware and other malware.

The rise of BYOVD attacks represents a fundamental threat to enterprise security posture. It undermines the trust model of the operating system and demonstrates that even robust endpoint detection and response tools can be neutralized. This forces a strategic shift beyond simple EDR reliance towards proactive measures like stringent application control, driver blocklisting, and enhanced monitoring for the initial administrative access required to load these drivers.