Isometric network nodes illustrating OpenClaw flaw and zero-day breaches.
Home»Cybersecurity News Summary»Daily Cybersecurity News - March 2, 2026

Daily Cybersecurity News - March 2, 2026

Written by:Daily Cyber Briefing TeamVerified by:Kirill Gavrilenko
March 2, 2026 5:26 PM 3 min read

OpenClaw Flaw Enables Agent Hijacking

High

Executive Summary

A high-severity vulnerability, dubbed ClawJacked (CVE-2026-25253), was discovered in the OpenClaw AI agent framework. The flaw allowed a malicious website to silently brute-force access to a local instance, leading to token theft, full control, and potential data exfiltration; a patched version is now available.

Vulnerability Details

  • Affected Product: OpenClaw (also known as Moltbot and Clawdbot) versions prior to 2026.2.26.
  • Identifier: CVE-2026-25253
  • CVSS Score: 8.8 (High)
  • Exploitation Status: Proof-of-concept exists; no evidence of active exploitation in the wild.

Risk & Impact

  • Triage: Urgent. The vulnerability allows for remote code execution and full system compromise with minimal user interaction.
  • Attack Vector: A user running a vulnerable OpenClaw instance visits a specially crafted malicious website. The site uses a WebSocket connection to connect to the local OpenClaw gateway, which improperly trusts localhost traffic, allowing the attacker to brute-force the password and gain control.
  • Ease of Exploit: Simple. The attack can be triggered by a single click on a malicious link, leading to compromise in milliseconds.

Action Plan

  • Immediate Action: Upgrade to OpenClaw Version 2026.2.26 or later.
  • Workaround: If immediate patching is not possible, avoid browsing untrusted websites while logged into the OpenClaw Control UI and consider using isolated browser profiles. It is also recommended to rotate any tokens or credentials used with a vulnerable version.
  • Detection: Monitor logs for any unauthorized configuration changes or unexpected command executions.

Relevant professional terms

AI Agent
An autonomous program designed to perceive its environment, make decisions, and take actions to achieve specific goals without direct human intervention. In cybersecurity, they can act as automated defenders that monitor networks and respond to threats.
Brute-force Attack
A cyberattack method that uses trial-and-error to guess credentials like passwords or encryption keys. Attackers systematically try all possible combinations, often using automated tools, until the correct one is found.
Source: BleepingComputer

Russian Hackers Exploit Microsoft Zero-Day

High

Executive Summary

A high-severity security feature bypass vulnerability, CVE-2026-21513, was exploited by the Russian state-sponsored group APT28 as a zero-day before being Patched by Microsoft in its February 2026 security updates.

Vulnerability Details

  • Affected Product: Microsoft Windows (via MSHTML Framework)
  • Identifier: CVE-2026-21513
  • CVSS Score: 8.8 (High)
  • Exploitation Status: Actively Exploited

Risk & Impact

  • Triage: Urgent: Immediate patching is required due to active exploitation.
  • Attack Vector: An attacker can exploit this by convincing a user to open a specially crafted HTML or .LNK file, which bypasses security warnings (like Mark-of-the-Web) to execute malicious code.
  • Ease of Exploit: Requires user interaction, but a functional exploit has been used in the wild by a sophisticated threat actor.

Action Plan

  • Immediate Action: Apply the Microsoft security updates released on or after the February 2026 Patch Tuesday.

Relevant professional terms

APT28
A Russian state-sponsored cyber espionage group, also known as Fancy Bear or Sofacy, linked to Russia's military intelligence agency (GRU). The group targets government, military, and other strategic organizations.
Zero-Day Vulnerability
A flaw in software or hardware that is unknown to the vendor. Attackers can exploit it before a patch is available, meaning the vendor has "zero days" to fix it.
Source: The Hacker News

North Korean APT Breaches Air-Gapped Networks

Executive Summary

The North Korean-linked group APT37 (aka ScarCruft) is targeting air-gapped systems with a new toolkit. The campaign, dubbed "Ruby Jumper," uses removable media to deploy multiple malware components for data theft and surveillance.

Key TTPs

  • Initial Access: Malicious Windows Shortcut (LNK) files on removable media (USB drives) are used to initiate the infection.
  • Execution: The LNK file executes a PowerShell script, which extracts and runs multiple payloads, including an implant named RestLeaf that uses Zoho WorkDrive for C2.
  • Defense Evasion: The malware establishes persistence by creating a scheduled task and disguising the Ruby runtime environment as a USB utility.

Campaign Analysis

This campaign demonstrates APT37's evolution in targeting isolated environments by turning USB drives into a two-way communication channel for command execution and data exfiltration. The use of a multi-stage toolkit with new malware like ThumbsBD and VirusTask highlights a sophisticated effort to bypass network segmentation.

Targeting & Infrastructure

  • Target Profile: The group historically targets government and private sector entities in South Korea, but has expanded to Japan, Vietnam, and the Middle East.

Relevant Terms

  • Air-Gapped System: A computer or network that is physically isolated from unsecured networks, such as the public internet, to enhance security.
  • C2 (Command and Control): The infrastructure (servers and software) used by attackers to communicate with and send commands to compromised devices.
Source: SecurityWeek