6 Zero-Days Exploited NOW, Lazarus Poisons npm, AI-Generated Malware & More | HN62

6 Zero-Days Exploited NOW, Lazarus Poisons npm, AI-Generated Malware & More | HN62

Author: Cipherceval February 26, 2026 Duration: 24:18
Microsoft just dropped patches for SIX actively exploited zero-day vulnerabilities — and that's just the beginning. In this week's Hacking News, we break down the February 2026 Patch Tuesday emergency, North Korea's Lazarus Group poisoning npm and PyPI through fake job recruiters, nation-state hackers weaponizing Google's Gemini AI (including malware that writes its own payloads), a massive Dutch telecom breach affecting 6.2 million people, and a U.S. government contractor breach that ballooned from 4 million to potentially tens of millions affected.

This is Exploit Brokers by Forgebound Research — cybersecurity news, threat intelligence, and insights. Whether you're a security analyst, developer, or just someone who wants to stay informed, this episode has something for you.

🔔 Subscribe and hit the bell so you never miss an episode.
⭐ Listening on Spotify or Apple Podcasts? A follow and 5-star rating helps others find the show.

---

⏱️ TIMESTAMPS

0:00 — Cold Open: Did You Run Windows Update?
0:51 — Forge OS Intro
0:55 — Welcome & CTA
1:20 — Microsoft Patch Tuesday: 6 Actively Exploited Zero-Days
6:08 — Lazarus Group "GraphAlgo": Fake Recruiters Poison npm & PyPI
10:02 — Nation-States Weaponize Google Gemini AI (HONESTCUE Malware)
15:05 — Odido Breach: 6.2 Million Dutch Records Stolen
18:38 — Conduent Breach Expands from 4M to Tens of Millions
21:55 — Recap & 5 Key Takeaways
23:54 — Outro

---

📰 STORIES COVERED

Story 1 — Microsoft February 2026 Patch Tuesday
• 58 vulnerabilities patched, 6 actively exploited zero-days
• CVE-2026-21510: Windows SmartScreen bypass (CVSS 8.8) — "widespread active exploitation"
• CVE-2026-21513: MSHTML security bypass
• CVE-2026-21514: Microsoft Word OLE bypass
• CVE-2026-21533: Remote Desktop Services privilege escalation to SYSTEM
• CVE-2026-21519: Desktop Window Manager type confusion → SYSTEM
• CVE-2026-21525: RasMan denial of service (VPN crash)
• Google, CrowdStrike, Acros Security & Microsoft collaborated on discovery

Story 2 — Lazarus Group "GraphAlgo" Campaign
• 192 malicious npm/PyPI packages targeting JavaScript & Python developers
• Fake crypto companies (e.g., "Veltrix Capital") used for recruitment lures
• Package "bigmathutils" had 10,000+ downloads before payload injection at v1.1.0
• Full-featured RAT with token-based C2 authentication
• Attribution: Medium-to-high confidence (Lazarus/DPRK) — GMT+9 commit timestamps

Story 3 — Nation-State Actors Weaponize Google Gemini
• Google GTIG report (Feb 12, 2026) confirms NK, Iran, China, Russia using Gemini
• UNC2970 (Lazarus overlap) using AI for OSINT and target profiling
• Iran's APT42 crafting native-sounding phishing with AI
• HONESTCUE malware: Uses Gemini API to generate & execute C# payloads in memory (fileless + polymorphic)
• COINBAIT phishing kit built using Lovable AI coding platform

Story 4 — Odido (Netherlands) Data Breach
• 6.2 million customers affected (~1/3 of the Netherlands' population)
• Stolen: Names, addresses, emails, phone numbers, DOBs, IBANs, passport/license numbers
• Formerly T-Mobile Netherlands; subsidiary Ben also affected
• Part of broader telecom targeting pattern (Salt Typhoon, SK Telecom, Free SAS)

Story 5 — Conduent Breach Expansion
• Jan 2025 ransomware attack originally reported as 4M affected
• Now: 15.4M in Texas alone, 10.5M in Oregon, plus DE, MA, NH and more
• Total potentially tens of millions across the U.S.
• Safeway ransomware gang claimed 8TB stolen
• SSNs, medical data, health insurance information compromised

---

📋 KEY TAKEAWAYS

1. Patch like it's urgent — 6 actively exploited zero-days can't wait
2. Your package manager is an attack surface — sandbox job assessment code
3. AI is a force multiplier for attackers — bad grammar is no longer a reliable phishing indicator
4. Telecom data is a goldmine — verify everything through official channels
5. Breach disclosures can be icebergs — monitor your identity proactively

---

🔗 SOURCES

Microsoft Patch Tuesday:
• BleepingComputer — https://www.bleepingcomputer.com
• Krebs on Security — https://krebsonsecurity.com
• SecurityWeek — https://www.securityweek.com
• Malwarebytes — https://www.malwarebytes.com
• Rapid7 — https://www.rapid7.com
• Help Net Security — https://www.helpnetsecurity.com
• TechCrunch — https://techcrunch.com

Lazarus GraphAlgo:
• ReversingLabs — https://www.reversinglabs.com
• The Hacker News — https://thehackernews.com
• BleepingComputer — https://www.bleepingcomputer.com
• SC Media — https://www.scworld.com
• Security Affairs — https://securityaffairs.com

Gemini AI Weaponization:
• Google GTIG Blog — https://blog.google/technology/safety-security/
• The Hacker News — https://thehackernews.com
• Infosecurity Magazine — https://www.infosecurity-magazine.com
• AI News — https://www.artificialintelligence-news.com

Odido Breach:
• BleepingComputer — https://www.bleepingcomputer.com
• The Register — https://www.theregister.com
• TechCrunch — https://techcrunch.com
• SecurityWeek — https://www.securityweek.com
• The Record — https://therecord.media
• NL Times — https://nltimes.nl

Conduent Breach:
• TechCrunch — https://techcrunch.com

---

🏷️ HASHTAGS

#cybersecurity #hackingnews #zeroday #microsoft #patching #lazarusgroup #npm #supplychainattack #gemini #AI #malware #databreach #ransomware #infosec #threathunting #exploitbrokers #forgeboundresearch #northkorea #nationstate #cyberthreat #patchtuesday #developers #phishing #telecom #OSINT

---

Ever wonder how a hacker actually thinks when they're picking a digital lock? That's the kind of curiosity that drives Exploit Brokers By Forgebound Research. Hosted by Cipherceval, this isn't just a rundown of the week's scary headlines. Instead, it's a deep, analytical dive into the mechanics behind major cyber events. Each episode takes apart real-world incidents-from sprawling data breaches and clever malware to massive botnet takedowns-and walks through the how and why. The goal is practical: by understanding the tools and tactics used in an attack, we can all build smarter defenses. You'll find a mix of sharp commentary on breaking tech news and clear, insightful tutorials that demystify complex security concepts. Tune in for a perspective that goes beyond surface-level reporting, offering a genuine look into the mindset of both attackers and defenders. This podcast serves as a valuable resource for anyone from IT professionals to simply tech-curious listeners who want to move past fear and into comprehension.
Author: Language: en-us Episodes: 62

Exploit Brokers By Forgebound Research - Tech and Hacking News Commentary
Podcast Episodes
HN41 - Chinese Hackers Hijack US Telecom Networks [not-audio_url] [/not-audio_url]

Duration: 15:46
In this eye-opening episode of Exploit Brokers, your host Lauro dives deep into the recent cyberattacks that have compromised major U.S. telecommunications networks. Chinese state-sponsored hackers, known as Salt Typhoon…
HN38 - Is Your Tap-to-Pay Secure? The Latest Android Malware Warning [not-audio_url] [/not-audio_url]

Duration: 13:35
Is Your Tap-to-Pay Secure? The Latest Android Malware Warning 🔒 In this episode of Exploit Brokers, we dive deep into a new Android malware that targets NFC technology to steal your banking information. 📱💳 If you use tap…
HN37 - AI Manipulation: The Silent Threat to Democracy [not-audio_url] [/not-audio_url]

Duration: 16:32
🚨 AI Propaganda Exposed: How It's Influencing Elections Right Now! 🚨 In this episode of Exploit Brokers, we dive deep into the unsettling world of AI-driven misinformation campaigns. From targeting voters on both sides t…
HN36 - Fake Sites, Real Danger: The Trojan Malware in Extensions [not-audio_url] [/not-audio_url]

Duration: 15:08
In this episode of Exploit Brokers, we dive into a significant new threat spreading across the web—Trojan malware hidden in malicious browser extensions. These sneaky extensions are distributed through fake download site…