In today’s cybersecurity news…

Crazy gang abuses employee monitoring tool

Security researchers at Huntress say a member of the Crazy ransomware gang is abusing legitimate employee-monitoring software and the SimpleHelp remote-support tool to stay inside corporate networks, avoid detection, and prepare for ransomware attacks. In observed intrusions, the attackers installed Net Monitor for Employees to watch screens, transfer files, and run commands, while also deploying SimpleHelp under disguised filenames for backup access and disabling Windows Defender. The attackers monitored systems for cryptocurrency wallets and remote-access tools, and Huntress says both incidents likely came from the same operator using stolen SSL VPN credentials. (BleepingComputer)

Nevada unveils new data classification

Nevada’s IT agency introduced a statewide data classification policy months after a major cyberattack disrupted state systems. Under the new framework, agencies have to label data as “public,” “sensitive,” “confidential,” or “restricted,” with stricter safeguards applied when classification is unclear. Officials say the policy establishes a shared baseline for protecting information and will underpin future cybersecurity measures, including multifactor authentication, as lawmakers continue broader reforms such as creating a state Security Operations Center. (SecurityWeek)

Georgia healthcare breach impacts more than 620,000

A 2025 cyberattack on Georgia-based physician group ApolloMD exposed the sensitive data of 626,540 people, according to a new filing with the U.S. Department of Health and Human Services. Hackers were inside the company’s systems for two days in May, accessing names, birth dates, addresses, diagnoses, treatment details, insurance data, and Social Security numbers. The Qilin ransomware gang claimed responsibility. Cisco Talos says the group published data from about 40 victims per month last year. (The Record)

Microsoft Store Outlook add-in hijacked to steal accounts

Researchers at Koi Security say a legitimate Outlook scheduling add-in called AgreeTo was hijacked after its developer abandoned the project, letting a threat actor take control of its hosted content and turn it into a phishing kit. The malicious version showed a fake Microsoft login page inside Outlook and stole more than 4,000 account credentials, along with credit card details and security answers, sending the data to attackers via Telegram. Microsoft has since removed the add-in from its marketplace, and researchers say it may be the first malicious Outlook add-in discovered there. (BleepingComputer)

Huge thanks to our episode sponsor, ThreatLocker

0APT ransomware group rises

Researchers at Halcyon and GuidePoint Security say the new 0APT ransomware group likely inflated claims of about 200 victims in its first week, with no evidence confirming most of the breaches. Halcyon says the group’s victim list appears to be a publicity stunt to attract affiliates, but warns its ransomware code and infrastructure are real and could pose a genuine threat. GuidePoint says the encryptor itself isn’t especially advanced and notes the group still needs proven access and lateral-movement capabilities to carry out attacks. (CyberScoop)

Devilish devs spawn Chrome extensions

Security researcher “Q Continuum” identified 287 Chrome extensions with about 37.4 million total installs that allegedly exfiltrate users’ browsing histories to more than 30 companies, including Similarweb, Semrush, Alibaba, and ByteDance. The study used automated testing to link browsing activity with outbound data, finding many extensions requested unnecessary history access while disclosing the collection only vaguely in privacy policies. About 20 million installs were tied to unknown collectors. (The Register)

Windows 11 Notepad flaw lets files execute silently

Microsoft fixed a high-severity Windows 11 Notepad vulnerability that let attackers execute local or remote programs through malicious Markdown links. The flaw let specially crafted links launch files without any Windows security warning, giving attackers the same permissions as the user who clicked them. The February Patch Tuesday update now adds warnings for non-standard links, and Notepad will update automatically through the Microsoft Store. (BleepingComputer)

JokerOTP seller arrested

Dutch police arrested a 21-year-old man suspected of selling access to the JokerOTP phishing tool, part of a three-year investigation that dismantled the service last April. Authorities say the phishing-as-a-service platform caused at least $10 million in losses across more than 28,000 attacks in 13 countries by automating calls to victims to capture one-time passcodes. The suspect allegedly sold licenses via Telegram, and police say dozens of buyers have already been identified and will face charges. (BleepingComputer)