Cyber Briefing: 2026.02.04
macOS infostealers surge, AI marketplaces host malware, crypto wallets lose millions, data breaches hit health and crypto firms, and governments tighten AI and youth rules.
👉 What’s trending in cybersecurity today?
Welcome to Cyber Briefing, the newsletter that informs you about the latest cybersecurity advisories, alerts, incidents and news every weekday.
First time seeing this? Please Subscribe
🚨 Cyber Alerts
1. Microsoft Warns Python Infostealers On macOS
Microsoft has highlighted a significant increase in information-stealing malware targeting macOS by using cross-platform languages like Python to expand beyond Windows. These campaigns frequently use deceptive social engineering and malicious advertisements to trick users into installing malware that harvests sensitive data, including browser credentials and cryptocurrency information.
2. Mozilla Adds One Click AI Disable Option
Mozilla has introduced a new settings section in the Firefox desktop browser that enables users to entirely disable all current and future generative artificial intelligence features. This update ensures that the browser remains fully customizable, allowing individuals to opt out of AI enhancements or manage specific tools like translations and tab grouping according to their preferences.
3. Researchers Find 341 Malicious ClawHub
A recent security audit by Koi Security identified 341 malicious skills among 2,857 listings on the ClawHub marketplace for the OpenClaw AI assistant. These malicious entries utilize deceptive installation requirements to deploy data-stealing malware, including the Atomic Stealer for macOS and keyloggers for Windows users.
For more alerts click here!
💥 Cyber Incidents
4. $30M Stolen From Step Finance Wallets
Step Finance recently confirmed that an attacker compromised its treasury and fee wallets during Asian Pacific trading hours, resulting in the theft of approximately 261,854 SOL valued at roughly $30 million. Although the team maintains that user funds were not directly impacted, the native STEP token lost over 90% of its value as the community questioned whether the incident was a security failure or a potential exit scam.
5. Precipio Data Breach Exposes PHI PII
Precipio, Inc., a cancer diagnostics firm, recently confirmed a significant data breach after an unauthorized party gained access to an employee’s cloud storage account. The incident, linked to the INC RANSOM group, resulted in the theft of 150 gigabytes of sensitive data including personal identification and private medical records.
6. Coinbase Confirms Insider Data Breach
Coinbase recently disclosed a security incident involving an external contractor who gained unauthorized access to the personal information of about thirty customers in December. After detecting the breach, the company terminated the contractor’s services and notified the affected individuals while providing them with protective resources.n without having actually compromised any sensitive information.
For more incidents click here!
📢 Cyber News
7. Spain To Ban Social Media For Kids
Spanish Prime Minister Pedro Sanchez announced a ban on social media for children under 16, requiring platforms to implement strict age verification systems. This move follows a growing international trend of restricting youth digital access, inspired by similar legislation recently passed in Australia.
8. French Prosecutors Raid X Offices
French prosecutors and international police units raided the offices of X on Tuesday as part of an escalating investigation into the platform’s algorithms and AI chatbot, Grok. Elon Musk and former CEO Linda Yaccarino have been summoned for interviews in April regarding allegations involving the dissemination of deepfakes and illegal content.
9. Incognito Dark Web Market Owner Sentenced
Rui-Siang Lin, a 24-year-old from Taiwan, received a 30-year prison sentence for managing Incognito Market, a massive darknet platform that facilitated over $105 million in illegal drug sales. Operating under the pseudonym Pharoah, Lin pleaded guilty to multiple charges including money laundering and narcotics distribution after his arrest in May 2024.
For more news click here!
📈Cyber Stocks
Mid-week action on Wednesday, 4 February 2026 saw cybersecurity equities under moderate pressure as broader U.S. technology stocks faced risk-off flows.
Zscaler ended near 188.05 dollars and moved lower, as zero-trust cloud security names saw short-term selling.
Fortinet closed at about 79.30 dollars and was mildly softer, with network security hardware/services lagging broader peers.
Check Point Software Technologies finished around 174.07 dollars and trended down, as defensive tech valuations softened with the broader sell-off.
SentinelOne closed near 13.14 dollars and was lower, as smaller AI-enabled endpoint security stocks saw risk-off flows.
Rapid7 finished at about 10.66 dollars and declined, with vulnerability management and SIEM names under pressure.
CyberArk Software closed near 406.67 dollars and moved down, as privileged access management equities aligned with broader trend weakness.
💡 Cyber Tip
🍎 Microsoft Warns of Python Infostealers on macOS
Microsoft is warning about a surge in macOS infostealers written in Python, allowing attackers to easily expand beyond Windows. These campaigns rely on malvertising and social engineering to trick users into installing fake tools or updates that steal browser data, credentials, and cryptocurrency information.
🛠️ What You Should Do
Avoid downloading software from ads or sponsored search results
Verify installers and developers before opening disk image files
Watch for unusual Terminal or automation activity on macOS
Monitor access to sensitive stores like iCloud Keychain
Use endpoint security that detects script-based and cross-platform malware
⚠️ Why This Matters
macOS is no longer a secondary target. Cross-platform malware lowers the barrier for attackers to steal data, pivot into corporate networks, and enable larger breaches using the same tooling across operating systems.
📚 Cyber Book
Fraud 101 by Stephen Pedneault
That concludes today’s briefing. You can check the top headlines here!
Copyright © 2026 CyberMaterial. All Rights Reserved.
Follow CyberMaterial on:
Substack, LinkedIn, Twitter, Reddit, Instagram, Facebook, YouTube, and Medium
Really solid coverage on the macOS infostealer surge. The cross-platform Python approch is smart from an attacker perspective since it lets them reuse the same codebase. I dealt with something similar last year where malvertising pushed fake updates that stole creds and wallet data. Bundling crypto targeting with traditional credential theft basically doubles the payout per victim.