Google Search can make information easy to find, but it can also make your personal data surface in ways that feel invasive or even dangerous. This is why Google is rolling out new tools that give people more control over what shows up about them online.

The company says it is expanding its Search removal features to make it simpler to take down sensitive personal information and explicit images that never should have been public in the first place.

How to remove personal information from Search

Google’s “Results about you hub” can now help you find and remove search results that contain sensitive government-issued identification numbers. This includes things like passport numbers, driver’s license numbers, and other official ID info that could be misused if they appear online.

To use this feature, you sign in to your Google account and select ‘Results about you,’ where you can fill out the information you want to track. Google will proactively scan Search for results that match your personal information and alert you if it finds something.

From there, you can review each result and request removal directly within the tool. You can also manually submit a removal request if you come across sensitive information yourself. Google says it will review these requests and remove results that violate its policies.

How to remove explicit images from Search

Google is also simplifying the process for removing explicit images, especially those shared without consent. You can now request the removal of explicit images more easily, including submitting multiple images at once rather than filing separate requests.

Once an image is removed, Google will also offer an option to proactively filter out similar explicit images from future Search results, to prevent similar content from resurfacing.

You can now track all your removal requests in one place through the Results about you hub, with email updates to keep you informed whenever the status changes.

Google also points out that removing information from Search does not erase it from the internet altogether, but it can still go a long way in protecting your privacy.

The update also comes as Google shuts down its dark web reports, which previously alerted users when their name, phone number, or email surfaced online in a data breach.

Google says those alerts did not always help people take meaningful action, something the new removal tools are designed to address.

Microsoft has released the Windows 10 KB5075912 extended security update to fix February 2026 Patch Tuesday vulnerabilities, including six zero-days, and continue rolling out replacements for expiring Secure Boot certificates.

If you are running Windows 10 Enterprise LTSC or are enrolled in the ESU program, you can install this update like normal by going into Settings, clicking on Windows Update, and manually performing a ‘Check for Updates.’

After installing this update, Windows 10 will be updated to build 19045.6937, and Windows 10 Enterprise LTSC 2021 will be updated to build 19044.6937.

What’s new in Windows 10 KB5075912

Microsoft is no longer releasing new features for Windows 10, and the KB5075912 update contains only security fixes and bug fixes introduced by previous security updates.

With today’s February 2026 Patch Tuesday, Microsoft has fixed 58 vulnerabilities, including six actively exploited zero-day flaws.

KB5075912 also fixes a known issue that prevented Windows 10 devices from shutting down or hibernating if System Guard Secure Launch is enabled.

The complete list of fixes is below:

• [Fonts] This update includes changes to Chinese fonts to meet GB18030-2022A compliance.
• [OS Security (known issue)] Fixed: After installing the Windows security update released on or after January 13, 2026, some Secure Launch-capable PCs with Virtual Secure Mode (VSM) enabled are unable to shut down or enter hibernation. Instead, the device restarts.
• [Folders] Fixed: This update fixes an issue that affects folder renaming with desktop.ini files in File Explorer. The LocalizedResourceName setting was ignored, so custom folder names did not show. Now, custom folder names appear as expected.
• [Graphics] Fixed: A stability issue affecting certain graphics processing units (GPUs) configurations.
• [Secure Boot] With this update, Windows quality updates include a broad set of targeting data that identifies devices and their ability to receive new Secure Boot certificates. Devices will receive the new certificates only after they show sufficient successful update signals, which helps ensure a safe and phased rollout.

Since June 2025, Microsoft has warned that multiple Windows Secure Boot certificates from 2011 are expiring in June 2026, and warned that if they are not updated, it would breach Secure Boot protections.

These certificates are used to validate Windows boot components, third-party bootloaders, and Secure Boot revocation updates, and if expired, could allow threat actors to bypass security protections.

As part of today’s update, Microsoft continues to roll out the new Secure Boot certificates to targeted systems, with updates to additional systems being installed as the targeting scope expands.

Microsoft states that there are no known issues with this update.

Modern IT infrastructure moves faster than manual workflows can handle.

In this new Tines guide, learn how your team can reduce hidden manual delays, improve reliability through automated response, and build and scale intelligent workflows on top of tools you already use.

Get the guide

A newly documented Linux botnet named SSHStalker is using the IRC (Internet Relay Chat) communication protocol for command-and-control (C2) operations.

The protocol was invented in 1988, and its adoption peaked during the 1990s, becoming the main text-based instant messaging solution for group and private communication.

Technical communities still appreciate it for its implementation simplicity, interoperability, low bandwidth requirements, and no need for a GUI.

The SSHStalker botnet relies on classic IRC mechanics such as multiple C-based bots and multi-server/channel redundancy instead of modern C2 frameworks, prioritizing resilience, scale, and low cost over stealth and technical novelty.

According to researchers at threat intelligence company Flare, this approach extends to other characteristics of SSHStalker’s operation, like using noisy SSH scans, one-minute cron jobs, and a large back-catalog of 15-year old CVEs.

“What we actually found was a loud, stitched-together botnet kit that mixes old-school IRC control, compiling binaries on hosts, mass SSH compromise, and cron-based persistence. In other words scale-first operation that favors reliability over stealth,” Flare says.

SSHStalker achieves initial access through automated SSH scanning and brute forcing, using a Go binary that masquerades as the popular open-source network discovery utility nmap.

Compromised hosts are then used to scan for additional SSH targets, which resembles a worm-like propagation mechanism for the botnet.

Flare found a file with results from nearly 7,000 bot scans, all from January, and focused mostly on cloud hosting providers in Oracle Cloud infrastructure.

Once SSHStalker infects a host, it downloads the GCC tool for compiling payloads on the victim device for better portability and evasion.

The first payloads are C-based IRC bots with hard-coded C2 servers and channels, which enroll the new victim in the botnet’s IRC infrastructure.

Next, the malware fetches archives named GS and bootbou, which contain bot variants for orchestration and execution sequencing.

Persistence is achieved via cron jobs that run every 60 seconds, invoking a watchdog-style update mechanism that checks whether the main bot process is running and relaunches it if it is terminated.

The botnet also contains exploits for 16 CVEs targeting Linux kernel versions from the 2009-2010 era. This is used to escalate privileges after the earlier brute-forcing step grants access to a low-privileged user.

Regarding monetization, Flare noticed that the botnet performs AWS key harvesting and website scanning. It also includes cryptomining kits such as the high-performance Ethereum miner PhoenixMiner.

Distributed denial-of-service (DDoS) capabilities are also present, though the researchers noted they have not yet observed any such attacks. In fact, SSHStalker’s bots currently just connect to the C2 and then enter an idle state, suggesting testing or access hoarding for now.

Flare has not attributed SSHStalker to a particular threat group, though it noted similarities with the Outlaw/Maxlas botnet ecosystem and various Romanian indicators.

The threat intelligence company suggests placing monitoring solutions for compiler installation and execution on production servers, and alerts for IRC-style outbound connections. Cron jobs with short execution cycles from unusual paths are also big red flags.

Mitigation recommendations include disabling SSH password authentication, removing compilers from production images, enforcing egress filtering, and restricting execution from ‘/dev/shm.’

Modern IT infrastructure moves faster than manual workflows can handle.

In this new Tines guide, learn how your team can reduce hidden manual delays, improve reliability through automated response, and build and scale intelligent workflows on top of tools you already use.

Get the guide

Rivian’s R2 Prototype has hit road with early reviews, and it’s a capable electric SUV that truly delivers on the adventure promise without breaking the bank like its larger siblings do. The test rides were place on California highways, curvy back roads, and rocky off-road trails near Rivian’s Irvine headquarters. Most reviewers agree that the R2 retains the adventurous spirit of the larger R1 models while also making it more fun and approachable for daily driving.

The power comes from two motors, and this all-wheel drive configuration generates a 656 horsepower and 609 pound-feet of torque. It accelerates from 0 to 60 mph in around 3.6 seconds and feels robust even at highway speeds. In normal mode, the R2 runs largely on rear-wheel drive for improved fuel efficiency, but when necessary, it uses the front motor. Sport mode engages full all-wheel drive for a faster reaction.

Sale

VOLPAM Electric Scooter Adult, 19 MPH & 15 Miles Range, 350W Motor, 8.5″ Solid Tires, Lightwight Foldable…

• ✅【 Powerful Performance】Equipped with a 350W brushless motor, this adult electric scooter reaches 19MPH and handles 15° inclines with ease…
• ✅【Long-Lasting Battery】This e scooter has 19 miles max long range on a single 4-5 hours fast charge, making it ideal for everyday commutes…
• ✅ 【Safety First】Scooter stay protected with a drum brake + EABS electronic brake system for quick, stable stopping. The bright LED headlight…

The R2 handles quite well and stays grounded in corners. The steering feels natural and connected, with plenty of feedback that increases as you request more. Body control is outstanding, especially given the high ground clearance and all-terrain tyres with tall sidewalls. Roll remains well under control, and the chassis responds quickly and without drama. The R2 feels lighter on its feet because to its unibody structure, lower weight (about 4,850 to 5,000 pounds), and lower center of gravity. When cruising, the ride is nice, but when you push harder, it tightens up. Steel coil springs and semi-active dampers handle uneven roads with ease, providing an excellent balance between pavement and dirt.

Off-road performance stands up well on the trails it was tested on, with 9.6 inches of ground clearance and angles that allow you to tackle tough terrain with confidence. The long-travel suspension articulates well, and torque vectoring maintains traction without the use of typical locking differentials. When the wheels begin to spin, the brakes come into action, but there is some initial slip before they fully intervene.

Inside, the room is surprisingly generous for a tiny SUV. Tall adults may comfortably sit into the back seats, which provide 40.4 inches of legroom and headroom. The inside remains clutter-free, featuring a large central touchscreen and a smaller driver display. The haptic steering wheel on the column controls climate, drive modes, and other settings via rolling, tilting, and pushing actions, and the feedback is satisfactory, but they are currently working on adjusting the prototypes. There is plenty of storage space, ranging from dual gloveboxes to a flat-folding rear section that can accommodate a fitted mattress for overnight use. The low beltline and upright windows provide excellent visibility.

The EPA cycle shows a range of more than 300 miles, thanks to a compact battery pack and a well-designed interior. Filling up is also much faster than you’d think, with the R2 going from 10 to 80 percent in less than half an hour at a fast charging station, and with a native NACS port, it’s virtually ready to go at any Tesla Supercharger.

The price starts about $45,000, with dual-motor variants costing $50,000 or $55,000, depending on how specced out you want to get. The truth is, that puts the R2 in a really good position in the market; it’s like a true alternative to the more mainstream electric crossovers (Tesla Model Y), but with one significant bonus: you can actually take it off the beaten track and get a real rush of performance.

North Korean hackers are running tailored campaigns using AI-generated video and the ClickFix technique to deliver malware for macOS and Windows to targets in the cryptocurrency sector.

The threat actor’s goal is financial, as suggested by the role of the tools used in an attack on a fintech company investigated by Google’s Mandiant researchers.

During the response engagement, the researchers found seven distinct macOS malware families and attributed the attack to UNC1069, a threat group they’ve been tracking since 2018.

Infection chain

The attack had a strong social engineering component as the victim was contacted over the Telegram messaging service from a compromised account of an executive at a cryptocurrency company.

After building a rapport, the hackers shared a Calendly link that took the victim to a spoofed Zoom meeting page on the attacker’s infrastructure.

According to the target, the hackers showed a deepfake video of a CEO at another cryptocurrency company.

“Once in the ‘meeting,’ the fake video call facilitated a ruse that gave the impression to the end user that they were experiencing audio issues,” Mandiant researchers say.

Under this pretext, the attacker instructed the victim to troubleshoot the problems using commands present on a webpage. Mandiant found commands on the page for both Windows and macOS that would start the infection chain.

Huntress researchers documented a similar attack method in mid-2025 and attributed it to the BlueNoroff  group, another North Korean adversary also known as Sapphire Sleet and TA44, that targeted macOS systems using a different set of payloads.

macOS malware

Mandiant researcher found evidence of AppleScript execution once the infection chain started, but could not recover the contents of the payload, followed by deploying a malicious Mach-O binary. In the next stage, the attacker executed seven distinct malware families: 

1. WAVESHAPER – C++ backdoor that runs as a background daemon, collects host system information, communicates with C2 over HTTP/HTTPS using curl, and downloads and executes follow-on payloads.
2. HYPERCALL – Golang-based downloader that reads an RC4-encrypted configuration file, connects to C2 over WebSockets on TCP 443, downloads malicious dynamic libraries, and reflectively loads them into memory.
3. HIDDENCALL – Golang-based backdoor reflectively injected by HYPERCALL that provides hands-on keyboard access, supports command execution and file operations, and deploys additional malware.
4. SILENCELIFT – Minimal C/C++ backdoor that beacons host information and lock screen status to a hard-coded C2 server and can interrupt Telegram communications when executed with root privileges.
5. DEEPBREATH – Swift-based data miner deployed via HIDDENCALL that bypasses macOS TCC protections by modifying the TCC database to gain broad filesystem access and steals keychain credentials, browser data, Telegram data, and Apple Notes data.
6. SUGARLOADER – C++ downloader that uses an RC4-encrypted configuration to retrieve next-stage payloads and was made persistent via a manually created launch daemon.
7. CHROMEPUSH – C++ browser data miner deployed by SUGARLOADER that installs as a Chromium native messaging host masquerading as a Google Docs Offline extension and collects keystrokes, credentials, cookies, and optionally screenshots.

Of the malware found, SUGARLOADER has the most detections on the VirusTotal scanning platform, followed by WAVESHAPER, which is flagged by just two products. The rest are not present in the platform’s malware database.

Mandiant says that SILENCELIFT, DEEPBREATH, and CHROMEPUSH represent a new set of tooling for the threat actor.

The researchers describe as unusual the volume of malware deployed on a host against a single individual.

This confirms a targeted attack focused on collecting as much data as possible for two reasons: “cryptocurrency theft and fueling future social engineering campaigns by leveraging victim’s identity and data,” Mandiant says.

Since 2018, UNC1069 has demonstrated its ability to evolve by adopting new techniques and tools. In 2023, the bad actor switched to targets in the Web3 industry (centralized exchanges, developers, venture capital funds).

Last year, the threat actor changed its target to financial services and the cryptocurrency industry in verticals such as payments, brokerage, and wallet infrastructure.

Modern IT infrastructure moves faster than manual workflows can handle.

In this new Tines guide, learn how your team can reduce hidden manual delays, improve reliability through automated response, and build and scale intelligent workflows on top of tools you already use.

Get the guide