Daily Briefing for 02.19.26

Top stories.

• New phishing toolkit proxies live websites.
• Figure breach affects nearly a million user records.
• Germany’s rail operator hit by DDoS attacks.
• California man sentenced for involvement in darknet drug trafficking operation.

New phishing toolkit proxies live websites.

A new phishing framework called "Starkiller" (no relation to the legitimate red-teaming tool of the same name) represents a significant escalation in phishing infrastructure, according to researchers at Abnormal. The platform operates as a proxy that serves genuine login pages through attacker-controlled infrastructure.

The researchers note, "By proxying real websites live instead of serving static clones, it bypasses the primary detection mechanism most security tools rely on: page fingerprinting. Combined with URL masking, session hijacking, and MFA bypass, it gives low-skill cybercriminals access to attack capabilities that were previously out of reach."

Figure breach affects nearly a million user records.

Blockchain-based lending giant Figure has confirmed a data breach after an employee fell for a social engineering attack, SecurityWeek reports. A Figure spokesperson told TechCrunch that the hackers stole "a limited number of files," and that the company is notifying affected individuals.

The ShinyHunters claimed responsibility for the hack and published 2.5 gigabytes of data on its leak site, saying Figure refused to pay a ransom. According to Have I Been Pwned, the allegedly stolen data includes around 967,000 user records, including full names, home addresses, dates of birth, and phone numbers.

Germany’s rail operator hit by DDoS attacks.

Germany’s national rail operator, Deutsche Bahn, was hit by a series of major DDoS attacks beginning on Tuesday and continuing through yesterday morning, Deutsche Welle reports. The attacks distrupted booking and ticketing services on Deutsche Bahn's website and in its Navigator app. The company stated yesterday, "DB has been and continues to be subjected to attacks on its IT systems. The current attack is specifically targeted at DB and has occurred in waves. The scale of the attack is considerable."

The motivation of the attack is unclear, and the rail operator added, "We will not comment on speculation about the background of the attack. Our top priority remains the protection of customer data and the availability of our information and booking systems." The company is in contact with Germany's cybersecurity authorities.

California man sentenced for involvement in darknet drug trafficking operation.

A Los Angeles court has sentenced a Glendale man to nearly five years in prison for his role in a darkweb drug trafficking operation, BleepingComputer reports. 36-year-old Davit Avalyan pleaded guilty to conspiracy to distribute and to possess with intent to distribute various illegal drugs. Three of Avalyan's accomplices have already received sentences ranging from ten to two years.

The Justice Department stated, "The conspiracy maintained darknet drug vendor accounts, including JoyInc, LaFarmacia, WhiteDoc, JanesAddiction, DaShop, WhiteRepublic, Tomorowland, PlanetHollywood, DopeValley, and Major2Minor. These accounts operated on several darknet marketplaces and sold methamphetamine, cocaine, MDMA, and ketamine to customers across the United States in exchange for cryptocurrency. The conspiracy regularly fulfilled multiple small-scale drug orders through darknet vendor accounts by packaging narcotics into parcels and depositing those parcels at post offices and postal mailboxes in Los Angeles County and elsewhere. JoyInc is believed to have been operating since at least 2018 and is one of the most prolific methamphetamine and cocaine distributors to ever operate on the darknet."