https://blog.dansec.red/actors/redkitten/Recent content in RedKitten on DanSec DailyHugoen-gbSun, 01 Feb 2026 00:00:00 +0000https://blog.dansec.red/posts/2026-02-01-cybersecurity-news/Sun, 01 Feb 2026 00:00:00 +0000https://blog.dansec.red/posts/2026-02-01-cybersecurity-news/<h2 id="major-incidents-or-breaches">Major Incidents or Breaches</h2> <ul> <li>Hackers compromised a MicroWorld Technologies update server, delivering a malicious file to eScan Antivirus customers via a supply chain attack.</li> <li>A researcher disclosed that private Instagram profiles were leaking photo links to unauthenticated visitors. The issue was subsequently fixed, but Meta closed the report as not applicable.</li> </ul> <h2 id="newly-discovered-vulnerabilities">Newly Discovered Vulnerabilities</h2> <ul> <li>Evidence indicated a flaw in Instagram&rsquo;s handling of private profile photos, allowing unauthorized access to photo links. This has since been remediated.</li> </ul> <h2 id="notable-threat-actor-activity">Notable Threat Actor Activity</h2> <ul> <li>A Farsi-speaking threat actor aligned with Iranian state interests (RedKitten) is conducting a cyber campaign targeting NGOs and individuals involved in documenting human rights violations.</li> <li>Mandiant reported an expansion in threat activity by ShinyHunters, a financially motivated group. The group is using voice phishing (vishing) and company-branded phishing sites to steal single sign-on (SSO) credentials and multi-factor authentication (MFA) tokens, enabling breaches of SaaS platforms.</li> <li>A large-scale cloud storage subscription scam campaign is targeting users globally with fake renewal emails, aiming to steal payment information.</li> <li>U.S. authorities convicted a former Google engineer for stealing AI supercomputer data and transferring it to Chinese tech firms.</li> </ul> <h2 id="trends-tools-or-tactics-of-interest">Trends, Tools, or Tactics of Interest</h2> <ul> <li>ShinyHunters’ recent campaigns leverage targeted vishing attacks and phishing sites mimicking company branding to capture SSO credentials and MFA tokens, facilitating cloud data theft.</li> <li>The eScan antivirus incident highlights ongoing risks from supply chain attacks targeting software update mechanisms.</li> <li>The cloud storage payment scam demonstrates continued use of mass phishing campaigns exploiting user fears of data loss.</li> </ul> <h2 id="regulatory-or-policy-developments-affecting-the-security-industry">Regulatory or Policy Developments Affecting the Security Industry</h2> <ul> <li>A U.S. federal jury conviction of a former Google engineer for transferring proprietary AI data to China underscores heightened legal and regulatory scrutiny over intellectual property and technology transfer, particularly involving AI and cloud technologies.</li> </ul>