Cybersecurity Brief – 2026-01-09

Fri, 09 Jan 2026 00:00:00 +0000

Major Incidents or Breaches

WhatsApp accounts are being targeted by a phishing campaign attempting to trick users into linking malicious devices, potentially resulting in account compromise.
A WhatsApp worm is distributing the Astaroth banking trojan in Brazil via auto-messaging to contacts, facilitating rapid malware propagation and credential theft.
Fake AI-powered Chrome extensions, mimicking legitimate tools, have stolen data from approximately 900,000 users, harvesting ChatGPT and DeepSeek credentials.
The Kimwolf botnet has rapidly infected over two million devices, primarily by compromising unofficial Android TV streaming boxes.
Microsoft Exchange Online experienced an outage affecting mailbox access via IMAP4.
Researchers demonstrated remote hacking risks in WHILL wheelchairs due to unauthenticated Bluetooth access, enabling unauthorized device movement.

Newly Discovered Vulnerabilities

HPE OneView: A maximum-severity, unauthenticated remote code execution vulnerability (CVE-2025-37164) is being actively exploited in the wild.
n8n: A critical vulnerability (CVE-2026-21858, CVSS 10) allows unauthenticated remote code execution, exposing self-hosted automation instances to takeover.
jsPDF: A critical vulnerability has been patched that allowed attackers to read arbitrary files from the system, risking credential and configuration exposure.
Coolify: Eleven critical security flaws have been disclosed in this open-source self-hosting platform, including authentication bypass and remote code execution.
Cisco Identity Services Engine (ISE): A medium-severity flaw with public proof-of-concept exploit code has been patched; exploitation requires administrative access.
VMware ESXi: Zero-day vulnerabilities were reportedly exploited by Chinese-speaking threat actors up to a year before public disclosure, with initial access via a compromised SonicWall VPN.
Cisco Switches: Multiple models are experiencing reboot loops due to a DNS client bug, causing operational disruptions.

Notable Threat Actor Activity

North Korean state-sponsored group Kimsuky is leveraging malicious QR codes in spear-phishing campaigns targeting US organizations.
China-linked UAT-7290 has been attributed to espionage intrusions targeting telecommunications providers in South Asia and Southeastern Europe, using Linux malware and edge device exploits.
Threat actors distributed the NodeCordRAT malware via three malicious npm Bitcoin-themed packages, targeting developers and users in the cryptocurrency space.
Fake WinRAR installers are distributing Winzipper malware, using a legitimate installer to mask malicious activity.

Trends, Tools, or Tactics of Interest

Increased use of QR codes in phishing, as seen in North Korean campaigns, indicating evolving social engineering tactics.
Credential stuffing remains a prevalent threat, driven by widespread password reuse.
Attackers are leveraging open-source supply chains, as evidenced by malicious npm packages and vulnerabilities in platforms like Coolify and n8n.
Rapid propagation of malware via messaging platforms (e.g., WhatsApp worm spreading Astaroth).
AI and automation are driving new attack trends, including prompt injection exploits targeting ChatGPT’s memory feature (“ZombieAgent” exploit).
Cloud and SaaS security remain under pressure, with attackers exploiting misconfigurations and vulnerabilities in widely used platforms.

Regulatory or Policy Developments Affecting the Security Industry

The UK government has unveiled a new cyber action plan focused solely on governmental operations, with no guidance for the private sector or critical national infrastructure.
The US Cybersecurity and Infrastructure Security Agency (CISA) retired 10 emergency directives, citing completion or incorporation of required actions into standard practice.
Microsoft will enforce multi-factor authentication (MFA) for all users accessing the Microsoft 365 admin center starting next month.

Cybersecurity Brief – 2025-12-19

Fri, 19 Dec 2025 00:00:00 +0000

Major Incidents or Breaches

The University of Sydney suffered a data breach after attackers accessed an online coding repository, resulting in the theft of files containing personal information of staff and students.
The Richmond Behavioral Health Authority (Virginia, US) experienced a ransomware attack, with threat actors stealing names, Social Security numbers, and financial and health information of 113,000 individuals.
French authorities arrested two crew members from an Italian passenger ferry for allegedly installing malware enabling remote control of the vessel. France’s counterespionage agency is investigating the incident as suspected foreign interference.
The US Department of Justice seized the E-Note cryptocurrency exchange, which was allegedly used to launder over $70 million in ransomware payments.

Newly Discovered Vulnerabilities

Hewlett Packard Enterprise (HPE) patched a critical vulnerability (CVE-2025-37164, CVSS 10.0) in OneView software allowing unauthenticated remote code execution.
SonicWall SMA1000 devices were found to be vulnerable to a zero-day flaw that has been exploited in the wild. Attackers chained this with a previously disclosed critical vulnerability to achieve remote code execution. SonicWall has released a patch.
A UEFI vulnerability affecting ASRock, Asus, Gigabyte, and MSI motherboards allows early-boot DMA attacks, exposing systems to compromise before the operating system loads.
CISA issued a warning regarding CVE-2025-59374, a supply chain backdoor in Asus Live Update, which has been exploited in the wild.
Microsoft confirmed that recent Windows updates have caused issues with Azure Virtual Desktop RemoteApp sessions and broke Message Queuing (MSMQ) functionality in Windows 11 and 10.
Automated password spraying attacks are targeting Cisco SSL VPN and Palo Alto Networks GlobalProtect VPN gateways.
A Chrome extension marketed for privacy was found to collect and exfiltrate users’ AI chat data after installation.

Notable Threat Actor Activity

The China-aligned APT group LongNosedGoblin was identified targeting governmental entities in Southeast Asia and Japan, using Windows Group Policy to deploy espionage malware across networks.
North Korea-linked threat actors, including Kimsuky, were responsible for at least $2.02 billion in global cryptocurrency theft in 2025. Kimsuky has also been observed distributing a new Android malware variant, DocSwap, via QR phishing campaigns impersonating Seoul-based delivery apps.
The Clop ransomware group is targeting Gladinet CentreStack file servers exposed to the internet, conducting data theft and extortion operations.
The Iranian APT group “Prince of Persia,” previously considered dormant, has been confirmed active, employing advanced operational security and cryptographic C2 communications to spy on dissidents.
WhatsApp account hijacking attacks using “GhostPairing” are ongoing, where attackers trick users into linking their accounts to attacker-controlled browsers via fake login prompts.
WeChat phishing attacks are increasing outside China, leveraging the platform’s wide functionality for social engineering.

Trends, Tools, or Tactics of Interest

AI-powered deepfake technologies are increasingly accessible, enabling realistic impersonation in video and audio, which is being leveraged for fraud and social engineering.
Ultra-realistic AI face-swapping platforms, such as “Haotian”, are being used to facilitate romance scams, with live video face swaps making detection difficult.
Attackers are refining credential-based attacks, evidenced by new password spraying campaigns against major VPN gateways.
There is a trend of exploiting supply chain vulnerabilities, as seen with the Asus Live Update backdoor.
The adoption of AI copilots and agents in SaaS applications is rising, increasing the attack surface and driving demand for dynamic AI-SaaS security measures.

Regulatory or Policy Developments Affecting the Security Industry

NIS2 compliance is placing increased emphasis on strong identity and access controls, with weak passwords and inadequate multi-factor authentication now considered compliance risks.
The US Immigration and Customs Enforcement (ICE) agency is seeking to expand its cybersecurity capabilities for enhanced internal monitoring and investigation of employees, reflecting a broader trend of increased internal surveillance in government agencies.

CVE-2025-37164 on DanSec Daily

Cybersecurity Brief – 2026-01-09

Major Incidents or Breaches

Newly Discovered Vulnerabilities

Notable Threat Actor Activity

Trends, Tools, or Tactics of Interest

Regulatory or Policy Developments Affecting the Security Industry

Cybersecurity Brief – 2025-12-19

Major Incidents or Breaches

Newly Discovered Vulnerabilities

Notable Threat Actor Activity

Trends, Tools, or Tactics of Interest

Regulatory or Policy Developments Affecting the Security Industry