Major Incidents or Breaches

• Microsoft is investigating reports of Windows 11 devices failing to boot with “UNMOUNTABLE_BOOT_VOLUME” errors following the January 2026 Patch Tuesday security updates.

Newly Discovered Vulnerabilities

• A critical-severity vulnerability affecting VMware products, disclosed in 2024, is now being actively targeted by attackers. The flaw allows remote code execution via crafted network packets.

Notable Threat Actor Activity

• ISC has observed scanning activity targeting webservers using “/$(pwd)/” as a starting path. This activity began on 13 January 2026 and has been detected by multiple sensors, indicating ongoing reconnaissance or exploitation attempts.

Trends, Tools, or Tactics of Interest

Major Incidents or Breaches

• Nike is investigating a potential security incident following claims by the WorldLeaks cybercrime group that they have stolen data from the company’s systems. The group is threatening to leak the purported information.
• A multi-stage phishing campaign has been identified targeting Russian users with ransomware and the Amnesia RAT. The campaign uses social engineering lures and delivers multiple payloads to compromise victims.
• A significant cyberattack targeting Poland’s power grid in late December 2025 has been attributed to the Russian state-sponsored group Sandworm. The attack involved the deployment of a new destructive wiper malware, DynoWiper, but was reportedly unsuccessful in causing disruption.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• An unsecured database exposing 149 million usernames and passwords, including Gmail, Facebook, and banking credentials, was discovered by researchers. The data is suspected to have been collected via infostealing malware.
• Under Armour is investigating a data breach involving the compromise of customer email addresses and other personal information.
• Dozens of Venezuelan nationals were charged in the US for using malware in ATM jackpotting schemes, stealing hundreds of thousands of dollars from banks. Two individuals have been convicted and are set for deportation.
• Spammers are abusing Zendesk to flood inboxes with legitimate-looking emails from trusted brands, generating significant inbox noise without direct phishing or malware delivery.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Under Armour suffered a ransomware breach resulting in the alleged exposure of data belonging to 72 million customers. The stolen data is reported to be circulating on the dark web.
• Fortinet FortiGate devices are being actively targeted and compromised in automated attacks. Threat actors are creating rogue accounts and stealing firewall configuration data, with reports of malicious configuration changes even on fully patched devices.
• A major food service franchisee operator in Southeast Asia was targeted by the new Osiris ransomware family in November 2025, leveraging a Bring Your Own Vulnerable Driver (BYOVD) attack using the POORTRY driver.
• SmarterTools SmarterMail email servers are being actively exploited via an authentication bypass vulnerability. Attackers are hijacking admin accounts and resetting passwords, with exploitation observed within two days of patch release.
• Researchers were able to recover stolen data from 12 U.S. organizations impacted by INC ransomware due to an operational security failure by the threat actors.
• Okta SSO accounts are being targeted in active vishing-based data theft attacks, with attackers employing custom phishing kits tailored for voice-based social engineering.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Zendesk ticket systems were hijacked in a large-scale global spam campaign, with individuals worldwide receiving hundreds of unsolicited and sometimes alarming emails originating from unsecured Zendesk support systems.
• Security testing and training applications such as DVWA, OWASP Juice Shop, Hackazon, and bWAPP have been exploited by threat actors to breach cloud environments of major security vendors and Fortune 500 firms, due to misconfigurations and over-permissioned access.
• PcComponentes, a Spanish technology retailer, confirmed a credential stuffing attack but denied claims of a data breach affecting 16 million customers.
• LastPass users are being targeted by a phishing campaign using fake password vault backup alerts, leveraging convincing subject lines and messaging.
• Tesla’s Infotainment System was compromised, and 37 zero-day vulnerabilities were demonstrated at Pwn2Own Automotive 2026, with researchers earning $516,500 for successful exploits.

Newly Discovered Vulnerabilities

• Cisco patched a critical zero-day vulnerability (CVE-2026-20045) in Unified Communications Manager (CM) and Webex Calling Dedicated Instance, which was actively exploited for remote code execution.
• Fortinet FortiGate firewalls are being compromised via a patch bypass for a previously fixed authentication vulnerability (CVE-2025-59718), with reports of attacks on both patched and unpatched devices. Automated attacks are altering firewall configurations via FortiCloud SSO abuse.
• Zoom and GitLab released security updates addressing vulnerabilities that allowed remote code execution, denial-of-service, and a high-severity two-factor authentication (2FA) bypass in GitLab Community and Enterprise editions.
• Chainlit, a popular open-source AI framework, was found to have two high-severity vulnerabilities enabling arbitrary file read and server-side request forgery (SSRF), allowing attackers to steal sensitive data and breach cloud environments.
• Anthropic’s official MCP server contained vulnerabilities exploitable via prompt injections, leading to potential code execution and data exposure.
• Oracle’s January 2026 Critical Patch Update (CPU) delivered 337 new security patches, addressing approximately 230 unique vulnerabilities across over 30 products.
• Researchers demonstrated that malicious Google Calendar invites can leverage prompt injection to bypass privacy controls and cause AI assistants to leak private data.

Notable Threat Actor Activity

• North Korean threat actors, identified with the PurpleBravo campaign, targeted at least 3,136 IP addresses through fake job interviews, resulting in compromise of 20 organizations, including those in AI, blockchain, and fintech sectors. The campaign involves malicious Visual Studio Code projects and leverages trusted repository authorship to deliver backdoors.
• Phishing campaigns targeting LastPass customers are using sophisticated, AI-generated emails to increase credibility and effectiveness, particularly around holiday periods.
• New phishing techniques are exploiting human factors such as timing, context, and emotion, with campaigns becoming more industrialized and scalable.
• A new family of Android malware is using AI (TensorFlow models) to perform automated click fraud by detecting and interacting with hidden advertisement elements.

Trends, Tools, or Tactics of Interest

• AI-assisted social engineering is a growing concern, with 47% of organizations in a World Economic Forum survey citing adversarial AI advancements as their top worry regarding generative AI.
• The VoidLink Linux malware framework, comprising 88,000 lines of code, was largely developed with AI assistance, marking a significant evolution in the use of AI for malware creation.
• Attackers are leveraging prompt injection vulnerabilities in AI-powered systems (e.g., Anthropic MCP server, Google Calendar invites) to bypass controls and facilitate data exfiltration.
• Exposure Assessment Platforms (EAPs) are emerging as a new security focus, reflecting a shift towards continuous, automated exposure management in response to overwhelming security workloads.
• Use of legitimate Windows tools (LOLBins) continues as a tactic for deploying remote access trojans (RATs), with recent incidents involving an unusually large assortment of such tools in a single attack.
• Managed Security Service Providers (MSSPs) are increasingly adopting AI to manage alert volumes and deliver higher-level protection with reduced analyst headcount.
• Data exfiltration via outbound email remains a critical and often underprotected vulnerability vector.

Regulatory or Policy Developments Affecting the Security Industry

• MITRE launched the Embedded Systems Threat Matrix (ESTM), a new security framework designed to help organizations protect critical embedded systems.
• Increased attention is being paid to health privacy and surveillance, with reports highlighting the impact of data brokers and law enforcement (e.g., ICE) on patient trust and healthcare access.

Major Incidents or Breaches

• Chainalysis reported scammers stole an estimated $17 billion in cryptocurrency in 2025, with AI-assisted scams accounting for a significant portion.
• LastPass warned of an active phishing campaign impersonating the company, targeting users with fake maintenance messages to steal master passwords.
• Researchers uncovered a campaign using LinkedIn messages to distribute remote access trojans (RATs) via DLL sideloading.
• “CrashFix”/ClickFix scams use malicious browser extensions and social engineering to crash users’ browsers, leading to malware installation and RAT deployment.
• Mass spam attacks are leveraging Zendesk instances to send suspicious emails; Zendesk confirmed there is no breach or vulnerability in their platform.
• Google Gemini AI assistant was tricked via prompt injection attacks into leaking private Google Calendar data. Attackers weaponized calendar invites to exfiltrate event summaries.
• Evelyn Stealer malware is targeting developers by abusing Microsoft Visual Studio Code extensions to steal credentials and cryptocurrency.
• APT-grade PDFSider malware, used by ransomware groups, is being distributed via DLL sideloading and provides cyberespionage and remote code execution capabilities.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Ingram Micro disclosed that a ransomware attack in July 2025 resulted in a data breach affecting over 42,000 individuals, with compromised data including names, dates of birth, Social Security numbers, and employment-related information.
• A Fortune 100 company in the finance sector was targeted by ransomware attackers, who deployed a new malware strain named PDFSider to deliver malicious payloads on Windows systems.
• Spanish energy company Endesa reported a data breach, as noted in Check Point’s latest threat intelligence report.
• A Tennessee man pleaded guilty to hacking the U.S. Supreme Court’s electronic filing system and breaching accounts at AmeriCorps and the Department of Veterans Affairs, subsequently leaking stolen Supreme Court data on Instagram.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• The Canadian Investment Regulatory Organization (CIRO) confirmed that a data breach last year exposed the personal information of approximately 750,000 Canadian investors.

Newly Discovered Vulnerabilities

• Cybersecurity researchers identified a cross-site scripting (XSS) vulnerability in the web-based control panel of the StealC information stealer malware. This flaw allowed researchers to observe threat actor operations within the panel.

Trends, Tools, or Tactics of Interest

• Honeypot logs have recorded a significant volume of API requests targeting various large language models (LLMs), indicating ongoing automated probing or attempted misuse of AI-related APIs by threat actors.

Regulatory or Policy Developments Affecting the Security Industry

Major Incidents or Breaches

• U.S. hackers have reportedly caused a blackout in Venezuela, according to recent reports, indicating a significant cyber operation targeting critical infrastructure.
• Nicholas Moore, a Tennessee man, pleaded guilty to repeatedly hacking the U.S. Supreme Court’s filing system and illegally accessing systems belonging to AmeriCorps and the Department of Veterans Affairs.

Newly Discovered Vulnerabilities

• Wireshark 4.6.3 has been released, addressing 4 vulnerabilities and 9 bugs.

Notable Threat Actor Activity

Major Incidents or Breaches

• The Canadian Investment Regulatory Organization (CIRO) suffered a data breach impacting 750,000 individuals, exposing personal information of member firms and their registered employees.
• Five malicious Chrome browser extensions impersonating HR and ERP platforms such as Workday and NetSuite were discovered hijacking user accounts.
• Verizon experienced a nationwide wireless outage last week and is now issuing $20 credits to affected customers.
• Researchers hijacked StealC malware control panels via an XSS flaw, gaining intelligence on the info-stealing operation and active attacker sessions.

Newly Discovered Vulnerabilities