Cybersecurity Brief – 2026-01-21

Wed, 21 Jan 2026 00:00:00 +0000

Major Incidents or Breaches

Chainalysis reported scammers stole an estimated $17 billion in cryptocurrency in 2025, with AI-assisted scams accounting for a significant portion.
LastPass warned of an active phishing campaign impersonating the company, targeting users with fake maintenance messages to steal master passwords.
Researchers uncovered a campaign using LinkedIn messages to distribute remote access trojans (RATs) via DLL sideloading.
“CrashFix”/ClickFix scams use malicious browser extensions and social engineering to crash users’ browsers, leading to malware installation and RAT deployment.
Mass spam attacks are leveraging Zendesk instances to send suspicious emails; Zendesk confirmed there is no breach or vulnerability in their platform.
Google Gemini AI assistant was tricked via prompt injection attacks into leaking private Google Calendar data. Attackers weaponized calendar invites to exfiltrate event summaries.
Evelyn Stealer malware is targeting developers by abusing Microsoft Visual Studio Code extensions to steal credentials and cryptocurrency.
APT-grade PDFSider malware, used by ransomware groups, is being distributed via DLL sideloading and provides cyberespionage and remote code execution capabilities.

CERT/CC disclosed a vulnerability in the binary-parser npm library, allowing privilege-level code execution in Node.js via arbitrary JavaScript execution.
Three vulnerabilities were reported in Anthropic’s mcp-server-git (MCP Git Server), enabling file access, deletion, and remote code execution.
Cloudflare fixed a vulnerability in its ACME validation logic that allowed attackers to bypass WAF controls and access origin servers.
A critical vulnerability in the ACF Extended plugin for WordPress allows unauthenticated attackers to gain admin access on up to 50,000 sites.
Vulnerabilities in the Chainlit AI framework, including arbitrary file read and SSRF, could expose credentials and sensitive information without user interaction.

North Korea-linked threat actors (Contagious Interview campaign) are targeting developers using malicious Visual Studio Code projects to deliver backdoors.
AI-generated VoidLink malware framework, showing high functionality and efficiency, is believed to have been developed with significant AI assistance.
A phishing campaign is using LinkedIn messages to propagate RAT malware via DLL sideloading.
Ransomware groups are employing the PDFSider malware for cyberespionage and remote code execution.

AI-assisted scams are increasingly effective, stealing 4.5 times more cryptocurrency than traditional scams.
Deepfake technology is being used to impersonate religious leaders in financial scams.
Attackers are exploiting orphan accounts left behind by former employees, contractors, or systems.
Leaked secrets in JavaScript bundles and exposed API keys remain prevalent, leading to breaches.
Use of Punycode and International Domain Names (IDNs) continues to be leveraged in phishing and impersonation attacks.
The VoidLink malware demonstrates a trend toward sophisticated, AI-generated malware frameworks.
Identity-based attacks remain a primary vector for network breaches, with increased emphasis on identity threat detection strategies.

The European Commission proposed new cybersecurity legislation mandating the removal of high-risk (primarily foreign, including Chinese) suppliers from telecom networks, with 5G cybersecurity measures to become mandatory.
Google agreed to pay $8.25 million to settle allegations of illegally tracking children’s data via its AdMob platform without parental consent.
OpenAI is rolling out an age prediction model in ChatGPT to apply safety restrictions based on user age.