Cybersecurity Brief – 2026-01-22

Thu, 22 Jan 2026 00:00:00 +0000

Major Incidents or Breaches

Zendesk ticket systems were hijacked in a large-scale global spam campaign, with individuals worldwide receiving hundreds of unsolicited and sometimes alarming emails originating from unsecured Zendesk support systems.
Security testing and training applications such as DVWA, OWASP Juice Shop, Hackazon, and bWAPP have been exploited by threat actors to breach cloud environments of major security vendors and Fortune 500 firms, due to misconfigurations and over-permissioned access.
PcComponentes, a Spanish technology retailer, confirmed a credential stuffing attack but denied claims of a data breach affecting 16 million customers.
LastPass users are being targeted by a phishing campaign using fake password vault backup alerts, leveraging convincing subject lines and messaging.
Tesla’s Infotainment System was compromised, and 37 zero-day vulnerabilities were demonstrated at Pwn2Own Automotive 2026, with researchers earning $516,500 for successful exploits.

Newly Discovered Vulnerabilities

Cisco patched a critical zero-day vulnerability (CVE-2026-20045) in Unified Communications Manager (CM) and Webex Calling Dedicated Instance, which was actively exploited for remote code execution.
Fortinet FortiGate firewalls are being compromised via a patch bypass for a previously fixed authentication vulnerability (CVE-2025-59718), with reports of attacks on both patched and unpatched devices. Automated attacks are altering firewall configurations via FortiCloud SSO abuse.
Zoom and GitLab released security updates addressing vulnerabilities that allowed remote code execution, denial-of-service, and a high-severity two-factor authentication (2FA) bypass in GitLab Community and Enterprise editions.
Chainlit, a popular open-source AI framework, was found to have two high-severity vulnerabilities enabling arbitrary file read and server-side request forgery (SSRF), allowing attackers to steal sensitive data and breach cloud environments.
Anthropic’s official MCP server contained vulnerabilities exploitable via prompt injections, leading to potential code execution and data exposure.
Oracle’s January 2026 Critical Patch Update (CPU) delivered 337 new security patches, addressing approximately 230 unique vulnerabilities across over 30 products.
Researchers demonstrated that malicious Google Calendar invites can leverage prompt injection to bypass privacy controls and cause AI assistants to leak private data.

Notable Threat Actor Activity

North Korean threat actors, identified with the PurpleBravo campaign, targeted at least 3,136 IP addresses through fake job interviews, resulting in compromise of 20 organizations, including those in AI, blockchain, and fintech sectors. The campaign involves malicious Visual Studio Code projects and leverages trusted repository authorship to deliver backdoors.
Phishing campaigns targeting LastPass customers are using sophisticated, AI-generated emails to increase credibility and effectiveness, particularly around holiday periods.
New phishing techniques are exploiting human factors such as timing, context, and emotion, with campaigns becoming more industrialized and scalable.
A new family of Android malware is using AI (TensorFlow models) to perform automated click fraud by detecting and interacting with hidden advertisement elements.

Trends, Tools, or Tactics of Interest

AI-assisted social engineering is a growing concern, with 47% of organizations in a World Economic Forum survey citing adversarial AI advancements as their top worry regarding generative AI.
The VoidLink Linux malware framework, comprising 88,000 lines of code, was largely developed with AI assistance, marking a significant evolution in the use of AI for malware creation.
Attackers are leveraging prompt injection vulnerabilities in AI-powered systems (e.g., Anthropic MCP server, Google Calendar invites) to bypass controls and facilitate data exfiltration.
Exposure Assessment Platforms (EAPs) are emerging as a new security focus, reflecting a shift towards continuous, automated exposure management in response to overwhelming security workloads.
Use of legitimate Windows tools (LOLBins) continues as a tactic for deploying remote access trojans (RATs), with recent incidents involving an unusually large assortment of such tools in a single attack.
Managed Security Service Providers (MSSPs) are increasingly adopting AI to manage alert volumes and deliver higher-level protection with reduced analyst headcount.
Data exfiltration via outbound email remains a critical and often underprotected vulnerability vector.

Regulatory or Policy Developments Affecting the Security Industry

MITRE launched the Embedded Systems Threat Matrix (ESTM), a new security framework designed to help organizations protect critical embedded systems.
Increased attention is being paid to health privacy and surveillance, with reports highlighting the impact of data brokers and law enforcement (e.g., ICE) on patient trust and healthcare access.

Cybersecurity Brief – 2026-01-21

Wed, 21 Jan 2026 00:00:00 +0000

Major Incidents or Breaches

Chainalysis reported scammers stole an estimated $17 billion in cryptocurrency in 2025, with AI-assisted scams accounting for a significant portion.
LastPass warned of an active phishing campaign impersonating the company, targeting users with fake maintenance messages to steal master passwords.
Researchers uncovered a campaign using LinkedIn messages to distribute remote access trojans (RATs) via DLL sideloading.
“CrashFix”/ClickFix scams use malicious browser extensions and social engineering to crash users’ browsers, leading to malware installation and RAT deployment.
Mass spam attacks are leveraging Zendesk instances to send suspicious emails; Zendesk confirmed there is no breach or vulnerability in their platform.
Google Gemini AI assistant was tricked via prompt injection attacks into leaking private Google Calendar data. Attackers weaponized calendar invites to exfiltrate event summaries.
Evelyn Stealer malware is targeting developers by abusing Microsoft Visual Studio Code extensions to steal credentials and cryptocurrency.
APT-grade PDFSider malware, used by ransomware groups, is being distributed via DLL sideloading and provides cyberespionage and remote code execution capabilities.

Newly Discovered Vulnerabilities

CERT/CC disclosed a vulnerability in the binary-parser npm library, allowing privilege-level code execution in Node.js via arbitrary JavaScript execution.
Three vulnerabilities were reported in Anthropic’s mcp-server-git (MCP Git Server), enabling file access, deletion, and remote code execution.
Cloudflare fixed a vulnerability in its ACME validation logic that allowed attackers to bypass WAF controls and access origin servers.
A critical vulnerability in the ACF Extended plugin for WordPress allows unauthenticated attackers to gain admin access on up to 50,000 sites.
Vulnerabilities in the Chainlit AI framework, including arbitrary file read and SSRF, could expose credentials and sensitive information without user interaction.

Notable Threat Actor Activity

North Korea-linked threat actors (Contagious Interview campaign) are targeting developers using malicious Visual Studio Code projects to deliver backdoors.
AI-generated VoidLink malware framework, showing high functionality and efficiency, is believed to have been developed with significant AI assistance.
A phishing campaign is using LinkedIn messages to propagate RAT malware via DLL sideloading.
Ransomware groups are employing the PDFSider malware for cyberespionage and remote code execution.

Trends, Tools, or Tactics of Interest

AI-assisted scams are increasingly effective, stealing 4.5 times more cryptocurrency than traditional scams.
Deepfake technology is being used to impersonate religious leaders in financial scams.
Attackers are exploiting orphan accounts left behind by former employees, contractors, or systems.
Leaked secrets in JavaScript bundles and exposed API keys remain prevalent, leading to breaches.
Use of Punycode and International Domain Names (IDNs) continues to be leveraged in phishing and impersonation attacks.
The VoidLink malware demonstrates a trend toward sophisticated, AI-generated malware frameworks.
Identity-based attacks remain a primary vector for network breaches, with increased emphasis on identity threat detection strategies.

Regulatory or Policy Developments Affecting the Security Industry

The European Commission proposed new cybersecurity legislation mandating the removal of high-risk (primarily foreign, including Chinese) suppliers from telecom networks, with 5G cybersecurity measures to become mandatory.
Google agreed to pay $8.25 million to settle allegations of illegally tracking children’s data via its AdMob platform without parental consent.
OpenAI is rolling out an age prediction model in ChatGPT to apply safety restrictions based on user age.

Chainlit on DanSec Daily

Cybersecurity Brief – 2026-01-22

Major Incidents or Breaches

Newly Discovered Vulnerabilities

Notable Threat Actor Activity

Trends, Tools, or Tactics of Interest

Regulatory or Policy Developments Affecting the Security Industry

Cybersecurity Brief – 2026-01-21

Major Incidents or Breaches

Newly Discovered Vulnerabilities

Notable Threat Actor Activity

Trends, Tools, or Tactics of Interest

Regulatory or Policy Developments Affecting the Security Industry