eScan on DanSec Daily

Cybersecurity Brief – 2026-02-02

Mon, 02 Feb 2026 00:00:00 +0000

Major Incidents or Breaches

eScan Antivirus update servers were compromised by unknown attackers, resulting in the delivery of multi-stage malware through the official update channel. The attack leveraged the trusted update infrastructure of MicroWorld Technologies, impacting users who downloaded updates during the compromise period.
The Open VSX Registry, a popular extension registry for Visual Studio Code, was targeted in a supply chain attack. Threat actors compromised a legitimate developer’s account to distribute malicious extensions containing the GlassWorm malware to end users.
Exposed MongoDB instances continue to be targeted in automated data extortion attacks. Threat actors are accessing unsecured databases, exfiltrating data, and demanding low-value ransoms from database owners to restore access.

Cybersecurity Brief – 2026-02-01

Sun, 01 Feb 2026 00:00:00 +0000

Major Incidents or Breaches

Hackers compromised a MicroWorld Technologies update server, delivering a malicious file to eScan Antivirus customers via a supply chain attack.
A researcher disclosed that private Instagram profiles were leaking photo links to unauthenticated visitors. The issue was subsequently fixed, but Meta closed the report as not applicable.

Newly Discovered Vulnerabilities

Evidence indicated a flaw in Instagram’s handling of private profile photos, allowing unauthorized access to photo links. This has since been remediated.

Notable Threat Actor Activity

A Farsi-speaking threat actor aligned with Iranian state interests (RedKitten) is conducting a cyber campaign targeting NGOs and individuals involved in documenting human rights violations.
Mandiant reported an expansion in threat activity by ShinyHunters, a financially motivated group. The group is using voice phishing (vishing) and company-branded phishing sites to steal single sign-on (SSO) credentials and multi-factor authentication (MFA) tokens, enabling breaches of SaaS platforms.
A large-scale cloud storage subscription scam campaign is targeting users globally with fake renewal emails, aiming to steal payment information.
U.S. authorities convicted a former Google engineer for stealing AI supercomputer data and transferring it to Chinese tech firms.

Trends, Tools, or Tactics of Interest

ShinyHunters’ recent campaigns leverage targeted vishing attacks and phishing sites mimicking company branding to capture SSO credentials and MFA tokens, facilitating cloud data theft.
The eScan antivirus incident highlights ongoing risks from supply chain attacks targeting software update mechanisms.
The cloud storage payment scam demonstrates continued use of mass phishing campaigns exploiting user fears of data loss.

Regulatory or Policy Developments Affecting the Security Industry

A U.S. federal jury conviction of a former Google engineer for transferring proprietary AI data to China underscores heightened legal and regulatory scrutiny over intellectual property and technology transfer, particularly involving AI and cloud technologies.

Cybersecurity Brief – 2026-01-30

Fri, 30 Jan 2026 00:00:00 +0000

Major Incidents or Breaches

Match Group, the parent company of Tinder, OkCupid, Hinge, and Match.com, confirmed a cybersecurity incident resulting in the compromise of user data across multiple platforms.
Marquis Software Solutions reported that a ransomware attack in August 2025 affecting dozens of U.S. banks and credit unions was due to a breach of SonicWall cloud backups.
An AI chat toy company, Bondu, exposed over 50,000 logs of conversations between children and its AI-enabled toys due to an unsecured web console.
The French national unemployment agency was fined €5 million for a breach that resulted in the theft of job seekers’ personal information.
eScan antivirus suffered a supply chain attack, with malicious updates detected and distributed through its update mechanism.
Google, in collaboration with industry partners, disrupted the IPIDEA residential proxy network, which had been leveraged by threat actors via malware-infected devices.

Newly Discovered Vulnerabilities

Ivanti released security updates for two zero-day remote code execution (RCE) vulnerabilities in Ivanti Endpoint Manager Mobile (EPMM), CVE-2026-1281 and CVE-2026-1340, both of which have been actively exploited.
SolarWinds patched four critical vulnerabilities in its Web Help Desk product, including unauthenticated RCE and authentication bypass flaws.
Multiple critical vulnerabilities were identified in the n8n automation platform, allowing unauthenticated remote code execution and server hijacking via sandbox and AST sanitization flaws.
Microsoft issued an emergency patch for a Microsoft Office zero-day that allowed malicious documents to bypass security checks.
Researchers found 175,000 publicly exposed Ollama AI servers across 130 countries, creating a significant attack surface for exploitation.
Android theft protection features were updated by Google to strengthen device authentication and recovery.

Notable Threat Actor Activity

A new Android malware campaign abused the Hugging Face platform to distribute thousands of APK payload variants targeting financial and payment credentials.
Chinese APT groups deployed advanced malware against organisations in Asia, indicating ongoing high-end cyber-espionage operations.
The Aisuru (Kimwolf) botnet executed a record-setting DDoS attack in December 2025, peaking at 31.4 Tbps and 200 million requests per second.
Flare researchers highlighted how infostealer malware is being distributed via malicious Roblox game mods, enabling lateral movement from home PCs to corporate environments.
An operation dubbed “Bizarre Bazaar” targeted exposed large language models (LLMs) and managed control panels (MCPs) for commercial monetization.
The Clawdbot malware rebranded as Moltbot, sparking impersonation and supply chain risk campaigns.

Trends, Tools, or Tactics of Interest

SentinelOne and Censys reported a widespread issue of unmanaged, publicly accessible AI deployments, specifically Ollama servers, posing risks to data privacy and security.
The use of “semantic chaining” in prompt engineering was shown to bypass content controls in LLMs such as Gemini Nano Banana and Grok 4 by splitting malicious prompts into discrete segments.
The IPIDEA proxy network relied on SDKs embedded in mobile and desktop applications to enroll compromised devices into its proxy service.
The Global Cybersecurity Outlook 2026 and industry commentary emphasize the need for improved vulnerability management, preparation for quantum threats, and responsible AI deployment.
A survey of over 100 energy sector OT systems revealed pervasive cybersecurity gaps in substations, power plants, and control centers.
Microsoft Teams will introduce a feature to report suspicious calls as potential scams or phishing attempts by mid-March 2026.

Regulatory or Policy Developments

The Trump administration rescinded Biden-era guidance requiring U.S. federal agencies to solicit software bills of materials (SBOMs) and compliance attestations with NIST’s Secure Software Development Framework (SSDF) from vendors.
The French data protection authority imposed a €5 million fine on the national unemployment agency for inadequate security measures leading to a data breach.

Cybersecurity Brief – 2026-01-29

Thu, 29 Jan 2026 00:00:00 +0000

Major Incidents or Breaches

The Polish energy grid suffered a coordinated cyberattack in December 2025, impacting around 30 distributed energy resource sites, including combined heat and power facilities and wind farms. The incident has been attributed to the Russian state-sponsored group ELECTRUM.
eScan antivirus vendor MicroWorld Technologies confirmed its update server was breached and used to distribute a malicious update.
The FBI seized the RAMP cybercrime forum, a major platform for ransomware gangs and malware advertisements.
Google, in collaboration with partners, disrupted IPIDEA, one of the world’s largest residential proxy networks.
A malicious campaign, dubbed “Bizarre Bazaar,” is actively targeting exposed Large Language Model (LLM) service endpoints to commercialise unauthorised access to AI infrastructure.
Researchers found 16 malicious Chrome extensions capable of hijacking ChatGPT sessions and exfiltrating user data.
Two malicious Python packages masquerading as spellcheckers were discovered on PyPI, delivering remote access trojans.

Newly Discovered Vulnerabilities

Two high-severity vulnerabilities were disclosed in the n8n workflow automation platform, allowing authenticated remote code execution and potential compromise of affected instances.
A critical sandbox escape vulnerability was identified in the vm2 Node.js library, enabling arbitrary code execution on the host system.
SolarWinds released patches for critical vulnerabilities in its Web Help Desk software, addressing authentication bypass and remote command execution issues.
Fortinet patched a zero-day (CVE-2026-24858) in FortiCloud SSO authentication, which allowed attackers to log into devices registered to other accounts; the company temporarily disabled SSO authentication to mitigate ongoing attacks.
Oracle WebLogic vulnerability CVE-2026-21962 has been recently patched, with evidence of exploit attempts being observed.

Notable Threat Actor Activity

Russian state-sponsored group ELECTRUM was attributed with medium confidence to the December 2025 cyberattack on Poland’s power grid.
Chinese-linked Mustang Panda deployed an updated COOLCLIENT backdoor in cyber espionage attacks against government entities, facilitating extensive data theft.
China-backed threat actor “PeckBirdy” used the JScript C2 framework in cross-platform campaigns targeting Chinese gambling websites and Asian government entities with new backdoors.
Multiple threat actors, including Russian and Chinese state-sponsored groups, are actively exploiting the WinRAR vulnerability CVE-2025-8088 for initial access and data theft, despite the availability of a patch since July 2025.
Initial access broker TA584 is now leveraging the Tsundere Bot and XWorm RAT to gain network access, leading to ransomware attacks.
Fake dating apps are being used as lures in Android spyware campaigns in Pakistan, linked to broader espionage operations.

Trends, Tools, or Tactics of Interest

A surge in attacks targeting Latin America, including data-leak extortion, credential theft, edge-device exploitation, and attacker adoption of AI-driven tactics, has made it the riskiest region for cyberattacks.
Threat actors are increasingly exploiting exposed AI/LLM endpoints and insecure deployments, leading to unauthorised access and data leakage in enterprise environments.
Malicious VS Code extensions (e.g., fake Moltbot) are being distributed via the official marketplace, dropping malware and exposing sensitive data such as API keys and OAuth tokens.
Password reuse and risky credential workarounds remain prevalent attack vectors, often overlooked by security teams.
AI-driven security operations (AI SOC agents) are accelerating triage and threat hunting, but concerns remain about over-reliance on automation.
Malicious browser extensions continue to target high-profile services like ChatGPT to exfiltrate user data.

Regulatory or Policy Developments Affecting the Security Industry

WhatsApp has rolled out new lockdown-style security features, including Strict Account Settings, to protect high-risk users (journalists, public figures) from advanced exploits and spyware. These features block risky attachments, media, and calls from unknown sources.
AI is increasingly being used for compliance controls and regulated actions, prompting CISOs to reconsider identity, access, and auditability frameworks.
ICE in the US is using Palantir’s AI tools to process and summarise tips, highlighting increased adoption of AI in law enforcement and government operations.