Cybersecurity Brief – 2026-01-09

Fri, 09 Jan 2026 00:00:00 +0000

Major Incidents or Breaches

WhatsApp accounts are being targeted by a phishing campaign attempting to trick users into linking malicious devices, potentially resulting in account compromise.
A WhatsApp worm is distributing the Astaroth banking trojan in Brazil via auto-messaging to contacts, facilitating rapid malware propagation and credential theft.
Fake AI-powered Chrome extensions, mimicking legitimate tools, have stolen data from approximately 900,000 users, harvesting ChatGPT and DeepSeek credentials.
The Kimwolf botnet has rapidly infected over two million devices, primarily by compromising unofficial Android TV streaming boxes.
Microsoft Exchange Online experienced an outage affecting mailbox access via IMAP4.
Researchers demonstrated remote hacking risks in WHILL wheelchairs due to unauthenticated Bluetooth access, enabling unauthorized device movement.

Newly Discovered Vulnerabilities

HPE OneView: A maximum-severity, unauthenticated remote code execution vulnerability (CVE-2025-37164) is being actively exploited in the wild.
n8n: A critical vulnerability (CVE-2026-21858, CVSS 10) allows unauthenticated remote code execution, exposing self-hosted automation instances to takeover.
jsPDF: A critical vulnerability has been patched that allowed attackers to read arbitrary files from the system, risking credential and configuration exposure.
Coolify: Eleven critical security flaws have been disclosed in this open-source self-hosting platform, including authentication bypass and remote code execution.
Cisco Identity Services Engine (ISE): A medium-severity flaw with public proof-of-concept exploit code has been patched; exploitation requires administrative access.
VMware ESXi: Zero-day vulnerabilities were reportedly exploited by Chinese-speaking threat actors up to a year before public disclosure, with initial access via a compromised SonicWall VPN.
Cisco Switches: Multiple models are experiencing reboot loops due to a DNS client bug, causing operational disruptions.

Notable Threat Actor Activity

North Korean state-sponsored group Kimsuky is leveraging malicious QR codes in spear-phishing campaigns targeting US organizations.
China-linked UAT-7290 has been attributed to espionage intrusions targeting telecommunications providers in South Asia and Southeastern Europe, using Linux malware and edge device exploits.
Threat actors distributed the NodeCordRAT malware via three malicious npm Bitcoin-themed packages, targeting developers and users in the cryptocurrency space.
Fake WinRAR installers are distributing Winzipper malware, using a legitimate installer to mask malicious activity.

Trends, Tools, or Tactics of Interest

Increased use of QR codes in phishing, as seen in North Korean campaigns, indicating evolving social engineering tactics.
Credential stuffing remains a prevalent threat, driven by widespread password reuse.
Attackers are leveraging open-source supply chains, as evidenced by malicious npm packages and vulnerabilities in platforms like Coolify and n8n.
Rapid propagation of malware via messaging platforms (e.g., WhatsApp worm spreading Astaroth).
AI and automation are driving new attack trends, including prompt injection exploits targeting ChatGPT’s memory feature (“ZombieAgent” exploit).
Cloud and SaaS security remain under pressure, with attackers exploiting misconfigurations and vulnerabilities in widely used platforms.

Regulatory or Policy Developments Affecting the Security Industry

The UK government has unveiled a new cyber action plan focused solely on governmental operations, with no guidance for the private sector or critical national infrastructure.
The US Cybersecurity and Infrastructure Security Agency (CISA) retired 10 emergency directives, citing completion or incorporation of required actions into standard practice.
Microsoft will enforce multi-factor authentication (MFA) for all users accessing the Microsoft 365 admin center starting next month.

Cybersecurity Brief – 2026-01-08

Thu, 08 Jan 2026 00:00:00 +0000

Major Incidents or Breaches

The Crimson Collective extortion group claims to have stolen data on over one million Brightspeed broadband customers. Brightspeed is investigating the alleged breach.
Chrome extensions impersonating AITOPIA, with a combined 900,000 downloads, were found exfiltrating users’ AI chat data and browser activity.
Logitech Options+ and G Hub apps for macOS became non-functional after their code-signing certificate expired, preventing users from launching the applications.
Multiple enterprises’ file-sharing instances were breached by the “Zestix” threat actor using infostealers to obtain credentials; lack of multi-factor authentication (MFA) was identified as a common vulnerability.
ownCloud issued a warning to users to enable MFA following reports of credential theft and unauthorised data access.

Newly Discovered Vulnerabilities

A critical unauthenticated remote code execution (RCE) vulnerability (CVSS 10.0, dubbed “Ni8mare”) was disclosed in n8n, a popular workflow automation platform, affecting both self-hosted and cloud deployments.
Veeam released patches for several vulnerabilities in its Backup & Replication software, including a critical RCE flaw (CVSS 9.0) that could allow attackers to compromise backup servers.
jsPDF, a widely used JavaScript PDF generation library, is affected by a critical vulnerability allowing attackers to steal sensitive local files via maliciously crafted PDFs.
A vulnerability in Totolink range extenders enables unauthenticated attackers to start a root-level Telnet service and take over affected devices.
A zero-day vulnerability in discontinued D-Link DSL routers is being actively exploited to execute arbitrary commands remotely on unpatched devices.
CISA added actively exploited vulnerabilities in Microsoft Office and HPE OneView to its Known Exploited Vulnerabilities Catalog, urging immediate remediation.

Notable Threat Actor Activity

North Korean threat actor Kimsuky is distributing mobile malware via phishing sites that use QR codes, targeting users to install malicious apps.
The Black Cat cybercrime group is running an SEO poisoning campaign, creating fraudulent sites advertising popular software to deliver malware to users searching for legitimate downloads.
The pro-Russian hacktivist group NoName057(16) continues to leverage its DDoSia tool to coordinate volunteer-driven DDoS attacks against government, media, and institutional targets associated with Ukraine and Western countries.
The “Zestix” actor used infostealers to compromise cloud credentials and breach approximately 50 enterprise file-sharing environments.
GoBruteforcer botnet activity is increasing, targeting crypto and blockchain projects by brute-forcing exposed databases on servers often configured with weak, AI-generated default credentials.
Threat actors are exploiting complex email routing scenarios and misconfigured spoof protections to impersonate internal domains in phishing campaigns, particularly targeting Microsoft Office 365 tenants with weak configurations.

Trends, Tools, or Tactics of Interest

QR code-based phishing is being actively observed, with attackers embedding QR codes in emails and web pages to lure victims into installing malware or visiting phishing sites.
There is a rise in phishing attacks exploiting email routing misconfigurations and insufficient anti-spoofing controls, enabling domain impersonation and internal phishing.
Cybercriminals are increasingly adopting AI to automate and scale attacks, including “vibe hacking” and the use of tools like “HackGPT” in underground forums, reducing the technical barrier to entry for threat actors.
AI-generated server configuration examples are contributing to insecure deployments, as seen in GoBruteforcer campaigns targeting databases with weak or default passwords.
Affiliate-driven hacktivist campaigns, such as those orchestrated by NoName057(16) with DDoSia, are enabling coordinated volunteer attacks at scale.
Non-human (AI/automation) entities are becoming integral to cybersecurity operations, increasing the attack surface and requiring new approaches to identity and access management.

Regulatory or Policy Developments

The UK government announced a new cybersecurity strategy backed by over £210 million to strengthen cyber defences across public sector organisations and government departments.
OpenAI confirmed that health information shared with ChatGPT Health will not be used to train its models, addressing privacy concerns related to health data.

jsPDF on DanSec Daily

Cybersecurity Brief – 2026-01-09

Major Incidents or Breaches

Newly Discovered Vulnerabilities

Notable Threat Actor Activity

Trends, Tools, or Tactics of Interest

Regulatory or Policy Developments Affecting the Security Industry

Cybersecurity Brief – 2026-01-08

Major Incidents or Breaches

Newly Discovered Vulnerabilities

Notable Threat Actor Activity

Trends, Tools, or Tactics of Interest

Regulatory or Policy Developments