Cybersecurity Brief – 2026-02-02

Mon, 02 Feb 2026 00:00:00 +0000

Major Incidents or Breaches

eScan Antivirus update servers were compromised by unknown attackers, resulting in the delivery of multi-stage malware through the official update channel. The attack leveraged the trusted update infrastructure of MicroWorld Technologies, impacting users who downloaded updates during the compromise period.
The Open VSX Registry, a popular extension registry for Visual Studio Code, was targeted in a supply chain attack. Threat actors compromised a legitimate developer’s account to distribute malicious extensions containing the GlassWorm malware to end users.
Exposed MongoDB instances continue to be targeted in automated data extortion attacks. Threat actors are accessing unsecured databases, exfiltrating data, and demanding low-value ransoms from database owners to restore access.

Sun, 01 Feb 2026 00:00:00 +0000

Hackers compromised a MicroWorld Technologies update server, delivering a malicious file to eScan Antivirus customers via a supply chain attack.
A researcher disclosed that private Instagram profiles were leaking photo links to unauthenticated visitors. The issue was subsequently fixed, but Meta closed the report as not applicable.

Evidence indicated a flaw in Instagram’s handling of private profile photos, allowing unauthorized access to photo links. This has since been remediated.

A Farsi-speaking threat actor aligned with Iranian state interests (RedKitten) is conducting a cyber campaign targeting NGOs and individuals involved in documenting human rights violations.
Mandiant reported an expansion in threat activity by ShinyHunters, a financially motivated group. The group is using voice phishing (vishing) and company-branded phishing sites to steal single sign-on (SSO) credentials and multi-factor authentication (MFA) tokens, enabling breaches of SaaS platforms.
A large-scale cloud storage subscription scam campaign is targeting users globally with fake renewal emails, aiming to steal payment information.
U.S. authorities convicted a former Google engineer for stealing AI supercomputer data and transferring it to Chinese tech firms.

ShinyHunters’ recent campaigns leverage targeted vishing attacks and phishing sites mimicking company branding to capture SSO credentials and MFA tokens, facilitating cloud data theft.
The eScan antivirus incident highlights ongoing risks from supply chain attacks targeting software update mechanisms.
The cloud storage payment scam demonstrates continued use of mass phishing campaigns exploiting user fears of data loss.

A U.S. federal jury conviction of a former Google engineer for transferring proprietary AI data to China underscores heightened legal and regulatory scrutiny over intellectual property and technology transfer, particularly involving AI and cloud technologies.