Cybersecurity Brief – 2026-01-28

Wed, 28 Jan 2026 00:00:00 +0000

Major Incidents or Breaches

Nike is investigating a potential data breach after the World Leaks ransomware/extortion group published 1.4 TB of allegedly stolen corporate files, including 188,347 highly sensitive documents.
SoundCloud has suffered a data breach impacting 29.8 million accounts, with hackers stealing personal and contact information.
Over 100 organizations have been targeted in a phishing campaign attributed to ShinyHunters, with domains set up to impersonate brands such as Atlassian, Canva, Epic Games, HubSpot, Moderna, ZoomInfo, and WeWork.
Over 6,000 SmarterMail servers are exposed online and likely vulnerable to automated hijacking attacks exploiting a critical authentication bypass vulnerability.
Multiple threat actors, including state-sponsored and financially motivated groups, continue to exploit the CVE-2025-8088 WinRAR path traversal vulnerability for initial access and malware delivery.
Chrome and Edge browser extensions marketed as ChatGPT enhancement tools have been found stealing ChatGPT session data, granting threat actors access to user information.

Microsoft released emergency out-of-band patches for Office zero-day vulnerability CVE-2026-21509, which is actively exploited to bypass security features through malicious Office files.
Fortinet patched a critical authentication bypass vulnerability in FortiOS/FortiCloud SSO (CVE-2026-24858) after reports of active exploitation in the wild.
A critical remote code execution vulnerability has been disclosed in Grist-Core, an open-source spreadsheet-database platform, exploitable via spreadsheet formulas.
A critical sandbox escape flaw (CVE-2026-22709) was found in the vm2 Node.js library, allowing arbitrary code execution on host systems.
OpenSSL patched 12 vulnerabilities, including a high-severity remote code execution flaw.
‘PackageGate’ vulnerabilities in the JavaScript ecosystem allow bypassing NPM supply chain attack protections, leading to arbitrary code execution.
A critical Telnet server flaw exposes legacy and IoT systems to unauthenticated remote access and shell control.
Linux vulnerabilities are being actively exploited, enabling attackers to obtain root privileges or bypass authentication via Telnet.

The HoneyMyte (aka Mustang Panda/Bronze President) APT group has updated its CoolClient backdoor and is deploying multiple infostealers, including three browser data stealer variants and clipboard monitoring tools, in recent campaigns.
China-aligned APT actors have been using a JScript-based command-and-control (C2) framework called PeckBirdy since 2023 to target multiple environments.
Pakistan-linked threat actors have conducted two cyber campaigns against Indian government entities using previously undocumented techniques.
The ShinyHunters group is running a large-scale phishing campaign targeting over 100 organizations with credential harvesting domains.
The World Leaks ransomware/extortion group claims responsibility for the Nike data breach and has published stolen data to pressure the victim.
Multiple threat actors continue to exploit the WinRAR CVE-2025-8088 vulnerability for initial access and malware deployment.
The ‘Stanley’ malware-as-a-service toolkit enables malicious Chrome extensions to overlay phishing content on legitimate websites without altering the visible URL.
A new ransomware strain, ‘Sicarii’, has emerged, featuring poor code quality and a possible false-flag Hebrew identity, and currently cannot be decrypted.

Attackers are increasingly weaponizing trusted Remote Monitoring and Management (RMM) tools to establish persistent backdoor access in victim networks.
Recent phishing campaigns are leveraging fake CAPTCHAs, Microsoft App-V scripts, and trusted web services to distribute infostealers (ClickFix-style attacks).
Modern ransomware operations are shifting from pure encryption to psychological extortion, leveraging stolen data and exposure threats to increase pressure on victims.
AI-generated data degradation (“model collapse”) is raising concerns about accuracy, malicious activity propagation, and PII protection in zero-trust environments.
Browser extensions are being used as undetectable phishing vectors, with malicious overlays on legitimate sites while maintaining the original URL.
Supply chain vulnerabilities in JavaScript/NPM environments remain a critical risk, with new bypass techniques emerging.
The exposure and exploitation of legacy protocols such as Telnet continue to present significant attack surfaces, especially in IoT and OT environments.

Meta (WhatsApp) has introduced a ‘Strict Account Settings’ security mode to protect high-risk users from spyware and advanced cyber attacks, similar to Apple’s Lockdown Mode.
Criticism has been raised regarding MITRE’s management of the CVE vulnerability database, with calls to transfer oversight to the private sector for improved efficiency.
TikTok has narrowly avoided a US ban by forming a new American joint venture, impacting data governance and regulatory oversight for the platform in the US.