Researchers disclosed a supply chain attack on the Open VSX Registry where attackers used a compromised developer account (oorzc) to publish four malicious extension updates that delivered the GlassWorm loader. The loader uses EtherHiding, runtime decryption, and Solana memos to fetch C2 and exfiltrate macOS credentials, browser data, and cryptocurrency wallet…
Category: Cyber Security News
Attackers compromised eScan’s update infrastructure to push a malicious update that replaced reload.exe and installed a persistent downloader on enterprise and consumer endpoints. The multi-stage payload blocked updates, established persistence, bypassed AMSI, and fetched additional components such as CONSCTLX.exe; MicroWorld isolated update servers, issued a patch, and advised impacted customers to…
Cisco Talos has identified a sophisticated campaign by threat actor UAT-8099 targeting Internet Information Services (IIS) servers across Thailand, Vietnam, and neighboring Asian countries with new region-tailored variants of the BadIIS malware active from late 2025 through early 2026. The group added built-in region-locking, customized file and page behaviors, and a…
![Threat Research | Weekly Recap [01 Feb 2026]](https://www.hendryadrian.com/tweet/image/WeeklyRecap.png "Threat Research | Weekly Recap [01 Feb 2026]")
Cybersecurity Threat Research ‘Weekly’ Recap: A sweeping roundup covers ransomware, Android threats, fileless tools, nation-state campaigns, cloud abuse, browser extension hijacks, supply-chain incidents, AI governance risks, and defensive improvements. It highlights actor-tool pairs and campaigns such as LockBit5.0, BravoX, Amnesia RAT, Arsink RAT, PlayCloak, PureRAT, PyRAT, GOGITTER, GITSHELLPAD, SheetCreep, VSCode tunnel, DarkSpectre, PayTool, SquarePhish2 and Graphish among others.
#LockBit5_0 #BravoX #AmnesiaRAT #ArsinkRAT #PlayCloak #PureRAT #PyRAT #GOGITTER #GITSHELLPAD #SheetCreep #VSCodeTunnel #DarkSpectre #PayTool #SquarePhish2 #Graphish
![Cybersecurity News | Daily Recap [31 Jan 2026]](https://www.hendryadrian.com/tweet/image/DailyRecap.png "Cybersecurity News | Daily Recap [31 Jan 2026]")
Daily Recap, a December 2025 campaign used default credentials to expose FortiGate VPNs and misconfigured OT devices, compromising about 30 Polish wind and solar sites, exfiltrating credentials, and deploying wipers linked to Static Tundra and DynoWiper with ties to Electrum and Sandworm. The recap also covers Ivanti EPMM zero-days (including CVE-2026-1281) exploited in the wild, SolarWinds Web Help Desk patches, Windows 11 boot failures after the December 2025 update, exposure of Ollama hosts and Hugging Face abuse, and notable disruptions and breaches such as IPIDEA takedown, the Match Group leak, the Marquis/SonicWall incident, and CNIL’s €5 million fine. #FortiGate #StaticTundra #DynoWiper #Electrum #Sandworm #Ivanti #CVE-2026-1281 #WebHelpDesk #Windows11 #Ollama #HuggingFace #IPIDEA #MatchGroup #SonicWall #Marquis #CNIL
Hudson Rock reports that the convergence of OpenClaw (local runtime), Moltbook (agent collaboration network), and Molt Road (black market) forms a “Lethal Trifecta” of autonomous AI agents that can use stolen credentials to infiltrate organizations, move laterally, deploy Ransomware 5.0, and self-fund via cryptocurrency without human oversight. Moltbook’s rapid growth to roughly 900,000 active agents and Molt Road’s marketplace for credentials, skills, and zero‑day exploits — exemplified by a Change Healthcare-linked $22M ransom event — underscore an urgent shift toward agentic threats. #OpenClaw #Moltbook #MoltRoad #Ransomware5.0 #ChangeHealthcare #DarkBard
Apple is introducing a “Limit Precise Location” setting that restricts the precision of location data shared with cellular networks so carriers can only see an approximate area instead of a precise street address. The feature requires iOS 26.3 or later on supported iPhone and iPad models and must be enabled in Settings > Cellular > Cellular Data Options, with availability dependent on carrier support (for example, Telekom, EE, BT, Boost Mobile, AIS, and True). #LimitPreciseLocation #iOS26_3
Threat actors are automatically compromising exposed MongoDB instances and leaving ransom notes demanding roughly 0.005 BTC (about $500) to restore data. Flare researchers discovered over 208,500 publicly exposed MongoDB servers — 3,100 without authentication — and found nearly half of those had already been wiped and left with ransom notes. #MongoDB #Flare
Daily Recap, a wave of critical flaws including n8n CVE-2026-1470/0863 enabling authenticated remote code execution and extensive updates across builds, alongside KEV catalog additions (Microsoft Office CVE-2026-21509, GNU InetUtils, SmarterMail, Linux kernel) highlight widespread risk across software, networks and OT. In parallel, state-backed and criminal groups continue weaponizing legacy flaws (WinRAR CVE-2025-8088 with UNC4895/RomCom, APT44, Turla), LLM/MCP abuses (Operation Bizarre Bazaar), C2 abuse (Sheet Attack), exposed AI tools (Bondu Panel, ChatGPT) and infrastructure attacks (IPIDEA takedown, Poland grid disruption), underscoring the need for resilient, AI-assisted defenses. #n8n #OperationBizarreBazaar
Security researcher Jatin Banga demonstrated that some private Instagram profiles returned embedded links and captions to private photos in the HTML response, exposing them to unauthenticated visitors via a polaris_timeline_connection JSON object. He reported the issue to Meta, which appears to have fixed the behavior within days but later closed the report as “not applicable” without providing a root-cause analysis; #Instagram #Meta
Mandiant and Google Threat Intelligence report that ShinyHunters and affiliated clusters are running vishing campaigns that use company-branded phishing sites to steal SSO credentials and MFA codes, allowing attackers to enroll their own devices and maintain access. Compromised accounts provide attackers with centralized access to SaaS dashboards (Okta, Microsoft Entra, Google SSO) to exfiltrate data from services like Salesforce and enable extortion. #ShinyHunters #Okta
A global phishing campaign is sending repeated cloud-storage scam emails that falsely warn recipients their photos, files, and backups will be deleted due to alleged payment failures. The emails use storage.googleapis.com redirectors to lead victims to impersonation pages that push unrelated affiliate products and collect payment details, so users should delete suspicious messages and verify billing only through official provider sites or apps. #GoogleCloud #GoogleDrive
Linwei Ding, a former Google software engineer, was convicted by a U.S. federal jury for stealing over 2,000 pages of confidential AI supercomputing materials and secretly sharing them with China-based technology firms. The stolen documents included proprietary TPU/GPU system designs, orchestration software, and SmartNIC technology, and evidence showed he sought to benefit entities linked to the People’s Republic of China. #LinweiDing #Google
The Aisuru/Kimwolf botnet launched a record-breaking DDoS campaign that peaked at 31.4 Tbps and generated over 200 million HTTP requests per second, targeting telecommunications providers, IT organizations, and Cloudflare’s dashboard and infrastructure. Cloudflare reported it detected and automatically mitigated the attacks on December 19 and noted a 121% year-over-year increase in…
CERT Polska reported coordinated destructive cyber attacks on December 29, 2025 that targeted more than 30 wind and photovoltaic farms, a manufacturing company, and a large combined heat and power (CHP) plant serving nearly half a million customers. The intrusions involved wiper malware (notably DynoWiper and LazyWiper), exploitation of vulnerable Fortinet/FortiGate…