A new malware-as-a-service called Stanley offers malicious Chrome extensions that overlay full-screen iframes to carry out phishing while leaving the browser address bar displaying a legitimate site. Stanley advertises silent auto-installation on Chrome, Edge, and Brave, subscription tiers (including a Luxe Plan that assists in publishing extensions to the Chrome Web Store), persistent C2 polling, geo-targeting, and an operator web panel for controlling hijacks and notifications. #Stanley #ChromeWebStore
Category: Cyber Security News
Nike is investigating a potential security breach after the WorldLeaks cybercrime group claimed it accessed and stole data from the companyās systems. WorldLeaks published 1.4TB of data and has shifted to extortion-focused data theft after rebranding from Hunters International, while Under Armour faces a separate large exposure linked to the Everest…
A failed December attempt to disrupt parts of Polandās energy grid used destructive “wiper” malware that security firm ESET calls DynoWiper. ESET attributed the attack with medium confidence to Russiaās Sandworm unit of the GRU, and Polish officials said defenses held and critical infrastructure was not compromised. #DynoWiper #Sandworm…
A critical out-of-bounds write in VMware vCenter Server’s DCERPC implementation (CVE-2024-37079) allows remote code execution and carries a 9.8 CVSS rating. Broadcom and CISA warn the flaw is being exploited in the wild despite a patch released over a year ago, and CISA has added it to its KEV requiring federal…
ShinyHunters claim to have leaked tens of millions of records from SoundCloud, Crunchbase, and Betterment after failed extortion attempts, publishing alleged partial databases on a new dark web .onion leak site. The group has also claimed responsibility for an Okta SSO vishing campaign, and researchers and the affected companies are investigating…
![Threat Research | Weekly Recap [25 Jan 2026]](https://www.hendryadrian.com/tweet/image/WeeklyRecap.png "Threat Research | Weekly Recap [25 Jan 2026]")
Cybersecurity Threat Research ‘Weekly’ Recap: the report highlights AIāgenerated malware frameworks like VoidLink, AIādriven KONNI backdoors, realātime LLMāassembled phishing, and evolving ransomware such as AnubisRaaS and Osiris, alongside supplyāchain and wateringāhole compromises across multiple industries. It also covers stateāsponsored espionage, credential theft campaigns, and defensive insights for detection, telemetry, and incident response. #VoidLink #KONNI #AnubisRaaS #Osiris #CharmingKitten #APT28 #PurpleBravo #Evelyn
CISA has flagged a critical VMware vCenter Server vulnerability (CVE-2024-37079) as actively exploited and ordered federal civilian agencies to secure affected systems within three weeks. The June 2024 patch fixes a DCERPC heap overflow that allows low-complexity, unauthenticated remote code execution, and Broadcom confirmed active exploitation with no available mitigations beyond applying the update. #CVE-2024-37079 #VMwarevCenter
1Password has added a built-in pop-up that alerts users to potential phishing and typosquatted URLs to reduce credential theft. The feature is auto-enabled for individual and family plans and can be activated by admins for company accounts, addressing rising phishing risks amplified by AI and risky user behaviors revealed in a 1Password survey. #1Password #Windows
Microsoft is investigating reports that some Windows 11 devices fail to boot with “UNMOUNTABLE_BOOT_VOLUME” stop errors after installing the January 2026 cumulative update KB5074109. Affected systems (Windows 11 25H2 and 24H2) display a black crash screen and require manual recovery; Microsoft is collecting Feedback Hub reports and separately issued OOB fixes for Outlook PST cloud freezes. #UNMOUNTABLE_BOOT_VOLUME #KB5074109
1Password has added built-in phishing URL protection that shows a pop-up warning users about potential typosquatted or malicious sites to prevent accidental credential entry. The feature is auto-enabled for individual and family plans and can be activated by admins for companies, addressing increased phishing risk highlighted by 1Password’s survey. #1Password #Passkeys
![Cybersecurity News | Daily Recap [24 Jan 2026]](https://www.hendryadrian.com/tweet/image/DailyRecap.png "Cybersecurity News | Daily Recap [24 Jan 2026]")
Daily Recap, phishing activity escalates with an AiTM campaign abusing SharePoint to steal Microsoft credentials, compromise inboxes, and bypass MFA in the energy sector, while vishing kits synchronize fake login pages with live calls targeting Google, Microsoft, and Okta. Ransomware and exploits dominate the headlines, from Osiris using POORTRY to disable protections and exfiltrate data to Wasabi, to INC recovery of encrypted data and Ploutus ATM jackpotting linked to Tren de Aragua, alongside critical vulnerabilities in FortiCloud SSO, SmarterMail, InetUtils telnetd, and widespread security updates from GitLab, Outlook iOS, curl, and Teams. #SharePoint #AiTM #Microsoft #Google #Okta #Osiris #POORTRY #Wasabi #INC #Ploutus #TrenDeAragua #FortiCloudSSO #FortiOS #SmarterMail #InetUtils #telnetd #GitLab #Outlook #curl #Teams #Pwn2OwnAuto #FALSECUB #TamperedChef #NetNTLMv1 #MnCHOICES #ActiveDirectory
Microsoft released emergency out-of-band updates for Windows 10, Windows 11, and Windows Server to fix an issue that prevented classic Outlook from opening when PST files were stored in cloud-backed storage. The problem appeared after the January 2026 Patch Tuesday updates and affected PSTs on services like OneDrive and Dropbox, prompting KB updates and download links for affected OS versions. #Microsoft #Outlook
A late-December 2025 cyberattack on Polandās power grid has been linked to the Russian state-sponsored group Sandworm, which attempted to deploy a new destructive wiper called DynoWiper. ESET identifies the wiper as Win32/KillFiles.NMO (SHA-1 4EC3C90846AF6B79EE1A5188EEFA3FD21F6D4CF6), but public samples have not been found and officials say the attack hit CHP plants and a renewables management system. #Sandworm #DynoWiper
North Korean-linked group Konni (Opal Sleet, TA406) is deploying AI-generated PowerShell backdoors to target developers and engineers in the blockchain sector across the Asia-Pacific region. The campaign uses Discord-hosted lures, LNK/DOCX/CAB loaders, UAC bypasses, scheduled tasks, and XOR-encrypted in-memory execution to maintain persistence and execute C2-issued code. #Konni #PowerShell
AI agents accelerate enterprise work by automating tasks, accessing data, and triggering workflows in real time, but they introduce complex ownership and access challenges that break traditional IAM models. Organizational agents with broad, persistent permissions and no clear owners create the greatest risk by enabling agentic authorization bypass and expanding blast…