Researchers found phishing-as-a-service toolkits engineered for voice-based social engineering (“vishing”) that synchronize fake login pages with live phone calls to defeat multifactor authentication. The kits target providers like Google, Microsoft and Okta, use real-time orchestration and Telegram for credential theft, and only phishing-resistant methods such as FIDO passkeys can reliably stop…
Category: Cyber Security News
![Cybersecurity News | Daily Recap [22 Jan 2026]](https://www.hendryadrian.com/tweet/image/DailyRecap.png "Cybersecurity News | Daily Recap [22 Jan 2026]")
Daily Recap, Active, high-risk flaws are being patched across vendors, including Cisco’s actively exploited CVE-2026-20045 in Webex, post-exploit activity on SmarterMail, FortiCloud SSO abuse to alter FortiGate configs, and several third-party dependency and RCE/2FA issues affecting major collaboration platforms. AI framework and toolchain vulnerabilities (Chainlit, Anthropic fixes) continue to surface, with coordinated patches from Atlassian, GitLab, Zoom and a Microsoft workaround for Outlook freezes after Windows updates. #Cisco #Chainlit
Attackers are exploiting a patch bypass in a FortiGate authentication vulnerability (CVE-2025-59718) to create admin accounts on devices that were thought to be patched, and Fortinet has acknowledged 7.4.10 did not fully fix the issue. Admins are advised to disable FortiCloud SSO or apply upcoming FortiOS fixes while Shadowserver and CISA…
This week’s incidents show attackers exploiting ordinary files, trusted services, and routine workflows to gain control without relying on exotic exploits. From targeted spear-phishing that delivered the FALSECUB backdoor to malvertising and droppers seeding infostealers like TamperedChef, adversaries favor low-friction, large-scale, and patient operations. #FALSECUB #TamperedChef…
Okta warns that custom vishing phishing kits sold “as a service” are being used in active attacks to steal Okta SSO credentials and gain access to integrated enterprise platforms. These adversary-in-the-middle platforms enable live caller interaction to manipulate authentication flows, intercept MFA (including TOTPs and push prompts), and facilitate data theft and extortion linked to groups like ShinyHunters. #Okta #ShinyHunters
A critical authentication bypass vulnerability (CVE-2026-24061) in the GNU InetUtils telnet daemon (telnetd), affecting versions 1.9.3 through 2.7, allows remote attackers to gain root by supplying a crafted USER environment value. The flaw, introduced in 2015 and reported in January 2026, is being actively probed in the wild and should be…
Researchers disclosed a new ransomware family called Osiris that struck a major food service franchisee in Southeast Asia in November 2025, leveraging a custom driver named POORTRY in a BYOVD-style attack to disable security and exfiltrate data to Wasabi cloud buckets. Osiris uses hybrid per-file encryption, can stop services and kill…
Britain’s House of Lords voted 261–150 to ban children under 16 from accessing social media within a year as an amendment to the Children’s Wellbeing and Schools Bill. The legislation also requires chief medical officers to publish guidance for parents and has prompted government consultations on raising the digital age of…
Spain’s High Court has closed its probe into alleged Pegasus spyware surveillance of senior officials after Israel failed to cooperate with multiple requests for information. Judge José Luis Calama said Israel’s refusal breached international obligations after the court found evidence that Pegasus infections — including five infections of Prime Minister Pedro…
The Irish government will draft legislation to legalize law enforcement use of spyware and electronic scanning equipment, with interception requests required to be authorized by a court. The Department of Justice says the bill will include robust legal safeguards and will be developed with the Attorney General’s Office and other state…
Hybrid work has increased Active Directory password resets and remote account lockouts, turning what used to be quick helpdesk fixes into significant productivity drains and hidden costs. Self-service tools like Specops uReset and Specops Password Policy can update cached credentials, reduce helpdesk workload, and save organizations tens of thousands of dollars annually. #ActiveDirectory #SpecopsuReset
An operational security failure let researchers recover encrypted data stolen by the INC ransomware gang from a dozen U.S. organizations. Cyber Centaurs’ forensic analysis exposed reused Restic-based backup infrastructure that retained victim data, enabling decryption and preservation while producing detection rules and coordinating with law enforcement. #RainINC #Restic
Microsoft will add a new fraud protection feature to Teams calls called Brand Impersonation Protection, which checks incoming VoIP calls from first-time external contacts for signs of brand impersonation and displays high-risk call warnings before suspicious calls are answered. The feature will roll out to the targeted release ring in mid-February and be enabled by default, allowing users to accept, block, or end flagged calls while alerts may persist during conversations, and IT teams should prepare support staff and update training for the new warnings. #BrandImpersonationProtection #MicrosoftTeams
An authentication bypass vulnerability in SmarterTools’ SmarterMail force-reset-password API allows unauthenticated attackers to reset administrator passwords and obtain full privileges. Researchers reported the flaw and SmarterMail issued a patch on January 15, but evidence shows threat actors began exploiting the issue in the wild soon after the fix was released. #SmarterMail #SmarterTools
Curl is ending its HackerOne bug bounty program due to a surge of low-quality, often AI-generated vulnerability reports that overwhelmed the small maintenance team. The project will stop offering monetary rewards, accept HackerOne submissions only until January 31, 2026, and move to direct GitHub reporting thereafter. #curl #HackerOne