The KRVTZ-NET IDS alerts dated January 28, 2026, represent reconnaissance activity detected by network intrusion detection systems. The alerts highlight two suspicious IP addresses: 41.104.54.158, which made inbound requests to hidden environment files, and 34.74.242.206, associated with suspicious user-agent strings linked to InfoBot malware. InfoBot is known for information-stealing and evasion tactics. No active exploitation or payload delivery has been observed, indicating early-stage scanning rather than an active attack.
Domains set up by the threat actor suggest attacks aimed at Atlassian, Canva, Epic Games, HubSpot, Moderna, ZoomInfo, and WeWork. The post Over 100 Organizations Targeted in ShinyHunters Phishing Campaign appeared first on SecurityWeek .
This investigation exposes a complex fraud ecosystem targeting Canadians through impersonation of government services and trusted brands. Attackers exploit digital dependencies for transportation, taxation, parcel delivery, and travel using convincing campaigns. The activity is linked to the 'PayTool' phishing framework, specializing in traffic violation scams. Additional infrastructure impersonates Canada Revenue Agency, Air Canada, and Canada Post. Threat actors commercialize these campaigns on underground forums, selling phishing kits mimicking official services. Victims are lured via SMS and malicious ads, using high-pressure tactics. The infrastructure employs fake validation phases and fraudulent payment gateways to harvest personal and financial data. The campaign's scope spans multiple provinces, utilizing shared hosting and domain generation patterns for scalability.
Quantum computers are coming, with a potential computing power almost beyond comprehension. The post Cyber Insights 2026: Quantum Computing and the Potential Synergy With Advanced AI appeared first on SecurityWeek .
Marketed as ChatGPT enhancement and productivity tools, the extensions allow the threat actor to access the victim's ChatGPT data. The post Chrome, Edge Extensions Caught Stealing ChatGPT Sessions appeared first on SecurityWeek .
The HoneyMyte APT group has enhanced its toolset with an updated CoolClient backdoor and new data stealing capabilities. The group targeted government entities in Asia and Europe, particularly Southeast Asia. CoolClient now features clipboard monitoring, HTTP proxy credential sniffing, and plugin support for extended functionality. HoneyMyte also deployed browser login data stealers and document theft scripts. The campaign's focus has shifted towards active surveillance, including keylogging, clipboard data collection, and proxy credential harvesting. Organizations are advised to remain vigilant against HoneyMyte's evolving toolkit, which includes CoolClient, PlugX, ToneShell, Qreverse, and LuminousMoth malware families.
CVE-2026-21408 is a high-severity vulnerability in FUJIFILM Business Innovation Corp. 's beat-access for Windows (version 3.0.3 and earlier) involving an uncontrolled search path element. This flaw allows an attacker with limited privileges to execute arbitrary code with SYSTEM-level privileges by exploiting insecure DLL loading behavior. The vulnerability requires local access and some user interaction, but once exploited, it can compromise confidentiality, integrity, and availability of affected systems. No known exploits are currently in the wild. European organizations using this software, especially in sectors relying on FUJIFILM's document management solutions, are at risk. Mitigation involves applying patches when available, restricting DLL search paths, and implementing application whitelisting. Countries with significant adoption of FUJIFILM products and critical infrastructure relying on them, such as Germany, France, and the UK, are most likely to be impacted.
CVE-2025-30248 is a high-severity DLL hijacking vulnerability in the WD Discovery Installer version 5.2.730 on Windows. It allows a local attacker to execute arbitrary code by placing a malicious DLL in the installer's search path. Exploitation requires local access and user interaction during installation. The vulnerability impacts confidentiality, integrity, and availability due to potential arbitrary code execution with elevated privileges. No known exploits are currently in the wild. European organizations using Western Digital WD Discovery software on Windows systems are at risk, especially those with many local users or shared workstations. Mitigation involves restricting installer search paths, applying patches when available, and enforcing strict DLL loading policies. Countries with high Western Digital market penetration and significant enterprise usage, such as Germany, France, and the UK, are most likely affected.
CVE-2026-24470 is a high-severity vulnerability in Zalando's Skipper HTTP router and reverse proxy, versions prior to 0.24.0. When used as a Kubernetes Ingress controller, it allows users with permissions to create Ingress and ExternalName Services to route traffic through Skipper to internal services, effectively bypassing network restrictions. This unintended proxy or 'confused deputy' flaw can lead to high confidentiality and integrity impacts without requiring user interaction. The vulnerability is mitigated in version 0.24.0 by disabling ExternalName Services by default and can be further controlled by allow-listing targets. European organizations using Skipper in Kubernetes environments should prioritize upgrading and applying strict allow-listing to prevent unauthorized internal access. Countries with strong Kubernetes adoption and critical cloud-native infrastructure, such as Germany, the UK, and the Netherlands, are most likely to be affected.
A Pakistan-linked APT group conducted two campaigns targeting Indian government entities. The Gopher Strike campaign used PDFs with malicious links to deliver an ISO file containing GOGITTER, a Golang downloader that fetches payloads from private GitHub repositories. GITSHELLPAD, a Golang backdoor, was used for C2 communication via GitHub. GOSHELL, a Golang shellcode loader, deployed Cobalt Strike Beacon on specific hostnames. The attackers used various techniques including scheduled tasks for persistence, obfuscation, and environmental keying. Post-compromise activities involved system reconnaissance and data exfiltration. The campaign demonstrated sophisticated TTPs and custom-built tools, indicating a potentially new subgroup or parallel Pakistan-linked threat actor.
In January 2026, IIJ observed malicious LNK files targeting Korean users to execute the MoonPeak malware, attributed to North Korean threat actors. The infection chain begins with a LNK file that runs an obfuscated PowerShell script, which checks for analysis environments, creates additional scripts, and sets up persistence. The second stage downloads and executes a payload from GitHub, which is actually the MoonPeak malware. MoonPeak is obfuscated using ConfuserEx and communicates with a C2 server. The campaign utilizes GitHub for hosting malware, a technique known as Living Off Trusted Sites (LOTS). This attack demonstrates the ongoing threat posed by North Korean actors targeting various countries and individuals worldwide.
The RansomHub ransomware group has claimed responsibility for a cyber-attack on Luxshare, a major electronics manufacturer supplying companies such as Apple, Nvidia, LG, and Tesla. The attackers reportedly accessed sensitive intellectual property, including 3D CAD models and circuit board designs. Although no CVSS score is provided, the attack's impact on confidentiality and potential disruption to supply chains is significant. No known exploits in the wild have been reported yet. The threat poses a medium severity risk, with potential implications for European organizations involved in electronics manufacturing and supply chains. Mitigation should focus on securing intellectual property, enhancing network segmentation, and monitoring for ransomware indicators. Countries with strong electronics manufacturing sectors and supply chain ties to affected companies, such as Germany, France, and the Netherlands, are most likely to be impacted. The attack highlights the importance of protecting proprietary design data and supply chain resilience against ransomware threats.
Crunchbase was targeted alongside SoundCloud and Betterment in a ShinyHunters campaign. The post Crunchbase Confirms Data Breach After Hacking Claims appeared first on SecurityWeek .
Priced $2,000 - $6,000 on a cybercrime forum, the MaaS toolkit promises publication on the Chrome Web Store. The post ‘Stanley’ Malware Toolkit Enables Phishing via Website Spoofing appeared first on SecurityWeek .
10 years after disrupting the Ukrainian power grid, the APT targeted Poland with data-wiping malware. The post Russian Sandworm Hackers Blamed for Cyberattack on Polish Power Grid appeared first on SecurityWeek .
