New Strict Account Settings allow users to block attachments and media and silence calls from unknown people. The post WhatsApp Boosts Account Security for At-Risk Individuals appeared first on SecurityWeek .
A total of 87 individuals, mostly Venezuelan nationals, have been charged for their role in the ATM jackpotting scheme. The post US Charges 31 More Defendants in Massive ATM Hacking Probe appeared first on SecurityWeek .
The KRVTZ-NET IDS alerts dated January 28, 2026, represent reconnaissance activity detected by network intrusion detection systems. The alerts highlight two suspicious IP addresses: 41.104.54.158, which made inbound requests to hidden environment files, and 34.74.242.206, associated with suspicious user-agent strings linked to InfoBot malware. InfoBot is known for information-stealing and evasion tactics. No active exploitation or payload delivery has been observed, indicating early-stage scanning rather than an active attack.
Domains set up by the threat actor suggest attacks aimed at Atlassian, Canva, Epic Games, HubSpot, Moderna, ZoomInfo, and WeWork. The post Over 100 Organizations Targeted in ShinyHunters Phishing Campaign appeared first on SecurityWeek .
This investigation exposes a complex fraud ecosystem targeting Canadians through impersonation of government services and trusted brands. Attackers exploit digital dependencies for transportation, taxation, parcel delivery, and travel using convincing campaigns. The activity is linked to the 'PayTool' phishing framework, specializing in traffic violation scams. Additional infrastructure impersonates Canada Revenue Agency, Air Canada, and Canada Post. Threat actors commercialize these campaigns on underground forums, selling phishing kits mimicking official services. Victims are lured via SMS and malicious ads, using high-pressure tactics. The infrastructure employs fake validation phases and fraudulent payment gateways to harvest personal and financial data. The campaign's scope spans multiple provinces, utilizing shared hosting and domain generation patterns for scalability.
Quantum computers are coming, with a potential computing power almost beyond comprehension. The post Cyber Insights 2026: Quantum Computing and the Potential Synergy With Advanced AI appeared first on SecurityWeek .
Marketed as ChatGPT enhancement and productivity tools, the extensions allow the threat actor to access the victim's ChatGPT data. The post Chrome, Edge Extensions Caught Stealing ChatGPT Sessions appeared first on SecurityWeek .
The HoneyMyte APT group has enhanced its toolset with an updated CoolClient backdoor and new data stealing capabilities. The group targeted government entities in Asia and Europe, particularly Southeast Asia. CoolClient now features clipboard monitoring, HTTP proxy credential sniffing, and plugin support for extended functionality. HoneyMyte also deployed browser login data stealers and document theft scripts. The campaign's focus has shifted towards active surveillance, including keylogging, clipboard data collection, and proxy credential harvesting. Organizations are advised to remain vigilant against HoneyMyte's evolving toolkit, which includes CoolClient, PlugX, ToneShell, Qreverse, and LuminousMoth malware families.
CVE-2026-24470 is a high-severity vulnerability in Zalando's Skipper HTTP router and reverse proxy, versions prior to 0.24.0. When used as a Kubernetes Ingress controller, it allows users with permissions to create Ingress and ExternalName Services to route traffic through Skipper to internal services, effectively bypassing network restrictions. This unintended proxy or 'confused deputy' flaw can lead to high confidentiality and integrity impacts without requiring user interaction. The vulnerability is mitigated in version 0.24.0 by disabling ExternalName Services by default and can be further controlled by allow-listing targets. European organizations using Skipper in Kubernetes environments should prioritize upgrading and applying strict allow-listing to prevent unauthorized internal access. Countries with strong Kubernetes adoption and critical cloud-native infrastructure, such as Germany, the UK, and the Netherlands, are most likely to be affected.
In January 2026, IIJ observed malicious LNK files targeting Korean users to execute the MoonPeak malware, attributed to North Korean threat actors. The infection chain begins with a LNK file that runs an obfuscated PowerShell script, which checks for analysis environments, creates additional scripts, and sets up persistence. The second stage downloads and executes a payload from GitHub, which is actually the MoonPeak malware. MoonPeak is obfuscated using ConfuserEx and communicates with a C2 server. The campaign utilizes GitHub for hosting malware, a technique known as Living Off Trusted Sites (LOTS). This attack demonstrates the ongoing threat posed by North Korean actors targeting various countries and individuals worldwide.
The RansomHub ransomware group has claimed responsibility for a cyber-attack on Luxshare, a major electronics manufacturer supplying companies such as Apple, Nvidia, LG, and Tesla. The attackers reportedly accessed sensitive intellectual property, including 3D CAD models and circuit board designs. Although no CVSS score is provided, the attack's impact on confidentiality and potential disruption to supply chains is significant. No known exploits in the wild have been reported yet. The threat poses a medium severity risk, with potential implications for European organizations involved in electronics manufacturing and supply chains. Mitigation should focus on securing intellectual property, enhancing network segmentation, and monitoring for ransomware indicators. Countries with strong electronics manufacturing sectors and supply chain ties to affected companies, such as Germany, France, and the Netherlands, are most likely to be impacted. The attack highlights the importance of protecting proprietary design data and supply chain resilience against ransomware threats.
Crunchbase was targeted alongside SoundCloud and Betterment in a ShinyHunters campaign. The post Crunchbase Confirms Data Breach After Hacking Claims appeared first on SecurityWeek .
Priced $2,000 - $6,000 on a cybercrime forum, the MaaS toolkit promises publication on the Chrome Web Store. The post ‘Stanley’ Malware Toolkit Enables Phishing via Website Spoofing appeared first on SecurityWeek .
An active infostealer campaign is targeting macOS and Windows users across various sectors. The threat actors are using SEO poisoning to direct victims to fake GitHub repositories impersonating legitimate tools like PagerDuty. The campaign involves over 20 malicious repositories active since September 2025. The attack flow begins with a Google search, leading to a fraudulent GitHub repository, then to a GitHub Pages site with a deceptive command. This command deploys the MacSync stealer in three stages: a loader, a dropper, and the final payload. MacSync aggressively harvests credentials from browsers, cloud services, and cryptocurrency wallets. The campaign's scale includes 39 identified malicious repositories, with 24 still active as of January 2026. Evasion tactics include using 'readme-only' repositories and distributed identities.
