The fastest way to squander the promise of AI is to mistake automation for assurance, and novelty for resilience. The post Why We Can’t Let AI Take the Wheel of Cyber Defense appeared first on SecurityWeek .
New Strict Account Settings allow users to block attachments and media and silence calls from unknown people. The post WhatsApp Boosts Account Security for At-Risk Individuals appeared first on SecurityWeek .
The KRVTZ-NET IDS alerts dated January 28, 2026, represent reconnaissance activity detected by network intrusion detection systems. The alerts highlight two suspicious IP addresses: 41.104.54.158, which made inbound requests to hidden environment files, and 34.74.242.206, associated with suspicious user-agent strings linked to InfoBot malware. InfoBot is known for information-stealing and evasion tactics. No active exploitation or payload delivery has been observed, indicating early-stage scanning rather than an active attack.
Domains set up by the threat actor suggest attacks aimed at Atlassian, Canva, Epic Games, HubSpot, Moderna, ZoomInfo, and WeWork. The post Over 100 Organizations Targeted in ShinyHunters Phishing Campaign appeared first on SecurityWeek .
Quantum computers are coming, with a potential computing power almost beyond comprehension. The post Cyber Insights 2026: Quantum Computing and the Potential Synergy With Advanced AI appeared first on SecurityWeek .
Marketed as ChatGPT enhancement and productivity tools, the extensions allow the threat actor to access the victim's ChatGPT data. The post Chrome, Edge Extensions Caught Stealing ChatGPT Sessions appeared first on SecurityWeek .
The HoneyMyte APT group has enhanced its toolset with an updated CoolClient backdoor and new data stealing capabilities. The group targeted government entities in Asia and Europe, particularly Southeast Asia. CoolClient now features clipboard monitoring, HTTP proxy credential sniffing, and plugin support for extended functionality. HoneyMyte also deployed browser login data stealers and document theft scripts. The campaign's focus has shifted towards active surveillance, including keylogging, clipboard data collection, and proxy credential harvesting. Organizations are advised to remain vigilant against HoneyMyte's evolving toolkit, which includes CoolClient, PlugX, ToneShell, Qreverse, and LuminousMoth malware families.
The RansomHub ransomware group has claimed responsibility for a cyber-attack on Luxshare, a major electronics manufacturer supplying companies such as Apple, Nvidia, LG, and Tesla. The attackers reportedly accessed sensitive intellectual property, including 3D CAD models and circuit board designs. Although no CVSS score is provided, the attack's impact on confidentiality and potential disruption to supply chains is significant. No known exploits in the wild have been reported yet. The threat poses a medium severity risk, with potential implications for European organizations involved in electronics manufacturing and supply chains. Mitigation should focus on securing intellectual property, enhancing network segmentation, and monitoring for ransomware indicators. Countries with strong electronics manufacturing sectors and supply chain ties to affected companies, such as Germany, France, and the Netherlands, are most likely to be impacted. The attack highlights the importance of protecting proprietary design data and supply chain resilience against ransomware threats.
Crunchbase was targeted alongside SoundCloud and Betterment in a ShinyHunters campaign. The post Crunchbase Confirms Data Breach After Hacking Claims appeared first on SecurityWeek .
Priced $2,000 - $6,000 on a cybercrime forum, the MaaS toolkit promises publication on the Chrome Web Store. The post ‘Stanley’ Malware Toolkit Enables Phishing via Website Spoofing appeared first on SecurityWeek .
An active infostealer campaign is targeting macOS and Windows users across various sectors. The threat actors are using SEO poisoning to direct victims to fake GitHub repositories impersonating legitimate tools like PagerDuty. The campaign involves over 20 malicious repositories active since September 2025. The attack flow begins with a Google search, leading to a fraudulent GitHub repository, then to a GitHub Pages site with a deceptive command. This command deploys the MacSync stealer in three stages: a loader, a dropper, and the final payload. MacSync aggressively harvests credentials from browsers, cloud services, and cryptocurrency wallets. The campaign's scale includes 39 identified malicious repositories, with 24 still active as of January 2026. Evasion tactics include using 'readme-only' repositories and distributed identities.
Based on the sensors reporting to ISC, this activity started on the 13 Jan 2026. My own sensor started seeing the first scan on the 21 Jan 2026 with limited probes. So far, this activity has been limited to a few scans based on the reports available in ISC [5] (select Match Partial URL and Draw):
The WorldLeaks cybercrime group claims to have stolen information from the footwear and apparel giant’s systems. The post Nike Probing Potential Security Incident as Hackers Threaten to Leak Data appeared first on SecurityWeek .
Other noteworthy stories that might have slipped under the radar: Cloudflare WAF bypass, Canonical Snap Store abused for malware delivery, Curl terminating bug bounty program The post In Other News: €1.2B GDPR Fines, Net-NTLMv1 Rainbow Tables, Rockwell Security Notice appeared first on SecurityWeek .
Under Armour is investigating a recent data breach that purloined customers’ email addresses and other personal information. The post Under Armour Looking Into Data Breach Affecting Customers’ Email Addresses appeared first on SecurityWeek .
