This investigation exposes a complex fraud ecosystem targeting Canadians through impersonation of government services and trusted brands. Attackers exploit digital dependencies for transportation, taxation, parcel delivery, and travel using convincing campaigns. The activity is linked to the 'PayTool' phishing framework, specializing in traffic violation scams. Additional infrastructure impersonates Canada Revenue Agency, Air Canada, and Canada Post. Threat actors commercialize these campaigns on underground forums, selling phishing kits mimicking official services. Victims are lured via SMS and malicious ads, using high-pressure tactics. The infrastructure employs fake validation phases and fraudulent payment gateways to harvest personal and financial data. The campaign's scope spans multiple provinces, utilizing shared hosting and domain generation patterns for scalability.
Quantum computers are coming, with a potential computing power almost beyond comprehension. The post Cyber Insights 2026: Quantum Computing and the Potential Synergy With Advanced AI appeared first on SecurityWeek .
Marketed as ChatGPT enhancement and productivity tools, the extensions allow the threat actor to access the victim's ChatGPT data. The post Chrome, Edge Extensions Caught Stealing ChatGPT Sessions appeared first on SecurityWeek .
The HoneyMyte APT group has enhanced its toolset with an updated CoolClient backdoor and new data stealing capabilities. The group targeted government entities in Asia and Europe, particularly Southeast Asia. CoolClient now features clipboard monitoring, HTTP proxy credential sniffing, and plugin support for extended functionality. HoneyMyte also deployed browser login data stealers and document theft scripts. The campaign's focus has shifted towards active surveillance, including keylogging, clipboard data collection, and proxy credential harvesting. Organizations are advised to remain vigilant against HoneyMyte's evolving toolkit, which includes CoolClient, PlugX, ToneShell, Qreverse, and LuminousMoth malware families.
CVE-2026-21408 is a high-severity vulnerability in FUJIFILM Business Innovation Corp. 's beat-access for Windows (version 3.0.3 and earlier) involving an uncontrolled search path element. This flaw allows an attacker with limited privileges to execute arbitrary code with SYSTEM-level privileges by exploiting insecure DLL loading behavior. The vulnerability requires local access and some user interaction, but once exploited, it can compromise confidentiality, integrity, and availability of affected systems. No known exploits are currently in the wild. European organizations using this software, especially in sectors relying on FUJIFILM's document management solutions, are at risk. Mitigation involves applying patches when available, restricting DLL search paths, and implementing application whitelisting. Countries with significant adoption of FUJIFILM products and critical infrastructure relying on them, such as Germany, France, and the UK, are most likely to be impacted.
CVE-2025-30248 is a high-severity DLL hijacking vulnerability in the WD Discovery Installer version 5.2.730 on Windows. It allows a local attacker to execute arbitrary code by placing a malicious DLL in the installer's search path. Exploitation requires local access and user interaction during installation. The vulnerability impacts confidentiality, integrity, and availability due to potential arbitrary code execution with elevated privileges. No known exploits are currently in the wild. European organizations using Western Digital WD Discovery software on Windows systems are at risk, especially those with many local users or shared workstations. Mitigation involves restricting installer search paths, applying patches when available, and enforcing strict DLL loading policies. Countries with high Western Digital market penetration and significant enterprise usage, such as Germany, France, and the UK, are most likely affected.
CVE-2026-24470 is a high-severity vulnerability in Zalando's Skipper HTTP router and reverse proxy, versions prior to 0.24.0. When used as a Kubernetes Ingress controller, it allows users with permissions to create Ingress and ExternalName Services to route traffic through Skipper to internal services, effectively bypassing network restrictions. This unintended proxy or 'confused deputy' flaw can lead to high confidentiality and integrity impacts without requiring user interaction. The vulnerability is mitigated in version 0.24.0 by disabling ExternalName Services by default and can be further controlled by allow-listing targets. European organizations using Skipper in Kubernetes environments should prioritize upgrading and applying strict allow-listing to prevent unauthorized internal access. Countries with strong Kubernetes adoption and critical cloud-native infrastructure, such as Germany, the UK, and the Netherlands, are most likely to be affected.
A Pakistan-linked APT group conducted two campaigns targeting Indian government entities. The Gopher Strike campaign used PDFs with malicious links to deliver an ISO file containing GOGITTER, a Golang downloader that fetches payloads from private GitHub repositories. GITSHELLPAD, a Golang backdoor, was used for C2 communication via GitHub. GOSHELL, a Golang shellcode loader, deployed Cobalt Strike Beacon on specific hostnames. The attackers used various techniques including scheduled tasks for persistence, obfuscation, and environmental keying. Post-compromise activities involved system reconnaissance and data exfiltration. The campaign demonstrated sophisticated TTPs and custom-built tools, indicating a potentially new subgroup or parallel Pakistan-linked threat actor.
In January 2026, IIJ observed malicious LNK files targeting Korean users to execute the MoonPeak malware, attributed to North Korean threat actors. The infection chain begins with a LNK file that runs an obfuscated PowerShell script, which checks for analysis environments, creates additional scripts, and sets up persistence. The second stage downloads and executes a payload from GitHub, which is actually the MoonPeak malware. MoonPeak is obfuscated using ConfuserEx and communicates with a C2 server. The campaign utilizes GitHub for hosting malware, a technique known as Living Off Trusted Sites (LOTS). This attack demonstrates the ongoing threat posed by North Korean actors targeting various countries and individuals worldwide.
Crunchbase was targeted alongside SoundCloud and Betterment in a ShinyHunters campaign. The post Crunchbase Confirms Data Breach After Hacking Claims appeared first on SecurityWeek .
Priced $2,000 - $6,000 on a cybercrime forum, the MaaS toolkit promises publication on the Chrome Web Store. The post ‘Stanley’ Malware Toolkit Enables Phishing via Website Spoofing appeared first on SecurityWeek .
An active infostealer campaign is targeting macOS and Windows users across various sectors. The threat actors are using SEO poisoning to direct victims to fake GitHub repositories impersonating legitimate tools like PagerDuty. The campaign involves over 20 malicious repositories active since September 2025. The attack flow begins with a Google search, leading to a fraudulent GitHub repository, then to a GitHub Pages site with a deceptive command. This command deploys the MacSync stealer in three stages: a loader, a dropper, and the final payload. MacSync aggressively harvests credentials from browsers, cloud services, and cryptocurrency wallets. The campaign's scale includes 39 identified malicious repositories, with 24 still active as of January 2026. Evasion tactics include using 'readme-only' repositories and distributed identities.
Based on the sensors reporting to ISC, this activity started on the 13 Jan 2026. My own sensor started seeing the first scan on the 21 Jan 2026 with limited probes. So far, this activity has been limited to a few scans based on the reports available in ISC [5] (select Match Partial URL and Draw):
