Security. In focus.

GhostChat Spyware Targets Android Users Via WhatsApp cyberpress.org/ghostchat…

A sophisticated Android spyware campaign targeting individuals through a deceptive mobile application dubbed “GhostChat.”

This malware, detected as Android/Spy.GhostChat.A, disguises itself as a legitimate dating and chat platform to facilitate cyberespionage.

The operators employ a combination of romance scam tactics and social engineering to infect devices, exfiltrate sensitive data, and monitor user activity.

China-Linked UAT-8099 Targets IIS Servers in Asia with BadIIS SEO Malware thehackernews.com/2026/01/c…

Cybersecurity researchers have discovered a new campaign attributed to a China-linked threat actor known as UAT-8099 that took place between late 2025 and early 2026.

The activity, discovered by Cisco Talos, has targeted vulnerable Internet Information Services (IIS) servers located across Asia, but with a specific focus on targets in Thailand and Vietnam. The scale of the campaign is currently unknown.

“UAT-8099 uses web shells and PowerShell to execute scripts and deploy the GotoHTTP tool, granting the threat actor remote access to vulnerable IIS servers,” security researcher Joey Chen said in a Thursday breakdown of the campaign.

UAT-8099 was first documented by the cybersecurity company in October 2025, detailing the threat actor’s exploitation of IIS servers in India, Thailand, Vietnam, Canada, and Brazil to facilitate search engine optimization (SEO) fraud. The attacks involve infecting the servers with a known malware referred to as BadIIS.

Google agrees to $135 million settlement for collecting Android users’ data | The Verge

Google has agreed to a $135 million settlement to resolve a class action lawsuit alleging the company collected Android users’ cellular data without permission, even when apps were closed or location sharing was off. The settlement, which includes potential payouts of up to $100 per user, also requires Google to improve data transfer controls and obtain explicit consent during device setup.

www.bleepingcomputer.com/news/secu…

As AI agents operate autonomously within business processes, traditional compliance frameworks (SOX, PCI DSS, HIPAA) face new governance challenges. CISOs must update identity, access and audit controls to manage risk.

cyberpress.org/nvidia-gp…

NVIDIA published critical patches addressing high-severity code execution and privilege escalation flaws in its GPU display drivers, vGPU platform and HD Audio drivers, affecting enterprise and data-center deployments.

www.helpnetsecurity.com/2026/01/3…

Ivanti issued provisional patches for two critical EPMM vulnerabilities (including one exploited in the wild). Security teams should apply these immediately and plan for permanent updates in upcoming releases.

cyberpress.org/wireshark…

The Wireshark Foundation released version 4.6.3 to fix four critical security flaws in dissectors and parsers that could be exploited for remote code execution or denial of service in network analysis environments.

Turning threat reports into detection insights with AI www.microsoft.com/en-us/sec… Microsoft outlines an AI-assisted workflow designed to help security teams convert unstructured threat intelligence into actionable detection insights. Security teams often face delays when extracting tactics, techniques and procedures (TTPs) from lengthy incident reports, red team assessments and public threat writeups. Mapping those TTPs to standard taxonomies and identifying detection gaps can take days or weeks, particularly when documents contain mixed formats such as prose, tables, screenshots and code. The proposed workflow uses AI to generate a structured initial analysis from common security content. It extracts candidate TTPs, validates and normalizes them, and aligns findings to the MITRE ATT&CK framework. The objective is to accelerate detection engineering, reduce manual effort and improve coverage analysis by systematically identifying where existing detections are sufficient and where gaps may exist.

Latvia says Russia remains its top cyber threat as attacks hit record high therecord.media/latvia-sa… Latvia’s national security service (SAB) has reported a record number of cyber threats in 2025, marking the highest level of activity observed and significantly exceeding pre-2022 levels. While most incidents were linked to cybercrime and digital fraud, SAB identified more serious cases involving intrusion attempts, malware distribution, equipment compromise and distributed denial-of-service (DDoS) attacks. According to the report, Russia remains the primary source of cyber risk to Latvia. SAB attributes the threat to Moscow’s broader strategic objectives and Latvia’s continued political, military and material support for Ukraine. Although most attacks have not resulted in major disruption, Latvian authorities assess that Russia’s cyber and sabotage activity shows no signs of slowing, reinforcing the need for sustained national cyber resilience.

Can’t stop, won’t stop: TA584 innovates initial access www.proofpoint.com/us/blog/t… Proofpoint reports sustained, high-volume activity from TA584, a prolific initial access broker targeting organizations globally. TA584 overlaps with a cluster Proofpoint tracks as Storm-0900. In the second half of 2025, TA584 materially adjusted its attack chains, including: • Adoption of ClickFix-style social engineering • More consistent targeting by geography and language • Delivery of a newer malware payload referred to as Tsundere Bot Proofpoint notes TA584’s operational tempo increased across 2025, with monthly campaigns tripling from March to December 2025. Active since at least November 2020, TA584 has used a range of delivery and filtering techniques to improve success rates and evade defences, including macro-enabled Excel lures, URL-based delivery with aggressive filtering, traffic distribution services (TDS), and geo-fenced landing pages.

Understanding the Russian cyber threat to the 2026 Winter Olympics unit42.paloaltonetworks.com/russian-c… Unit 42 assesses that the 2026 Winter Games in Milano Cortina face elevated cyber risk amid ongoing geopolitical tensions between Russia and the International Olympic Committee (IOC). Russia’s exclusion from the Olympic movement — driven primarily by geopolitical fallout from its 2022 invasion of Ukraine rather than earlier doping-related sanctions — has removed a historic stabilizing factor associated with participation on the global stage. The IOC indefinitely suspended Russia following the invasion, citing a violation of the Olympic Truce and subsequent actions involving regional sports councils in occupied Ukrainian territories. Within this context, Unit 42 warns that major international sporting events increasingly intersect with geopolitical competition, making them attractive targets for state-aligned cyber operations, influence campaigns and disruptive activity. The report highlights the potential for cyber operations aimed at reputational damage, service disruption or strategic signalling in advance of, or during, the Games, reinforcing the need for heightened defensive posture across event organizers, sponsors, telecommunications providers and supporting infrastructure.

Supply chain attack on eScan antivirus: Detecting and remediating malicious updates securelist.com/escan-sup… A supply chain attack targeting eScan antivirus, developed by India-based MicroWorld Technologies, was disclosed following malicious updates distributed on Jan. 20 through the vendor’s update server. The compromised update delivered a malicious file, Reload.exe, which initiated a multi-stage infection chain. Security solutions detected and blocked related activity the same day. On Jan. 21, after being notified by Morphisec, eScan developers contained the incident. According to Morphisec’s investigation, Reload.exe modified the system HOSTS file to block connections to security vendor infrastructure, preventing further antivirus updates and hindering automated remediation efforts. This interference contributed to update service errors and delayed corrective action. The incident underscores ongoing risks associated with trusted update mechanisms and the importance of monitoring update infrastructure, validating digital signatures and maintaining independent detection controls.

Aisuru botnet sets new record with 31.4 Tbps DDoS attack www.bleepingcomputer.com/news/secu… The Aisuru, also known as Kimwolf, botnet has set a new benchmark for distributed denial-of-service activity, launching an attack that peaked at 31.4 terabits per second and 200 million requests per second. The campaign, detected and mitigated by Cloudflare on Dec. 19, primarily targeted telecommunications providers and IT organizations. Cloudflare referred to the operation as “The Night Before Christmas,” describing it as an unprecedented bombardment. Aisuru previously held the DDoS record at 29.7 Tbps. Microsoft has also attributed a separate 15.72 Tbps attack to the botnet, involving approximately 500,000 IP addresses. The latest activity underscores the continued escalation in volumetric DDoS capabilities and the growing resilience required of telecommunications and critical digital infrastructure providers.

Clawdbot’s rename to Moltbot sparks impersonation campaign www.malwarebytes.com/blog/thre… Following a trademark dispute that forced the viral AI assistant Clawdbot to rebrand as Moltbot, threat actors rapidly launched an impersonation campaign targeting the project and its growing user base. Within days of the rename, researchers observed typosquatted domains and a cloned GitHub repository designed to impersonate the project’s creator. While the legitimate open-source codebase remains clean, the surrounding infrastructure tied to the fake domains raises concerns about potential supply-chain abuse. Clawdbot, created by Peter Steinberger and described as “Claude with hands,” gained rapid traction in early 2026. The self-hosted assistant enables users to control their computers through messaging platforms such as WhatsApp, Telegram and Discord. After Anthropic objected to the original name, the project was rebranded to Moltbot. Malwarebytes warns that the incident illustrates how quickly threat actors capitalize on high-visibility open-source projects. Rapid growth, brand transitions and public attention can create ideal conditions for typosquatting, repository cloning and downstream supply-chain compromise attempts.

Interlock Ransomware: New techniques, same old tricks www.fortinet.com/blog/thre… The Interlock ransomware group continues to target organizations globally, with a primary focus on U.K.- and U.S.-based entities, particularly in the education sector. Unlike many current ransomware actors, Interlock does not operate under a ransomware-as-a-service (RaaS) model. Fortinet assesses it to be a smaller, tightly controlled group that develops and deploys its own tooling across much of the attack lifecycle. The group has demonstrated an ability to evolve techniques and infrastructure in response to defensive measures. FortiGuard Incident Response recently investigated a new intrusion linked to Interlock, identifying early-stage indicators that align with activity previously reported by eSentire in July and elements of the Interlock ecosystem documented by Mandiant. The report highlights newly observed indicators of compromise and reinforces the need for proactive threat hunting, particularly for organizations in the education sector and those operating in the U.K. and U.S., as the group continues to refine its tradecraft.

Dissecting UAT-8099: New persistence mechanisms and regional focus blog.talosintelligence.com/uat-8099-… Cisco Talos has identified renewed activity from threat actor UAT-8099 spanning August 2025 through early 2026, targeting compromised Microsoft IIS servers across Asia. Impacted infrastructure has been observed in India, Pakistan, Thailand, Vietnam and Japan, with a notable concentration in Thailand and Vietnam. Talos assesses this campaign overlaps significantly with the previously reported WEBJACK operation, citing high-confidence correlations across malware hashes, command-and-control infrastructure, victim profiles and promoted gambling platforms. Operationally, UAT-8099 continues to rely on web shells, SoftEther VPN and EasyTier to maintain access to compromised IIS servers. However, Talos notes two key shifts: • A move toward more regionally focused black hat SEO campaigns • Increased use of red team frameworks and legitimate administrative tools to evade detection and establish long-term persistence The activity reflects a maturing tradecraft model that blends commodity web exploitation with enterprise-grade persistence techniques, complicating detection and remediation efforts.

No Place Like Home Network: Disrupting the world’s largest residential proxy network cloud.google.com/blog/topi… Google, in coordination with partners, has taken action against what it assesses to be one of the largest residential proxy networks globally — the IPIDEA proxy network. IPIDEA’s infrastructure enabled bad actors to route traffic through compromised residential devices, masking malicious activity behind legitimate consumer IP addresses. The network relied in part on software development kits (SDKs) embedded in mobile and desktop applications that covertly enrolled user devices into the proxy network. The disruption, led by Google Threat Intelligence Group (GTIG), included: • Legal action to seize and disrupt domains used to control infected devices and proxy traffic • Sharing technical intelligence on IPIDEA SDKs and proxy software with platform providers, law enforcement and research partners to drive broader ecosystem enforcement • Blocking and removing applications containing IPIDEA SDKs through Google Play Protect, and preventing future installations on certified Android devices Google stated that the objective is to limit the network’s ability to scale, protect users from covert device enrolment, and reduce the misuse of residential proxy infrastructure for cybercrime operations.

Ivanti warns of two EPMM flaws exploited in zero-day attacks www.bleepingcomputer.com/news/secu… Ivanti has disclosed two critical vulnerabilities in Ivanti Endpoint Manager Mobile (EPMM), tracked as CVE-2026-1281 and CVE-2026-1340, that have been exploited in zero-day attacks. Both are unauthenticated remote code execution flaws with a CVSS score of 9.8. Ivanti confirmed a limited number of customers were impacted at the time of disclosure. Successful exploitation could allow attackers to execute arbitrary code on vulnerable EPMM appliances and potentially access sensitive administrative, user and device data. Mitigations are available via RPM scripts: • RPM 12.x.0.x for EPMM 12.5.0.x, 12.6.0.x and 12.7.0.x • RPM 12.x.1.x for EPMM 12.5.1.0 and 12.6.1.0 Ivanti states the updates require no downtime and have no functional impact. Organizations should apply the mitigations immediately. CISA has added CVE-2026-1281 to its Known Exploited Vulnerabilities catalogue, reinforcing the urgency of remediation.

Operation Bizarre Bazaar: First Attributed LLMjacking Campaign with Commercial Marketplace Monetization www.pillar.security/blog/oper…

Between December 2025 and January 2026, Pillar Security Research team uncovered a disturbing evolution in AI-focused cyber threats. Our honeypots captured 35,000 attack sessions targeting exposed AI infrastructure.

We have named this campaign Operation Bizarre Bazaar. It represents the first public documentation of a systematic campaign targeting exposed LLM and Model Context Protocol (MCP) endpoints at scale, featuring complete commercial monetization. The investigation reveals how cybercriminals discover, validate, and monetize unauthorized access to AI infrastructure through a coordinated supply chain spanning reconnaissance, validation, and commercial resale.

Report: Attacks ‘Cascade’ From IT, OT to Patient Care www.databreachtoday.com/report-at…

Of the millions of threats detected in healthcare IT environments last year, email phishing, identity failures and device vulnerabilities were among the dominant vectors for non-clinical IT compromises - often “cascading” into patient care workflows and causing nearly $2 million a day in losses, said a new report from security firm Trellix.

Of 54.7 million threats detected by Trellix last year across its healthcare customers worldwide, 75% originated at U.S.-based organizations, with email incidents - including phishing - accounting for at least 85% of the detections, Trellix said.

The Milpitas, California-based security firm did not respond to Information Security Media Group’s request for the percentage of the company’s healthcare clients that are based in the United States.

“The most pressing weaknesses are email and identity failures, legacy medical and OT systems, and a lack of visibility into lateral movement and data exfiltration,” said Anne An, principal threat intelligence analyst at Trellix.

SolarWinds warns of critical Web Help Desk RCE, auth bypass flaws www.bleepingcomputer.com/news/secu…

SolarWinds has released security updates to patch critical authentication bypass and remote command execution vulnerabilities in its Web Help Desk IT help desk software.

The authentication bypass security flaws (tracked as CVE-2025-40552 and CVE-2025-40554) patched today by SolarWinds were reported by watchTowr’s Piotr Bazydlo and can be exploited by remote unauthenticated threat actors in low-complexity attacks.

Bazydlo also found and reported a critical remote code execution (RCE) flaw (CVE-2025-40553) stemming from an untrusted data deserialization weakness that can enable attackers without privileges to run commands on vulnerable hosts. A second RCE vulnerability (CVE-2025-40551) reported by Horizon3.ai security researcher Jimi Sebree can also enable unauthenticated attackers to execute commands remotely.

Malicious PyPI Packages spellcheckpy and spellcheckerpy Deliver Python RAT www.aikido.dev/blog/mali…

On January 20th and 21st, 2026, our malware detection pipeline flagged two new PyPI packages: spellcheckerpy and spellcheckpy. Both claimed to be the legitimate author of pyspellchecker library. Both are linked to his real GitHub repo.

They weren’t his.

Hidden inside the Basque language dictionary file was a base64-encoded payload that downloads a full-featured Python RAT. The attacker published three “dormant” versions first, payload present, trigger absent, then flipped the switch with spellcheckpy v1.2.0, adding an obfuscated execution trigger that fires the moment you import SpellChecker.

Unveiling the Weaponized Web Shell EncystPHP www.fortinet.com/blog/thre…

FortiGuard Labs has discovered a web shell that we named “EncystPHP.” It features several advanced capabilities, including remote command execution, persistence mechanisms, and web shell deployment. Incidents were launched in early December last year and propagated via exploitation of the FreePBX vulnerability CVE-2025-64328.

Its malicious activity appears to be associated with the hacker group INJ3CTOR3, first identified in 2020, which targeted CVE-2019-19006. In 2022, the threat actor shifted its focus to the Elastix system via CVE-2021-45461. These incidents begin with the exploitation of a FreePBX vulnerability, followed by the deployment of a PHP web shell in the target environments. We assess that this campaign represents recent attack activity and behavior patterns associated with INJ3CTOR3.

FBI seizes RAMP cybercrime forum used by ransomware gangs www.bleepingcomputer.com/news/secu…

The FBI has seized the notorious RAMP cybercrime forum, a platform used to advertise a wide range of malware and hacking services, and one of the few remaining forums that openly allowed the promotion of ransomware operations.

Both the forum’s Tor site and its clearnet domain, ramp4u[.]io, now display a seizure notice stating, “The Federal Bureau of Investigation has seized RAMP.”

“This action has been taken in coordination with the United States Attorney’s Office for the Southern District of Florida and the Computer Crime and Intellectual Property Section of the Department of Justice,” the notice reads.

AI’s safety features can be circumvented with poetry, research finds | AI (artificial intelligence) | The Guardian

Research from Italys Icaro Lab found that AI safety features can be circumvented using poetry, with models responding to harmful requests in 62% of poetic prompts. This “adversarial poetry” exploits the unpredictable nature of poems, making it difficult for AI models to detect harmful intent.