Security. In focus.

OpenAI Wants To Use Biometrics To Kill Bots And Create Humans Only Social Network

OpenAI is developing a social network aiming to eliminate bots by potentially using biometric verification like iris scans or Face ID. This initiative seeks to create a real-humans-only platform, addressing the pervasive bot problem seen on other social media sites.

A rash of scam spam is coming from a real Microsoft address Source: Ars Technica arstechnica.com/informati… Reports describe a wave of scam emails originating from an authentic Microsoft email address, increasing the likelihood recipients will trust the messages. The issue underscores the practical risk of brand trust abuse when attackers can leverage legitimate infrastructure or sending pathways to improve delivery and credibility.

Cyberattack on Poland’s power grid hit around 30 energy facilities, report says Source: The Record therecord.media/poland-el… A new report said a coordinated cyberattack targeting Poland’s power grid in late December compromised control and communications systems at roughly 30 facilities tied to distributed energy generation. The coverage attributes the findings to Dragos and positions the incident as affecting operational technology and grid-adjacent environments.

Two high-severity n8n flaws allow authenticated remote code execution Source: The Hacker News thehackernews.com/2026/01/t… Researchers disclosed two vulnerabilities in the n8n workflow automation platform, including a flaw that could lead to remote code execution under certain conditions for authenticated users. The report highlights the risk profile for automation platforms that often have broad connectivity, credentials, and execution capabilities in enterprise environments.

Critical vm2 Node.js flaw allows sandbox escape and arbitrary code execution Source: The Hacker News thehackernews.com/2026/01/c… A critical vulnerability in the vm2 Node.js sandbox library, tracked as CVE-2026-22709, could allow an attacker to escape the sandbox and execute arbitrary code on the host operating system. The issue is particularly relevant for systems that run untrusted JavaScript in “sandboxed” contexts and rely on vm2 for isolation.

Hackers hijack exposed LLM endpoints in “Bizarre Bazaar” operation Source: BleepingComputer www.bleepingcomputer.com/news/secu… Researchers reported an active campaign targeting exposed or weakly authenticated large language model (LLM) service endpoints to monetize unauthorized access to AI infrastructure. Pillar Security said its honeypots logged more than 35,000 attack sessions over 40 days, and assessed the activity as one of the first “LLMjacking” operations attributed to a specific actor.

Why Microsoft routed example.com traffic to a company in Japan Source: Ars Technica arstechnica.com/informati… Microsoft has remediated an unusual network anomaly that resulted in traffic destined for example.com—a domain reserved exclusively for testing—being routed to an electronics cable manufacturer located in Japan. Under RFC 2606, an Internet Engineering Task Force (IETF) standard, example.com is not intended to be reachable by any organization. Instead, it resolves to IP addresses assigned to the Internet Assigned Numbers Authority (IANA). This designation is designed to prevent unintended traffic from reaching third parties when developers, penetration testers and others require a non-routable domain for testing or documentation purposes. Alongside example.com, the domains example.net and example.org are similarly reserved for this purpose. Developers are explicitly instructed to use these domains instead of live, Internet-routable addresses to avoid accidental traffic exposure.

From cipher to fear: The psychology behind modern ransomware extortion Source: BleepingComputer www.bleepingcomputer.com/news/secu… For years, security teams treated ransomware primarily as a technological problem. Defensive strategies focused on hardening backup systems, deploying endpoint detection capabilities, rehearsing incident response playbooks centred on data recovery, and reducing attack surface to prevent initial access. By 2025, this approach has become increasingly ineffective. Modern ransomware operations have evolved beyond simple file encryption into highly systematized extortion campaigns that leverage stolen data, regulatory and legal exposure, and sustained psychological pressure at scale. As a result, the traditional remediation model of restoring from backup is no longer sufficient. Organizations must now be prepared to address data exposure, legal and regulatory liability, and reputational damage as core elements of their ransomware response strategy.

Russian security systems firm Delta hit by cyberattack, services disrupted Source: The Record therecord.media/russia-de… A cyberattack has disrupted operations at Delta, a Russian provider of alarm and security systems for residential, commercial and vehicle use, resulting in widespread service outages and customer complaints. Delta said on Monday that it was the victim of a “large-scale, coordinated and well-organized” cyberattack originating from an unspecified “hostile foreign state.” The company acknowledged temporary service disruptions but stated that it has no evidence that customer personal data was compromised. In a video address, Delta marketing director Valery Ushkov said the company’s architecture was unable to withstand a coordinated external attack. He added that recovery efforts were ongoing, noting that the restoration of backups was taking time while the organization remained at risk of follow-on attacks.

HoneyMyte updates CoolClient and deploys multiple stealers in recent campaigns Source: Securelist (Kaspersky) securelist.com/honeymyte… Over the past several years, researchers have monitored the espionage activities of HoneyMyte, also known as Mustang Panda or Bronze President, across Asia and Europe, with Southeast Asia identified as the most heavily targeted region. Government entities remain the primary targets of the group’s operations. As an advanced persistent threat (APT) group, HoneyMyte employs a diverse and sophisticated toolset to support its campaigns. Known tooling includes ToneShell, PlugX, Qreverse, and CoolClient backdoors, as well as Tonedisk and SnakeDisk USB worms, among others. In 2025, HoneyMyte was observed modernizing its capabilities by enhancing the CoolClient backdoor with additional functionality, deploying multiple variants of browser credential stealers, and leveraging a range of scripts designed to support data theft and reconnaissance activities.

Diverse threat actors exploiting critical WinRAR vulnerability (CVE-2025-8088) Source: Google Cloud Threat Intelligence cloud.google.com/blog/topi… The Google Threat Intelligence Group (GTIG) has identified widespread, ongoing exploitation of CVE-2025-8088, a critical vulnerability in WinRAR, a widely used file archiving utility for Windows. The flaw is being leveraged to establish initial access and deliver a range of malicious payloads. Discovered and patched in July 2025, the vulnerability continues to be exploited as an n-day by a broad set of adversaries. These include government-backed threat actors linked to Russia and China, as well as financially motivated cybercriminal groups operating across multiple, unrelated campaigns. The exploitation technique is consistent across observed activity and involves a path traversal flaw that enables attackers to place files into the Windows Startup folder, thereby achieving persistence. GTIG notes that the continued success of this technique highlights enduring gaps in basic application security controls and user awareness. In its blog post, GTIG provides an overview of CVE-2025-8088, details the typical exploit chain, outlines observed activity from both financially motivated and state-sponsored espionage actors, and supplies indicators of compromise (IOCs) to support detection and threat-hunting efforts.

Have I Been Pwned: SoundCloud data breach impacts 29.8 million accounts Source: BleepingComputer www.bleepingcomputer.com/news/secu… Hackers have stolen personal and contact information associated with more than 29.8 million SoundCloud user accounts following a breach of the audio streaming platform’s systems. Founded in 2007 as an artist-first platform, SoundCloud now hosts more than 400 million tracks from over 40 million artists worldwide. SoundCloud confirmed the incident on Dec. 15, after users reported being unable to access the service and encountering 403 “Forbidden” errors when connecting via VPN. At the time, SoundCloud told BleepingComputer that it had activated its incident response procedures after detecting unauthorized activity involving an ancillary service dashboard. In a statement, SoundCloud said: “We understand that a purported threat actor group accessed certain limited data that we hold. We have completed an investigation into the data that was impacted, and no sensitive data (such as financial or password data) has been accessed. The data involved consisted only of email addresses and information already visible on public SoundCloud profiles.”

Microsoft Office zero-day (CVE-2026-21509): Emergency patch issued for active exploitation Source: The Hacker News thehackernews.com/2026/01/m… Microsoft on Monday issued out-of-band security updates to address a high-severity Microsoft Office zero-day vulnerability that is being actively exploited. The vulnerability, tracked as CVE-2026-21509, has a CVSS score of 7.8 and is classified as a security feature bypass affecting Microsoft Office. In an advisory, Microsoft stated: “Reliance on untrusted inputs in a security decision in Microsoft Office allows an unauthorized attacker to bypass a security feature locally. This update addresses a vulnerability that bypasses OLE mitigations in Microsoft 365 and Microsoft Office, which protect users from vulnerable COM/OLE controls.” Successful exploitation requires an attacker to deliver a specially crafted Office document and persuade a target to open it. Microsoft noted that the Preview Pane is not an attack vector for this vulnerability.

Over 6,000 SmarterMail servers exposed to automated hijacking attacks Source: BleepingComputer www.bleepingcomputer.com/news/secu… Nonprofit security organization Shadowserver has identified more than 6,000 SmarterMail servers exposed online and likely vulnerable to active exploitation of a critical authentication bypass vulnerability. Cybersecurity firm watchTowr reported the flaw to SmarterTools on Jan. 8. A fix was released on Jan. 15, initially without an assigned vulnerability identifier. The issue was subsequently assigned CVE-2026-23760 and rated critical severity. The vulnerability allows unauthenticated attackers to hijack administrator accounts and achieve remote code execution on affected hosts, potentially resulting in full server compromise. According to an advisory added to the NIST National Vulnerability Database on Thursday: “SmarterTools SmarterMail versions prior to build 9511 contain an authentication bypass vulnerability in the password reset API.”

Starbucks Removes $250,000-a-Year Cap for CEO’s Private Jet Use - Bloomberg

Starbucks Removes CEO Jet Expense Cap

Following a security review, Starbucks now mandates CEO Brian Niccol use the company jet for all travel—personal and business—with no reimbursement required.

Previously capped at $250,000/year, personal jet use is now fully covered. The board cited “credible threat actors” and heightened security risks post-UnitedHealthcare CEO shooting.

FY2025 costs: $1.1M security, ~$1M jet usage, $370K+ housing expenses.

Part of a broader trend: many US companies are requiring CEOs to use corporate jets and enhancing executive security measures.​​​​​​​​​​​​​​​​

Cloudflare Misconfiguration Behind Recent BGP Route Leak BleepingComputer www.bleepingcomputer.com/news/secu… Cloudflare has released additional details regarding a 25-minute Border Gateway Protocol (BGP) route leak that affected IPv6 traffic. The incident resulted in measurable network congestion, packet loss, and approximately 12 Gbps of dropped traffic. BGP is the routing protocol used to exchange routing information between autonomous systems (AS), enabling traffic to traverse multiple interconnected networks to reach its destination. In this case, the disruption was caused by an accidental routing policy misconfiguration on a Cloudflare router. The impact extended beyond Cloudflare customers, affecting external networks across the broader internet. In a statement addressing the incident, Cloudflare noted that on Jan. 22 it unintentionally accepted routes from certain peers and redistributed them from its Miami location to other peers and upstream providers. According to Cloudflare, and based on the definitions outlined in RFC 7908, the event constituted a combination of Type 3 and Type 4 BGP route leaks.

Who Operates the Badbox 2.0 Botnet? Krebs on Security krebsonsecurity.com/2026/01/w… The operators of Kimwolf, a disruptive botnet that has infected more than two million devices, recently shared a screenshot suggesting they had compromised the control panel of Badbox 2.0. Badbox 2.0 is a large China-based botnet powered by malicious software pre-installed on many Android TV streaming boxes. Both the FBI and Google have confirmed they are actively pursuing those responsible. Due to public boasting by the Kimwolf operators, additional insight into the actors behind Badbox 2.0 has now emerged. An earlier 2026 report, The Kimwolf Botnet Is Stalking Your Local Network, detailed the highly invasive propagation techniques used by Kimwolf. That analysis highlighted that the majority of infected systems were unofficial Android TV devices, commonly marketed as one-time-purchase platforms for accessing pirated movie and television streaming services. A subsequent report published on Jan. 8, Who Benefitted from the Aisuru and Kimwolf Botnets?, cited multiple sources identifying the current Kimwolf administrators by the online aliases “Dort” and “Snow.” More recently, a former close associate of these individuals provided a screenshot allegedly captured by the Kimwolf operators while logged into the Badbox 2.0 botnet control panel.

APT Attacks Target Indian Government Using GOGITTER, GITSHELLPAD, and GOSHELL | Part 1 Zscaler ThreatLabz www.zscaler.com/blogs/sec… In September 2025, Zscaler ThreatLabz identified two distinct threat campaigns, tracked as Gopher Strike and Sheet Attack. The activity was attributed to a Pakistan-based threat actor primarily targeting Indian government entities. Across both campaigns, ThreatLabz identified previously undocumented tools, techniques and procedures (TTPs). While the observed activity shares certain characteristics with the Pakistan-linked advanced persistent threat (APT) group APT36, ThreatLabz assesses with medium confidence that this activity may originate from a new subgroup or a separate Pakistan-linked actor operating in parallel. This blog post is the first in a two-part series focusing on the Gopher Strike campaign. It details: GOGITTER, an initial-stage downloader GITSHELLPAD, a backdoor used for command-and-control (C2) communications GOSHELL, a Golang-based shellcode loader used to deploy a Cobalt Strike Beacon The second part of the series will examine the Sheet Attack campaign in detail, including the full attack chain, associated backdoors, and the use of generative AI in malware development.

PeckBirdy: A Versatile Script Framework for LOLBins Exploitation Used by China-Aligned Threat Groups Trend Micro Research www.trendmicro.com/en_us/res… Since 2023, researchers have observed multiple threat campaigns leveraging a previously undocumented, script-based command-and-control (C&C) framework, now designated PeckBirdy. These campaigns targeted organizations within the Chinese gambling sector, as well as government entities and private organizations across Asia. During the investigation, at least two distinct campaigns using PeckBirdy were identified. These campaigns were attributed to several China-aligned advanced persistent threat (APT) actors. Preliminary findings were previously presented at the HitCon conference in August 2025. This publication expands on that research to share the findings with a broader audience. PeckBirdy is a script-based framework implemented in JScript, an older scripting language. Despite its age, JScript was deliberately chosen to ensure broad compatibility across execution environments by leveraging LOLBins (living-off-the-land binaries). This design enables flexible deployment across multiple stages of the attack lifecycle. Observed use cases include: Operation as a watering-hole control server during the initial access phase Functioning as a reverse shell server during lateral movement Serving as a full C&C server during the backdoor phase This versatility highlights PeckBirdy’s role as a modular and adaptable framework within sophisticated, multi-stage intrusion campaigns.

VulnCheck: State of Exploitation 2026 www.vulncheck.com/blog/stat… In 2025, VulnCheck identified 884 Known Exploited Vulnerabilities (KEVs) for which evidence of exploitation was observed for the first time. By using the CVE publication date as a proxy for when defenders typically become aware of a vulnerability, the analysis provides insight into how quickly exploitation follows disclosure. The findings indicate that 28.96 per cent of KEVs in 2025 were exploited on or before the day their CVE was published. This represents an increase from the 23.6 per cent reported in VulnCheck’s 2024 trends in exploitation report, underscoring the continued prevalence of both zero-day and n-day exploitation. The results reinforce the urgency for organizations to act rapidly on newly disclosed vulnerabilities while continuing to reduce long-standing vulnerability backlogs. Throughout 2025, initial evidence of exploitation was reported by more than 100 unique organizations, including security researchers, cybersecurity vendors, and software suppliers. Attackers continued to prioritize internet-facing and widely deployed technologies, while also opportunistically targeting a long tail of enterprise software, hardware, and emerging technologies, including artificial intelligence.

Europe’s GCVE Raises Concerns Over Fragmentation in Vulnerability Databases www.darkreading.com/cyber-ris… In response to continued uncertainty around the future of the MITRE-run Common Vulnerabilities and Exposures (CVE) program, a European cybersecurity organization has launched the Global CVE Allocation System (GCVE) to identify software security vulnerabilities. Experts anticipate this move could lead to significant fragmentation in how organizations track and manage security flaws. The existing CVE program experienced notable instability in 2025. Government funding nearly ceased last April, a situation that would have forced a complete shutdown of the program. A last-minute contract extension between the Cybersecurity and Infrastructure Security Agency (CISA) and MITRE preserved the CVE program; however, that contract is set to expire this March. With the future of CVE funding still uncertain, several organizations have begun exploring competing models. The European Union’s GCVE is a vulnerability identification and numbering system designed to “improve flexibility, scalability, and autonomy for participating entities,” according to its website. Operated by the Computer Incident Response Center Luxembourg (CIRCL), the initiative has been in development since last April. The GCVE system is positioned within the European Union’s broader cybersecurity infrastructure, which includes the European Union Vulnerability Database. That database is based on CIRCL’s vulnerability-lookup software.

Microsoft releases emergency OOB update to fix Outlook freezes www.bleepingcomputer.com/news/micr…

Microsoft has released emergency, out-of-band updates on Saturday for Windows 10, Windows 11, and Windows Server to fix an issue that prevented Microsoft Outlook classic from opening when using PSTs stored in cloud storage. Since Microsoft released the January 2026 Patch Tuesday updates, Outlook app users have been encountering freezes when opening the application if a PST file is stored in cloud storage, such as OneDrive and Dropbox.

A Microsoft Outlook PST file is a data file used by the application to store a user’s email and other data locally on their computer instead of on the mail server. In enterprise environments, these files are commonly used to access mail when offline and back up important messages.

“After installing Windows updates released on or after January 13, 2026 (the Originating KBs listed above), some applications might become unresponsive or experience unexpected errors when opening files from or saving files to cloud-backed storage, such as OneDrive or Dropbox,” explains Microsoft.

ESET Research: Sandworm behind cyberattack on Poland’s power grid in late 2025

ESET Research attributes the cyberattack on Polands power grid in late 2025 to the Russia-aligned Sandworm APT group, utilizing data-wiping malware named DynoWiper. This incident occurred on the 10th anniversary of a similar Sandworm attack on the Ukrainian power grid.

Ransomware.live - Victim: KPMG

The Nova ransomware group has targeted KPMG, a global professional services firm, with an estimated attack date of January 23, 2026. The group claims KPMG Netherlands has 10 days to contact them regarding the breach.

New DPRK Interview Campaign Leverages Fake Fonts to Deploy Malware

The Lazarus Group has initiated a Fake Font campaign, a sophisticated supply chain attack targeting software developers through fake job interviews and malicious GitHub repositories. This campaign employs fake font files to deploy the InvisibleFerret malware, designed to steal sensitive information and gain long-term access to compromised systems.