Security. In focus.

How real software downloads can hide remote backdoors | Malwarebytes

A campaign uses a fake RustDesk download site (rustdesk[.]work) to trick users into installing legitimate RustDesk alongside the Winos4.0 backdoor malware, which operates entirely in memory and blends its network traffic with legitimate remote desktop activity.

Victorian Department of Education says hackers stole students’ data

Hackers accessed a database of the Victorian Department of Education, stealing personal information and email addresses of current and former students, leading to password resets.

Cloud marketplace Pax8 accidentally exposes data on 1,800 MSP partners

Cloud marketplace Pax8 accidentally emailed a spreadsheet with internal business and licensing data for approximately 1,800 MSP partners to fewer than 40 recipients, and threat actors are reportedly seeking to purchase the exposed dataset.

Online shoppers at risk as Magecart skimming hits major payment networks | Malwarebytes

A Magecart campaign is targeting major payment networks like American Express and Mastercard, using web skimming to steal online shoppers' payment and personal data through malicious JavaScript injected into checkout pages.

Direct and reverse NFC relay attacks being used to steal money | Kaspersky official blog

Kaspersky’s official blog details how criminals exploit NFC relay attacks, including direct and reverse methods, to steal money by tricking users into installing malicious apps and either relaying card data or emulating cards at ATMs.

Belgian hospital AZ Monica shuts down servers after cyberattack

Belgian hospital AZ Monica shut down servers and canceled procedures due to a cyberattack, transferring critical patients to other facilities while continuing essential care.

Analyzing a Multi-Stage AsyncRAT Campaign via Managed Detection and Response www.trendmicro.com/en_us/res… AsyncRAT has emerged as a notable remote access trojan (RAT) used by threat actors for its robust capabilities and ease of deployment. It gained favour for its extensive feature set, which includes keylogging, screen capturing, and remote command execution capabilities. Its modular architecture, typically implemented in Python, provides flexibility and ease of customization, making it a preferred tool of choice for cybercriminals. During Trend Micro’s investigation of AsyncRAT infections, Python scripts played a central role in the infection chain, automating various stages of the attack. The initial payload, a Windows Script Host (WSH) file, was designed to download and execute additional malicious scripts hosted on a WebDAV server. These scripts facilitated the download of batch files and further payloads, enabling a seamless and persistent infection routine. The attackers exploited Cloudflare’s free-tier services to host their WebDAV server, abusing the platform’s reliability and widespread trust to evade detection. By using Cloudflare’s infrastructure, the threat actors masked malicious activity under legitimate domains, making it challenging for traditional security solutions to identify and block the threat. Similar behaviour was documented previously by other researchers. Since then, there have been changes in the scripts’ behaviour, as well as differences in the primary payloads. This entry dissects the attack chain from initial compromise through AsyncRAT deployment, examining the attacker’s techniques for system infiltration and persistent access.

Sweden detains ex-military IT consultant suspected of spying for Russia therecord.media/sweden-de… A 33-year-old former IT consultant for Sweden’s Armed Forces has been detained on suspicion of spying for Russian intelligence, Swedish prosecutors said on Friday. The suspected criminal activity took place throughout 2025 and into the new year, but Swedish authorities believe the espionage may have been ongoing since 2022, the year Russia launched its full-scale invasion of Ukraine. Senior prosecutor Mats Ljungqvist declined to provide further details, citing the sensitivity of the ongoing investigation. Citing an Armed Forces spokesperson, Swedish media reported that the suspect lives in central Sweden and previously worked with the military from 2018 until 2022 as a consultant through an IT services company. The man is also registered as the head of a cybersecurity firm focused on “offensive cyber operations,” which reportedly has no recorded turnover.

Hungary grants asylum to former Polish minister implicated in spyware probe therecord.media/hungary-a… Hungary has granted political asylum to Poland’s former justice minister, Zbigniew Ziobro, who is being prosecuted for his role in a spyware scandal that has rocked the country. Ziobro is facing dozens of charges for allegedly embezzling money meant for crime victims to pay for spyware used to snoop on the devices of political opponents. One of the highest-profile people implicated in Poland’s sprawling spyware scandal, Ziobro said on X that he intends to accept Hungary’s asylum offer “due to the political persecution in Poland.” “I have decided to remain abroad until genuine guarantees of the rule of law are restored in Poland,” Ziobro posted. “I believe that instead of acquiescing to being silenced and subjected to a torrent of lies—which I would have no opportunity to refute—I can do more by fighting the mounting lawlessness in Poland.”

A company handed out real gold as a year-end bonus — and it raises an interesting question about rewards, culture and leadership in a competitive tech market. Here’s what Dreame Technology’s approach says about recognition and growth.

kiledjian.com/2026/01/1…

Executives worry most about cyber-enabled fraud, geopolitics and AI | Cybersecurity Dive

A World Economic Forum report reveals executives are most concerned about cyber-enabled fraud, followed by AI-related vulnerabilities and geopolitics, with strong global support for cyber regulation.

US prepares for cyber war with Iran

The US is considering cyber warfare options against Iran in response to the regime’s crackdown on protesters, including amplifying anti-government messages online and deploying cyber weapons, while also exploring ways to bypass Iran’s internet blackout.

1Password Focuses on Identity Security in Agentic AI Era

1Password is enhancing its identity security platform to manage machine identities for agentic AI, appointing former AWS exec Nancy Wang as CTO to lead this strategy.

Cybersecurity jobs available right now: January 13, 2026 - Help Net Security

This article lists current cybersecurity job openings as of January 13, 2026, including roles like CISO, Cyber Defense Specialist, and various Cybersecurity Engineer positions across different global locations and industries.

Rakuten Viber CISO/CTO on balancing encryption, abuse prevention, and platform resilience - Help Net Security

Liad Shnell, CISO and CTO at Rakuten Viber, discusses the challenges of balancing end-to-end encryption with abuse prevention and platform resilience, emphasizing that security decisions must prioritize user safety and availability, especially during crises.

DeVixor: An Evolving Android Banking RAT With Ransomware Capabilities Targeting Iran - Cyble

Cyble has analyzed deVixor, an evolving Android banking RAT targeting Iranian users with capabilities including SMS harvesting, credential theft via JavaScript injection, and ransomware, distributed through phishing websites.

New Malware Campaign Delivers Remcos RAT Through Multi-Stage Windows Attack

A new malware campaign named SHADOW#REACTOR uses a multi-stage Windows attack to deliver the Remcos RAT, employing evasive techniques like text-only stagers and in-memory execution to bypass detection.

Spanish Energy Company Endesa Hacked - SecurityWeek

Spanish energy company Endesa confirmed a data breach affecting customer information, including contact details and payment information, after unauthorized access to its commercial platform.

Remote Code Execution With Modern AI/ML Formats and Libraries

Vulnerabilities in three AI/ML Python libraries (NeMo, Uni2TS, FlexTok) from NVIDIA, Salesforce, and Apple allow for remote code execution when loading malicious model files, with fixes released by all vendors.

XDR * eBPF = CADR - by Andrew Green - Green Abstracts

Article claims: XDR, an extension of EDR, is critiqued for its user-space limitations, suggesting eBPF as a superior alternative for enhanced kernel-level visibility and control across various infrastructure components, leading to solutions like Cloud App Detection and Response (CADR).

For application security: SCA, SAST, DAST and MAST. What next? | CSO Online

The article argues that traditional application security tools like SCA, SAST, and DAST are no longer sufficient and that the future lies in Application Security Posture Management (ASPM), software supply chain integrity (provenance), and verifiable proof of security, emphasizing a shift from alert-driven approaches to a more integrated and context-aware security strategy.

SAP’s January 2026 Security Updates Patch Critical Vulnerabilities - SecurityWeek

SAP’s January 2026 Security Patch Day addresses 17 new security notes, including four critical vulnerabilities related to SQL injection and code execution in S/4HANA and Wily Introscope Enterprise Manager.

Artificial brains could point the way to ultra-efficient supercomputers www.theregister.com/2026/01/0…

New research from Sandia National Laboratories suggests that brain-inspired neuromorphic computers are just as adept at solving complex mathematical equations as they are at speeding up neural networks and could eventually pave the way to ultra-efficient supercomputers.

Running on around 20 watts, the human brain is able to process vast quantities of sensory information from our environment without interrupting consciousness. For decades, researchers have been trying to replicate these processes in silicon, in what is commonly referred to as neuromorphic computing.

Sandia has been at the center of much of this research. The lab has deployed numerous neuromorphic systems from the likes of Intel, SpiNNaker, and IBM over the past several years.

Much of the research around these systems has focused on things like artificial intelligence and machine learning. But as it turns out, these brain-inspired chips are much more versatile.

Brussels plots open source push to pry Europe off Big Tech www.theregister.com/2026/01/1…

The European Commission has launched a fresh consultation into open source, setting out its ambitions for Europe’s developer communities to go beyond propping up US tech giants' platforms.

In a “Call for Evidence” published this week, Brussels says the EU’s reliance on non-European technology suppliers (read: US tech giants) has become a strategic liability, limiting choice, weakening competitiveness, and creating supply chain risks across everything from cloud services to critical infrastructure. The consultation, which will run from January 6 to February 3, is an early move toward a formal strategy on “European Open Digital Ecosystems,” which would treat open source as core infrastructure rather than a nice-to-have.

According to the Commission, dependence on foreign vendors makes it harder for Europe to control its digital stack, potentially opening the door to security and resilience issues in sensitive sectors. Open source offers a way out of that bind by underpinning “a diverse portfolio of high-quality and secure digital solutions” that can act as viable alternatives to proprietary platforms, the EC said.

Instagram denies breach amid claims of 17 million account data leak www.bleepingcomputer.com/news/secu…

Instagram says it fixed a bug that allowed threat actors to mass-request password reset emails, amid claims that data from more than 17 million Instagram accounts was scraped and leaked online.

“We fixed an issue that allowed an external party to request password reset emails for some Instagram users,” a Meta spokesperson told BleepingComputer.

“We want to reassure everyone there was no breach of our systems and people’s Instagram accounts remain secure. People can disregard these emails and we apologize for any confusion this may have caused.”

A media frenzy over an alleged Instagram data breach began after Malwarebytes warned its customers that cybercriminals had stolen data from 17.5 million accounts.

This alleged Instagram data was released for free on numerous hacking forums, with the poster claiming it was gathered through an unconfirmed 2024 Instagram API leak.