Security. In focus.

Rakuten Viber CISO/CTO on balancing encryption, abuse prevention, and platform resilience - Help Net Security

Liad Shnell, CISO and CTO at Rakuten Viber, discusses the challenges of balancing end-to-end encryption with abuse prevention and platform resilience, emphasizing that security decisions must prioritize user safety and availability, especially during crises.

DeVixor: An Evolving Android Banking RAT With Ransomware Capabilities Targeting Iran - Cyble

Cyble has analyzed deVixor, an evolving Android banking RAT targeting Iranian users with capabilities including SMS harvesting, credential theft via JavaScript injection, and ransomware, distributed through phishing websites.

New Malware Campaign Delivers Remcos RAT Through Multi-Stage Windows Attack

A new malware campaign named SHADOW#REACTOR uses a multi-stage Windows attack to deliver the Remcos RAT, employing evasive techniques like text-only stagers and in-memory execution to bypass detection.

Spanish Energy Company Endesa Hacked - SecurityWeek

Spanish energy company Endesa confirmed a data breach affecting customer information, including contact details and payment information, after unauthorized access to its commercial platform.

Remote Code Execution With Modern AI/ML Formats and Libraries

Vulnerabilities in three AI/ML Python libraries (NeMo, Uni2TS, FlexTok) from NVIDIA, Salesforce, and Apple allow for remote code execution when loading malicious model files, with fixes released by all vendors.

XDR * eBPF = CADR - by Andrew Green - Green Abstracts

Article claims: XDR, an extension of EDR, is critiqued for its user-space limitations, suggesting eBPF as a superior alternative for enhanced kernel-level visibility and control across various infrastructure components, leading to solutions like Cloud App Detection and Response (CADR).

For application security: SCA, SAST, DAST and MAST. What next? | CSO Online

The article argues that traditional application security tools like SCA, SAST, and DAST are no longer sufficient and that the future lies in Application Security Posture Management (ASPM), software supply chain integrity (provenance), and verifiable proof of security, emphasizing a shift from alert-driven approaches to a more integrated and context-aware security strategy.

SAP’s January 2026 Security Updates Patch Critical Vulnerabilities - SecurityWeek

SAP’s January 2026 Security Patch Day addresses 17 new security notes, including four critical vulnerabilities related to SQL injection and code execution in S/4HANA and Wily Introscope Enterprise Manager.

Artificial brains could point the way to ultra-efficient supercomputers www.theregister.com/2026/01/0…

New research from Sandia National Laboratories suggests that brain-inspired neuromorphic computers are just as adept at solving complex mathematical equations as they are at speeding up neural networks and could eventually pave the way to ultra-efficient supercomputers.

Running on around 20 watts, the human brain is able to process vast quantities of sensory information from our environment without interrupting consciousness. For decades, researchers have been trying to replicate these processes in silicon, in what is commonly referred to as neuromorphic computing.

Sandia has been at the center of much of this research. The lab has deployed numerous neuromorphic systems from the likes of Intel, SpiNNaker, and IBM over the past several years.

Much of the research around these systems has focused on things like artificial intelligence and machine learning. But as it turns out, these brain-inspired chips are much more versatile.

Brussels plots open source push to pry Europe off Big Tech www.theregister.com/2026/01/1…

The European Commission has launched a fresh consultation into open source, setting out its ambitions for Europe’s developer communities to go beyond propping up US tech giants' platforms.

In a “Call for Evidence” published this week, Brussels says the EU’s reliance on non-European technology suppliers (read: US tech giants) has become a strategic liability, limiting choice, weakening competitiveness, and creating supply chain risks across everything from cloud services to critical infrastructure. The consultation, which will run from January 6 to February 3, is an early move toward a formal strategy on “European Open Digital Ecosystems,” which would treat open source as core infrastructure rather than a nice-to-have.

According to the Commission, dependence on foreign vendors makes it harder for Europe to control its digital stack, potentially opening the door to security and resilience issues in sensitive sectors. Open source offers a way out of that bind by underpinning “a diverse portfolio of high-quality and secure digital solutions” that can act as viable alternatives to proprietary platforms, the EC said.

Instagram denies breach amid claims of 17 million account data leak www.bleepingcomputer.com/news/secu…

Instagram says it fixed a bug that allowed threat actors to mass-request password reset emails, amid claims that data from more than 17 million Instagram accounts was scraped and leaked online.

“We fixed an issue that allowed an external party to request password reset emails for some Instagram users,” a Meta spokesperson told BleepingComputer.

“We want to reassure everyone there was no breach of our systems and people’s Instagram accounts remain secure. People can disregard these emails and we apologize for any confusion this may have caused.”

A media frenzy over an alleged Instagram data breach began after Malwarebytes warned its customers that cybercriminals had stolen data from 17.5 million accounts.

This alleged Instagram data was released for free on numerous hacking forums, with the poster claiming it was gathered through an unconfirmed 2024 Instagram API leak.

Why attackers are phishing on LinkedIn (and how to stop it) www.pandasecurity.com/en/mediac…

Phishing isn’t just an email problem anymore. Attackers now use social media, search results, and messaging apps to reach victims, and research suggests that about 1 in 3 phishing attacks happen outside the inbox.

LinkedIn has become a particularly attractive channel because it blends professional trust, easy access to corporate decision-makers, and direct messaging that many security teams can’t monitor the same way they do email. This article explains why LinkedIn phishing works so well and what practical steps you can take to reduce the risk of account compromise and downstream business impact.

Ireland recalls almost 13,000 passports over missing ‘IRL’ code www.bleepingcomputer.com/news/secu…

Ireland’s Department of Foreign Affairs has recalled nearly 13,000 passports after a software update caused a printing defect.

The printing error makes the documents non-compliant with international travel standards and potentially unreadable at automated border gates.

The government said the affected passports, issued between December 23 and January 6, may fail at eGates and border control systems worldwide, prompting a global alert through the International Civil Aviation Organisation (ICAO) and a mass re-issuance program.

Holders are being asked to return their passport books (and cards, where applicable) for free replacement, with new documents to be issued within approximately 10 working days.

Reborn in Rust: Muddy Water Evolves Tooling with RustyWater Implant www.cloudsek.com/blog/rebo…

CloudSEK’s TRIAD recently identified a spearphishing campaign attributed to the Muddy Water APT group targeting multiple sectors across the Middle East, including diplomatic, maritime, financial, and telecom entities. The campaign uses icon spoofing and malicious Word documents to deliver Rust based implants capable of asynchronous C2, anti-analysis, registry persistence, and modular post-compromise capability expansion.

Historically, Muddy Water has relied on PowerShell and VBS loaders for initial access and post-compromise operations. The introduction of Rust-based implants represents a notable tooling evolution toward more structured, modular, and low noise RAT capabilities.

Although this Rust-based implant has appeared in limited reporting under names like Archer RAT / RUSTRIC, it remains far less documented than Muddy Water’s legacy PowerShell/VBS tooling. To avoid name collisions and for sanity, we refer to this variant as RustyWater throughout this report

Spain arrests 34 suspects linked to Black Axe cyber crime

Authorities in Spain have arrested 34 suspects linked to the Black Axe criminal network, believed to be involved in cyber fraud, including Business Email Compromise (BEC) scams, with damages exceeding $6 million over 15 years. The operation, supported by Europol, resulted in the seizure of cash, electronic devices, and frozen bank accounts, with four main suspects facing charges including aggravated fraud and money laundering.

North Korea–linked APT Kimsuky behind quishing attacks, FBI warns

The FBI has issued a warning that the North Korea-linked APT group Kimsuky is conducting quishing attacks targeting governments, think tanks, and academic institutions. These attacks involve spear-phishing emails with malicious QR codes that lead to credential harvesting pages, and have been observed in campaigns during May and June 2025.

BreachForums hacking forum database leaked, exposing 324,000 accounts

The BreachForums hacking forum experienced a data leak exposing a database with 324,000 accounts, including usernames, registration dates, and IP addresses. Initially, the forum’s administrator stated that a backup was briefly exposed, but later it was revealed that the PGP private key associated with the forum was also leaked and its password subsequently published.

Largest Outages of 2025: A Downdetector Analysis | Ookla®

In his latest Ookla analysis, Perry Haghighi details how 2025 became a year of “Logic Layer” failures rather than hardware crashes. For Security and IT professionals, these stats illustrate the terrifying reach of centralized dependencies: The AWS mega-outage on Oct 20 (US-EAST-1) was the year’s largest, generating 17 million global reports. Traced to automated DNS management for DynamoDB, the 15-hour event crippled “isolated” apps like Snapchat (944k reports) and Netflix, proving that control plane logic is now our biggest single point of failure. Gaming and streaming weren’t far behind. The Feb 7 PlayStation Network blackout lasted 24 hours with 3 million reports, while YouTube’s Oct 15 streaming glitch saw 1.5 million. Regional resilience also fluctuated, with X (Twitter) peaking at 645k reports in APAC and WhatsApp hitting 621k in LATAM. The takeaway for architects is clear: automation and centralization have created a “Thundering Herd” risk. When providers like Cloudflare or AWS hiccup, the MTTR is no longer in your team’s hands, but in the logic of a third-party global control plane.

Microsoft may soon allow IT admins to uninstall Copilot

www.bleepingcomputer.com/news/micr…

Microsoft is testing a new policy that allows IT administrators to uninstall the AI-powered Copilot digital assistant on managed devices. The new RemoveMicrosoftCopilotApp policy began rolling out today to systems in the Dev and Beta Insider channels that have installed Windows 11 Insider Preview Build 26220.7535 (KB5072046). As the Windows Insider team explained in a blog post, Copilot will be uninstalled after the policy is enabled on endpoints managed via Microsoft Intune or System Center Configuration Manager (SCCM). The new policy will apply to devices where Microsoft 365 Copilot and Microsoft Copilot are both installed, the Microsoft Copilot app was not installed by the user, and the app was not launched in the last 28 days.

Illicit crypto economy surges as nation-states join in the fray

www.darkreading.com/cyber-ris…

Illicit cryptocurrency transactions grew more than 160 per cent in 2025 to total at least $154 billion, driven by sanctioned countries — such as Russia, Iran and North Korea — dramatically increasing their use of digital currency to evade financial blockades. The value of identified illicit blockchain transactions was dominated by Russia, which passed legislation in 2024 to establish ways of skirting sanctions via cryptocurrency and launched its rouble-backed A7A5 token in 2025, according to data released by blockchain-intelligence firm Chainalysis. Overall, at least $93 billion in cryptocurrency transactions came from Russia’s new cryptocurrency token, the main driver behind a nearly sevenfold surge in cryptocurrency volumes by sanctioned entities, the researcher found. Large, transnational money-laundering networks operated by Chinese criminal syndicates throughout Southeast Asia account for the lion’s share of the transactions, says Andrew Fierman, head of national security intelligence for Chainalysis. “As nation-states, organized criminal groups and other traditional crypto-criminal activity continue to grow in complexity, so too will their on-chain presence,” he says. “However, as both public and private sectors continue to develop more advanced, complex mechanisms to identify and disrupt this activity, there is an opportunity to prevent these flows from reaching their destination.”

FBI warns North Korean hackers using malicious QR codes in spear-phishing thehackernews.com/2026/01/f… The U.S. Federal Bureau of Investigation (FBI) on Thursday released an advisory warning of North Korean state-sponsored threat actors leveraging malicious QR codes in spear-phishing campaigns targeting entities in the country. “As of 2025, Kimsuky actors have targeted think tanks, academic institutions, and both U.S. and foreign government entities with embedded malicious Quick Response (QR) codes in spear-phishing campaigns,” the FBI said in the flash alert. “This type of spear-phishing attack is referred to as quishing.” The use of QR codes for phishing forces victims to shift from a machine secured by enterprise policies to a mobile device that may not offer the same level of protection, effectively allowing threat actors to bypass traditional defences. Kimsuky, also tracked as APT43, Black Banshee, Emerald Sleet, Springtail, TA427, and Velvet Chollima, is a threat group assessed to be affiliated with North Korea’s Reconnaissance General Bureau (RGB). It has a long history of orchestrating spear-phishing campaigns designed to subvert email authentication protocols.

Hackers target misconfigured proxies to access paid LLM services www.bleepingcomputer.com/news/secu… Threat actors are systematically hunting for misconfigured proxy servers that could provide access to commercial large language model (LLM) services. In an ongoing campaign that started in late December, the attackers have probed more than 73 LLM endpoints and generated over 80,000 sessions. According to threat monitoring platform GreyNoise, the threat actors use low-noise prompts to query endpoints in an attempt to determine the accessed AI model without triggering a security alert. GreyNoise says in a report that over the past four months, its Ollama honeypot caught a total of 91,403 attacks that are part of two distinct campaigns. One operation started in October and is still active, with a spike of 1,688 sessions over 48 hours around Christmas. It exploits server-side request forgery (SSRF) vulnerabilities that allow the actor to force a server to connect to attacker-controlled external infrastructure.

Are criminal hacking organizations recruiting teenagers to do the dirty work? www.pandasecurity.com/en/mediac… Yes, they are. It has been confirmed that many of the popular hacking organizations that have been terrorizing the world over the last few years have been actively recruiting teenagers and young adults located in Western countries. The hackers offer monetary compensation in crypto funds if the youngsters agree to help commit criminal acts, such as infecting companies with ransomware. The foreign cyber-criminal groups are not particularly looking for elite hackers, but for anyone willing to do the job. The hackers pretend to be part of fake businesses that offer teenagers lucrative crypto payments, free training, and “easy money” if they do as they are told without asking many questions. In most cases, what they are being told to do is illegal.

First Federal Data Breach Claims Investigated by Lynch

Lynch Carpenter is investigating claims against First Federal Savings & Loan Association following a cybersecurity incident that may have exposed individuals' personal information, including names, Social Security numbers, and financial details. Those affected by this data breach may be entitled to compensation.

Iranian Hack Turns Leaked Israeli Contacts Into Intelligence Windfall – Sri Lanka Guardian

An Iranian-backed hacking operation has compromised the personal devices and messaging accounts of senior Israeli political figures, including former prime minister Naftali Bennett and Prime Minister Benjamin Netanyahu’s chief of staff. The leaked data, which includes thousands of contact lists and conversations, is considered an intelligence gold mine by security experts, potentially enabling surveillance and espionage on a large scale.