TECHZONE™

Phishing Attack Uses Stolen Credentials to Install LogMeIn RMM for Persistent Access https://thehackernews.com/2026/01/phishing-attack-uses-stolen-credentials.html Cybersecurity researchers have disclosed details of a new dual-vector campaign that leverages stolen credentials to deploy legitimate Remote Monitoring and Management (RMM) software for persistent remote access to compromised hosts. "Instead of deploying custom viruses, attackers are bypassing security perimeters by weaponizing the necessary IT tools that administrators trust," KnowBe4 Threat

Microsoft Flags Multi-Stage AitM Phishing and BEC Attacks Targeting Energy Firms https://thehackernews.com/2026/01/microsoft-flags-multi-stage-aitm.html Microsoft has warned of a multi‑stage adversary‑in‑the‑middle (AitM) phishing and business email compromise (BEC) campaign targeting multiple organizations in the energy sector. "The campaign abused SharePoint file‑sharing services to deliver phishing payloads and relied on inbox rule creation to maintain persistence and evade user awareness," the Microsoft Defender Security Research Team said.

New Osiris Ransomware Emerges as New Strain Using POORTRY Driver in BYOVD Attack https://thehackernews.com/2026/01/new-osiris-ransomware-emerges-as-new.html Cybersecurity researchers have disclosed details of a new ransomware family called Osiris that targeted a major food service franchisee operator in Southeast Asia in November 2025. The attack leveraged a malicious driver called POORTRY as part of a known technique referred to as bring your own vulnerable driver (BYOVD) to disarm security software, the Symantec and Carbon Black Threat Hunter

Critical GNU InetUtils telnetd Flaw Lets Attackers Bypass Login and Gain Root Access https://thehackernews.com/2026/01/critical-gnu-inetutils-telnetd-flaw.html A critical security flaw has been disclosed in the GNU InetUtils telnet daemon (telnetd) that went unnoticed for nearly 11 years. The vulnerability, tracked as CVE-2026-24061, is rated 9.8 out of 10.0 on the CVSS scoring system. It affects all versions of GNU InetUtils from version 1.9.3 up to and including version 2.7. "Telnetd in GNU Inetutils through 2.7 allows remote authentication bypass

ThreatsDay Bulletin: Pixel Zero-Click, Redis RCE, China C2s, RAT Ads, Crypto Scams & 15+ Stories https://thehackernews.com/2026/01/threatsday-bulletin-pixel-zero-click.html Most of this week’s threats didn’t rely on new tricks. They relied on familiar systems behaving exactly as designed, just in the wrong hands. Ordinary files, routine services, and trusted workflows were enough to open doors without forcing them. What stands out is how little friction attackers now need. Some activity focused on quiet reach and coverage, others on timing and reuse. The emphasis

Filling the Most Common Gaps in Google Workspace Security https://thehackernews.com/2026/01/filling-most-common-gaps-in-google.html Security teams at agile, fast-growing companies often have the same mandate: secure the business without slowing it down. Most teams inherit a tech stack optimized for breakneck growth, not resilience. In these environments, the security team is the helpdesk, the compliance expert, and the incident response team all rolled into one. Securing the cloud office in this scenario is all about

Malicious PyPI Package Impersonates SymPy, Deploys XMRig Miner on Linux Hosts https://thehackernews.com/2026/01/malicious-pypi-package-impersonates.html A new malicious package discovered in the Python Package Index (PyPI) has been found to impersonate a popular library for symbolic mathematics to deploy malicious payloads, including a cryptocurrency miner, on Linux hosts. The package, named sympy-dev, mimics SymPy, replicating the latter's project description verbatim in an attempt to deceive unsuspecting users into thinking that they are

SmarterMail Auth Bypass Exploited in the Wild Two Days After Patch Release https://thehackernews.com/2026/01/smartermail-auth-bypass-exploited-in.html A new security flaw in SmarterTools SmarterMail email software has come under active exploitation in the wild, two days after the release of a patch. The vulnerability, which currently does not have a CVE identifier, is tracked by watchTowr Labs as WT-2026-0001. It was patched by SmarterTools on January 15, 2026, with Build 9511, following responsible disclosure by the exposure management

Automated FortiGate Attacks Exploit FortiCloud SSO to Alter Firewall Configurations https://thehackernews.com/2026/01/automated-fortigate-attacks-exploit.html Cybersecurity company Arctic Wolf has warned of a "new cluster of automated malicious activity" that involves unauthorized firewall configuration changes on Fortinet FortiGate devices. The activity, it said, commenced on January 15, 2026, adding it shares similarities with a December 2025 campaign in which malicious SSO logins on FortiGate appliances were recorded against the admin account from

Cisco Fixes Actively Exploited Zero-Day CVE-2026-20045 in Unified CM and Webex https://thehackernews.com/2026/01/cisco-fixes-actively-exploited-zero-day.html Cisco has released fresh patches to address what it described as a "critical" security vulnerability impacting multiple Unified Communications (CM) products and Webex Calling Dedicated Instance that it has been actively exploited as a zero-day in the wild. The vulnerability, CVE-2026-20045 (CVSS score: 8.2), could permit an unauthenticated remote attacker to execute arbitrary commands on the

VoidLink Linux Malware Framework Built with AI Assistance Reaches 88,000 Lines of Code https://thehackernews.com/2026/01/voidlink-linux-malware-framework-built.html The recently discovered sophisticated Linux malware framework known as VoidLink is assessed to have been developed by a single person with assistance from an artificial intelligence (AI) model. That's according to new findings from Check Point Research, which identified operational security blunders by malware's author that provided clues to its developmental origins. The latest insight makes

LastPass Warns of Fake Maintenance Messages Targeting Users’ Master Passwords https://thehackernews.com/2026/01/lastpass-warns-of-fake-maintenance.html LastPass is alerting users to a new active phishing campaign that's impersonating the password management service, which aims to trick users into giving up their master passwords. The campaign, which began on or around January 19, 2026, involves sending phishing emails claiming upcoming maintenance and urging them to create a local backup of their password vaults in the next 24 hours. The

CERT/CC Warns binary-parser Bug Allows Node.js Privilege-Level Code Execution https://thehackernews.com/2026/01/certcc-warns-binary-parser-bug-allows.html A security vulnerability has been disclosed in the popular binary-parser npm library that, if successfully exploited, could result in the execution of arbitrary JavaScript. The vulnerability, tracked as CVE-2026-1245 (CVSS score: N/A), affects all versions of the module prior to version 2.3.0, which addresses the issue. Patches for the flaw were released on November 26, 2025. Binary-parser is a

Old habits die hard: 2025’s most common passwords were as predictable as ever https://www.welivesecurity.com/en/cybersecurity/old-habits-die-hard-2025-most-common-passwords/ Once again, data shows an uncomfortable truth: the habit of choosing eminently hackable passwords is alive and well

North Korea-Linked Hackers Target Developers via Malicious VS Code Projects https://thehackernews.com/2026/01/north-korea-linked-hackers-target.html The North Korean threat actors associated with the long-running Contagious Interview campaign have been observed using malicious Microsoft Visual Studio Code (VS Code) projects as lures to deliver a backdoor on compromised endpoints. The latest finding demonstrates continued evolution of the new tactic that was first discovered in December 2025, Jamf Threat Labs said. "This activity involved

Three Flaws in Anthropic MCP Git Server Enable File Access and Code Execution https://thehackernews.com/2026/01/three-flaws-in-anthropic-mcp-git-server.html A set of three security vulnerabilities has been disclosed in mcp-server-git, the official Git Model Context Protocol (MCP) server maintained by Anthropic, that could be exploited to read or delete arbitrary files and execute code under certain conditions. "These flaws can be exploited through prompt injection, meaning an attacker who can influence what an AI assistant reads (a malicious README,

Hackers Use LinkedIn Messages to Spread RAT Malware Through DLL Sideloading https://thehackernews.com/2026/01/hackers-use-linkedin-messages-to-spread.html Cybersecurity researchers have uncovered a new phishing campaign that exploits social media private messages to propagate malicious payloads, likely with the intent to deploy a remote access trojan (RAT). The activity delivers "weaponized files via Dynamic Link Library (DLL) sideloading, combined with a legitimate, open-source Python pen-testing script," ReliaQuest said in a report shared with

The Hidden Risk of Orphan Accounts https://thehackernews.com/2026/01/the-hidden-risk-of-orphan-accounts.html The Problem: The Identities Left Behind As organizations grow and evolve, employees, contractors, services, and systems come and go - but their accounts often remain. These abandoned or “orphan” accounts sit dormant across applications, platforms, assets, and cloud consoles. The reason they persist isn’t negligence - it’s fragmentation.  Traditional IAM and IGA systems are designed

Evelyn Stealer Malware Abuses VS Code Extensions to Steal Developer Credentials and Crypto https://thehackernews.com/2026/01/evelyn-stealer-malware-abuses-vs-code.html Cybersecurity researchers have disclosed details of a malware campaign that's targeting software developers with a new information stealer called Evelyn Stealer by weaponizing the Microsoft Visual Studio Code (VS Code) extension ecosystem. "The malware is designed to exfiltrate sensitive information, including developer credentials and cryptocurrency-related data. Compromised developer

Cloudflare Fixes ACME Validation Bug Allowing WAF Bypass to Origin Servers https://thehackernews.com/2026/01/cloudflare-fixes-acme-validation-bug.html Cloudflare has addressed a security vulnerability impacting its Automatic Certificate Management Environment (ACME) validation logic that made it possible to bypass security controls and access origin servers.  "The vulnerability was rooted in how our edge network processed requests destined for the ACME HTTP-01 challenge path (/.well-known/acme-challenge/*)," the web infrastructure