Cybercrime
-
Italy thwarts cyberattacks tied to Russia ahead of Milano Cortina Games
Italy has begun defending against cyberattacks that targeted foreign ministry sites and some Milano Cortina Winter Olympics locations. The attacks were described as of Russian origin and mitigations were put in place before the Games.
-
Infy resumes operations with new C2 infrastructure after nationwide outage
Infy paused C2 activity on January 8, 2026 and reestablished new command and control servers on January 26, 2026, deploying Tornado version 51 and new delivery methods that include a weaponized WinRAR SFX.
-
DEAD#VAX campaign mounts IPFS VHDs to deliver in-memory AsyncRAT
Researchers disclosed DEAD#VAX, a campaign that uses IPFS-hosted VHD files to mount virtual drives and deploy AsyncRAT as encrypted shellcode run in memory, avoiding disk-based artifacts and complicating detection.
-
Amaranth Dragon exploits WinRAR flaw to target Southeast Asian agencies
Amaranth Dragon exploited CVE-2025-8088 in WinRAR to target government and law enforcement agencies across six Southeast Asian countries from mid-2025, delivering encrypted loaders and using Cloudflare-backed command servers.
-
Microsoft warns Python-based infostealers are targeting macOS via malvertising and fake installers
Microsoft warned in a technical analysis that Python-based infostealers have expanded to macOS since late 2025. Campaigns use malvertising, fake DMG installers, and fileless techniques to steal credentials and iCloud Keychain data.
-
Threat actors exploit Metro4Shell RCE in React Native CLI
Threat actors exploited a critical Metro Development Server RCE in the @react-native-community/cli package starting December 21, 2025, tracked as CVE-2025-11953 with a CVSS score of 9.8.
-
APT28 exploits Microsoft Office bug to deploy email stealer and Covenant implant
Russia-linked APT28 exploited a Microsoft Office bypass tracked as CVE-2026-21509 to deliver an Outlook email stealer and a Covenant Grunt implant in Ukraine, Slovakia and Romania, researchers say.
-
Audit finds 341 malicious skills on ClawHub marketplace
An analysis found 341 malicious skills on the ClawHub marketplace among 2,857 audited entries. The skills used fake prerequisites and scripts to deliver macOS information stealers and backdoors, creating a supply chain risk for OpenClaw users.
-
State actors hijacked Notepad++ updater to redirect users to malicious servers
Notepad++’s maintainer said attackers compromised hosting infrastructure to hijack the updater and redirect some users to malicious servers. The activity began in June 2025 and credentials persisted until December 2 2025.
-
Threat actor compromises about 1,400 exposed MongoDB servers in low-value extortion campaign
A technical analysis found a threat actor compromised about 1,400 exposed MongoDB servers, leaving ransom notes demanding about 0.005 BTC per victim. Researchers identified roughly 208,500 exposed servers and many running outdated versions.
