VulnHub

The FBI has issued a warning about a series of phishing attacks where criminals are posing as U.S. city and county officials. These attacks primarily target businesses and individuals seeking planning and zoning permits. Scammers use these impersonations to trick victims into providing sensitive information or money. This situation is concerning as it can lead to financial losses and undermine trust in local government processes. The FBI urges anyone involved in such applications to verify the legitimacy of communications before responding, especially if they involve requests for personal or financial information.

Two Google Chrome extensions have been compromised after a transfer of ownership, allowing attackers to inject malicious code and steal sensitive user data. The extensions, originally developed by a user identified as 'akshayanuonline@gmail.com', are QuickLens and another unnamed extension. This incident raises significant concerns as it exposes users who have installed these extensions to potential malware and data breaches. Users of these extensions should be cautious and consider removing them to protect their information. This situation serves as a reminder of the risks associated with third-party software and the importance of monitoring the permissions and developers of browser extensions.

A Chinese threat actor has been targeting high-value organizations across South, Southeast, and East Asia in a long-running campaign. This group has focused on sectors such as aviation, energy, government, law enforcement, pharmaceuticals, technology, and telecommunications. Palo Alto Networks Unit 42 has linked these activities to a new, undocumented threat group that exploits web servers and utilizes Mimikatz, a tool known for stealing credentials. The implications of these attacks are significant, as they threaten the security of critical infrastructure in the region and could lead to serious disruptions or data breaches. Organizations in these sectors need to enhance their cybersecurity measures to defend against these sophisticated threats.

A hacking group known as Transparent Tribe, which has ties to Pakistan, is utilizing AI tools to create malware implants targeting India. This campaign is notable for its use of lesser-known programming languages like Nim, Zig, and Crystal, allowing attackers to produce a large number of implants quickly. The implants are described as being of mediocre quality but are still effective enough to pose risks to targeted systems. This shift to AI-driven malware production marks a concerning trend in cybercrime, as it may lead to increased frequency and variety of attacks. Organizations in India need to be vigilant and enhance their cybersecurity measures to defend against these evolving threats.

Cisco has confirmed that two vulnerabilities in the Catalyst SD-WAN Manager are currently being exploited by attackers. The first vulnerability, identified as CVE-2026-20122, has a CVSS score of 7.1 and allows authenticated remote users to overwrite files on the local file system. This could lead to significant disruptions and unauthorized access to sensitive data. Organizations using the Catalyst SD-WAN Manager should take immediate action to address these vulnerabilities, as they pose a serious risk to network security. It’s crucial for affected users to monitor their systems closely and apply any available patches as soon as possible.

A recent cyber campaign attributed to a group linked to Iran is targeting Iraqi government officials by impersonating the Ministry of Foreign Affairs. This operation, identified by Zscaler ThreatLabz and named Dust Specter, involves the deployment of new malware strains called SPLITDROP and GHOSTFORM. Observed in January 2026, these attacks aim to compromise sensitive information from officials within the Iraqi government. The use of sophisticated tactics and novel malware underscores a growing threat to government entities in the region. This incident raises concerns about the security of state institutions and the potential for sensitive data breaches that could have significant political ramifications.

Despite the widespread implementation of multi-factor authentication (MFA) in organizations, many still fall victim to credential theft. Attackers are exploiting valid usernames and passwords to gain unauthorized access to networks, particularly in Windows environments. The problem isn't with MFA itself, but rather with how comprehensively it is enforced through identity providers like Microsoft Entra ID and Okta. If MFA isn't applied consistently across all access points, attackers can bypass these security measures. This situation emphasizes the need for companies to ensure that MFA is enforced everywhere, not just in select areas, to truly safeguard their systems from credential abuse.

The latest Security Affairs Malware newsletter covers several significant malware threats that have emerged recently. Notably, a group identified as Stan Ghouls is targeting users in Russia and Uzbekistan using the NetSupport Remote Access Trojan (RAT), which allows attackers to control infected systems remotely. Another concerning development is the discovery of ZeroDayRAT, a new spyware designed to infiltrate both Android and iOS devices. Additionally, researchers have uncovered a Linux botnet named SSHStalker, which utilizes old-school IRC methods to compromise new victims. These activities demonstrate the evolving tactics of cybercriminals and emphasize the need for users and organizations to remain vigilant against these persistent threats.

Last week, a newly patched vulnerability in BeyondTrust's Remote Code Execution (RCE) software was exploited in the wild. This vulnerability poses significant risks as it allows attackers to execute commands on affected systems without authorization. BeyondTrust has issued patches to address this issue, but organizations using the affected software need to act quickly to apply these updates to prevent potential breaches. Additionally, in an interview, Deneen DeFiore, the Chief Information Security Officer at United Airlines, discussed the importance of resilience in cybersecurity. She emphasized that while prevention is crucial, organizations must also prepare for disruptions and manage risks associated with their interconnected vendor and partner ecosystems. This dual focus on resilience and safety is essential for maintaining operational integrity in today's complex digital landscape.

A recent investigation by Q Continuum has uncovered that 287 Chrome extensions are leaking private browsing data from approximately 37.4 million users to companies like Similarweb and Alibaba. These extensions, often perceived as harmless tools, have been found to convert users' browsing histories into marketable products. The data breach raises significant privacy concerns, particularly for users who may not be aware that their online activities are being monitored and sold. This incident highlights the need for users to be vigilant about the extensions they install and the permissions they grant. As these extensions may not seem malicious at first glance, it serves as a reminder of the potential risks associated with browser add-ons.

Recent threat intelligence reports indicate that a single threat actor is behind the majority of attacks exploiting two critical vulnerabilities in Ivanti Endpoint Manager Mobile (EPMM), identified as CVE-2026-21962 and CVE-2026-24061. These vulnerabilities allow for remote code execution, posing significant risks to organizations using this mobile management solution. The findings suggest that companies using Ivanti's software need to be vigilant, as the attacks are actively occurring. The focus on a single actor highlights the need for targeted defenses against this specific threat. Organizations are encouraged to monitor for unusual activity and apply any available patches to mitigate potential exploitation.