Tracking Threats, Incidents, and Vulnerabilities
Tracking Threats, Incidents, and Vulnerabilities
Poland's electric grid was targeted by Russian wiper malware (DynoWiper) aiming to disrupt electricity delivery but failed. The attack coincided with the anniversary of a 2015 Ukrainian blackout due to Russian cyberattacks.
Microsoft provided the FBI with encryption keys for BitLocker-protected data on three laptops, following a warrant related to a Covid unemployment assistance fraud investigation in Guam. This case marks the first known instance of Microsoft providing law enforcement with encryption keys. Privacy experts criticize Microsoft for this decision, arguing that it compromises user privacy and security, and urging the company to adopt stronger protections like those offered by Apple and Google.
NIST is revising its approach to software vulnerability analysis due to overwhelming submissions. It plans to prioritize certain vulnerabilities for in-depth analysis and may delegate enrichment tasks to external organizations. A strategic review aims to clarify NIST's role, focusing on collaboration with partners while ensuring operational functions align with its research mission. This transition can lead to a significant reset in the National Vulnerability Database's processing and involvement in the broader CVE ecosystem.
https://www.cybersecuritydive.com/news/nist-cve-vulnerability-analysis-nvd-review/810300/
NVIDIA allegedly sought high-speed access to millions of pirated books from Anna's Archive for AI training, leading to a class-action lawsuit by authors for copyright infringement. Internal emails suggest NVIDIA management proceeded with piracy despite warnings about the legality of the library's content. The lawsuit expands to include claims of using other pirated sources and distributing tools for accessing copyrighted materials, demanding compensation for damages suffered by the authors.
New Android malware utilizes AI with TensorFlow to automatically click on hidden ads, enhancing click fraud mechanisms. Distributed via Xiaomi’s app store and third-party sites, it uses a ‘phantom’ mode for covert actions and a ‘signalling’ mode for real-time control. Affected apps initially lack malicious intent but receive updates adding harmful features, misleading users. Users are advised to avoid non-Google Play apps to mitigate risks.
VoidLink malware, developed likely by a solo programmer with AI assistance, exhibits advanced features like custom loaders and rootkits. Check Point Research notes it shows clear signs of AI generation, operational security failures, and rapid functionality development within a week. This marks a shift where individuals with technical skills can produce sophisticated malware, previously achievable only by well-resourced teams, making it a notable example of AI-driven cyber threats.
Cybercrime has evolved with AI, offering tools like Dark LLMs for scams at subscription prices. Group-IB reports a 371% increase in AI mentions on dark web forums since 2019. AI simplifies previously complex cyberattacks into easily accessible services. Deepfake and synthetic identity tools are now inexpensive, resulting in significant financial losses, including $347 million in a single quarter. Automation in cybercrime lowers barriers for criminals, complicating defense efforts and increasing the scale and personalization of scams.
https://www.theregister.com/2026/01/20/group_ib_ai_cycercrime_subscriptions/
A significant recent cybersecurity concern is a prompt injection vulnerability in Google's Gemini AI, allowing attackers to exploit Google Calendar invites to access private data covertly and create deceptive events. This highlights the need for advanced security strategies addressing semantic vulnerabilities in AI systems.
https://www.darkreading.com/cloud-security/google-gemini-flaw-calendar-invites-attack-vector
Malicious browser extensions, including ShadyPanda and GhostPoster, have been found to spy on users across Firefox, Chrome, and Edge. These extensions behaved normally for years before switching to spyware after updates, leveraging techniques like steganography to hide malicious code. Seventeen affected extensions have over 840,000 downloads. Users are advised to uninstall any suspicious extensions and conduct a Malwarebytes Deep Scan to check for infections.
17 malicious GhostPoster browser extensions found in Chrome, Firefox, and Edge have accumulated 840,000 installs, employing hidden JavaScript for tracking, ad fraud, and backdoor access. These extensions, initially reported in December, include popular ones like “Google Translate in Right Click” and “Ads Block Ultimate.” They originated on Microsoft Edge and spread to other browsers, with some active since 2020. Recent variants show advanced evasion tactics, but affected users remain at risk even after removals from stores.
Microsoft disrupted the RedVDS cybercrime marketplace, linked to $40 million in fraud, by seizing key infrastructure and working with international law enforcement. RedVDS enabled mass phishing and account takeover campaigns, compromising over 191,000 organizations worldwide. The service sold access to Windows RDP servers, leaving behind technical indicators like a shared computer name and a cloned Windows Server 2022 image.
Signal leaders warn agentic AI is insecure, unreliable, and risks surveillance. At 39C3, they highlighted its vulnerabilities, including susceptibility to malware and low task success rates. They advocate for industry changes to improve privacy, security, and transparency, urging firms to halt reckless deployment and prioritize user consent and data protection.
Wiz Research uncovered a critical vulnerability, named CodeBreach, in AWS CodeBuild that allowed unauthorized access to key AWS GitHub repositories, notably the JavaScript SDK for the AWS Console. This flaw, stemming from unanchored regex filters in build triggers, let attackers exploit CI/CD processes to extract sensitive credentials, potentially compromising many AWS accounts. Recommendations for safeguarding against such vulnerabilities include implementing strict build gates and securing GitHub connections. AWS promptly remediated the issue and issued additional hardening measures in response to the findings. The incident underscores the increasing targeting of CI/CD environments by attackers.
https://www.wiz.io/blog/wiz-research-codebreach-vulnerability-aws-codebuild
Security researchers found a critical vulnerability in Google's Fast Pair protocol, called “WhisperPair,” allowing attackers to hijack Bluetooth audio devices to track and eavesdrop on users. The flaw affects numerous devices, regardless of smartphone OS, due to improper implementation allowing unauthorized pairing. Attackers can exploit it from up to 14 meters away, gaining control of the devices for malicious purposes. Google awarded researchers $15,000, but security updates are still pending for many devices. Users must install firmware updates to mitigate risks.
Varonis Threat Labs identified a new AI vulnerability called Reprompt in Microsoft Copilot that allows attackers to exploit a single click on a seemingly legitimate link to bypass security controls and exfiltrate sensitive user data without detection. This attack can lead to significant data breaches by firing off malicious commands that continue even after the user interacts with the Copilot. Key methods involve URL parameter manipulation and managing hidden follow-up requests, making it difficult to spot the exploitation attempts. Microsoft has since patched the vulnerability. Recommendations are made for both vendors and users to enhance security against such vulnerabilities.
