🔥 ThreatsDay Bulletin: First of 2026

• GhostAd drains phones
• GlassWorm hits Macs
• AWS key flaw
• DPRK fake devs
• Meta ad cleanup
• Proxy botnets
• Crypto heists
• Cloud exploits
• Android fraud
• Hacktivist ops
• OceanLotus malware
• Magecart upgrade
• Disney fined

Full recap ⬇️ https://thehackernews.com/2026/01/threatsday-bulletin-ghostad-drain-macos.html

🚨 A former Coinbase support agent was arrested in India after hackers bribed contractors to steal customer data.

The breach exposed 69,461 users and led to a $20M ransom demand. Coinbase cut ties with involved vendors and says more arrests are coming.

🔗 Details → https://thehackernews.com/2025/12/weekly-recap-mongodb-attacks-wallet.html#:~:text=Former%20Coinbase%20Customer%20Service%20Agent%20Arrested%20in%20India

Researchers uncovered phishing sent through Google Cloud’s built-in email feature. Emails came from google[.]com, not spoofed domains, making them harder to spot.

Clicks passed through Google-hosted pages before stealing Microsoft login credentials.

🔗 Read → https://thehackernews.com/2026/01/cybercriminals-abuse-google-cloud-email.html

APT36 (Transparent Tribe) has been linked to new espionage attacks against Indian government and academic targets.

Emails deliver ZIP files with PDF-looking LNK shortcuts that run malware via mshta.exe and load the RAT in memory.

🔗 Technical details → https://thehackernews.com/2026/01/transparent-tribe-launches-new-rat.html

Attack Surface Management usually proves visibility, not safety.

Teams count assets and alerts, but can’t show reduced exposure.

ROI only appears when risky assets get owned and fixed faster, not when inventories grow.

🔗 Why ASM feels busy but ineffective → https://thehackernews.com/2026/01/the-roi-problem-in-attack-surface.html

⚠️ Researchers disclosed VVS Stealer, a Python-based infostealer built to drain Discord tokens and browser data.

alerts to stay active. Obfuscated with PyArmor, it’s designed to slip past signature-based defenses.

🔗Read → https://thehackernews.com/2026/01/new-vvs-stealer-malware-targets-discord.html

Ilya Lichtenstein, sentenced in 2024 for laundering funds tied to the 2016 Bitfinex hack, says he was released early.

He credits the First Step Act after serving time for moving proceeds from 119,754 bitcoin stolen in the breach.

🔗 Read → https://thehackernews.com/2026/01/bitfinex-hack-convict-ilya-lichtenstein.html

🔥 No reset for cyber risk in 2026.

The latest recap shows steady pressure across common systems.

🖧 IoT botnets abusing React2Shell
🔐 Trust Wallet Chrome extension breach
🧩 Malicious browser extensions at scale
💸 Crypto scams via fake wallet updates
📡 Botnets targeting exposed routers
🧑‍💻 Phishing via legitimate services
🔄 Old flaws reused and re-exploited
🏗️ Supply chain gaps in plugins and tools

🔗 Read the latest weekly cyber recap → https://thehackernews.com/2026/01/weekly-recap-iot-exploits-wallet.html

Passwords, perimeter tools, and annual training are no longer enough on their own. Across SaaS, endpoints, and supply chains, attackers move faster by abusing trust and context.

The report shows how defenders are responding — from hardware-backed identity to binary verification. Identity is becoming the control plane.

🔗 Full analysis and expert insights → https://thehackernews.com/2026/01/the-state-of-cybersecurity-in-2025key.html

🛡️A Russia-linked hacking group is using Viber to target Ukrainian military and government entities.

Instead of email, victims receive ZIP files containing fake Office-themed shortcuts that quietly launch malware.

The attack chain ends with Remcos RAT, giving attackers full remote control.

🔗 Read → https://thehackernews.com/2026/01/russia-aligned-hackers-abuse-viber-to.html

🛑 More than 2 million Android devices were quietly absorbed into the Kimwolf botnet.

It spreads mainly through exposed ADB, turning phones, smart TVs, and boxes into proxy relays and DDoS infrastructure.

Activity links to large-scale attacks and active resale of residential bandwidth.

🔗 Read → https://thehackernews.com/2026/01/kimwolf-android-botnet-infects-over-2.html

🚨 Popular workflow automation platform n8n disclosed a critical flaw that lets authenticated users with workflow edit rights execute OS commands on the host.

Tracked as CVE-2025-68668, the issue carries a CVSS score of 9.9.

🔗 Details here → https://thehackernews.com/2026/01/new-n8n-vulnerability-99-cvss-lets.html

⚠️ AdonisJS users are being advised to patch a critical flaw in adonisjs/bodyparser.

CVE-2026-21440 (CVSS 9.2) allows arbitrary file writes via path traversal when upload filenames aren’t explicitly sanitized.

🔗 Read → https://thehackernews.com/2026/01/critical-adonisjs-bodyparser-flaw-cvss.html

⚡ Identity risk is no longer about bad policies. It’s about blind spots.

IAM tools only cover what’s fully onboarded. Everything else becomes identity dark matter, where accounts and access exist without oversight.

As environments scale, this unmanaged layer grows quietly.

🔗 How identity goes dark → https://thehackernews.com/2026/01/what-is-identity-dark-matter.html

AI-powered VS Code forks are suggesting extensions that are missing from Open VSX.

That gap leaves the names unclaimed, letting anyone publish code under them.

Koi showed how a fake PostgreSQL extension spread via a single click.

🔗 Read → https://thehackernews.com/2026/01/vs-code-forks-recommend-missing.html

The Patching Paradox: You can't patch a device while it’s saving a life.

Stop chasing 10k vulnerabilities and start validating True Risk. Join us Jan 20 to learn how to secure legacy IoMT without clinical downtime.

Save your seat: https://thn.news/healthcare-sec-insights

⚠️ Bluetooth headphones built on Airoha chips have flaws that let attackers connect without pairing and control device functions over the air.

The issue sits in the RACE protocol and requires vendor firmware updates to fix.

🔗 Learn more → https://thehackernews.com/2026/01/weekly-recap-iot-exploits-wallet.html#:~:text=Flaws%20in%20Bluetooth%20Headphones%20Using%20Airoha%20Chips%20Detailed

🚨 CERT/CC disclosed an unpatched flaw in the end-of-life TOTOLINK EX200.

A firmware upload error can start an unauthenticated root telnet service, giving full control after web admin access.

🔗 Read → https://thehackernews.com/2026/01/unpatched-firmware-flaw-exposes.html

⚠️ Warning: Two Chrome extensions with 900,000+ installs were found stealing ChatGPT and DeepSeek conversations, plus all open tab URLs.

Researchers call this prompt poaching.

🔗 Read here → https://thehackernews.com/2026/01/two-chrome-extensions-caught-stealing.html

🛑 European hotels are facing a phishing campaign abusing Booking-com cancellation emails.

Victims hit a fake site, see a fake blue screen, and are told to run a PowerShell “fix.” That installs DCRat via MSBuild.exe, sets Defender exclusions, and persists on the system.

🔗 Learn more → https://thehackernews.com/2026/01/fake-booking-emails-redirect-hotel.html