🚨 Fake SymPy on PyPI is targeting Linux devs. The package sympy-dev clones the real project text, poses as a dev build, and has 1,100+ downloads since Jan 17.

It activates only when certain math functions run, then loads an XMRig miner fully in memory to avoid traces.

🔗 Learn how the loader works → https://thehackernews.com/2026/01/malicious-pypi-package-impersonates.html

Learn cybersecurity risk management from the experts at Georgetown. Attend our webinar on TBD.

Sign up - https://thn.news/risk-mgmt-insight

⚠️📧 Email is still the easiest way in.

In Google Workspace, BEC attacks often carry no links or malware, so native defenses miss them. One compromised inbox can expose years of sensitive email and files.

Hardening helps, but blind spots remain.

🔗 Gmail limits, real attack paths → https://thehackernews.com/2026/01/filling-most-common-gaps-in-google.html

🔥 ThreatsDay Bulletin — Get this week’s active threat landscape...

🔓 Zero-click Pixel exploit
🧱 EU moves to lock down the tech supply chain
🕷️ Mass WordPress plugin reconnaissance
📢 Malvertising → infostealers & RATs
🧾 Fake invoices, loans, and proxyware abuse
🌐 18,000+ active C2 servers exposed
💸 Crypto scams racing past $17B
🏧 ATM malware ring dismantled

🔗 Read all 20 updates → https://thehackernews.com/2026/01/threatsday-bulletin-pixel-zero-click.html

🚨 An 11-year-old critical flaw in GNU InetUtils telnetd lets attackers log in as root with no password.

Tracked as CVE-2026-24061 (CVSS 9.8), it affects all versions 1.9.3–2.7 due to an unsanitized USER environment value passed to login.

⚠️ Exploitation has already been observed in the wild.

🔗 Read →https://thehackernews.com/2026/01/critical-gnu-inetutils-telnetd-flaw.html

⚠️ Osiris ransomware hit a major food service operator in Southeast Asia, researchers say.

The attack used a custom POORTRY driver to shut down security tools, then encrypted systems and exfiltrated data to cloud storage.

🔗 Details here → https://thehackernews.com/2026/01/new-osiris-ransomware-emerges-as-new.html

🛠️⚠️ Attackers are abusing trusted IT tools, not deploying malware.

A new campaign steals email logins, then installs legitimate RMM software for silent, long-term access.
Because the tools are signed and allowed, many security controls don’t trigger.

🔗 Details → https://thehackernews.com/2026/01/phishing-attack-uses-stolen-credentials.html

🇺🇸  TikTok confirmed a new U.S. joint venture to stay operational in the country.

ByteDance will reduce its stake to 19.9%, giving majority control to U.S. investors.

U.S. user data and algorithms will move to Oracle’s U.S. cloud with third-party security audits.

🔗 Read → https://thehackernews.com/2026/01/tiktok-forms-us-joint-venture-to.html

🚨 Fortinet confirms active exploitation of CVE-2025-59718 / 59719, allowing FortiGate FortiCloud SSO bypass — even on fully patched devices.

Attackers abuse crafted SAML logins to gain admin access, add persistent accounts, enable VPN, and steal configs. Disabling FortiCloud SSO is advised.

🔗 Details → https://thehackernews.com/2026/01/fortinet-confirms-active-forticloud-sso.html

🚨 CISA added four exploited vulnerabilities to its KEV list, impacting Zimbra, Versa SD-WAN, Vite, and a compromised npm package linked to a supply-chain attack.

⏳ U.S. federal agencies must apply fixes by Feb 12 under BOD 22-01.

🔗 CVEs, fixes, and deadlines → https://thehackernews.com/2026/01/cisa-updates-kev-catalog-with-four.html

🚨 CISA confirms active exploitation of a critical VMware vCenter Server flaw.

CVE-2024-37079 allows remote code execution via a DCE/RPC heap overflow if an attacker has network access.

🔗 Details → https://thehackernews.com/2026/01/cisa-adds-actively-exploited-vmware.html

🇵🇱 Poland blocked what officials described as its strongest cyberattack on the energy sector in years.

ESET links it to Russia-aligned Sandworm, which used a new DynoWiper malware to target ⚡ power plants and renewable energy systems in late Dec 2025.

🔗Details → https://thehackernews.com/2026/01/new-dynowiper-malware-used-in-attempted.html

🤖 AI agents now move faster than IAM can see.

Shared agents quietly gain broad, long-lived access across systems, often with no clear owner. That’s how access drift begins.

The risk isn’t stolen creds—it’s valid access used in unsafe ways that never trigger alerts.

🔗 Read → https://thehackernews.com/2026/01/who-approved-this-agent-rethinking.html

⚠️ Russian users hit by a new phishing chain delivering Amnesia RAT and ransomware.

Fake business docs and LNK files do the work — no exploits. Payloads are split across GitHub and Dropbox, then Microsoft Defender is disabled using defendnot.

🔗Full attack chain and defenses → https://thehackernews.com/2026/01/multi-stage-phishing-campaign-targets.html

🧑‍💻 North Korea’s Konni group is using AI-assisted PowerShell malware to target blockchain developers.

Campaigns hit Japan, Australia, and India via Google ad–style phishing links that bypass filters and drop EndRAT.

🔗 Inside the full attack chain → https://thehackernews.com/2026/01/konni-hackers-deploy-ai-generated.html

🛑 Attackers now use 🤖 AI to write, hide, and mutate malware in real time. Google and Anthropic confirm AI-orchestrated attacks running autonomously end to end.

They bypass EDR by looking normal on each endpoint. The tell is in network behavior.

🔗 How network signals expose what endpoints miss → https://thehackernews.com/2026/01/winning-against-ai-based-attacks.html