Good morning. This is your security briefing for Thursday, January 15, 2026, covering 13 articles analyzed overnight. All attribution is by the article authors. All article analysis is automated.
Brad Duncan reports on a persistent Lumma Stealer infection that repeatedly creates scheduled tasks executing mshta commands to the same command and control domain. After initial data exfiltration, the malware accesses a Pastebin link containing PowerShell commands, resulting in substantial increases in traffic to fileless-market dot cc.
Silent Push has uncovered a long-running Magecart web-skimming campaign that has been active since January 2022, targeting global e-commerce sites. The attackers inject malicious JavaScript into checkout pages to steal credit card data and personal information, with infrastructure including cdn-cookie dot com hosting obfuscated skimming scripts.
Lumen's Black Lotus Labs successfully disrupted the Kimwolf botnet, which became the world's most powerful DDoS botnet in August 2025, launching attacks exceeding eleven trillion bits per second. The operation exploited vulnerabilities in residential proxy services to acquire 200,000 daily bots, and Black Lotus Labs disrupted it by null-routing over 550 command and control servers over four months.
Sansec discovered a keylogger on a major U.S. bank's employee merchandise store that potentially compromised data from over 200,000 employees. The malware was active for approximately 18 hours on January 14th and 15th, using a two-stage loader to harvest credentials and payment information, exfiltrating it to js-csp dot com via base64-encoded image beacons.
Check Point Software has analyzed Sicarii, a new Ransomware-as-a-Service operation emerging in late 2025 with unusual characteristics. The group exhibits Israeli and Jewish branding while operating primarily in Russian with machine-translated Hebrew, geo-fences to avoid Israeli systems, but offers preferential rates for attacks against Arab and Muslim states, raising questions about potential false-flag operations.
According to National ENFAST, a BlackBasta ransomware administrator has been officially identified and added to the EU's most wanted list for computer-related crimes. This marks a significant development in international efforts to pursue ransomware operators through criminal prosecution.
Researchers from KU Leuven University discovered WhisperPair, a critical vulnerability in Google Fast Pair technology affecting hundreds of millions of Bluetooth accessories globally. The flaw allows attackers to forcibly pair with vulnerable devices without user consent, enabling unauthorized access, audio recording, and location tracking, and it cannot be disabled by users, requiring manufacturer patches to mitigate.
Jamf Threat Labs documented sophisticated anti-analysis techniques in Predator spyware for iOS. The spyware employs an undocumented error code system to report implant failures to command and control infrastructure, actively detects security analysis tools and jailbreaks, and refuses to execute on devices with US or Israeli locale settings.
Huntress researchers discovered that the SDFlags field in Active Directory Event ID 1644 logs is a critical indicator for detecting BloodHound and SharpHound reconnaissance activities. These attack path enumeration tools use SDFlags when querying the nTSecurityDescriptor attribute to map privilege escalation paths and lateral movement opportunities in Active Directory environments.
CyberArk researchers discovered and exploited a cross-site scripting vulnerability in the StealC Malware-as-a-Service panel used by cybercriminals. The vulnerability allowed them to steal session cookies from the threat actors operating the panel, exposing details about their infrastructure, location, and hardware due to lack of basic security measures.
Cisco Talos reports that UAT-8837, a China-nexus APT group, has been targeting critical infrastructure sectors in North America since at least 2025. The threat actor exploits zero-day and n-day vulnerabilities including CVE-2025-53690 in SiteCore, uses tools like SharpHound and Earthworm for credential harvesting, and establishes persistent access through compromised credentials and remote administration tools.
Acronis has identified a targeted espionage campaign dubbed LOTUSLITE affecting U.S. government and policy-related entities. The campaign uses politically themed ZIP archives containing legitimate executables that sideload a malicious DLL backdoor, with the custom C++ implant capable of remote command execution, file manipulation, and establishing persistence.
Mandiant has released a comprehensive dataset of Net-NTLMv1 rainbow tables to accelerate deprecation of the insecure protocol that has been vulnerable for over 20 years. The tables enable attackers to crack Net-NTLMv1 hashes within hours on affordable hardware, potentially leading to Active Directory compromise and DCSync attacks, and defenders are urged to immediately disable the protocol and monitor for its usage through Event ID 4624.
That concludes today's briefing.