Good morning. This is your security briefing for Sunday, January 25, 2026, covering 15 articles analyzed overnight. All attribution is by the article authors. All article analysis is automated.
Microsoft reports a sophisticated multi-stage phishing campaign targeting energy sector organizations using Adversary-in-the-Middle techniques to bypass multi-factor authentication by stealing session cookies. The attackers abuse SharePoint services, establish persistence through inbox rule manipulation, and conduct Business Email Compromise attacks after gaining initial access through compromised trusted vendors.
According to ThanniKudam, the TopazTerminator project exploits a vulnerability in the wsftprm.sys kernel driver to terminate protected processes including EDR and antivirus software on Windows systems. The exploit uses a specific IOCTL code to bypass kernel-level protections and terminate processes with PPL protection, and the vulnerable driver is not currently on Microsoft's Vulnerable Driver Blocklist as of January 2026.
Security researcher S3N4T0R-0X0 released Malicious PixelCode, a proof-of-concept demonstrating a novel steganographic technique that encodes executable malware into pixel data within MP4 videos. The technique uses a custom C++ loader with an embedded Python stager to download the encoded video from platforms like YouTube, reconstruct the binary payload in memory, and execute it, bypassing traditional security filters.
Unit 42 from Palo Alto Networks reveals that attackers are leveraging Large Language Models to generate malicious JavaScript in real-time within victim browsers through client-side API calls and prompt engineering. The technique creates polymorphic, evasive phishing attacks that bypass traditional network security by originating from trusted LLM domains, with each generated malicious script being unique and tailored to individual victims, making signature-based detection ineffective.
Andrew Northern, Principal Security Researcher at Censys, reports that attackers are exploiting trusted web interfaces using fake Captcha verification pages that resemble legitimate services like Cloudflare to deliver malware through multiple execution methods. This Living Off the Web technique includes clipboard-based attacks, MSIEXEC installers, and fileless browser notification-based C2 frameworks like Matrix Push, decoupling visual lures from execution methods and making traditional payload-based detection ineffective.
The National Security Agency released the first two Zero Trust Implementation Guidelines to help organizations adopt Zero Trust cybersecurity principles. The guidelines include a foundational Primer and a Discovery Phase document focused on establishing visibility into organizational architecture, data, applications, and access activities, designed for system owners and cybersecurity professionals to strengthen security posture.
The Daylight MDR Team reports that threat actors are targeting macOS and Windows users through SEO poisoning and fake GitHub repositories that impersonate legitimate software like PagerDuty. Victims are socially engineered via ClickFix tactics to execute malicious Terminal commands that deploy the MacSync information stealer, which harvests credentials, keychain data, password manager contents, and cryptocurrency wallets.
Swiss Post Cybersecurity uncovered a sophisticated phishing campaign delivering the PURELOGS infostealer through a multi-stage attack chain that hides its payload within PNG image files downloaded from archive.org. The malware uses process hollowing to inject into legitimate processes, employs VM detection to evade analysis, and targets home users, small businesses, and freelancers, stealing browser credentials, session cookies, and payment card data from Chromium-based browsers.
Resecurity identifies PDFSIDER, a sophisticated backdoor malware that uses DLL side-loading to evade AV and EDR detection, with characteristics of Advanced Persistent Threats. The malware is delivered via spear-phishing emails, employs AES-256-GCM encryption for C2 communications, and is actively used by ransomware actors targeting organizations including Fortune 100 corporations, incorporating anti-VM and anti-debugger techniques.
WithSecure Labs identified breaches by Andariel, a North Korean state-sponsored group linked to RGB's 3rd bureau, targeting a European public sector organization and a South Korean ERP software provider. The attacks employed three newly discovered RATsβStarshellRAT, JelusRAT, and GopherRATβalongside privilege escalation tools and BYOVD techniques to disable security products, with the cyberespionage campaign focused on accessing anti-money laundering documents aligned with North Korea's sanctions evasion efforts.
Logisek released HuntCyberArk, a PowerShell-based security audit tool for offensive security professionals to assess CyberArk Privileged Access Management platforms. The tool operates remotely via the PVWA API to identify misconfigurations, compliance gaps, and potential exploits without requiring installation on CyberArk servers, and includes features like OPSEC mode, proxy integration, and timing attacks.
nullsection released chisel-ng, a Rust-based tunneling tool designed for penetration testing and red team operations that encapsulates SSH traffic within WebSocket connections over TLS to bypass network security controls. The tool enables covert reverse tunnels and multi-hop pivoting through compromised hosts while disguising malicious traffic as legitimate HTTPS communication, featuring PSK authentication and auto-reconnect capabilities.
The LiveContainer project allows running iOS apps without installation by patching executables and bypassing library validation, but third-party closed-source builds pose significant security risks. The tool's unrestricted access to sensitive user data including keychain items and login credentials, combined with its ability to modify system behavior, makes it a potential vector for compromise if malicious versions are distributed.
Arcanum-Sec released the Sec-Context project, documenting over 25 security anti-patterns commonly generated by AI coding assistants, addressing a critical issue where 81% of organizations have deployed vulnerable AI-generated code to production. The project provides detailed documentation with CWE references and mitigation strategies for vulnerabilities including XSS with an 86% failure rate, SQL injection, hardcoded secrets, and command injection.
GitLab released patch versions 18.8.2, 18.7.2, and 18.6.4 addressing multiple security vulnerabilities including a critical two-factor authentication bypass flaw that allowed an individual with existing knowledge of a victim's credential ID to bypass 2FA by submitting forged device responses. The vulnerabilities affect all self-managed GitLab installations with severities ranging up to High CVSS 7.5, and immediate upgrade is strongly recommended.
That concludes today's briefing.