Zero Day Wire

Breaches

Threat Actor Claims Massive Leak of 36 Million Venezuelan Citizen Records Including National Identity Data

A threat actor is claiming to have leaked personal data belonging to 36 million Venezuelan citizens, potentially encompassing the entire population of the country, according to a posting on a dark web forum observed by Zero Day Wire. The forum post, published on January 27, 2026, advertises a database containing

Alerts

Critical Appsmith Vulnerability Enables Account Takeover Through Origin Header Manipulation (CVE-2026-22794)

A critical authentication vulnerability in Appsmith allows attackers to take over user accounts by manipulating the HTTP Origin header during the password reset process, with over 1,600 vulnerable instances currently exposed on the internet, according to research published by Resecurity. The vulnerability, tracked as CVE-2026-22794, carries a CVSS score

Threats

China-Aligned APT Groups Deploy PeckBirdy JScript Framework for Fileless Attacks on Government Targets

China-aligned advanced persistent threat groups have been using a previously undocumented JScript-based command-and-control framework called PeckBirdy to conduct fileless attacks against Asian government entities, educational institutions, and Chinese gambling operations since 2023, according to research published by Trend Micro. PeckBirdy is built entirely in JScript and leverages the Windows Script

Threats

Malicious npm Package "G_Wagon" Steals Browser Credentials and 100+ Cryptocurrency Wallets

A sophisticated malicious npm package disguised as a UI component library has been discovered deploying a multi-stage infostealer that targets browser credentials, over 100 cryptocurrency wallet extensions, cloud credentials, and messaging tokens, according to research published by Aikido Security. The package, named ansi-universal-ui, describes itself as "a lightweight, modular

Threats

Mustang Panda Upgrades CoolClient Backdoor with Clipboard Monitoring and Credential Theft Capabilities

The China-linked advanced persistent threat group HoneyMyte, also known as Mustang Panda or Bronze President, has significantly upgraded its CoolClient backdoor with new surveillance capabilities including clipboard monitoring, HTTP proxy credential sniffing, and browser credential theft, according to research published by Kaspersky. The group continues to actively target government entities

Alerts

Critical vm2 Sandbox Escape Vulnerability Allows Arbitrary Code Execution on Host Systems (CVE-2026-22709)

A critical vulnerability in vm2, a widely-used Node.js sandbox library, allows attackers to completely bypass sandbox isolation and execute arbitrary code on host machines. The flaw carries a CVSS severity score of 9.8, the highest possible rating for a remotely exploitable vulnerability. The vulnerability, tracked as CVE-2026-22709, affects

Breaches

Salt Typhoon Hacked Downing Street Mobile Phones for Years, Exposing Senior UK Government Communications

Chinese state-sponsored hackers compromised mobile phones of senior Downing Street officials for several years, exposing private communications of some of the closest aides to three British prime ministers, according to a report by The Telegraph. The espionage operation, attributed to the Beijing-linked threat group Salt Typhoon, targeted phones of senior

Threats

Fake Notepad++ and 7-Zip Websites Distribute Weaponized RMM Tools to Deploy Backdoor Malware

Threat actors are exploiting legitimate Remote Monitoring and Management software as an initial infection vector, distributing weaponized RMM tools through fake download sites impersonating popular utilities like Notepad++, 7-Zip, Telegram, and ChatGPT, according to research published by ASEC. The campaigns represent a shift in attacker tactics. Traditionally, threat actors deployed

Threats

Pakistan-Linked APT Targets Indian Government with New Golang Malware Using GitHub for Command and Control

A Pakistan-linked advanced persistent threat group is targeting Indian government entities with three previously undocumented malware tools that leverage private GitHub repositories for command-and-control communication, according to research published by Zscaler ThreatLabz. The campaign, dubbed Gopher Strike, deploys a new downloader called GOGITTER, a backdoor named GITSHELLPAD, and a shellcode

Alerts

CISA Adds Four Vulnerabilities to KEV Catalog Including Critical SmarterMail Authentication Bypass

CISA has added four vulnerabilities to its Known Exploited Vulnerabilities catalog, including two critical flaws in SmarterTools SmarterMail that could allow unauthenticated attackers to achieve full administrative compromise of mail servers. Federal agencies must apply mitigations by February 16, 2026. Critical SmarterMail Authentication Bypass The most severe addition is CVE-2026-23760,

Alerts

Microsoft Office Zero-Day Under Active Exploitation Bypasses OLE Security Mitigations (CVE-2026-21509)

Microsoft has disclosed an actively exploited zero-day vulnerability in Microsoft Office that allows attackers to bypass security features designed to protect users from malicious OLE and COM controls. The vulnerability was publicly disclosed and is confirmed under active exploitation. The flaw, tracked as CVE-2026-21509, carries a CVSS score of 7.

Threats

Russian Malware Toolkit Guarantees Chrome Web Store Approval for $6,000

A malware-as-a-service toolkit circulating on Russian cybercrime forums offers turnkey website spoofing capabilities disguised as a Chrome extension, with its premium tier guaranteeing publication on the official Chrome Web Store, according to research published by Varonis. The toolkit, dubbed Stanley after the seller's alias, sells for $2,000