Breaches
UPDATE 27/01/2026 Nike has confirmed that it is investigating a potential cybersecurity incident after claims surfaced online that its internal data may have leaked by a cybercrime group. The same group, known for extortion-driven attacks against other companies, previously claimed the Nike cyberattack on its dark web site.
Breaches
A threat actor is allegedly selling a database containing 26.7 million user records from Affirm, the popular buy-now-pay-later financial services platform operating in the United States and Canada. The listing appeared on the Exploit cybercrime forum on January 23, 2026, posted by a threat actor using the handle "
Alerts
CISA has added four vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog after confirming active exploitation in the wild, affecting widely deployed development tools, email infrastructure, and enterprise networking products. The newly catalogued vulnerabilities impact Vite, Versa Concerto, eslint-config-prettier, and Synacor Zimbra Collaboration Suite. Under Binding Operational Directive 22-01, Federal
Threats
Security researchers have uncovered sophisticated phishing toolkits purpose-built for voice-based social engineering attacks that synchronize fake login pages with live phone conversations to defeat multifactor authentication in real time. The toolkits, sold as-a-service to criminals, target major identity providers including Google, Microsoft, Okta, and various cryptocurrency platforms. Unlike traditional phishing
Threats
A sophisticated Windows backdoor dubbed PDFSider has been identified in targeted attacks against enterprise environments, including a Fortune 100 financial services company. The malware demonstrates APT-grade tradecraft while being deployed in ransomware operations, blending advanced evasion techniques with financially motivated attacks. DLL Side-Loading via PDF24 Creator PDFSider is delivered through
Threats
Summary Attackers compromised the official download page of EmEditor, a popular text and code editor, to distribute a trojanized installer containing multi-stage malware. The attack targeted the software's primarily Japanese developer user base during the late December 2025 holiday period when security monitoring typically weakens. The malware performs
Alerts
A critical vulnerability in the Academy LMS plugin for WordPress is under active exploitation, allowing unauthenticated attackers to take over administrator accounts and gain full control of affected eLearning platforms. The flaw, tracked as CVE-2025-15521, carries a CVSS score of 9.8 and affects all versions of the plugin up
Breaches
The Nova ransomware group has claimed responsibility for an attack against KPMG, one of the Big Four professional services firms, threatening to release 500GB of stolen data if ransom demands are not met. The listing appeared on Nova's dark web leak site on January 23, 2026, with a
Threats
A sophisticated evolution of the ClearFake malware campaign is abusing a legitimate Windows component to execute malicious PowerShell commands while evading endpoint detection systems. The campaign, which has compromised hundreds of websites since August 2025, now leverages a command injection vulnerability in a trusted Microsoft-signed script to silently run malicious
Threats
A previously undocumented ransomware family dubbed Osiris has emerged in attacks targeting enterprise environments, with technical evidence suggesting the operators may have ties to the Inc ransomware group. Symantec's Threat Hunter Team identified the new strain during an investigation into an attack against a major food service franchisee
Alerts
Microsoft's January 2026 cumulative update for Windows 11 is causing widespread system stability issues, with users reporting full lockups, black screens, and application failures that have forced many to uninstall the security patches. KB5074109, released on Patch Tuesday January 13, targets Windows 11 versions 24H2 and 25H2, delivering
Threats
North Korean-linked threat actor KONNI is deploying an AI-generated PowerShell backdoor in an ongoing phishing campaign targeting software developers and engineering teams with access to blockchain infrastructure. The campaign, documented by Check Point Research, marks a notable evolution in both the group's targeting and tooling. Expanding Beyond Traditional