TLDR INFORMATION SECURITY 2026-01-02

TRUST WALLET CHROME EXTENSION HACK DRAINS $8.5M VIA SHAI-HULUD SUPPLY CHAIN ATTACK

Trust Wallet disclosed that the second iteration of the Shai-Hulud supply chain attack in November compromised its Google Chrome extension, resulting in the theft of approximately $8.5 million in cryptocurrency assets. The attack leveraged malicious packages published to npm and PyPI, compromising developer environments and enabling attackers to insert malicious code into the extension for wallet credential theft.

22 MILLION AFFECTED BY AFLAC DATA BREACH

Hackers breached Aflac's US network in June 2025, stealing data on about 22.65 million people, including names, addresses, Social Security numbers, IDs, and medical and insurance details. Aflac contained the attack without ransomware impact and is now offering 24 months of credit, identity, and medical fraud monitoring, urging vigilance.

CONDÉ NAST HACK EXPOSES 40 MILLION USERS' DATA

A hacker calling themselves Lovely claims to have breached Condé Nast's user database, leaking 2.3 million records with names and contact details. They have threatened to dump 40 million more from brands like Vogue and The New Yorker.

EQUIFAX EUROPE CISO: NOTORIOUS BREACH SPURRED CYBERSECURITY TRANSFORMATION

Equifax Continental Europe CISO Javier Checa detailed the company's $3 billion transformation following the 2017 breach that compromised 147 million records, including a complete cloud migration, zero legacy systems, and embedding security culture across all 300 cybersecurity specialists, plus company-wide employee bonus structures tied to security metrics. The company built its recovery strategy on transparency and collaboration, publishing annual security reports with incident-response metrics and sharing security control frameworks publicly, while neutralizing 15 million daily threats (175 per second, up 25% from 2023). Security teams should adopt hybrid defense strategies combining AI-powered tools with traditional signature-based protections, implement biometric authentication to counter deepfake attacks, and ensure CISO representation on management committees to maintain strategic alignment between security investments and business objectives.

MAKING CLOUDFLARE WORKERS WORK FOR RED TEAMS

Cloudflare Workers can provide a serverless, rapidly adaptable platform for Conditional Access Payload Delivery (CAPD). Authentication can be achieved via a custom header, and the system can be enhanced by supplying secrets as environment variables, using more generic error codes, or by using timing-safe comparisons. The post also details detection opportunities for defenders.

SINGULARITY: DEEP DIVE INTO A MODERN STEALTH LINUX KERNEL ROOTKIT

Singularity demonstrates advanced Linux rootkit tactics by leveraging legitimate kernel features (ftrace) for syscall hooking and implementing defense-in-depth across processes, filesystems, network layers, and logging systems. The rootkit's dual-architecture support (x86_64 and ia32) prevent a common detection bypass in which investigators use 32-bit binaries to circumvent 64-bit-only hooks. Comprehensive anti-forensics capabilities, including log sanitization, taint flag manipulation, and module auto-hiding, render traditional detection methods ineffective. Defenders should adopt memory-based forensics techniques, monitor ftrace hook signatures in kernel debug interfaces, test with both 32-bit and 64-bit tools, and recognize that filesystem-based security checks can be completely intercepted by kernel-level adversaries.

SILPH: STEALTHY IN-MEMORY LOCAL PASSWORD HARVESTER

THIRD EYE

Third Eye is a user-mode WDA_MONITOR/WDA_EXCLUDEFROMCAPTURE bypasser using undocumented Windows functions with C# bindings.

CIPHERO (PRODUCT LAUNCH)

Ciphero provides an AI security and governance platform that acts as an AI verification layer for enterprises. It captures, verifies, and governs all AI interactions (including shadow AI and agentic workflows) to prevent data loss, enforce policies, and improve AI reliability.

HOW TO ACHIEVE YOUR CYBERSECURITY GOALS IN 2026

Those setting New Year's goals should start by establishing a system, such as a study schedule, to achieve them. To-do lists or scheduled blocks of time can help fight procrastination. Having a mentor or friend keep you accountable can also help with ensuring goals are met.

MONGODB UNAUTHENTICATED ATTACKER SENSITIVE MEMORY LEAK

A critical flaw in MongoDB's use of the zlib compression library allows network attackers to leak sensitive data from server memory without requiring authentication. By sending specially crafted compressed messages, they can gradually extract user information, passwords, and API keys from affected MongoDB versions. Updating to patched releases, closing unnecessary ports, and disabling zlib compression where possible are key steps to reduce exposure.

COUPANG ANNOUNCES $1.18 BILLION COMPENSATION TO SOUTH KOREAN USERS FOR DATA LEAK

South Korean Coupang will distribute 50,000 won vouchers to 33.7 million account holders after a data leak, totaling 1.69 trillion won ($1.18 billion). Critics say the vouchers, usable only on Coupang, turn a privacy crisis into marketing and don't reflect the breach's seriousness, sparking parliamentary hearings and consumer anger.

TOP US ACCOUNTING FIRM SAX DISCLOSES 2024 DATA BREACH IMPACTING 220,000

Sax, a major US accounting firm, has disclosed a breach that happened in 2024 that exposed data on about 220,000 individuals.

RONDODOX BOTNET EXPLOITS CRITICAL REACT2SHELL FLAW TO HIJACK IOT DEVICES AND WEB SERVERS

Cybersecurity researchers have revealed a nine-month campaign that exploited CVE-2025-55182 in React2Shell to hijack IoT devices and web servers, incorporating them into the RondoDox botnet.

MICROSOFT WILL FINALLY KILL OBSOLETE CIPHER THAT HAS WRECKED DECADES OF HAVOC

Microsoft has announced that it will be dropping support for RC4, the default encryption method in Active Directory for the last 26 years.