TLDR INFORMATION SECURITY 2026-01-07

SCHEDULE YOUR DEMO →

CLICKFIX ATTACK USES FAKE WINDOWS BSOD SCREENS TO PUSH MALWARE

Securonix tracked a ClickFix campaign (PHALT#BLYX) targeting European hospitality firms through phishing emails impersonating Booking.com reservation cancellations, leading victims to a high-fidelity clone site that displays fake Windows BSOD screens in full-screen browser mode. The social engineering attack tricks users into executing malicious PowerShell commands that download and compile a .NET project using MSBuild.exe, thereby deploying the DCRAT remote access trojan, which includes keylogging, reverse shell, remote desktop functionality, and cryptocurrency mining. Hospitality organizations should implement email filtering for Booking.com impersonation attempts, educate staff that legitimate BSOD screens never provide recovery instructions or commands to execute, and monitor for suspicious MSBuild.exe compilation activity and Windows Defender exclusion modifications.

HACKTIVIST DELETES WHITE SUPREMACIST WEBSITES LIVE ONSTAGE DURING HACK CONFERENCE

A hacktivist who goes by Martha Root deleted the websites of WhiteDate, WhiteChild, and WhiteDeal in real time at the end of a talk about the websites at Chaos Communication Congress. Root infiltrated the sites using AI chatbots that bypassed verification processes and were verified as “white.” Root also leaked data from the sites, including users' profiles with names, pictures, descriptions, ages, locations, genders, languages, races, and other personal information.

NEW N8N VULNERABILITY (9.9 CVSS) LETS AUTHENTICATED USERS EXECUTE SYSTEM COMMANDS

A critical flaw in n8n (CVE-2025-68668) allows authenticated users with workflow permissions to bypass the Python sandbox and run arbitrary OS commands on the host, scoring 9.9 on CVSS. The issue affects versions 1.0.0 through 2.0.0 and is fixed in 2.0.0. Mitigations include disabling the Code Node, turning off Python support, or using task runner-based isolation.

WINNING THE AI CYBER RACE: VERIFIABILITY IS ALL YOU NEED

AI-powered cyber offense is outpacing defense because offensive tasks offer binary, easily verifiable outcomes, while defensive tasks like SIEM analysis, GRC assessments, and forensics lack reliable mechanical verifiers, resulting in noise-heavy signals with precision rates below 1% that make model training ineffective. Research demonstrates the verifiability gap's impact: OpenAI's o3 achieved 90% CTF challenge success versus GPT-4's 20%, DARPA AIxCC results showed autonomous vulnerability detection improving from 37% to 77%, and Microsoft's Project Ire reached 98% precision by wrapping LLMs with proper tool scaffolding, compared to Google's Sec-Gemini at 12% precision without verifiers. Security leaders should prioritize building mechanical verifiers and adopt offense-first thinking through continuous AI red teaming, as whoever owns the verifiers wins the AI security race.

ESCAPING ISLA NUBLAR: COMING AROUND TO LLMS FOR FORMAL METHODS

CNnotator is a tool that combines large language models (LLMs) with formal verification to generate memory-safety annotations for C code automatically. It works through an iterative process where LLM-generated annotations are tested against a CN verifier. This approach addresses the challenge of translating legacy C/C++ code—which accounts for 70% of Chromium's security bugs—into memory-safe languages like Rust. Testing showed that OpenAI's o3 reasoning model achieved a 90% success rate on the first attempt and 97% within three attempts.

REVERSE ENGINEERING MY CLOUD-CONNECTED E-SCOOTER AND FINDING THE MASTER KEY TO UNLOCK ALL SCOOTERS

The Äike electric scooter relies entirely on a cloud-backed mobile app for locking, unlocking, and other controls, which becomes risky once the manufacturer goes bankrupt and services degrade. By reverse engineering the Android app, using Frida to intercept BLE GATT traffic and Java hashing calls, the author uncovers a SHA-1–based challenge-response that incorrectly uses a global default key rather than a unique per-device secret. With this knowledge, any nearby Äike scooter can be authenticated to and remotely commanded via a short Python proof-of-concept using Bleak.

PYFRC2G

PyFRC2G converts pfSense and OPNSense firewall rules into graphical flow diagrams and PDF documentation through API-based alias retrieval, automatic interface detection, and per-interface output generation with color-coded visualization. The tool implements smart change detection using MD5 comparison to regenerate graphs only when rules change, generates separate CSV and PDF files for each interface using Graphviz, and supports optional CISO Assistant integration for automatic upload of compliance evidence. Security teams can use PyFRC2G to visually document complex firewall rule sets and meet IT security compliance requirements across various frameworks without manual configuration files.

FAIL2BAN

Fail2Ban scans log files and bans IP addresses that conduct too many failed login attempts. It does this by updating system firewall rules to reject new connections from those IP addresses, for a configurable amount of time. Fail2Ban comes out-of-the-box ready to read many standard log files, such as those for sshd and Apache. It can be easily configured to read any log file of your choosing, for any error you wish.

RUSTSCAN

RustScan is a modern Port scanner that helps find ports quickly (3 seconds at its fastest for 65k ports).

RUSSIA-ALIGNED HACKERS ABUSE VIBER TO TARGET UKRAINIAN MILITARY AND GOVERNMENT

UAC-0184 (Hive0156), a threat actor aligned with Russia, used the Viber messaging platform to send malicious ZIP files containing LNK files disguised as Office documents to Ukrainian military and government targets. The attack involved multiple stages, including the deployment of Hijack Loader via PowerShell, which employed DLL side-loading and module stomping techniques to bypass detection from major security vendors like Kaspersky, Avast, BitDefender, AVG, Emsisoft, Webroot, and Microsoft. Afterward, it injected Remcos RAT into chime.exe for cyber espionage and data theft. Ukrainian organizations should improve monitoring of messaging platforms beyond email, adopt behavioral detection for Hijack Loader and Remcos RAT, and bolster defenses against social engineering attacks that exploit trusted communication channels.

THE SHIFT FROM DISK IMAGING TO DIGITAL TRIAGE

Quick Triage addresses digital forensics backlogs by shifting from traditional bit-for-bit disk imaging to rapid artifact-focused triage, enabling field decisions within minutes rather than months of lab analysis. The "desktop pivot" strategy exploits cloud synchronization mechanics where mobile data protected by iOS Secure Enclave or Android TEE encryption becomes accessible on Windows systems with weaker BitLocker protection. Waymo's trade secret theft (Registry USB logs) demonstrated how Windows artifact analysis solves investigations when mobile extraction fails. Investigators are advised to prioritize communication artifacts and web activity as immediate lead sources before comprehensive forensic imaging.

NORDVPN DENIES BREACH AFTER HACKER LEAKS DATA

A threat actor claims to have brute-forced a misconfigured NordVPN server, allegedly leaking data, including Salesforce and Jira information, but NordVPN's forensic review found no compromise of its infrastructure. The threat actor attributed the leak to a third-party testing platform that used only dummy data without any real customer information, source code, or credentials.

perimeter. Learn how Okta Secures AI.

BITFINEX HACK CONVICT ILYA LICHTENSTEIN RELEASED EARLY UNDER US FIRST STEP ACT

Ilya Lichtenstein, convicted of laundering 119,754 bitcoin stolen in the 2016 Bitfinex hack through a multi-signature vulnerability exploit, has been released early under the US First Step Act after serving part of his five-year sentence.

DISNEY FINED $10M FOR VIOLATING CHILDREN'S PRIVACY LAWS ON YOUTUBE

Disney agreed to pay $10 million to settle DOJ allegations that it violated COPPA by failing to properly designate YouTube videos as child-directed content.

FCC FINALIZES NEW PENALTIES FOR ROBOCALL VIOLATORS

FCC finalized regulations effective February 5, imposing financial penalties on telecoms for submitting false or inaccurate information to the Robocall Mitigation Database.