Daily Threat Intel Digest - 2026-01-26

🔴 Critical Threats & Active Exploitation

[NEW] Massive Fake CAPTCHA Ecosystem Hijacks Trusted Web Services for Malware Delivery
Attackers have deployed a sophisticated malware delivery network using fake CAPTCHA pages that mimic trusted verification systems like Cloudflare, enabling the distribution of diverse payloads through conditioned user trust [CyberPress]. This “Living Off the Web” tactic affects 9,494 tracked assets, with 70% clustered into visually identical lures that hide varying execution methods—from clipboard-driven PowerShell scripts to fileless Matrix Push C2 frameworks. Infrastructure analysis reveals fragmented silos with no single malware family tying the ecosystem together, allowing multiple operators to reuse the interface. Defenders must shift beyond clipboard-only detection, monitor notification permission grants post-verification, and block C2 infrastructure including 95.164.53.115:5506, matrix.cymru, and domains like ghost.nestdns.com [Censys Analysis].

[NEW] Windows 11 January Update Triggers Widespread Boot Failures
Microsoft’s January 2026 Patch Tuesday update (KB5074109) is causing critical boot failures on Windows 11 25H2/24H2 systems, rendering devices unusable with “UNMOUNTABLE_BOOT_VOLUME” errors [CyberPress; BleepingComputer]. The issue exclusively affects physical hardware, requiring manual recovery via WinRE to uninstall the faulty package. Beyond boot failures, the update introduces system instability, graphics driver conflicts with Nvidia/AMD GPUs, and Azure Virtual Desktop credential issues—partially addressed in emergency OOB update KB5077744. Administrators should pause deployments, use Known Issue Rollback (KIR) policies where available, and prepare for rollback procedures until Microsoft releases a comprehensive fix.

🎯 Threat Actor Activity & Campaigns

[UPDATE] North Korean KONNI Group Enhances AI-Generated Malware for Developer Targeting
KONNI APT actors have expanded their AI-powered malware campaign targeting blockchain developers in APAC, now using XOR-encoded CAB files delivered via Discord-hosted ZIP archives containing PDF lures and LNK shortcuts [CyberPress]. The AI-crafted PowerShell backdoor (zVJs.ps1) features arithmetic obfuscation and UAC bypass via registry hijacking, with persistence achieved through scheduled tasks named “OneDrive Startup Task”. New TTPs include geofencing checks against CIS countries and SHA-256-based host ID generation for C2 polling. This evolution from previous reports underscores DPRK’s pivot to AI-accelerated tooling for financial espionage. Defenders should monitor for XOR key ‘Q’, mutex Global\SysInfoProject_f7d77a6d-36e0-4fcb-bae7-5f4b3b723f61, and RMM tools like SimpleHelp [Checkpoint Report].

[NEW] MacSync Infostealer Evolves with Code-Signed Swift Droppers
A new MaaS infostealer campaign dubbed MacSync targets macOS users via ClickFix lures mimicking Microsoft logins at crosoftonline.com, redirecting to macclouddrive.com to trick users into executing Terminal commands [CyberPress; CloudSek]. Recent variants employ code-signed Swift droppers to bypass Gatekeeper silently, with payloads targeting 25+ crypto extensions, hardware wallets (Ledger/Trezor), and Keychain data. Persistence mechanisms include trojanizing Electron-based wallet apps via asar replacement and injecting fake PIN/recovery phrase wizards. C2 infrastructure spans jmpbowl.xyz variants and meshsorterio.com, with stolen data exfiltrated via /tmp/osalogging.zip. Defenders should block phishing domains, monitor for osascript processes, and audit hardware wallet app modifications.

[NEW] EmEditor Supply Chain Attack Targets Developer Tools
A watering hole attack compromised EmEditor’s download page to distribute a tampered MSI installer delivering multi-stage PowerShell stealers that harvest credentials, disable ETW, and enable lateral movement [CyberPress]. The malware stages payloads via domains impersonating regional EmEditor sites (EmEditorjp.com, EmEditorgb.com), with geofencing excluding CIS countries to minimize attribution risks. Post-exploitation activities include data exfiltration to cachingdrive.com and screenshot capture. Defender recommendations include MSI integrity verification via hashes, PowerShell execution logging, and vendor supply chain audits. This attack highlights third-party Windows software risks beyond traditional developer environments.

[NEW] ‘rn’ Typo Homoglyph Attacks Target Microsoft/Marriott Users
Attackers are registering domains using ‘rn’ instead of ’m’ (e.g., rnarriottinternational.com, rnicrosoft.com) to launch sophisticated phishing campaigns exploiting typography tricks in modern fonts [CyberPress]. Mobile users face heightened risk due to compressed UI rendering, with lures harvesting loyalty credentials for Marriott and bypassing MFA on Microsoft accounts. Defenders should block observed malicious domains, educate users on URL inspection techniques, and deploy password managers with anti-phishing features. This technique exemplifies how cognitive exploits bypass traditional security training.

⚠️ Vulnerabilities & Patches

[NEW] Critical Backdoor in LA-Studio WordPress Plugin Affects 20,000+ Sites
A former employee inserted a backdoor in the LA-Studio Element Kit for Elementor plugin (CVE-2026-0920, CVSS 9.8), enabling unauthenticated admin user creation via the lakit_bkrole parameter [CyberPress; Wordfence]. The vulnerability, active in versions up to 1.5.6.3, allows attackers to execute obfuscated role assignment logic by string manipulation (changing ‘adstrator’ to ‘administrator’). Patched in version 1.6.0, defenders must immediately update, scan for rogue admin accounts, and review POST requests to /wp-admin/admin-ajax.php. This insider-threat case underscores supply chain risks in plugin ecosystems.

🛡️ Defense & Detection

[NEW] 1Password Introduces Built-in Phishing URL Warnings
1Password deployed automatic pop-up alerts for suspected phishing sites, closing a critical gap where users might manually enter credentials on typosquatted domains [1Password Blog; BleepingComputer]. Enabled by default for individual/family plans and controllable via admin console policies, the feature addresses survey data showing 75% of users neglect URL checks. This responds to AI-driven phishing escalation and reduces credential exposure in enterprise environments. Organizations should activate the feature and integrate it into security awareness training.

📋 Policy & Industry News

[NEW] CISA Releases Global OT Connectivity Security Framework
CISA alongside international partners (UK NCSC, ACSC, FBI, BSI, etc.) published eight principles for securing OT network connections, emphasizing risk management, boundary hardening, and modern protocol adoption [CyberPress; CISA Guidance]. Key recommendations include consolidating access points, implementing DNP3-SAv5/CIP Security, and treating obsolete products as untrusted. The framework directly addresses critical infrastructure vulnerabilities exposed by increasing IT/OT convergence, urging organizations to prioritize implementation based on operational impact and geopolitical threats. Sector-specific guidance targets energy, manufacturing, and utilities operators.