Threat actors are finding shortcuts to control. |
Today's threats blur the line between access and takeover — spanning chat hijacks, remote access knockouts, WordPress admin grabs, and stealthy cloud malware built to blend in.
Reminder: Due to the MLK holiday here in the U.S., there will be no newsletter sent on Monday the 19th. Read past newsletters here. |
|
| Here’s what you need to know: |
|
|
Attackers Use Fake WhatsApp Web Logins to Hijack Chats |
A new WhatsApp phish uses fake “join meeting” links and QR codes to hijack accounts by linking WhatsApp Web to an attacker’s browser. The campaign appears to target Iran-linked political, media, research, and activist communities, but any user who scans an unexpected WhatsApp Web QR code is at risk. |
This is an active campaign in the wild.
Only scan WhatsApp Web QR codes from the official site and regularly check settings to remove any sessions you don’t recognize. |
Palo Alto Networks Fixes PAN-OS Bug That Knocks GlobalProtect Offline |
A PAN-OS vulnerability could disrupt GlobalProtect remote access by enabling DoS attacks on exposed gateways and portals. The flaw affects PAN-OS NGFW and Prisma Access GlobalProtect deployments across multiple release trains, while Cloud NGFW is unaffected.
Palo Alto Networks has released a patch for the issue and proof-of-concept code is available. Patch internet-facing GlobalProtect portals and gateways to the latest hotfix, and restrict access with IP allowlists while monitoring for traffic spikes and maintenance mode events. |
Microsoft’s 112-Bug Patch Tuesday Fixes Exploited Windows Issue |
Microsoft’s first Patch Tuesday of 2026 fixes 112 flaws across Windows, Office, SharePoint, and core services, with Chromium updates bringing the total higher.
The most notable issue is CVE-2026-20805, a Windows DWM info disclosure bug on CISA’s KEV list, and teams should also prioritize critical SharePoint, Office, and Windows networking patches. Patch DWM and SharePoint updates first, then monitor for unusual privileged logins and SharePoint traffic spikes. |
|
|
How locked down is your remote access? |
|
|
Yesterday's Pulse Check Results |
If a big employee data dump hits tomorrow, what’s your first move? |
|
|
Security Tools You Can Use |
|
|
WordPress Admin Takeovers Hit Modular DS Plugin Installs |
A Modular DS WordPress plugin vulnerability is being exploited to gain admin access on vulnerable sites.
Patchstack says CVE-2026-23550 affects Modular DS 2.5.1 and below across 40,000+ installs, allowing attackers to bypass authentication via /api/modular-connector/ and reach a login flow that can grant wp-admin access without valid credentials. |
A patch has been released for the vulnerability.
Update Modular DS to 2.5.2+ immediately, restrict access to API connectors, and audit logs and admin accounts for suspicious changes. |
Check Point Uncovers VoidLink Cloud Linux Malware Framework |
Check Point researchers say the newly uncovered VoidLink framework shows cloud-focused Linux threats becoming more modular and persistent.
VoidLink targets cloud and container environments, using in-memory plugins for recon, credential theft, and anti-forensics, and it can detect Docker/Kubernetes contexts to adapt its stealth and evade detection.
Restrict cloud metadata access, rotate secrets, and harden container and Kubernetes permissions to limit post-compromise impact. |
|
|
Siloed service management limits growth. Join TechnologyAdvice in collaboration with Freshworks on January 21 at 1:00 PM ET to learn how teams are creating alignment across the enterprise with smarter service strategies. Get the insights you need to move from complexity to clarity. Join peers shaping the future of service management. |
|
|
Lock Down Cloud and Container Security |
In cloud environments, misconfigured identities, exposed metadata services, or overly permissive Kubernetes settings can turn a small foothold into widespread access fast. Tightening controls helps reduce credential theft, lateral movement, and persistence. |
How to harden cloud and container workloads: |
-
Strengthen cloud security by restricting metadata access and rotating secrets using short-lived tokens stored in an approved vault.
-
Enforce least privilege for Kubernetes by limiting service account permissions and blocking privileged container workloads.
- Apply runtime protections and control egress traffic to detect and disrupt command-and-control activity.
|
These steps help reduce your cloud attack surface and limit blast radius if a workload is compromised. |
|
|
|
Ken Underhill is an award-winning cybersecurity professional, bestselling author, and seasoned IT professional. He holds a graduate degree in cybersecurity and information assurance from Western Governors University, bringing years of hands-on experience to the field. |
|
|
Cybersecurity Insider is a TechnologyAdvice business |
© 2026 TechnologyAdvice, LLC. All rights reserved. |
TechnologyAdvice, 3343 Perimeter Hill Dr., Suite 215, Nashville, TN 37211, USA. |
|
|
|
