Attackers are getting quieter — and faster. |
This week, they’re slipping in through “trusted” links, open databases, plugin backdoors, and even phone calls that beat MFA in real time. If your defenses only rely on what looks suspicious, you may already be behind.
Read past newsletters here. |
|
| Here’s what you need to know: |
|
|
WordPress Admin Backdoor Puts 20,000 Sites at Risk |
A popular WordPress plugin vulnerability lets attackers create admin accounts without logging in, putting thousands of sites at risk of takeover. The LA-Studio Element Kit for Elementor flaw (20,000+ installs) uses a hidden registration backdoor to grant admin access via a crafted request, enabling full site takeover. |
The vendor has released a patch and Wordfence has also released a firewall rule to protect against exploitation. Apply the latest patch, audit admin users, enforce MFA, and validate backups.
|
149M Stolen Credentials Left Wide Open on the Internet |
Researchers found an unsecured online database exposing roughly 149 million usernames and passwords, with no encryption or access controls in place before it was taken down. The leak includes logins for Gmail and Facebook and it’s suspected that infostealer malware collected the data. Researchers suspect that the leaked credentials are already circulating in the criminal ecosystem.
Assume exposure, reset passwords, enable 2FA, scan endpoints for infostealers, and train users. |
Microsoft Flags SharePoint AiTM Campaign Targeting Energy Sector |
Attackers are abusing trusted SharePoint links to launch AiTM phishing against energy firms, hijacking sessions and enabling BEC.
Sent from compromised vendors and disguised as normal SharePoint doc shares, the lures can bypass email defenses. After login, attackers steal session tokens to persist past MFA, then create inbox rules to hide alerts. These attacks are active in the wild.
Revoke active sessions, remove malicious inbox rules/forwarding, enforce phishing-resistant MFA and Conditional Access, lock down SharePoint sharing, and monitor for abnormal sign-ins and outbound email spikes.
|
|
|
If an AiTM attack hijacked your login session today… |
|
|
Yesterday's Pulse Check Results |
If Zoom or GitLab dropped a critical patch today, how fast would your org ship it? |
|
|
Security Tools You Can Use |
|
|
Windows Malware Disables Defender, Then Drops Ransomware |
A new multi-stage malware campaign abuses built-in Windows features to disable defenses before deploying ransomware. FortiGuard says the attack starts with fake accounting archives that use a .LNK + PowerShell chain to pull payloads from GitHub/Dropbox, then Defendnot disables Defender so Amnesia RAT and ransomware can deploy. |
The malware is active in the wild.
Block .LNK files from archives, lock down PowerShell/script execution, and alert on new AV registrations or Defender tampering to stop the kill chain early. |
Okta Spots Vishing Kits That Bypass MFA in Real Time |
Okta researchers uncovered custom phishing kits designed to help phone-based attackers steal credentials and coach victims through MFA prompts in real time. These kits let callers sync and update fake login pages in real time to capture passwords and MFA codes or approvals during a live call. Okta says the tools are now sold as-a-service, lowering the barrier to entry and boosting vishing volume. Deploy phishing-resistant MFA (passkeys/FIDO2), and block sign-ins from anonymizers using network zones/allowlists. |
|
|
Scaling AI without governance increases risk and uncertainty.
On February 5 at 1:00 PM ET, TechnologyAdvice and UST explore how enterprises embed responsible AI to unlock value safely. Strengthen your AI foundation. |
|
|
How locked down are your databases right now? |
Databases are a target because they store high-value information like customer data, credentials, financial records, and internal IP — and small gaps in access controls or configuration can create outsized risk. |
How to harden your databases: |
-
Enforce least-privilege access and MFA and eliminate shared privileged accounts.
- Keep databases private with network segmentation and use encryption for data at rest and in transit.
-
Maintain secure baselines by patching regularly and monitoring audit logs for unusual access, role changes, and data export spikes.
|
Locking down database access and configuration helps reduce overall exposure. |
|
|
|
Ken Underhill is an award-winning cybersecurity professional, bestselling author, and seasoned IT professional. He holds a graduate degree in cybersecurity and information assurance from Western Governors University, bringing years of hands-on experience to the field. |
|
|
Cybersecurity Insider is a TechnologyAdvice business |
© 2026 TechnologyAdvice, LLC. All rights reserved. |
TechnologyAdvice, 3343 Perimeter Hill Dr., Suite 215, Nashville, TN 37211, USA. |
|
|
|
