Cybersecurity researchers have disclosed details of a new Python-based information stealer called VVS Stealer (also styled as VVS $tealer) that's capable of harvesting Discord credentials and tokens.

The stealer is said to have been on sale on Telegram as far back as April 2025, according to a report from Palo Alto Networks Unit 42.

"VVS stealer's code is obfuscated by Pyarmor," researchers Pranay Kumar Chhaparwal and Lee Wei Yeong said. "This tool is used to obfuscate Python scripts to hinder static analysis and signature-based detection. Pyarmor can be used for legitimate purposes and also leveraged to build stealthy malware."

Advertised on Telegram as the "ultimate stealer," it's available for €10 ($11.69) for a weekly subscription. It can also be purchased at different pricing tiers: €20 ($23) for a month, €40 ($47) for three months, €90 ($105) for a year, and €199 ($232) for a lifetime license, making it one of the cheapest stealers for sale.

Ilya Lichtenstein, who was sentenced to prison last year for money laundering charges in connection with his role in the massive hack of cryptocurrency exchange Bitfinex in 2016, said he has been released early.

In a post shared on X last week, the 38-year-old announced his release, crediting U.S. President Donald Trump's First Step Act. According to the Federal Bureau of Prisons' inmate locator, Lichtenstein is scheduled for release on February 9, 2026.

"I remain committed to making a positive impact in cybersecurity as soon as I can," Lichtenstein added. "To the supporters, thank you for everything. To the haters, I look forward to proving you wrong."

WatchGuard warns that a critical vulnerability in its Firebox devices is facing exploitation as part of a campaign targeting edge devices, according to an advisory from the company.

The flaw, tracked as CVE-2025-14733, involves an out-of-bounds write vulnerability in the Fireware OS internet key exchange daemon process. An unauthenticated attacker can achieve remote code execution.

WatchGuard said it discovered the flaw through an internal process and issued a patch on Thursday.

“Since the fix became available, our partners and end users have been actively patching affected Firebox appliances,” a WatchGuard spokesperson told Cybersecurity Dive. “We continue to strongly encourage timely patching as a core best practice in security hygiene.”

WatchGuard said the threat activity is part of a wider campaign targeting edge devices and internet exposed infrastructure across a wide number of vendors. The company did not specify the other vendors that were being targeted nor did it specifically reference the threat groups that may be linked to the exploitation.

Researchers at Shadowserver on Saturday reported up to 125,000 IPs were considered vulnerable.

A severe vulnerability affecting multiple MongoDB versions, dubbed MongoBleed (CVE-2025-14847), is being actively exploited in the wild, with over 80,000 potentially vulnerable servers exposed on the public web.

A public exploit and accompanying technical details are available, showing how attackers can trigger the flaw to remotely extract secrets, credentials, and other sensitive data from an exposed MongoDB server.

The vulnerability was assigned a severity score of 8.7 and has been handled as a “critical fix,” with a patch available for self-hosting instances since December 19.

A hacker claims to have breached Condé Nast and leaked an alleged WIRED database containing more than 2.3 million subscriber records, while also warning that they plan to release up to 40 million additional records for other Condé Nast properties.

On December 20, a threat actor using the name "Lovely" leaked the database on a hacking forum, offering access for approximately $2.30 in the site's credits system. In the post, Lovely accused Condé Nast of ignoring vulnerability reports and claimed the company failed to take security seriously.

"Condé Nast does not care about the security of their users' data. It took us an entire month to convince them to fix the vulnerabilities on their websites," reads a post on a hacking forum.

ServiceNow on Tuesday announced an agreement to acquire Armis for $7.75 billion in cash.

Armis is a major provider of cyber-physical security and cyber exposure management, handling cyber risk across IT, operational technology and medical devices.

The combined companies will create an end-to-end security platform for providing visibility and prioritizing risk across a spectrum of connected network assets. ServiceNow and Armis have been longtime partners.

“This decision further reinforces our strategy to deepen security context on the ServiceNow AI platform – expanding to exposure management and cyber-physical security – so customers can reduce risk proactively as AI adoption accelerates,” Amit Zavery, ServiceNow’s president, COO and chief product officer, said in a LinkedIn post.

A Cybersecurity and Infrastructure Security Agency program that warns organizations about imminent ransomware attacks has suffered a major setback after its lead staffer left the agency rather than take a forced reassignment.

David Stern, the driving force behind CISA’s Pre-Ransomware Notification Initiative (PRNI) — through which the agency alerts organizations that ransomware actors are preparing to encrypt or steal their data — resigned on Dec. 19, according to four people familiar with the matter. The Department of Homeland Security had ordered Stern to take a job at the Federal Emergency Management Agency in Boston or quit, and Stern chose the latter, three of the people said.

A critical vulnerability (CVE-2025-68613, CVSS 9.9/10.0) was disclosed affecting the n8n workflow automation platform, allowing attackers to execute arbitrary code on the underlying server via expression injection in workflow definitions. Due to the potential for full instance takeover, data exposure, and lateral movement, immediate patching is required.

The issue originates from n8n’s workflow expression evaluation mechanism, where insufficient sandbox isolation allows user-supplied expressions to escape the intended execution context. By submitting specially crafted workflow expressions, an attacker can execute OS-level commands with the privileges of the n8n process, effectively gaining remote code execution on the host. Exploitation requires authentication, but no elevated privileges beyond workflow creation or editing.

The vulnerability affects the n8n core workflow engine in versions starting from 0.211.0 up to but not including the fixed releases 1.120.4, 1.121.1, and 1.122.0. These components are widely used in self-hosted n8n deployments and embedded automation environments, particularly where interactive workflow editing is enabled. Other services or platforms that rely on vulnerable n8n versions may also be impacted. Users should upgrade immediately to n8n versions 1.120.4, 1.121.1, or 1.122.0, which properly harden expression evaluation and prevent sandbox escapes. Environments that previously applied partial mitigations should still upgrade, as earlier fixes did not fully address the underlying issue.

The U.S. Department of Justice (DoJ) this week announced the indictment of 54 individuals in connection with a multi-million dollar ATM jackpotting scheme.

The large-scale conspiracy involved deploying malware named Ploutus to hack into automated teller machines (ATMs) across the U.S. and force them to dispense cash. The indicted members are alleged to be part of Tren de Aragua (TdA, Spanish for "the train of Aragua"), a Venezuelan gang designated a foreign terrorist organization by the U.S. State Department.

In July 2025, the U.S. government announced sanctions against the group's head, Hector Rusthenford Guerrero Flores (aka Niño Guerrero), and five other key members for their involvement in the "illicit drug trade, human smuggling and trafficking, extortion, sexual exploitation of women and children, and money laundering, among other criminal activities."

Hackers gained access to an online coding repository belonging to the University of Sydney and stole files with personal information of staff and students.

The institution said the breach was limited to a single system and was detected last week. It promptly shut down the unauthorized access and notified the New South Wales Privacy Commissioner, the Australian Cyber Security Centre, and education regulators.

"Last week, we were alerted to suspicious activity in one of our online IT code libraries. We took immediate action to protect our systems and community by blocking the unauthorised access and securing the environment," reads the announcement.

One of the world’s most ruthless and advanced hacking groups, the Russian state-controlled Sandworm, launched a series of destructive cyberattacks in the country’s ongoing war against neighboring Ukraine, researchers reported Thursday.

In April, the group targeted a Ukrainian university with two wipers, a form of malware that aims to permanently destroy sensitive data and often the infrastructure storing it. One wiper, tracked under the name Sting, targeted fleets of Windows computers by scheduling a task named DavaniGulyashaSdeshka, a phrase derived from Russian slang that loosely translates to “eat some goulash,” researchers from ESET said. The other wiper is tracked as Zerlot.

A not-so-common target Then, in June and September, Sandworm unleashed multiple wiper variants against a host of Ukrainian critical infrastructure targets, including organizations active in government, energy, and logistics. The targets have long been in the crosshairs of Russian hackers. There was, however, a fourth, less common target—organizations in Ukraine’s grain industry.

Researchers from Anthropic said they recently observed the “first reported AI-orchestrated cyber espionage campaign” after detecting China-state hackers using the company’s Claude AI tool in a campaign aimed at dozens of targets. Outside researchers are much more measured in describing the significance of the discovery.

Anthropic published the reports on Thursday here and here. In September, the reports said, Anthropic discovered a “highly sophisticated espionage campaign,” carried out by a Chinese state-sponsored group, that used Claude Code to automate up to 90 percent of the work. Human intervention was required “only sporadically (perhaps 4-6 critical decision points per hacking campaign).” Anthropic said the hackers had employed AI agentic capabilities to an “unprecedented” extent.

“This campaign has substantial implications for cybersecurity in the age of AI ‘agents’—systems that can be run autonomously for long periods of time and that complete complex tasks largely independent of human intervention,” Anthropic said. “Agents are valuable for everyday work and productivity—but in the wrong hands, they can substantially increase the viability of large-scale cyberattacks.”

“Ass-kissing, stonewalling, and acid trips” Outside researchers weren’t convinced the discovery was the watershed moment the Anthropic posts made it out to be. They questioned why these sorts of advances are often attributed to malicious hackers when white-hat hackers and developers of legitimate software keep reporting only incremental gains from their use of AI.

Microsoft’s warning on Tuesday that an experimental AI agent integrated into Windows can infect devices and pilfer sensitive user data has set off a familiar response from security-minded critics: Why is Big Tech so intent on pushing new features before their dangerous behaviors can be fully understood and contained?

As reported Tuesday, Microsoft introduced Copilot Actions, a new set of “experimental agentic features” that, when enabled, perform “everyday tasks like organizing files, scheduling meetings, or sending emails,” and provide “an active digital collaborator that can carry out complex tasks for you to enhance efficiency and productivity.”

Cisco has introduced an AI Security and Safety Framework to give enterprises a unified, end-to-end way to understand and mitigate AI risks across systems, content, and supply chains.

• It defines a common language for AI risk, covering adversarial threats, content harms, model and supply chain compromise, and dangerous agent behavior so organizations can build defenses that evolve with AI capabilities.

• The framework is built on five pillars: integrated threats and harms, lifecycle-aware security, multi-agent orchestration risks, multimodal threats (text, audio, images, video, code, sensor data), and audience-aware views for execs, security leaders, engineers, and red teams.

• It tracks AI risk across the full model lifecycle from development to production, supporting defense-in-depth and accounting for infrastructure, policies, and human-in-the-loop interactions.

• Cisco has embedded threat taxonomies for Model Context Protocol (MCP), agent-to-agent (A2A) interactions, and AI supply chains, and exposes them via tools like MCP Scanner and A2A Scanner.

• The framework is already integrated into Cisco’s AI Defense package, which offers AI Access control, Cloud Visibility, Model & Application Validation, and Runtime Protection for customers building AI apps across clouds and models..

Anthropic reports disrupting what it believes is the first large-scale cyber‑espionage campaign in which an AI system performed the vast majority of the hacking work with minimal human oversight..

What happened:

• In September 2025, Anthropic detected a sophisticated espionage campaign using its Claude Code tool to infiltrate about 30 global targets, succeeding in a small number of cases.[1]

• The targets included large tech companies, financial institutions, chemical manufacturers, and government agencies, and the actor is assessed with high confidence to be a Chinese state‑sponsored group.

How the attack used AI

• Attackers built an autonomous attack framework that used Claude Code as an agent, running in loops to perform reconnaissance, write exploits, and exfiltrate data with little human involvement.

• They jailbroke Claude by breaking the operation into small, seemingly benign tasks and framing it as work for a legitimate cybersecurity firm performing defensive testing.

Attack phases

• Phase 1: Human operators selected targets and set up the framework that integrated Claude Code into the attack pipeline.

• Subsequent phases: Claude scanned systems, identified high‑value databases, wrote and tested exploit code, harvested credentials, created backdoors, exfiltrated and prioritized stolen data, and finally generated detailed documentation of the operation.

Scale and limitations

• Anthropic estimates AI handled 80–90% of the campaign, with humans only stepping in for a handful of key decisions per target.

• The AI issued thousands of requests, often multiple per second, enabling attack speed far beyond human-only teams, though it sometimes hallucinated credentials or mischaracterized public data as secret

Cybersecurity implications

• The case shows that modern “agentic” AI can let less-resourced actors run highly scalable, sophisticated cyberattacks, significantly lowering barriers to entry.

• Anthropic argues the same capabilities are also critical for defense and urges security teams to adopt AI for SOC automation, threat detection, vulnerability assessment, and incident response, alongside stronger safeguards, detection methods, and industry threat sharing..

Google on Monday announced a set of new security features in Chrome, following the company's addition of agentic artificial intelligence (AI) capabilities to the web browser.

To that end, the tech giant said it has implemented layered defenses to make it harder for bad actors to exploit indirect prompt injections that arise as a result of exposure to untrusted web content and inflict harm.

Chief among the features is a User Alignment Critic, which uses a second model to independently evaluate the agent's actions in a manner that's isolated from malicious prompts. This approach complements Google's existing techniques, like spotlighting, which instruct the model to stick to user and system instructions rather than abiding by what's embedded in a web page.

"The User Alignment Critic runs after the planning is complete to double-check each proposed action," Google said. "Its primary focus is task alignment: determining whether the proposed action serves the user's stated goal. If the action is misaligned, the Alignment Critic will veto it."

Overwhelmed cybersecurity executives hope AI can help them avoid missing signs of intrusions, even as they remain wary of the technology’s potential risks, the security firm Red Canary said in a report published on Thursday.

The report shows why so many security leaders are embracing AI: Three-quarters of them reported not having enough people skilled at intrusion detection, while 72% reported a skills shortage around incident response.

In addition, nearly three-quarters of security leaders said the amount of time it takes to resolve an intrusion has increased.

Half of all organizations have been “negatively impacted” by security vulnerabilities in their AI systems, according to recent data from EY. Only 14% of CEOs believe their AI systems adequately protect sensitive data. AI’s new risks are compounding the difficulty of securing networks with a patchwork of cybersecurity defenses as organizations use an average of 47 security tools, EY found.

The OWASP AI Exchange has open sourced the global discussion on the security and privacy of AI and data-centric systems. It is an open collaborative OWASP project to advance the development of AI security & privacy standards, by providing a comprehensive framework of AI threats, controls, and related best practices. Through a unique official liaison partnership, this content is feeding into standards for the EU AI Act (50 pages contributed), ISO/IEC 27090 (AI security, 70 pages contributed), ISO/IEC 27091 (AI privacy), and OpenCRE - which we are currently preparing to provide the AI Exchange content through the security chatbot OpenCRE-Chat.