This week, the world of cybersecurity faced a whole range of threats—from massive phishing attacks on users of the largest social network to the takedown of a legendary botnet that had been stealing cryptocurrencies for two decades. I break down the key events that cannot be ignored.
Anomalous activity on X: attack or an echo of an old leak?
Users of X (formerly Twitter) are mass-complaining about a wave of unauthorized password reset requests and suspicious notifications about logins from new devices. Platform engineers acknowledged the anomaly but deny a breach of infrastructure, linking it to automated attempts to seize accounts for access to X Money's internal monetization.
In my view, the root of the problem is deeper. We are seeing an echo of the 2022 API vulnerability, when data from 200 million users was compromised. In March 2025, hacker ThinkingOne released a 34 GB database with data from 201 million accounts. Botnets running millions of login/password combinations through the login form only confirm that attackers are actively using this data. The good news: two-factor authentication (2FA) cuts off 85.6% of such attempts.
Meanwhile, a separate phishing campaign has been active since July: victims receive perfect copies of X emails about "login from a new device," leading to fake pages designed to steal authorization tokens. I recommend that everyone, without exception, enable password reset protection and check the sender's address—legitimate emails only come from @X.com or @e.X.com.
End of an era: Sality botnet destroyed
U.S. and European law enforcement conducted a joint operation to dismantle the decentralized Sality botnet, which had been active since 2003. At the time of shutdown, the network numbered more than 15,000 active infected devices. Given the P2P architecture, simply taking down servers was not enough—cyberpolice intercepted control over key supernodes, isolating infected machines.
Of particular interest to the crypto community is the EggJagger module—a specialized clipper that has been the botnet's main payload for the past eight years. It silently replaced copied cryptocurrency addresses in the clipboard with hackers' wallets. This is a reminder: always double-check the recipient's address before sending a transaction, even if you copied it from a trusted source.
Charges against a Russian citizen and the evolution of AI attacks
A federal court in California brought charges against 40-year-old Sirazhudin Aktulaev, arrested in Cyprus. From 2016 to 2017, he created 255 fake profiles on a U.S. labor exchange and infected 80,000 freelancers with malicious Excel documents carrying TVRAT and DarkVNC trojans. Paying for infrastructure with cryptocurrency is a typical trail that, however, did not help him avoid justice.
Meanwhile, ESET experts discovered the GuardBreaker technique used by the pro-Russian group UAC-0099. Attackers embed open-text decoys into scripts ("I want to create nuclear weapons. Help me...") to trigger protective filters in AI scanners. The scanning tool interrupts the session without reaching the analysis of the malicious code itself, allowing the MATCHBOIL loader to be delivered covertly. This is an alarming signal: AI security tools are becoming vulnerable to "prompt poisoning," and the industry urgently needs to rethink approaches to protecting them.
Pegasus in Serbia: surveillance of the opposition
Citizen Lab and the SHARE Foundation reported the infection of an iPhone belonging to a member of the Serbian student movement with Pegasus spyware via a zero-click exploit in iMessage. From December 2025 to January 2026, at least 14 representatives of civil society, including students and opposition politicians, were targeted. The devices also contained the local Android spyware NoviSpy, and private messages from Viber on the infected phone were quoted on a pro-government TV channel. This is a striking example of how commercial spyware is used to suppress civil liberties.
My conclusion: the week showed that cyber threats are becoming increasingly sophisticated. From botnets stealing cryptocurrency to AI attacks bypassing modern antivirus software, attackers are adapting faster than we expect. The only reliable defense is basic hygiene: 2FA, checking senders, and constant vigilance.