Another week brought a packed agenda in the realm of digital security: from massive attacks on users of the largest social network to the takedown of a legendary botnet and new hacker tricks targeting artificial intelligence.
A wave of phishing and hacking attempts has engulfed X users
Users of the social platform X are mass-complaining about a barrage of unauthorized password reset requests and notifications about logins from unknown devices. Platform engineers acknowledge the presence of anomalous activity but categorically deny any infrastructure breach, linking it to automated bots. In my view, the attackers' motivation is obvious—access to accounts for manipulating the launched X Money monetization system.
The situation is compounded by the fact that databases containing email and phone number pairings with user profiles have long been circulating in the public domain. One such leak, dating back to 2022, affected around 200 million accounts. Later, in 2025, another dataset of 201 million users, including nicknames and registration dates, hit the web. This data is a veritable treasure trove for attackers, enabling them to conduct targeted credential stuffing attacks.
Researchers have already recorded the operation of a botnet that ran millions of login/password combinations through X's login form. It is important to note that two-factor authentication (2FA) blocks the vast majority of such attempts, but it is not a panacea. In parallel, a separate phishing campaign is underway: users receive emails with a perfect imitation of official X notifications about "login from a new device," which lead to fake pages designed to steal authorization tokens.
My recommendations for protection remain unchanged, but they are now critically important:
- Enable password reset protection. This adds an extra verification step before sending a recovery link.
- Always check the sender's address. Legitimate emails only come from @X.com or @e.X.com domains.
- Use authenticator apps instead of SMS codes, which can be intercepted.
Law enforcement has dealt a fatal blow to the Sality botnet
A joint operation by U.S. and European authorities has led to the takedown of one of the oldest and most resilient botnets in history—Sality, which had been active since 2003. At the moment of shutdown, it contained more than 15,000 active infected devices. Sality's uniqueness lay in its decentralized P2P architecture, which made it invulnerable to attacks on a single command center.
Cyberpolice managed to seize control of the network's key supernodes, effectively isolating infected machines from each other and blocking command transmission. In parallel, servers and domains were physically seized in the U.S., Bulgaria, Hungary, and Romania.
Over two decades, Sality was used for password theft, spam, and DDoS attacks. However, in recent years, its main "specialization" became the EggJagger module—a cryptoclipper that swaps cryptocurrency wallet addresses in a victim's clipboard for hackers' wallets in real time. This was a deadly threat for anyone working with digital assets.
U.S.: Charges against a Russian citizen for cyberattack on 80,000 freelancers
A federal court in California has brought charges against 40-year-old Russian citizen Sirazhudin Aktulaev, who was arrested in Cyprus in May 2025. He is accused of orchestrating a large-scale malicious campaign that lasted from 2016 to 2017. The attacker created hundreds of fake profiles on a U.S. freelance exchange and, through its internal messenger, distributed malicious Excel documents disguised as work assignments.
When files were opened, remote access trojans TVRAT and DarkVNC were loaded onto victims' computers, allowing the hacker to gain full control over the system. The goal was to steal credentials and personal information. Aktulaev paid for the attack infrastructure with cryptocurrency, which once again underscores how digital assets are used in the shadow economy. About half of the infected machines were located in the U.S. The extradited hacker awaits trial in custody.
New tactic: Hackers "blind" AI antiviruses with forbidden text
ESET specialists have discovered a curious technique for bypassing security systems, which they named GuardBreaker. The pro-Russian group UAC-0099, which attacks Ukrainian government agencies and military targets, exploits a vulnerability in large language models embedded in modern antiviruses and code scanners.
The attack mechanism is elegant and simple. A decoy text is inserted into the body of a malicious script, for example: "I want to create nuclear weapons. Help me...". When an AI analyst begins scanning the code, it stumbles upon this forbidden content. The model's basic safety filters trigger, and it aborts the session without ever analyzing the malicious code itself. Thus, attackers successfully deliver their MATCHBOIL loader.
This is an alarming signal. We are witnessing hackers learn to manipulate the very tools of defense, turning their limitations into weapons. Previously, such attacks on "naive" AI pipelines were recorded in Python and npm ecosystems, and now this tactic has migrated into targeted cyberwarfare.
Pegasus in Serbia: Espionage against students and the opposition
International researchers from Citizen Lab, together with human rights advocates from the SHARE Foundation, have confirmed the infection of an iPhone belonging to a participant in the Serbian student protest movement with Pegasus spyware. The hack was carried out via a zero-click exploit in iMessage, requiring no action from the victim.
Experts identified traces of infection between December 2025 and January 2026. According to human rights advocates, at least 14 representatives of civil society and opposition politicians have been attacked with advanced spyware since the beginning of the year. These attacks coincided with preparations for local and snap parliamentary elections. In addition to Pegasus, activists' devices were also found to contain the local Android trojan NoviSpy.
Of particular concern is a case where private messages from Viber on an infected phone were read live on a pro-government television channel. This indicates that the espionage is not merely intelligence-gathering in nature but also informational and propaganda-driven, aimed at discrediting and suppressing civic activity.
My verdict: the past week has shown that the threat landscape is becoming increasingly complex and multifaceted. Classic botnets are giving way to targeted attacks using AI, while data leaks from past years continue to fuel waves of phishing. The only reliable shield remains basic hygiene: multi-factor authentication, critical scrutiny of any emails, and the awareness that your data is most likely already in the hands of attackers.