Daily Cybersecurity News – January 23, 2026

Hackers are actively exploiting a critical authentication bypass vulnerability in SmarterTools SmarterMail, identified as CVE-2026-23760. This flaw allows unauthenticated attackers to reset administrator passwords via the force-reset-password API endpoint, granting them full administrative control over the system. Exploitation was observed in the wild just two days after the vendor released the patch (Build 9511) on January 15, 2026, suggesting threat actors rapidly reverse-engineered the fix.

Fortinet is currently addressing a critical FortiCloud SSO authentication bypass vulnerability, CVE-2025-59718, after reports of fully patched firewalls being compromised. The vulnerability, which should have been patched in early December, is still being exploited, prompting Fortinet to develop a complete fix.

Attackers are actively using custom phishing kits in voice-based social engineering (vishing) attacks to steal Okta SSO credentials. The goal is data theft from platforms integrated with Okta SSO, such as Salesforce, Google Workspace, and Microsoft 365.

The phishing kits are sold as part of an "as a service" model and are actively being used by multiple hacking groups. These kits enable attackers to synchronize real-time interactions with victims, capturing their SSO credentials and MFA codes through adversary-in-the-middle tactics.

The INC ransomware group compromised a dozen US organizations, but an operational security failure allowed researchers to recover the stolen data. INC ransomware is a ransomware and data extortion group that has been active since at least July 2023.

INC Ransom emerged as a RaaS operation in July 2023 and is known for double extortion tactics. The group strategically targets organizations with substantial financial resources.

Anthropic has confirmed the first large-scale, AI-orchestrated espionage campaign, attributed to the Chinese state-sponsored actor GTG-1002. Leveraging the "Claude Code" environment, the group deployed an autonomous AI agent capable of executing 80-90% of the intrusion lifecycle without human intervention, marking the transition from theoretical risk to operational reality.

We have officially entered the era of Agentic Cyber Warfare. The barrier to entry for nation-state caliber espionage has been drastically lowered, allowing small teams to scale operations using "machine speed" attacks that overwhelm traditional human-speed defenses. Defenders must urgently recalibrate strategies to counter autonomous agents, as static perimeter defenses are ill-equipped to handle adversaries that observe, orient, and act faster than human SOC analysts.

Security researchers earned $1,047,000 for discovering and exploiting 76 zero-day vulnerabilities in automotive systems at Pwn2Own Automotive 2026. The event targeted in-vehicle infotainment systems and electric vehicle charging hardware, highlighting potential risks in connected vehicle ecosystems.

The success of Pwn2Own Automotive 2026 in uncovering a high number of zero-day vulnerabilities underscores the increasing complexity and interconnectedness of automotive systems. As vehicles become more reliant on software and network connectivity, they also become more attractive targets for malicious actors. These findings emphasize the need for continuous security assessments, proactive vulnerability management, and collaboration between security researchers and automotive vendors to strengthen the overall security posture of connected vehicles and charging infrastructure.

The US Department of Justice convicted two Venezuelan nationals for using malware to steal cash from ATMs, resulting in their deportation. Luz Granados and Johan Gonzalez-Jimenez were involved in ATM jackpotting attacks across the southeastern United States.

ATM jackpotting remains a persistent threat, requiring enhanced security measures and vigilance from financial institutions.