Critical

Phishing scam exploits performance review anxiety to deploy malware

SCM feed for Latest

January 13, 2026 at 9:13 PM

Actively Exploited

Overview

A new phishing campaign is targeting employees by exploiting their anxiety around performance reviews. The attackers are sending emails that impersonate management or HR, claiming to discuss performance evaluations scheduled for October 2025 and falsely hinting at potential layoffs. This tactic aims to create urgency and fear, prompting recipients to click on malicious links or download malware. Companies and employees need to be vigilant, as these scams can lead to data breaches or financial loss. The incident highlights the need for better cybersecurity awareness and training, especially during sensitive times like performance review periods.

Key Takeaways

Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
Affected Systems: Employees of companies receiving the phishing emails, specifically those concerned about performance reviews.
Action Required: Employees should be trained to recognize phishing emails and verify the authenticity of unexpected communications from management or HR.
Timeline: Newly disclosed

Original Article Summary

The phishing campaign begins with emails impersonating management or HR, referencing October 2025 performance reviews and falsely suggesting potential layoffs.

Impact

Employees of companies receiving the phishing emails, specifically those concerned about performance reviews.

Exploitation Status

This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.

Timeline

Newly disclosed

Remediation

Employees should be trained to recognize phishing emails and verify the authenticity of unexpected communications from management or HR. Regular updates on cybersecurity practices should be implemented.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to Phishing, Malware.

Read Original Article

Related Coverage

Update now: 7-Zip fixes RCE flaw exploitable with malicious archives

BleepingComputer

7-Zip has released version 26.02 to address a serious remote code execution (RCE) vulnerability. This flaw allows attackers to execute malicious code on users' systems if they open specially crafted compressed files. Users of 7-Zip should update to the latest version to protect themselves from potential exploitation. The vulnerability is particularly concerning as it could be exploited easily by tricking users into opening harmful files. Keeping software up to date is crucial in maintaining security and preventing such attacks.

Jul 18, 2026

OpenSSL Fixes HollowByte Memory Exhaustion Bug

Security Affairs

Okta has reported a new vulnerability in OpenSSL, dubbed HollowByte, which allows remote attackers to exploit a flaw that can lead to memory exhaustion on servers. This specific vulnerability is only 11 bytes long, and when exploited, it can cause a server to allocate up to 131 KB of memory. As a result, this could trigger denial-of-service attacks, rendering the affected servers unable to respond to legitimate requests. Organizations using affected versions of OpenSSL should prioritize patching this vulnerability to protect their systems from potential exploitation. The risk is significant, as attackers can exploit this flaw without needing authentication, making it easier for malicious actors to disrupt services.

Jul 18, 2026

WordPress Core "wp2shell" RCE flaws get public exploits, patch now

BleepingComputer

Recent vulnerabilities known as 'wp2shell' have been discovered in WordPress Core, allowing remote code execution. These flaws are particularly concerning because public exploits have now been released, meaning attackers can actively take advantage of them. Administrators of WordPress sites need to act quickly to patch their systems to protect against potential breaches. The urgent nature of this situation is underscored by the fact that these vulnerabilities can compromise the security of websites, putting sensitive data at risk. Users of WordPress should ensure they are running the latest version to mitigate these risks.

Jul 18, 2026

Two new high severity WordPress vulnerabilities, patch immediately!

Help Net Security

WordPress has released a security update, version 7.0.2, to address two significant vulnerabilities that pose risks to users. The first vulnerability, identified as CVE-2026-60137, is a SQL injection issue that could allow attackers to manipulate databases. The second, also CVE-2026-60137, relates to a REST API batch-route confusion that could lead to remote code execution, potentially giving attackers full control over affected systems. The vulnerabilities affect WordPress version 6.9 and earlier. Users are strongly advised to update their installations immediately to mitigate the risks associated with these security flaws.

Jul 18, 2026

2 charged in New York for laundering $43 million from investment scams

SCM feed for Latest

Zhuoying Chen, 27, and Haojie Zhang, 38, have been charged in New York for allegedly laundering $43 million that was obtained through various investment scams. The two men are accused of operating a network that funneled this significant sum of money to China, raising concerns about the scale and sophistication of financial fraud schemes. The case illustrates how cybercriminals are increasingly using complex methods to hide illicit funds, which can undermine legitimate financial systems. Authorities are focusing on these activities to combat financial crimes and protect potential victims from similar scams. The investigation underscores the ongoing challenges law enforcement faces in tracking and prosecuting financial fraud linked to cyber activities.

Jul 17, 2026

New Russian-speaking threat actor UAT-11795 targets US and Europe with novel malware

SCM feed for Latest

A new Russian-speaking hacking group known as UAT-11795 is targeting organizations in the United States and Europe. This group is using innovative malware tools, specifically the Starland Remote Access Trojan (RAT) built with Python and the PowerShell-based WLDR agent, which operates solely in memory. These tools are designed to evade detection through encrypted communications and a unique execution environment. The emergence of UAT-11795 raises concerns for businesses and government entities, as their tactics could lead to significant data breaches or system compromises. As cyber threats continue to evolve, organizations need to be vigilant and enhance their security measures to defend against such sophisticated attacks.

Jul 17, 2026