Cyware Daily Threat Intelligence, January 21, 2026
The job interview from hell is now taking place inside your code editor. The Contagious Interview campaign is targeting crypto and fintech developers using malicious Microsoft VS Code projects. Attackers execute hidden payloads via task configuration files to establish a persistent backdoor on the victim's machine.
Your next professional connection on LinkedIn might be delivering a trojan horse instead of a job offer. A new phishing campaign is targeting high-value individuals with malicious WinRAR archives that use DLL sideloading to slip a RAT past standard defenses.
The bridge between your AI and your code repository just got a critical safety check. Anthropic has issued urgent patches for its Git MCP server to fix three severe vulnerabilities that could allow attackers to execute remote code or overwrite sensitive files. These flaws exploit the way AI systems connect to external data sources.
Top Malware Reported in the Last 24 Hours
North Korean hackers exploit VS Code projects
North Korean hackers associated with the Contagious Interview campaign are targeting developers by using malicious Microsoft VS Code projects to deliver backdoor malware. This tactic involves instructing victims to clone repositories from platforms like GitHub and launch them in VS Code, where embedded malicious payloads are executed through task configuration files. The malware, disguised as benign files such as spell-check dictionaries, utilizes obfuscated JavaScript to establish communication with remote servers, enabling remote code execution and persistent access. Attackers specifically target software engineers in cryptocurrency and fintech sectors to gain access to sensitive information and digital assets. Additionally, the campaign has evolved to include various delivery methods, such as malicious npm dependencies and advanced modules for keylogging and cryptocurrency mining.
Hackers exploit LinkedIn to spread malware
A new phishing campaign has emerged, utilizing LinkedIn messages to distribute RAT through DLL sideloading. Cybercriminals target high-value individuals by sending messages that build trust and encourage them to download a malicious WinRAR self-extracting archive. This archive contains a legitimate PDF reader application, alongside a malicious DLL that is sideloaded when the application is executed. The attack installs a Python interpreter and executes Base64-encoded shellcode in memory, enabling persistent remote access to the compromised system. This method allows attackers to operate stealthily, bypassing traditional security measures typically focused on email.
Top Vulnerabilities Reported in the Last 24 Hours
ACF plugin vulnerability exposes WordPress sites
A critical vulnerability in the ACF Extended plugin for WordPress allows unauthenticated attackers to gain administrative access to approximately 50,000 websites. This flaw, identified as CVE-2025-14533, stems from a lack of role restriction enforcement during user creation or updates through the plugin's forms. Attackers can exploit this vulnerability to set user roles arbitrarily, including granting themselves administrator privileges. Although the issue was reported in December 2025 and patched shortly after, many sites remain exposed due to outdated versions of the plugin.
Three vulnerabilities found in Anthropic's MCP
Anthropic has addressed critical vulnerabilities in its Git MCP server that could allow remote code execution. These vulnerabilities, identified as CVE-2025-68145, CVE-2025-68143, and CVE-2025-68144, have been fixed in the latest update. Users are urged to update to the latest version to prevent potential exploitation. The vulnerabilities could allow attackers to execute malicious code or overwrite files by exploiting the way AI systems connect to external data sources. This poses a significant risk to organizations using the Git MCP server, as it could lead to unauthorized access and data manipulation.