🤖 Hundreds of Clawdbot Servers Exposed with API Keys & Private Chats 🔓

Security researchers have discovered hundreds of publicly exposed Clawdbot control servers containing API keys, private messages, and OAuth credentials. The viral AI assistant, which went mainstream over the weekend, has critical authentication vulnerabilities allowing unauthorized access to users' complete chat histories, financial accounts, and system commands. Misconfigured servers could enable credential theft and remote...

🇬🇧 UK Lords Vote to Ban VPNs for Kids 🇬🇧

The UK House of Lords voted 207 to 159 to ban VPNs for anyone under 18, claiming it will prevent children from bypassing age verification on social media and adult content. The amendment would require VPN providers to implement age verification, likely through government IDs or facial scans. Privacy advocates are calling it surveillance infrastructure disguised as child protection, and the measure now heads to the House of Commons.

- https://hansard.par...

🎵⚖️ Spotify Pulled Off a SECRET LAWSUIT to Stop Pirates Who Stole 300TB of Music 🎵⚖️

Shadow library Anna's Archive, which scraped nearly 300 terabytes of Spotify's music catalog in December 2025, lost its primary .org domain after Spotify and major record labels filed a sealed lawsuit and secured a court order before the site even knew it was being sued. A federal judge granted a preliminary injunction on January 16, 2026, ordering domain registries and internet infrastructure providers worldwi...

🤖 NVIDIA & Meta Caught Pirating 500TB to Train AI Models 🏴‍☠️

Billion-dollar tech companies got caught red-handed downloading hundreds of terabytes of pirated books to train their AI. NVIDIA literally asked a piracy site for 500TB of stolen content, got WARNED it was illegal, and said "send it anyway." Meanwhile Zuckerberg's playing dumb even though internal messages show he approved it…classic corporate villain energy.

Sources:

- https://torrentfreak.com/nvidia-contacted-annas-archive-to-sec...

🚨 LastPass Phishing Alert: Fake Backup Emails Target Your Master Password 🔐

LastPass users are being targeted by a phishing campaign that started January 19th, with fake emails claiming urgent maintenance requires vault backups within 24 hours. The emails redirect victims to malicious sites attempting to steal master passwords. The campaign was deliberately launched during the MLK holiday weekend when security teams are understaffed.

- https://www.securityweek.com/lastpass-users-targeted-with-...

🚨 ESA Breached Twice in 2 Weeks: Space Mission Data Stolen 🚀

- https://cisoseries.com/cybersecurity-news-esa-confirms-new-data-heist-ni8mare-lets-hackers-hijack-n8n-servers-taiwan-blames-cyber-army-for-intrusion-attempts/

- https://www.theregister.com/2026/01/07/european_space_agency_breach_criminal_probe/

- https://www.space.com/space-exploration/esa-email-credentials-on-dark-web

- https://www.securityweek.com/european-space-agency-confirms-breach-after-hacker-offers-to-sell-data

- https://www....

🚨 CyberArk Labs Hacks the Hackers with XSS on StealC Credential Stealing Malware. 🚨

• https://www.cyberark.com/resources/threat-research-blog/uno-reverse-card-stealing-cookies-from-cookie-stealers

• https://www.bleepingcomputer.com/news/security/stealc-hackers-hacked-as-researchers-hijack-malware-control-panels/

• https://www.bleepingcomputer.com/news/security/stealc-hackers-hacked-as-researchers-hijack-malware-control-panels/

• https://bazaar.abuse.ch/browse/tag/Stealc-v2/

• https://www.zscale...

🇨🇳🛡️ China orders firms to drop US and Israeli cybersecurity software, major vendors hit 🛡️🇨🇳

China has told domestic companies to stop using cybersecurity products from a list of US and Israeli firms, citing national security concerns. The move could force rapid tool replacements inside networks where security platforms have deep visibility into traffic and identity.

• https://www.reuters.com/world/china/beijing-tells-chinese-firms-stop-using-us-israeli-cybersecurity-software-sources-2026-01-1...

🚨 BREAKING: Russian Hackers Use Simple Copy-Paste Trick to Steal Your Entire Microsoft Account 🚨

A sophisticated phishing attack called ConsentFix exploits OAuth vulnerabilities by tricking users into copying and pasting a malicious URL that contains their Microsoft authorization code. Attackers exchange this code for access tokens, gaining full account access without passwords or MFA, and the technique is already being used by APT29 (Cozy Bear) and other threat actors.

- https://www.hendryadr...

Apex Legends match hack: During a live Apex Legends Global Series tournament, someone pushed cheats onto pro players mid match. Players suddenly had aimbot and wallhacks they never installed. The attacker appeared to hijack controls in real time, which points to a serious security hole in the game or its tournament environment.

BreachForums data breach: BreachForums got breached. Data tied to about 324,000 users leaked, including details that can expose admin identities. It is a reminder that c...