A (0:00)

From the CISO series, it's Cybersecurity Headlines.

B (0:06)

These are the cybersecurity headlines for Friday, January 23, 2026. I'm Steve Prentiss. Multi Stage adversary in the middle Phishing and business email Compromise campaign abusing SharePoint researchers at Microsoft Defender have uncovered this multi stage campaign targeting multiple organizations in the energy sector resulting in the compromise of various user accounts. This campaign targets SharePoint file sharing services and delivers phishing payloads, relying on inbox rule creation to maintain persistence and evade user awareness. The researchers state that password resets alone are insufficient to mitigate this issue. Impacted organizations in the energy sector must additionally revoke active session cookies and remove attacker created inbox rules used to evade detection. Smarter Mail Auth bypass flaw now exploited despite patch following up on a story we covered on December 31, threat actors are now exploiting an authentication ByPass vulnerability in SmarterTools Smarter Mail Email server and collaboration tool that allows resetting admin passwords. Specifically, the issue quote resides in the Force Reset Password API endpoint, which is intentionally exposed without authentication. The issue was reported by Watchtower on January 8, and SmarterMail released a fix on January 15. The Watchtower researchers found evidence of exploitation just two days later. This suggests, they say, that hackers reverse engineered the patch and found a way to leverage the flaw. Spanish judge closes NSO Group spyware probe the reason for the closure of a probe into the use of Pegasus spyware to snoop on top government officials has been reported as a lack of cooperation from Israel. The probe started in 2022, when the court looked into the alleged spying on devices belonging to Spain's prime minister and defense minister, allegedly using zero click spyware known as Pegasus, manufactured by Israel's NSO Group. Israel has not responded to five cooperation requests, the judge said, breaking the balance inherent in international cooperation and violating the principle of good faith that should govern relations between states. Fake cell tower scam uncovered in Greece Back in September, we reported on scammers who use mobile cell towers packed into cars to blast phishing messages to phone users in a selected city. Police in Athens have now taken down such an operation after stopping a car at a checkpoint east of the city. The mobile computing system was hidden in the car's trunk. The device forced nearby mobile phones to connect to the suspect's system and downgraded them from 4G to the less secure 2G network, exploiting long known vulnerabilities. This allowed the thieves to harvest identifying data such as phone numbers and then send scam text messages posing as banks or couriers companies. Three fraud cases have now been uncovered in Greece, but authorities said the full scope of the operation remains unclear. Huge thanks to our sponsor, Dropzone AI. All week we've talked about alert fatigue, MTTR and the math that's breaking your sock. Here's the proof. DropZone AI is trusted by over 300 global enterprises and MSSPs, named a Gartner Cool Vendor, recognized in the Fortune Cyber 60 and backed by $37 million in Series B funding. But they're not stopping at a single agent. They're building toward fully agentic SOC teams where human engineers are augmented with specialized AI agents for threat hunting, detection, engineering and forensics. Your team deserves a backup that never sleeps. Book a demo at Dropzone AI that is D R O P Z O N E AI NIST Officials describe impact of staff cuts At a meeting on Wednesday of the Information Security Privacy Advisory Board, NIST officials described how they are dealing with current mandates on AI, cybersecurity and post quantum encryption. The director of the Information technology laboratory at NIST, Kevin Stein, said the agency has lost more than 700 people in the last year through personnel initiatives like resignations and voluntary deferments. The agency is facing further constraints, including a Congress led cut of $13 million from NIST's labs program. Such constraints, he said, are forcing a very focused discussion on prioritization of our activities. An alternative to CVE appears. The Global CVE Allocation System, or gcve, will be maintained by the Computer Incident Response Center Luxembourg as an alternative to the traditional Common Vulnerabilities and Exposures program, which narrowly avoided shutdown last April when CISA initially failed to renew its contract with Mitre, which operates the CVE system. Although collapse was averted, it exposed the program's dependence on a single funding source. The proposed GCVE avoids reliance on a centralized system allowing independent numbering authorities to allocate identifiers. The system will maintain a backward compatibility with the existing CV infrastructure through a technical accommodation OSIRIS ransomware emerges in Vulnerable driver attack Researchers at the Symantec and Carbon Black Threat Hunter are warning of a new ransomware family called Osiris Osiris that targeted a major food service franchisee operator in Southeast Asia in November of 2025. This campaign used a malicious driver named Poor Try P O O R T R Y as part of a known technique called Bring your own vulnerable driver BYOVD to disarm security software. This is a brand new ransomware strain, not related to the one of the same name that was present around December 2016. It is thought that the actors who deployed this ransomware may have been previously associated with ink ransomware, and it is being described as an effective encryption payload that makes use of a hybrid encryption scheme and a unique encryption key for each file. The problem of AI agents emerges at Davos at the annual World Economic Forum meeting, better known by the Swiss resort that hosts it, the topic of AI agents and how to secure them against becoming the ultimate insider threat took center stage. The chief technology officer of the training company, Pearson Dave Treat, stated, we have enough difficulty getting the humans trained to be effective at preventing cyber attacks. Now I've got to do it for humans and agents in combination. It seemed no one had a good response to this. Cloudflare co founder and President Michel Zatlin said, with agents, you need to think about them as an extension of your team and an extension of your employee base. Hatem Dawidar Group, CEO of Emirati company Etisalat, suggested more guardrails with human agents. Many years ago we started saying all calls are recorded for quality purposes. We need to create that also for AI agents, he said. And MasterCard CEO Michael Maybach said organizations should take a page from the banking industry's security and threat intelligence practices and collect as many signals as possible from relevant data streams and other indicators to determine if activity is safe or malicious. Do you want to keep up with all the CISO Series events that we have planned for 2026? Then subscribe to our events calendar. Just head on over to the events page@cisoseries.com and click the subscribe button. Our calendar keeps you up to date on all of our live streams like Super Cyber Friday and the Department of no, as well as in person events that we feature across the country. And if you have some thoughts on the news from today or about this show in general, please be sure to reach out to us at feedback@cisoseries.com we would love to hear from you. I'm Steve Prentiss reporting for the CISO Series.