In today’s cybersecurity news…

GoBruteforcer targets crypto, blockchain projects

Check Point reports an updated GoBruteforcer botnet is targeting crypto and blockchain projects by compromising internet-exposed Linux services like FTP, MySQL, phpMyAdmin, and PostgreSQL. The malware leverages leaked or weak credentials, and is benefiting from AI-generated server deployments that ship with default usernames and passwords, plus legacy stacks like XAMPP (zamp). Once in, attackers deploy a web shell and an IRC bot for remote control, along with modules that enumerate TRON addresses and move BSC and TRON tokens to attacker wallets. (SecurityWeek)

Android accessibility issue just a bug

Google confirmed a bug causing Android volume keys to behave incorrectly when the Select to Speak accessibility feature is enabled. Reports say the buttons adjust accessibility volume instead of media volume and no longer trigger the camera shutter shortcut. Google hasn’t said how many users or which versions are affected and is directing those impacted to temporarily disable Select to Speak until a fix arrives in a future update. (BleepingComputer)

Verizon to stop automatic unlocking of phones

The FCC granted Verizon a waiver, letting it stop automatically unlocking phones after 60 days, replacing the rule with looser CTIA standards. That change lets Verizon keep prepaid devices locked for a year and postpaid devices locked until financing or termination fees are paid, making switching harder. The FCC framed the shift as a fraud and law enforcement issue, despite pushback from consumer groups that said automatic unlocking boosts competition, lowers costs, and reduces e-waste. Existing devices aren’t affected; new activations follow the updated policy. (Ars Technica)

Senior military cyber operator steps down from Russia task force

UPDATE January 30, 2026: After publication, this story was subsequently updated with a comment by Lt. Col. Jason Gargan to The Record. We share his statement in its entirety:

In comments to Recorded Future News following the publication of that story, Gargan stated he left of his own accord.

“I was not relieved ‘for cause’ nor were there any arguments over operations,” he said in a statement. “Unfortunately, I had to retire for personal reasons but I know I left it in a better place and they are in good hands moving forward. I’m forever thankful to have had the opportunity to not only lead a Cyber National Mission Force Joint Task Force, but elite people that were within my Joint Task Force.”

Air Force Lt. Col. Jason Gargan stepped down from command of the U.S. Cyber National Mission Force’s Russia-focused task force. Gargan has been reassigned within CNMF and is expected to retire by late 2026. This comes as CNMF chief Maj. Gen. Lorna Mahlock is nominated to become Cyber Command’s deputy chief, amid broader senior turnover at the command, which has lacked a Senate-confirmed leader for more than nine months. (The Record)

Huge thanks to our sponsor, ThreatLocker

CISA flags actively exploited Gogs vulnerability

CISA added a high-severity Gogs vulnerability to its Known Exploited Vulnerabilities list after Wiz found attackers abusing it as a zero-day to overwrite files and achieve remote code execution. The flaw affects Gogs up to 0.13.3 and stems from symbolic link handling in the PutContents API. Wiz says more than 700 instances were compromised, with roughly 1,600 exposed online and no official patch yet. CISA told federal agencies to mitigate by February 2nd. (Infosecurity Magazine)

Web skimmer steals credit cards from online checkout pages

Silent Push researchers uncovered a long-running Magecart-style web skimming operation active since early 2022, targeting checkout pages tied to major payment networks including AmEx, Mastercard, Discover, UnionPay, JCB and Diners Club. The campaign injects obfuscated JavaScript from sanctioned hosting infrastructure, detects WordPress admin sessions to self-delete, and can render a fake Stripe form to harvest card numbers, CVCs and personal details before restoring the real form. Stolen data is then exfiltrated, and the skimmer sets flags to avoid re-running on the same victim. (The Hacker News)

JPMorgan discloses law firm data breach

JPMorgan is notifying investors about a data breach tied to an incident at law firm Fried Frank, the same intrusion that prompted Goldman Sachs disclosures in late 2025. An unauthorized party copied files from a shared drive containing names, contact details, account numbers, SSNs, and passport or government ID numbers for 659 private equity fund investors. JPMorgan and Goldman say their own systems weren’t compromised. Fried Frank faces lawsuits and says it contained the incident, engaged external responders, and involved law enforcement. (SecurityWeek)

Betterment confirms breach after crypto scam wave

Betterment disclosed a data breach after hackers abused a third-party marketing platform to send a crypto “triple your deposit” scam from a legitimate Betterment subdomain on January 9th. The attacker accessed contact and personal details stored in that system, though Betterment says its core infrastructure, accounts, and credentials were not touched, though  later it said it was hit with a DDoS attack. Betterment has cut off the unauthorized access, warned users, and says it will publish a post-mortem once its investigation finishes. (BleepingComputer)