ThreatsDay Bulletin: GhostAd Drain, macOS Attacks, Proxy Botnets, Cloud Exploits, and 12+ Stories

The January 2026 ThreatsDay Bulletin opens with a roundup of how threat actors are moving from loud breaches to quieter, more precise techniques across the ecosystem. It highlights a KMSAuto-themed campaign that infected 2.8 million systems and stole assets worth about KRW 1.7 billion ($1.2 million) in 8,400 transactions, with the suspect extradited to South Korea.

The report also notes a Christmas-era campaign targeting Adobe ColdFusion servers, attributed to a Japan-based infrastructure operator responsible for around 98% of attack traffic and leveraging more than 10 CVEs. In the macOS space, GlassWorm resurfaced with three Open VSX extensions designed to steal wallets and credentials, while a separate IPCola proxy network claims over 1.6 million unique IPs across 100 countries and includes an SDK capable of remote code execution.

The bulletin also covers GhostAd, a large Android adware operation that quietly drains device resources via background services, and the New MacSync macOS stealer that bypasses Gatekeeper with a signed app. Overall, the year starts with a spread of stealthy, targeted threats rather than loud, headline-grabbing breaches, according to GreyNoise and Check Point analyses.