Massive Instagram Data Breach: Hackers Obtained Data from 17.5 Million Users

According to a report by Malwarebytes, sensitive personal data from approximately 17.5 million Instagram user accounts has been leaked.

The stolen data includes usernames, email addresses, phone numbers, and even partial physical addresses. A seller on the BreachForums forum, operating under the alias “Solonik,” claims that the data was freshly obtained during the last three months of 2024. This combination of information makes users particularly vulnerable to phishing attacks and social engineering.

The database disclosure has immediate consequences. Many users have started receiving legitimate emails from Instagram requesting password resets. As part of phishing campaigns, attackers rely on users panicking and clicking the password reset button without realizing they’re enabling attackers to access their accounts. Users should also check which devices are logged into their accounts and remove all unknown connections.

Meta, which owns Instagram, has not yet issued an official statement regarding the extent of the breach or remedial measures.

Malicious Browser Extensions Stealing Your AI Conversations

Security researchers from OX Security have uncovered a malware campaign targeting users of popular AI chatbots. Two malicious extensions for the Chrome browser, masquerading as legitimate tools for accessing ChatGPT and DeepSeek, were secretly stealing complete conversation contents and sending them to attackers’ servers. The extensions named “Chat GPT for Chrome with GPT-5, Claude Sonnet & DeepSeek AI” and “AI Sidebar with Deepseek, ChatGPT, Claude and more” were installed by over 900,000 users combined. Particularly concerning is the fact that the first of these extensions received a “Featured” badge from Google, suggesting it met recommended practices for Chrome extensions.

The malicious extensions mimicked the features of a legitimate extension from AITOPIA, which allows chatting with various AI models through a sidebar. After installation, they requested consent to collect “anonymized analytical data,” but in reality, they were collecting all conversation content from ChatGPT and DeepSeek. The malware exploited broad permissions to read web page content and, upon detecting visits to target platforms, searched for specific DOM elements containing text conversations. Stolen data included not only complete chat histories but also URLs of all open tabs in the browser, search queries, and parameters containing session tokens. All information was automatically sent to the attackers’ C2 server every thirty minutes.

However, this incident is not isolated. Security analysts from Secure Annex identified a broader trend called “Prompt Poaching,” where marketing companies use browser extensions to monetize user conversations with AI tools. They discovered that the popular Similarweb extension with over a million users contains sophisticated mechanisms for capturing data from AI platforms.

Stolen data can cause serious harm to both individuals and companies. Conversations with AI chatbots often contain sensitive information such as proprietary source code shared during programming, business strategies and plans, personal identifying information, or confidential legal and corporate communications. This information can be exploited for corporate espionage, identity theft, targeted phishing attacks, or sale on the darknet. Organizations whose employees had these extensions installed may have unknowingly exposed intellectual property, customer data, and confidential business information.

Ni8mare: Critical Vulnerability in n8n

Ni8mare is a critical security vulnerability (CVSS 10.0) in the popular automation tool n8n. It is an Unauthenticated Remote Code Execution, meaning an attacker can completely control the server running n8n without needing credentials.

The main flaw lies in how n8n processes incoming HTTP requests in Webhook nodes and forms. The application assumes that uploaded files are only handled when the request goes through a secure file upload parser.

However, an attacker can send a request with a different Content Type, for example JSON, and manually insert an object into it. The application doesn’t recognize this forged object as fake and processes it as if it were a legitimately uploaded file.

The attack proceeds in several steps that lead to complete takeover of control.

1. Arbitrary File Read: Because the attacker controls the files object, they can specify a path to any file on the server instead of a path to a temporary file.

2. Data Exfiltration: The attacker obtains key data from these files, specifically the encryption key and user information.

3. Authentication Bypass: Using the stolen encryption key, the attacker creates a valid administrator session cookie.

4. Remote Code Execution: Once the attacker is logged in as admin, they create a new automation workflow in n8n. They insert an Execute Command node into it, which allows them to execute arbitrary commands on the server’s operating system.

It is necessary to update to version 1.121.0 or newer, which contains the input data validation fix.

Critical Vulnerability in Veeam Backup & Replication Threatens Enterprise Backup Systems

In early January 2026, a security update was released for the popular Veeam Backup & Replication tool, fixing four serious vulnerabilities. The most critical of these, designated CVE-2025–59470, received a CVSS score of 9.0. This flaw allows an attacker with elevated privileges to perform remote code execution (RCE) as the postgres user through sending malicious parameters.

In its security bulletin, Veeam emphasizes that although the CVE-2025–59470 vulnerability achieved a critical CVSS score, it adjusted its rating to “high severity.” The reason is that exploitation requires access to privileged Backup Operator or Tape Operator roles.

In addition to the main critical flaw, three other security vulnerabilities were fixed: CVE-2025–55125 enabling remote code execution as root through a malicious backup configuration file, CVE-2025–59468 allowing code execution as postgres user via a malicious password parameter, and CVE-2025–59469 enabling file writing with root privileges.

The vulnerability affects all versions of Veeam Backup & Replication 13.0.1.180 and older builds of version 13. It is important to note that previous versions of the product (12.x and older) are not affected by this particular vulnerability.

Backup systems have become a primary target for attackers in recent years. According to surveys by Veeam, up to 96% of ransomware attacks directly target organizations’ backups, with attackers successfully damaging backup data in more than 40% of cases.