Daily Briefing for 01.22.26

Top stories.

• Automated attacks target Fortinet devices.
• Spam campaign exploits unsecured Zendesk systems.
• Greek police shut down SMS blaster scheme.

Automated attacks target Fortinet devices.

Arctic Wolf warns of automated attacks targeting Fortinet FortiGate devices, making unauthorized firewall configuration changes. The activity, which began on January 15th, "involved the creation of generic accounts intended for persistence, configuration changes granting VPN access to those accounts, as well as exfiltration of firewall configurations."

It's unclear how the attacks are taking place, but BleepingComputer says Fortinet customers are reporting exploitation of a patch bypass for a critical FortiGate authentication vulnerability (CVE-2025-59718) that was fixed in early December. Arctic Wolf stated, "It is not known at this time whether the latest threat activity observed is fully covered by the patch that initially addressed CVE-2025-59718 and CVE-2025-59719."

Spam campaign exploits unsecured Zendesk systems.

BleepingComputer says a massive spam campaign is exploiting unsecured Zendesk support systems to send junk emails. BleepingComputer explains, "Attackers are abusing Zendesk's ability to allow unverified users to submit support tickets, which then automatically generate confirmation emails sent to the email address the attacker entered. Because Zendesk sends automated replies confirming that a ticket was received, the attackers are able to turn these systems into a mass-spamming platform by iterating through large lists of email addresses when creating fake support tickets." The attackers are exploiting Zendesk systems belonging to Discord, Tinder, Riot Games, Dropbox, CD Projekt, Maya Mobile, NordVPN, the Tennessee Department of Labor, and others.

While the emails have alarming subject lines related to legal takedowns or law enforcement notifications, they don't contain phishing links or malicious attachments. The campaign may be simply an attempt at trolling or disruption. The messages can bypass spam filters since they originate from trusted sources, and some users have reported receiving hundreds of emails.

Greek police shut down SMS blaster scheme.

Greek police have arrested two foreign nationals in Athens who were allegedly running a rogue mobile base station (also known as an "SMS blaster") out of the trunk of their car, TechNadu reports. The police said the suspects "downgraded the network connection on the devices from 4G to 2G, exploiting security vulnerabilities in the 2G network and then...obtained knowledge of their identifying information such as the subscriber's phone number." The individuals then allegedly sent SMS phishing messages designed to trick users into handing over their bank account credentials.