Jared's Technology Podcast Network · Jared Rimer

Sans covers the newsletter for January 9, 2026

·1 hr 52 min·5 clips

A threat actor thought Resecurity had been breached, but the “compromised” data was synthetic.

Jared opens episode 37 by welcoming listeners back to SANS News Byte and noting that it has been a while since the last episode. He explains that he transcribed the file himself and gives options for Braille, including UEB and multiple cell versions. He also shares contact details for anyone who wants a copy or wants to reply directly. The show keeps its solo, conversational pace as he reads through the newsletter and follows it closely. He identifies the January 9, 2026 issue as Volume 28, Number 2 of SANS News Byte. The first part of the episode is housekeeping and catching up after the delay. Jared then moves into the security content and starts working through the newsletter in order. The lead story is a ClickFix phishing campaign aimed at the hospitality sector. The lure imitates a costly Booking.com cancellation email. A link sends the target to a counterfeit site. There, a fake error page and fake BSOD instruct the user to enter keyboard shortcuts that paste a PowerShell script into the Windows Run dialog. The script downloads a malicious project file. MSBuild is then used to compile and run the initial payload. The attack disables Windows Defender and sets persistence. The final payload is DCRAT, which adds process hollowing, keylogging, persistent remote access, and the ability to drop more payloads. Jared points out clues in the lure, including euro-denominated charges and Russian language in the MSBuild file. He also notes that DCRAT is known in Russian forums. The defensive advice is direct: train employees against phishing and ClickFix-style tricks, monitor for suspicious MSBuild and system-binary activity, watch for unusual file creation in ProgramData and the Startup folder, enable PowerShell script block logging, and check indicators of compromise. The episode keeps Jared's usual rhythm of reading, pausing, correcting himself, and restating the practical lesson. It ends with a return to the show's contact information and a closing sign-off as he says he is trying to catch up.

As heard by us

A clear security bulletin that turns a ClickFix phishing chain into practical defensive guidance.

SANS News Byte for January 9, 2026 is a practical security bulletin with a steady voice, and it takes a little time to settle before getting to the main threat report.

Read the full review in PlayNext →

Why you'd press play

You want the security news, the attack chain, and the practical warning signs without the polish.

Read the full recommendation in PlayNext →

Listen to the show on

Apple Podcasts Spotify

Play clips from this episode More from Jared's Technology Podcast Network