--- title: MSP cybersecurity news digest, January 12, 2026 description: ClickFix campaigns use fake BSOD screens to trick users into running malware, Newly disclosed Veeam issues highlight ongoing risks to backup infrastructure, and more. Here are the latest threats to MSP security. canonical_url: https://www.acronis.com/en/tru/posts/msp-cybersecurity-news-digest-january-12-2026/ locale: en last_updated: 2026-10-27 --- * [Home](https://www.acronis.com/en/tru/) * [Articles](https://www.acronis.com/en/tru/posts/) * [Acronis Threat Research Unit](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/) 12 January 2026 # MSP cybersecurity news digest, January 12, 2026 ClickFix campaigns use fake BSOD screens to trick users into running malware, Newly disclosed Veeam issues highlight ongoing risks to backup infrastructure, and more. Here are the latest threats to MSP security. Author: **[Acronis Threat Research Unit](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/)** ## ClickFix campaigns use fake BSOD screens to trick users into running malware [ClickFix social-engineering campaigns](https://www.acronis.com/en/tru/posts/fake-adult-websites-pop-realistic-windows-update-screen-to-deliver-stealers-via-clickfix/) presented users with [fake Windows Blue Screen of Death](https://thehackernews.com/2026/01/fake-booking-emails-redirect-hotel.html) or update screens that instructed them to execute commands [that downloaded and ran malware](https://www.bleepingcomputer.com/news/security/clickfix-attack-uses-fake-windows-bsod-screens-to-push-malware/). The attack chain relies on user trust and manual action rather than exploitation of a software vulnerability, making it effective against untrained users. These deceptive screens may deliver next-stage payloads that establish persistence or exfiltrate information once executed. ## Credential theft fuels data breaches across ownCloud, Nextcloud and ShareFile Portals A threat actor offered corporate [data stolen from ShareFile, Nextcloud and OwnCloud](https://www.bleepingcomputer.com/news/security/owncloud-urges-users-to-enable-mfa-after-credential-theft-reports/) instances, likely obtained after attackers used infostealer-harvested credentials to access these services. Stolen credentials permitted unauthorized cloud access, allowing extraction of sensitive documents and business data. These compromises underscore how credential theft remains a core enabler of data breaches affecting cloud collaboration platforms. ## Missing extension namespaces in VS Code forks open the door to look‑alike malware Multiple [VS Code-based IDE forks](https://www.bleepingcomputer.com/news/security/vscode-ide-forks-expose-users-to-recommended-extension-attacks/) surfaced a condition where recommended extensions were missing from OpenVSX, leaving namespaces available for attacker registration. Attackers can weaponize this by publishing look-alike malicious extensions that users install based on trusted “recommendation” cues. The security implication is a developer-tool supply-chain insertion point, potentially exposing credentials, source code and build environments. ## Newly disclosed Veeam issues highlight ongoing risks to backup infrastructure Updates addressed multiple [Veeam Backup & Replication flaws](https://thehackernews.com/2026/01/veeam-patches-critical-rce.html), including issues that could enable remote code execution under certain role / parameter conditions. Backup servers are frequently targeted because they provide direct leverage over recovery operations and are often reachable from privileged admin contexts. The broader implication is continued attacker focus on backup-layer disruption as a precursor to, or amplifier for, ransomware outcomes. ## Trend Micro patches severe Apex Central vulnerabilities affecting on‑premises installs Trend Micro released [Critical Patch Build 7190 for Apex Central (on premises) that addresses multiple vulnerabilities](https://www.bleepingcomputer.com/news/security/trend-micro-fixes-critical-rce-flaw-in-apex-central-console/), including a critical remote code execution flaw (CVE-2025-69258, CVSS 9.8) that could allow an unauthenticated attacker to load a malicious DLL and execute code with SYSTEM privileges on affected installations. The patch also fixes two other high-severity flaws (CVE-2025-69259 and CVE-2025-69260) that could lead to denial-of-service conditions, all affecting versions prior to Build 7190. Because Apex Central is a centralized security management console, compromise could enable attackers to disrupt visibility, configuration and enforcement on connected security products, increasing incident impact. Related articles [The Gentlemen: A closer look at a not-so-gentle ransomware-as-a- service operation](https://www.acronis.com/en/tru/posts/the-gentlemen-a-closer-look-at-a-not-so-gentle-ransomware-as-a-service-operation/) [Acronis AI Copilot: Adoption is high and growing among MSPs](https://www.acronis.com/en/tru/posts/acronis-ai-copilot-adoption-is-high-and-growing-among-msps/) [Acronis Cyberthreats Update, October 2026](https://www.acronis.com/en/tru/posts/acronis-cyberthreats-update-october-2026/) [AI agents at work: What Acronis endpoint data reveals about MSP and SMB usage](https://www.acronis.com/en/tru/posts/ai-agents-at-work-what-acronis-endpoint-data-reveals-about-msp-and-smb-usage/)