In October 2025, phishing emails predominantly delivered Trojan malware via attachments, accounting for 47% of cases. These attachments included scripts, documents, and compressed files, notably RAR archives containing JavaScript files. The phishing campaigns also involved distribution of Remcos RAT malware and used document attachments to download additional payloads. Korean phishing emails were specifically analyzed, revealing targeted case names, subjects, and attachment filenames. The report highlights evolving tactics such as increased use of compressed JS files and exploitation of OLE objects within documents. The threat leverages multiple MITRE ATT&CK techniques including persistence, command execution, and credential access. This medium-severity campaign poses significant risks through social engineering and malware delivery via email attachments, requiring focused defensive measures. No known exploits in the wild are reported, but the widespread use of common file formats and compression methods increases the attack surface. European organizations should be vigilant against these evolving phishing tactics and malware payloads.
The Eternidade Stealer is a newly identified malware spreading via WhatsApp messages, targeting users to steal sensitive banking and cryptocurrency data. It propagates through social engineering by sending malicious links or files over WhatsApp, tricking users into executing the stealer. Once active, it harvests credentials and financial information from infected devices. Although no known exploits are reported in the wild yet, the malware poses a medium severity threat due to its potential impact on confidentiality and financial assets. European organizations with employees or customers using WhatsApp are at risk, especially those in banking and crypto sectors. Mitigation requires user awareness, endpoint protection, and network monitoring for suspicious WhatsApp traffic. Countries with high WhatsApp usage and significant financial sectors, such as the UK, Germany, France, Italy, and Spain, are more likely to be affected. The threat is assessed as medium severity given the need for user interaction and the targeted nature of the attack. Defenders should prioritize phishing education, multi-factor authentication, and rapid incident response capabilities to reduce risk.
A Chinese threat actor is exploiting known vulnerabilities in discontinued Asus devices in an Operational Relay Box (ORB) facilitation campaign. The post Over 50,000 Asus Routers Hacked in ‘Operation WrtHug’ appeared first on SecurityWeek .
Eternidade Stealer is a banking Trojan distributed via WhatsApp hijacking and social engineering. It uses a Python-based WhatsApp worm to propagate malicious attachments and an MSI installer that deploys a Delphi-based banking Trojan. The campaign aims to steal banking credentials and conduct fraud. Exploitation does not require prior authentication but relies on user interaction to open malicious attachments. The malware targets Windows systems through MSI installers. The medium severity rating reflects moderate impact and exploitation complexity. European organizations with significant WhatsApp usage and Windows environments are at risk, especially financial institutions. Mitigations include user awareness training, restricting MSI execution, and monitoring WhatsApp traffic for suspicious activity. Countries with high WhatsApp penetration and financial sector importance, such as Germany, France, Italy, Spain, and the UK, are most likely affected. The threat poses a medium risk due to its reliance on social engineering and targeted banking fraud objectives.
Iran-linked hackers conducted reconnaissance by mapping ship Automatic Identification System (AIS) data days before an attempted missile strike, indicating coordinated cyber-physical threat activity. This mapping effort likely aimed to identify maritime targets and optimize attack timing and precision. The threat highlights the use of cyber intelligence gathering to support kinetic military operations, increasing risks to maritime assets. European organizations involved in shipping, port operations, and maritime security could face elevated risks due to potential targeting or collateral damage. The threat requires enhanced monitoring of AIS data integrity and maritime situational awareness. Mitigation should include anomaly detection on AIS feeds, collaboration with maritime authorities, and hardened cyber defenses for critical maritime infrastructure. Countries with significant maritime trade and naval presence, such as the UK, Netherlands, Germany, and Italy, are particularly at risk. Given the high impact on availability and integrity of maritime operations and the ease of exploitation through publicly accessible AIS data, this threat is assessed as high severity. Defenders must prioritize integrating cyber and physical security intelligence to anticipate and respond to such hybrid threats.
TamperedChef is a sophisticated global malvertising and SEO-driven campaign that delivers malicious payloads via seemingly legitimate, digitally signed installers. It leverages social engineering, malvertising, and abused code-signing certificates obtained through U. S. -registered shell companies to evade detection and increase user trust. The campaign primarily targets healthcare, construction, and manufacturing sectors, establishing persistence and deploying obfuscated JavaScript for remote access and control. Attackers may use this access for credential theft, ransomware preparation, or espionage. Although currently concentrated in the Americas, European organizations in similar sectors are at risk due to the campaign's stealth and persistence techniques. Mitigation requires enhanced scrutiny of signed applications, network monitoring for unusual JavaScript execution, and strict controls on software installation sources. Countries with significant healthcare and manufacturing industries, such as Germany, France, and the UK, are most likely to be affected. Given the medium severity rating and the complexity of exploitation, the threat is assessed as high severity for European contexts due to potential impact and stealth.
The Sneaky2FA phishing-as-a-service (PhaaS) kit has integrated the Browser-in-the-Browser (BitB) attack technique, enhancing its ability to bypass two-factor authentication protections by mimicking legitimate browser pop-ups. This attack creates convincing fake login dialogs within a browser window, deceiving users into entering credentials and 2FA codes. The campaign is considered high severity due to its potential to compromise multi-factor authentication, a critical security layer. European organizations relying on 2FA for sensitive systems are at increased risk, especially those in finance, government, and critical infrastructure sectors. Mitigations include user training to recognize BitB attacks, deploying advanced anti-phishing tools that detect UI spoofing, and adopting hardware-based or phishing-resistant authentication methods. Countries with high adoption of 2FA and significant financial or governmental digital infrastructure, such as Germany, France, the UK, and the Netherlands, are most likely to be targeted. The threat does not require software vulnerabilities but exploits user trust and UI deception, making it relatively easy to execute. Defenders must prioritize awareness and technical controls to mitigate this evolving phishing technique.
The UK government has exposed a bulletproof hosting operator that is linked to major ransomware groups including BlackBasta, Evil Corp, and LockBit. Bulletproof hosting providers offer cybercriminals resilient infrastructure to host malicious operations with minimal risk of takedown. This exposure highlights the ongoing support infrastructure enabling ransomware campaigns that target organizations globally. While no direct exploit or vulnerability is reported, the takedown or exposure of such hosting services can disrupt ransomware operations. European organizations remain at risk due to the widespread targeting by these ransomware groups. The threat is medium severity given the indirect nature of the exposure and absence of direct exploitation details. Defenders should monitor for ransomware activity linked to these groups and collaborate with law enforcement to mitigate infrastructure abuse. Countries with high ransomware targeting history and significant digital infrastructure are most likely affected.
Amazon threat intelligence experts have documented two cases in which Iran leveraged hacking to prepare for kinetic attacks. The post Amazon Details Iran’s Cyber-Enabled Kinetic Attacks Linking Digital Spying to Physical Strikes appeared first on SecurityWeek .
When people discuss the security implications of Unicode, International Domain Names (IDNs) are often highlighted as a risk. However, while visible and often talked about, IDNs are probably not what you should really worry about when it comes to Unicode. There are several issues that impact application security beyond confusing domain names.
When the sales hit, you might bag some serious bargains; however, you also have to watch out for unscrupulous vendors that just jack up prices. We’re bringing AI into the mix and suggesting working prompts designed to unlock genuine value.
Eurofiber, a European telecommunications infrastructure provider, confirmed a cyberattack on November 13 involving unauthorized access, data theft, and an extortion attempt. The breach was publicly disclosed via a security news source and Reddit InfoSec community, highlighting the incident's recent and newsworthy nature. Although specific technical details about the attack vector or exploited vulnerabilities are not provided, the incident involves data exfiltration and extortion, indicating a ransomware or data leak scenario. No known exploits or patches are currently reported. The attack poses significant risks to confidentiality and potentially availability of Eurofiber's services. European organizations relying on Eurofiber's infrastructure could face service disruptions or data exposure. Mitigation requires enhanced monitoring, incident response readiness, and verification of supply chain security. Countries with high Eurofiber market presence and critical infrastructure dependency, such as the Netherlands, Belgium, and Germany, are most at risk. Given the high impact on confidentiality and extortion elements, the threat severity is assessed as high. Defenders should prioritize containment, forensic analysis, and communication strategies to mitigate reputational and operational damage.
The China-linked cyber operation named “WrtHug” has been identified hijacking thousands of ASUS routers globally. This campaign involves compromising vulnerable ASUS routers to gain unauthorized control, potentially enabling data interception, network manipulation, and further lateral attacks. The threat is considered high severity due to the scale of affected devices and the critical role routers play in network infrastructure. European organizations using ASUS routers are at risk of exposure to espionage, data breaches, and service disruption. Mitigation requires immediate firmware updates, network segmentation, and enhanced monitoring for unusual router behavior. Countries with high ASUS router market penetration and strategic geopolitical interest in China are more likely to be targeted. Given the lack of a CVSS score, the threat is assessed as high severity due to the broad impact on confidentiality, integrity, and availability, ease of exploitation, and no requirement for user interaction. Defenders should prioritize identifying vulnerable routers, applying patches, and implementing network defenses to mitigate this campaign’s impact.
RONINGLOADER is a sophisticated multi-stage malware loader used by the DragonBreath APT group to deploy an updated variant of the gh0st RAT. It begins infection via trojanized NSIS installers disguised as legitimate software and employs advanced evasion techniques including signed driver abuse, thread-pool injection, and Protected Process Light (PPL) exploitation to disable Microsoft Defender. The loader terminates antivirus processes, applies custom Windows Defender Application Control (WDAC) policies, and injects payloads into trusted system processes to avoid detection. This campaign targets Chinese EDR tools but demonstrates advanced tactics that could be adapted elsewhere. The malware’s complexity and stealth capabilities pose a medium severity threat, with potential impacts on confidentiality and integrity. European organizations using Windows environments with Microsoft Defender could be at risk, especially those in critical infrastructure and government sectors. Mitigation requires tailored detection of abnormal driver behavior, WDAC policy monitoring, and restricting installation of unsigned drivers. Countries with high adoption of Microsoft Defender and strategic geopolitical interest in China-related espionage are most likely affected.
The Tycoon 2FA Phishing Platform represents a sophisticated phishing framework designed to bypass legacy multi-factor authentication (MFA) methods by intercepting and relaying two-factor authentication tokens in real time. This threat undermines the security assurances of traditional MFA implementations, particularly those relying on SMS or time-based one-time passwords (TOTP). European organizations using legacy MFA solutions are at risk of credential compromise and unauthorized access, potentially leading to data breaches and operational disruptions. The platform exploits user interaction through phishing, requiring victims to enter credentials and 2FA codes on fraudulent sites. Mitigation requires adopting modern MFA methods resistant to phishing, such as hardware security keys (FIDO2/WebAuthn), continuous monitoring for phishing campaigns, and user training focused on recognizing sophisticated phishing attempts. Countries with high adoption of legacy MFA and significant digital infrastructure, such as Germany, France, the UK, and the Netherlands, are most likely to be targeted. Given the high impact on confidentiality and integrity, ease of exploitation via phishing, and broad scope of affected systems, the threat severity is assessed as high. Defenders must prioritize upgrading MFA solutions and enhancing phishing detection capabilities to mitigate this evolving threat.
A threat actor known as "888" claims to have leaked sensitive LG Electronics data, including source code, configuration files, and hardcoded credentials, via a supply chain compromise through a contractor access point. The leak, currently unconfirmed by LG, could enable attackers to persist within LG systems, conduct lateral movement, and launch sophisticated phishing campaigns using exposed SMTP credentials. Source code exposure may reveal vulnerabilities in LG IoT devices, potentially impacting millions globally. The threat actor has a history of targeting major corporations and monetizing breaches via ransomware or data sales. This incident highlights risks associated with supply chain security and contractor access management. European organizations using LG products or connected to LG supply chains should be vigilant. The severity is assessed as high due to the sensitivity of leaked data and potential for widespread impact.
Britain’s domestic intelligence agency warned that Chinese nationals were ”using LinkedIn profiles to conduct outreach at scale” on behalf of the Chinese Ministry of State Security. The post MI5 Warns Lawmakers That Chinese Spies Are Trying to Reach Them via LinkedIn appeared first on SecurityWeek .
ShadowRay 2.0 is an active global cyber campaign that hijacks Ray AI infrastructure to create a self-propagating botnet. The attackers exploit AI systems to turn them against themselves, leveraging the compromised AI nodes to expand the botnet autonomously. This campaign is currently ongoing and has been reported by Oligo Security with limited public technical details. Although no known exploits are confirmed in the wild, the campaign's medium severity rating reflects its potential to disrupt AI-based services and infrastructure. European organizations using Ray AI infrastructure or related AI platforms could face risks of service disruption, data compromise, or being unwitting participants in botnet activities. Mitigations require proactive monitoring of AI infrastructure, network segmentation, and rapid incident response capabilities. Countries with significant AI technology adoption and critical infrastructure relying on AI are more likely to be targeted. Given the campaign's self-propagating nature and AI focus, the threat severity is assessed as high due to potential widespread impact and complexity of mitigation.
The Inc Ransom group has taken credit for the hack, claiming to have stolen several terabytes of data. The post Pennsylvania Attorney General Confirms Data Breach After Ransomware Attack appeared first on SecurityWeek .
