Threats Affecting Czechia

VectraRAT is a previously undocumented Malware-as-a-Service platform combining a Go-based control server (VectraHub) with a native C++ Windows implant, renting from $250 monthly. The developer, operating under the handle 'Vectra' (formerly 'Nyxel'), has been active since August 2022 without prior public documentation. The platform offers hidden desktop control, keylogging, clipboard hijacking with cryptocurrency address replacement, browser credential theft, and a UAC bypass achieving elevation without user prompts. Delivered through Amadey loader and ClickFix campaigns targeting tax-themed lures, 48% of observed victims run corporate Windows editions including Windows Server 2025. Infrastructure analysis revealed exposed directories and operational panels across multiple hosting providers, with victims spanning the United States, Russia, Germany, and other nations.

MediumMalwareUnited StatesBritish Indian Ocean TerritoryCzechia+4#amadey#maas platform#vidar

Manic is a newly discovered Android malware family that steals banking credentials, intercepts sensitive data, and allows remote control of infected devices. It uniquely exfiltrates stolen data even without an internet connection by exploiting Android Accessibility services to capture keystrokes and replay them on targeted apps. The malware targets banking apps, government apps, crypto wallets, and two-factor authentication apps across multiple European countries. Infection vectors likely include unofficial app stores, malicious APKs, and phishing links, with no evidence of distribution via Google Play. Manic abuses Accessibility permissions to spy on users, grant itself additional permissions, and prevent removal. It overlays an invisible keyboard to capture passwords and sensitive input. The malware has been active since at least May 2026 and continues to evolve to evade detection.

HighMalwareAustriaCzechiaEstonia+10#android#mobile#malware

This analysis details infrastructure used by multiple Russian cyber espionage clusters targeting academia, think tanks, and organizations in Europe and the United States. The clusters UNC6293, UNC7005, and UNC5976 employ OAuth phishing, Microsoft device code phishing, and WhatsApp targeting techniques. UNC6293 uses sophisticated lure domains impersonating reputable organizations with possible Evilginx configurations. UNC7005 shows lower operational security with simpler phishing domains. UNC5976 uses Google Drive impersonation for OAuth phishing. The investigation uses DNS data, CSS hashes, favicon analysis, registration patterns, and certificate info to track and identify related malicious infrastructure.

MediumAnalysisUnited StatesCzechia#device code phishing#oauth phishing#dns pivoting

A newly identified Android malware family named Manic combines banking malware and mobile spyware capabilities, targeting Ukrainian banks, government services, messaging applications, Russian and European financial institutions, and global fintech and cryptocurrency services. Active since February 2026, Manic enables extensive Device Takeover operations through sophisticated surveillance and remote-control features. It employs advanced PIN stealing techniques without requiring traditional overlay attacks, utilizing Accessibility services as a UI keylogger to capture lock-screen inputs, recovery phrases, and authentication codes. A distinctive feature is its Wi-Fi mesh egress technique, allowing compromised devices to relay stolen data through other infected phones via Wi-Fi Direct, Bluetooth, or BLE when direct C2 access is unavailable. The malware monitors 169 applications including banks, cryptocurrency wallets, government eID services, and military-focused messengers across multiple countries.

MediumMalwareAustriaCzechiaEstonia+9#wi-fi mesh relay#ukraine targeted#android

WindRelay is an Android NFC relay malware used in combination with the SpyNote remote administration tool (RAT) to steal live payment card data and commit financial fraud. Attackers socially engineer victims to install SpyNote disguised as a legitimate app, granting remote access to their device. Subsequently, WindRelay is installed to relay NFC card data in real time, enabling attackers to perform fraudulent transactions including taking out loans and making purchases using the victim's card. The attack relies heavily on social engineering and occurs rapidly, often within minutes. Targeting appears focused on Czechia, Slovakia, and Slovenia. Users are advised to avoid sideloading apps from untrusted sources and be cautious with apps requesting NFC or accessibility permissions.

HighMalwareCzechiaSlovakiaSlovenia#android#malware

A new NFC relay malware family called WindRelay has been discovered operating in combination with SpyNote RAT to enable sophisticated contactless payment fraud. The scheme uses live social engineering phone calls where fraudsters impersonate bank employees and guide victims to install personalized RAT malware labeled with the victim's own name. Once installed, the RAT enables silent deployment of WindRelay, which captures contactless payment card data via NFC when victims tap their cards to their phones. The captured data is relayed in real-time to fraudster-controlled terminals for immediate cash-out through physical purchases or ATM withdrawals. The operation employs dual monetization, combining RAT-driven digital loan fraud with NFC-based card-present transactions. Group-IB identified 23 WindRelay samples targeting victims in Czechia, Slovakia, and Slovenia between November 2025 and July 2026.

MediumMalwareCzechiaPolandSlovakia+1#windrelay#android banking trojan#ghost tapping

Tomorrowland Belgium 2026, spanning two weekends in July at De Schorre in Boom, sold out rapidly, creating opportunities for cybercriminals. Investigation uncovered approximately a dozen fraudulent websites impersonating the festival brand to target ticket seekers and travellers. These scams include fake ticket shops mimicking official sales with countdown timers and fraudulent biometric checks, travel sites offering bogus accommodation and transport packages, and affiliate schemes. The operations harvest complete identity data, payment credentials, and personal information through sophisticated social engineering. Victims lose money with no recourse, face identity theft risks, and ultimately receive invalid or non-existent tickets. The scammers exploit high demand, tight supply, and rushed purchasing decisions, with sites registered weeks in advance and pushed hardest when official tickets are sold out.

MediumCampaignBelgiumCzechiaFrance+1#social-engineering#payment-fraud#phishing

A sophisticated cyber-espionage campaign attributed to China-linked actors targets officials and citizens in Czech Republic and Taiwan through spearphishing attacks. The operation deploys malicious ZIP archives containing dual infection paths that ultimately deliver AZUREVEIL, an Adaptix C2 agent. The campaign uniquely leverages Microsoft Azure Blob Storage as a dead-drop command-and-control channel, bypassing traditional C2 infrastructure. A multi-stage infection chain employs RUSTCLOAK, a Rust-based loader implementing triple-layer encryption using modified RC4, Base64, and SM4-CBC algorithms. The final payload supports 36 post-exploitation commands including Beacon Object File execution in memory, file system manipulation, process control, network pivoting, and data exfiltration. Lure documents impersonate official communications from Taiwanese research institutions and Czech Social Security Administration, demonstrating targeted social engineering tailored to each region.

MediumMalwareCzechiaTaiwan#china-linked#taiwan#dll sideloading

The ShinyHunters hacker group claimed to have stolen over 350GB of information from European Commission cloud systems. The post European Commission Reports Cyber Intrusion and Data Theft appeared first on SecurityWeek .

LowAnalysisBelgiumFranceGermany+12

User enumeration in ESET Protect (on-prem) via Response Timing.

MediumVulnerabilityUnited StatesGermanyUnited Kingdom+7#cve#cve-2025-3716#cwe-204