Reddit NetSec

CVE Database V5

AlienVault OTX General

Exploit-DB RSS Feed

Reddit InfoSec News

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

Finnish hacker Harri Hursti hacks U.S. voting machine on live podcast

Source: https://techstartups.com/2024/09/25/finnish-hacker-harri-hursti-hacks-u-s-voting-machine-on-live-podcast/

The reported security threat involves Finnish hacker Harri Hursti demonstrating a live hack of a U.S. voting machine during a podcast. While specific technical details about the exploited vulnerabilities or the exact voting machine model are not provided, the event highlights the potential risks associated with electronic voting systems. Voting machines are critical infrastructure components that require robust security to ensure election integrity. A successful hack could allow an attacker to manipulate vote counts, disrupt election processes, or undermine public trust in democratic systems. The demonstration by a well-known security researcher underscores ongoing concerns about the security posture of voting technology, particularly legacy systems that may lack modern protections such as strong encryption, secure boot, or tamper-evident hardware. The lack of detailed technical information and absence of known exploits in the wild suggest this is primarily a proof-of-concept or awareness-raising event rather than an active widespread threat. However, it serves as a reminder that vulnerabilities in voting machines remain a significant security challenge that must be addressed proactively.

Detailed information about Finnish hacker Harri Hursti hacks U.S. voting machine on live podcast. Get real-time updates, technical details, and mitigation strat

Finnish hacker Harri Hursti hacks U.S. voting machine on live podcast - Live Threat Intelligence - Threat Radar | OffSeq.com

Finnish hacker Harri Hursti hacks U.S. voting machine on live podcast

Reddit Discussion: Finnish hacker Harri Hursti hacks U.S. voting machine on live podcast

ethereum is a common ethereum structs for Rust. Prior to ethereum crate v0.18.0, signature malleability (according to EIP-2) was only checked for "legacy" transactions, but not for EIP-2930, EIP-1559 and EIP-7702 transactions. This is a specification deviation. The signature malleability itself is not a security issue and not as high of a risk if the ethereum crate is used on a single-implementation blockchain. This issue has been patched in version v0.18.0. A workaround for this issue involves manually checking transaction malleability outside of the crate, however upgrading is recommended.

CVE-2025-53359 is a medium-severity vulnerability identified in the rust-ethereum project's ethereum crate versions prior to 0.18.0. The vulnerability relates to improper handling of signature malleability checks across different Ethereum transaction types. Specifically, the crate only enforced signature malleability checks, as defined by Ethereum Improvement Proposal 2 (EIP-2), for legacy transactions but failed to apply these checks to newer transaction types introduced by EIP-2930, EIP-1559, and EIP-7702. Signature malleability refers to the possibility of altering the digital signature of a transaction without invalidating it, which can lead to multiple valid signatures for the same transaction data. While signature malleability itself is not inherently a security flaw, the lack of consistent checks across all transaction types represents a deviation from the Ethereum specification and can introduce risks in multi-implementation blockchain environments where different clients might interpret transactions differently. This inconsistency could potentially be exploited to cause transaction replay, double-spending, or confusion in transaction validation processes. The vulnerability does not require authentication, user interaction, or privileges to exploit and affects all users of the ethereum crate versions below 0.18.0. The issue has been addressed in version 0.18.0 by extending signature malleability checks to all transaction types. Until upgrading, users can implement manual checks for transaction malleability outside the crate as a workaround. No known exploits are currently reported in the wild.

Detailed information about CVE-2025-53359: CWE-754: Improper Check for Unusual or Exceptional Conditions in rust-ethereum ethereum affecting rust-ethereum ether

CVE-2025-53359: CWE-754: Improper Check for Unusual or Exceptional Conditions in rust-ethereum ethereum - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-53359: CWE-754: Improper Check for Unusual or Exceptional Conditions in rust-ethereum ethereum

A PHP objection injection vulnerability exists in the Monero Project’s Laravel-based forum software due to unsafe handling of untrusted input in the /get/image/ endpoint. The application passes a user-supplied link parameter directly to file_get_contents() without validation. MIME type checks using PHP’s finfo can be bypassed via crafted stream filter chains that prepend spoofed headers, allowing access to internal Laravel configuration files. An attacker can extract the APP_KEY from config/app.php, forge encrypted cookies, and trigger unsafe unserialize() calls, leading to reliable remote code execution.

CVE-2025-34060 is a critical remote code execution vulnerability affecting the Monero Project's Laravel-based forum software. The root cause lies in unsafe handling of untrusted user input in the /get/image/ endpoint, where a user-supplied 'link' parameter is passed directly to PHP's file_get_contents() function without proper validation or sanitization. The application attempts to verify MIME types using PHP's finfo functions; however, this check can be bypassed by attackers using crafted stream filter chains that prepend spoofed headers. This bypass allows attackers to access sensitive internal Laravel configuration files, notably config/app.php, which contains the APP_KEY. With access to the APP_KEY, attackers can forge encrypted cookies and trigger unsafe unserialize() calls within the application. This deserialization of untrusted data (CWE-502) leads to reliable remote code execution without requiring authentication or user interaction. The vulnerability also involves CWE-829 (inclusion of functionality from untrusted control sphere) and CWE-20 (improper input validation). The CVSS 4.0 base score is 10.0, reflecting the vulnerability's criticality and ease of exploitation over the network without privileges or user interaction. No patches are currently available, and no known exploits have been observed in the wild as of the publication date.

Detailed information about CVE-2025-34060: CWE-502 Deserialization of Untrusted Data in Monero Project Forum affecting Monero Project Forum. Get real-time updat

CVE-2025-34060: CWE-502 Deserialization of Untrusted Data in Monero Project Forum - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-34060: CWE-502 Deserialization of Untrusted Data in Monero Project Forum

This report examines recent activities attributed to the XDSpy threat actor, focusing on an ongoing campaign targeting Eastern European and Russian governmental entities using the XDigo malware since March 2025. The investigation stemmed from analyzing a vulnerability in LNK files, leading to the discovery of a multi-stage infection chain. The report provides analysis of the XDigo implant and its connections to previous XDSpy activities. It also details the exploitation of LNK parsing issues and infrastructure used across different campaigns. The research uncovered additional, more recent XDSpy activity employing an alternative infection chain. Targets include government entities in Eastern Europe, with a confirmed victim in Belarus.

The threat known as SadFuture represents the latest evolution of the XDSpy threat actor's activities, focusing on a sophisticated multi-stage malware campaign targeting governmental entities primarily in Eastern Europe and Russia. The campaign has been active since at least March 2025 and centers around the deployment of the XDigo implant, a malware strain linked to previous XDSpy operations. The infection chain exploits a vulnerability in the parsing of LNK (Windows shortcut) files, enabling initial compromise without requiring user authentication but potentially involving user interaction to trigger the payload. This exploitation leverages Windows' handling of LNK files to execute malicious code, a technique that bypasses some traditional security controls. The campaign infrastructure and tactics have evolved, with recent activity showing an alternative infection chain, indicating adaptability and ongoing development by the threat actor. The attack techniques include a range of tactics and procedures such as etdownloader usage, living-off-the-land binaries (LOLBins) exploitation (e.g., T1218.011), credential dumping, data staging, and command and control communications, reflecting a comprehensive and persistent attack methodology. The confirmed targeting of government entities, including a victim in Belarus, underscores the geopolitical motivations behind the campaign. The threat actor's use of multiple techniques to maintain persistence, evade detection, and exfiltrate data highlights the advanced nature of this threat. No known public exploits are currently reported, but the exploitation of LNK parsing vulnerabilities remains a critical vector. The campaign's complexity and targeted nature suggest a well-resourced adversary with significant operational capabilities.

Detailed information about SadFuture: Mapping XDSpy latest evolution. Get real-time updates, technical details, and mitigation strategies.

SadFuture: Mapping XDSpy latest evolution - Live Threat Intelligence - Threat Radar | OffSeq.com

SadFuture: Mapping XDSpy latest evolution

RISC Zero is a zero-knowledge verifiable general computing platform, with Ethereum integration. The risc0-ethereum repository contains Solidity verifier contracts, Steel EVM view call library, and supporting code. Prior to versions 2.1.1 and 2.2.0, the `Steel.validateCommitment` Solidity library function will return `true` for a crafted commitment with a digest value of zero. This violates the semantics of `validateCommitment`, as this does not commitment to a block that is in the current chain. Because the digest is zero, it does not correspond to any block and there exist no known openings. As a result, this commitment will never be produced by a correct zkVM guest using Steel and leveraging this bug to compromise the soundness of a program using Steel would require a separate bug or misuse of the Steel library, which is expected to be used to validate the root of state opening proofs. A fix has been released as part of `risc0-ethereum` 2.1.1 and 2.2.0. Users for the `Steel` Solidity library versions 2.1.0 or earlier should ensure they are using `Steel.validateCommitment` in tandem with zkVM proof verification of a Steel program, as shown in the ERC-20 counter example, and documentation. This is the correct usage of Steel, and users following this pattern are not at risk, and do not need to take action. Users not verifying a zkVM proof of a Steel program should update their application to do so, as this is incorrect usage of Steel.

CVE-2025-52884 is a low-severity vulnerability identified in the risc0-ethereum project, specifically affecting versions prior to 2.1.1 and 2.2.0 of the Steel Solidity library. RISC Zero is a zero-knowledge verifiable general computing platform integrated with Ethereum, and the risc0-ethereum repository includes Solidity verifier contracts and supporting libraries such as Steel, which is used to validate commitments to blockchain state roots. The vulnerability arises from improper handling of a crafted commitment with a digest value of zero in the Steel.validateCommitment function. This function incorrectly returns true for such a commitment, which semantically should not be valid because a zero digest does not correspond to any block in the current blockchain and has no known openings. This flaw violates the intended semantics of validateCommitment, potentially compromising the soundness of programs relying solely on this function for validation. However, exploitation requires either a separate bug or misuse of the Steel library, as correct usage involves verifying zkVM proofs of Steel programs in tandem with validateCommitment, which prevents risk. The vulnerability does not impact confidentiality, availability, or integrity directly and has no known exploits in the wild. The fix was introduced in versions 2.1.1 and 2.2.0, and users are advised to update and ensure proper usage patterns that include zkVM proof verification alongside validateCommitment, as demonstrated in the ERC-20 counter example and official documentation.

Detailed information about CVE-2025-52884: CWE-159: Improper Handling of Invalid Use of Special Elements in risc0 risc0-ethereum affecting risc0 risc0-ethereum.

CVE-2025-52884: CWE-159: Improper Handling of Invalid Use of Special Elements in risc0 risc0-ethereum - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-52884: CWE-159: Improper Handling of Invalid Use of Special Elements in risc0 risc0-ethereum

Trezor’s support platform abused in crypto theft phishing attacks

Source: https://www.bleepingcomputer.com/news/security/trezors-support-platform-abused-in-crypto-theft-phishing-attacks/

This threat involves the abuse of Trezor's official support platform as part of phishing attacks aimed at stealing cryptocurrency from users. Trezor is a well-known hardware wallet provider that secures private keys offline, making it a popular choice among cryptocurrency holders for safeguarding digital assets. The attackers exploit the trust users place in Trezor's support infrastructure by impersonating legitimate support channels or leveraging the platform itself to conduct phishing campaigns. These phishing attacks typically involve tricking victims into divulging sensitive information such as recovery seed phrases, private keys, or login credentials under the guise of receiving technical support or resolving account issues. Since hardware wallets like Trezor are designed to be secure against remote compromise, attackers resort to social engineering techniques that bypass technical protections by targeting the human element. The abuse of the support platform suggests that attackers may be using legitimate communication channels or mimicking them convincingly, increasing the likelihood of successful credential theft. Although no specific affected versions or technical vulnerabilities are reported, the high severity rating indicates significant risk due to the potential financial losses from stolen cryptocurrency. No known exploits in the wild have been documented yet, but the threat is recent and newsworthy, highlighting the evolving tactics of cybercriminals targeting crypto users through trusted service platforms.

Detailed information about Trezor’s support platform abused in crypto theft phishing attacks. Get real-time updates, technical details, and mitigation strategie

Trezor’s support platform abused in crypto theft phishing attacks - Live Threat Intelligence - Threat Radar | OffSeq.com

Trezor’s support platform abused in crypto theft phishing attacks

Reddit Discussion: Trezor’s support platform abused in crypto theft phishing attacks

SparkKitty Spyware on App Store and Play Store, Steals Photos for Crypto Data

Source: https://hackread.com/sparkkitty-spyware-app-store-play-store-steals-photos-crypto/

The SparkKitty spyware is a recently identified malicious application discovered on both the Apple App Store and Google Play Store. This spyware specifically targets mobile devices by stealthily stealing photos from infected devices, with a particular focus on extracting images that may contain cryptocurrency-related data such as wallet QR codes, private keys, or transaction details. The spyware's presence on official app distribution platforms indicates a sophisticated evasion of app store security mechanisms, allowing it to reach a broad user base. Although detailed technical specifics such as the infection vector, persistence mechanisms, or command and control infrastructure are not provided, the core malicious capability centers on unauthorized access to the device's photo gallery. This access enables attackers to harvest sensitive visual data that can compromise users' cryptocurrency assets. The spyware's operation does not appear to require user interaction beyond initial app installation, and it likely exploits granted permissions to access photos. There is no current evidence of known exploits in the wild beyond the app store presence, and no patches or updates have been documented yet. The threat was reported recently, with minimal discussion in the InfoSec community, indicating it is an emerging concern that may escalate as awareness grows.

Detailed information about SparkKitty Spyware on App Store and Play Store, Steals Photos for Crypto Data. Get real-time updates, technical details, and mitigati

SparkKitty Spyware on App Store and Play Store, Steals Photos for Crypto Data - Live Threat Intelligence - Threat Radar | OffSeq.com

SparkKitty Spyware on App Store and Play Store, Steals Photos for Crypto Data

Reddit Discussion: SparkKitty Spyware on App Store and Play Store, Steals Photos for Crypto Data

APT28 Uses Signal Chat to Deploy BEARDSHELL Malware and COVENANT in Ukraine

Source: https://thehackernews.com/2025/06/apt28-uses-signal-chat-to-deploy.html

The threat involves the advanced persistent threat group APT28, also known as Fancy Bear, leveraging the Signal messaging platform to deploy two distinct malware families: BEARDSHELL and COVENANT. APT28 is a well-known cyber espionage group linked to Russian state interests, historically targeting government, military, and critical infrastructure entities. The use of Signal chat as a command and control (C2) or delivery vector is notable because Signal is an encrypted, privacy-focused messaging application, which complicates detection and monitoring efforts by defenders. BEARDSHELL malware is likely a custom-developed implant designed for stealthy persistence, reconnaissance, and data exfiltration, while COVENANT is a known .NET-based post-exploitation framework used for lateral movement, privilege escalation, and command execution. The deployment in Ukraine suggests a targeted campaign aligned with geopolitical tensions in the region. The absence of affected versions or patch links indicates this is a malware distribution and operational tactic rather than an exploitation of a specific software vulnerability. No known exploits in the wild are reported, implying the infection vector relies on social engineering or covert delivery via Signal communications. The minimal discussion level and low Reddit score suggest limited public visibility, but the source is a trusted cybersecurity news outlet, The Hacker News, lending credibility. Overall, this threat represents a sophisticated, targeted espionage campaign leveraging encrypted communication channels to evade detection and deploy advanced malware tools.

Detailed information about APT28 Uses Signal Chat to Deploy BEARDSHELL Malware and COVENANT in Ukraine. Get real-time updates, technical details, and mitigation

APT28 Uses Signal Chat to Deploy BEARDSHELL Malware and COVENANT in Ukraine - Live Threat Intelligence - Threat Radar | OffSeq.com

APT28 Uses Signal Chat to Deploy BEARDSHELL Malware and COVENANT in Ukraine

Reddit Discussion: APT28 Uses Signal Chat to Deploy BEARDSHELL Malware and COVENANT in Ukraine

NeKernal is a free and open-source operating system stack. Prior to version 0.0.3, there are several memory safety issues that can lead to memory corruption, disk image corruption, denial of service, and potential code execution. These issues stem from unchecked memory operations, unsafe typecasting, and improper input validation. This issue has been patched in version 0.0.3.

CVE-2025-52568 is a high-severity vulnerability affecting the NeKernal operating system stack, an open-source OS project. The flaw exists in versions prior to 0.0.3 and arises from improper input validation and unsafe memory operations, including unchecked memory accesses and unsafe typecasting. These issues lead to memory corruption and disk image corruption, which can cause denial of service (DoS) conditions or potentially allow arbitrary code execution. The vulnerability is classified under CWE-20 (Improper Input Validation) and CWE-770 (Allocation of Resources Without Limits or Throttling), indicating that the system fails to properly validate inputs and manage memory safely. Exploitation requires no authentication or user interaction and can be triggered remotely over the network, as indicated by the CVSS vector (AV:N/AC:L/PR:N/UI:N). The impact on confidentiality and availability is high, with integrity also severely affected due to possible disk image corruption and code execution. The vulnerability has been patched in version 0.0.3 of NeKernal, but systems running earlier versions remain at risk. No known exploits are currently in the wild, but the ease of exploitation and severity suggest active exploitation attempts could emerge rapidly once the vulnerability becomes widely known.

Detailed information about CVE-2025-52568: CWE-20: Improper Input Validation in nekernel-org nekernel affecting nekernel-org nekernel. Get real-time updates, te

CVE-2025-52568: CWE-20: Improper Input Validation in nekernel-org nekernel - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-52568: CWE-20: Improper Input Validation in nekernel-org nekernel

Scammers Use Inferno Drainer to Steal $43,000 of Crypto from Over 110 Wallets on CoinMarketCap

Source: https://hackread.com/scammers-inferno-drainer-crypto-coinmarketcap-users/

The reported threat involves scammers leveraging a malware tool known as 'Inferno Drainer' to steal approximately $43,000 worth of cryptocurrency from over 110 wallets associated with users of CoinMarketCap, a widely used cryptocurrency market data platform. Inferno Drainer is a type of crypto-stealing malware designed to target victims' wallets by intercepting or manipulating transactions, or by exploiting vulnerabilities in wallet software or browser extensions. While specific technical details about the malware's infection vector or exploitation methods are not provided, the attack likely involves social engineering or phishing tactics to trick users into authorizing malicious transactions or installing compromised software. The malware's operation results in unauthorized transfers of cryptocurrency assets from victims' wallets to attacker-controlled addresses. The scale of the theft, involving over 110 wallets, indicates a targeted campaign with moderate success. The absence of known exploits in the wild and lack of detailed technical indicators suggest this is a relatively new or emerging threat, primarily disseminated through social media and community forums such as Reddit. The medium severity rating reflects the financial impact and the targeted nature of the attack, which primarily compromises the confidentiality and integrity of users' crypto assets without necessarily affecting system availability.

Detailed information about Scammers Use Inferno Drainer to Steal $43,000 of Crypto from Over 110 Wallets on CoinMarketCap. Get real-time updates, technical deta

Title	Severity	Type	Source	Date

Threats Affecting Estonia

Filter Threats

Threats Affecting Estonia

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility