Researchers have demonstrated how malicious extensions can create fake AI sidebars in the Comet and Atlas browsers, and spoof the models' responses. We explain how to avoid becoming a victim.
Key Findings Ransomware in Q3 2025: RaaS fragmentation increases and Lockbit is back During the third quarter of 2025, we monitored more than 85 active data leak sites (DLS) that collectively listed 1,592 new victims. Compared to the 1,607 victims reported in Q2 2025, the publication rate remained stable though it is still notably higher […] The post The State of Ransomware – Q3 2025 appeared first on Check Point Research .
A large-scale spam attack has flooded the npm registry with over 67,000 fake packages, mimicking a worm-like propagation pattern. These counterfeit packages may contain malicious code or be used to distribute malware, posing significant risks to developers and organizations relying on npm for software dependencies. Although no known exploits in the wild have been reported yet, the sheer volume and automated nature of the attack increase the likelihood of accidental inclusion of malicious packages in projects. European organizations using npm extensively for development and production environments face risks including supply chain compromise, data breaches, and service disruptions. Mitigation requires enhanced package vetting, use of trusted package sources, dependency auditing, and implementation of strict CI/CD pipeline controls. Countries with strong software development sectors and high npm usage, such as Germany, the UK, France, and the Netherlands, are particularly vulnerable. Given the potential for widespread impact on confidentiality, integrity, and availability, and the ease of exploitation via automated package installation, this threat is assessed as high severity. Defenders must prioritize monitoring npm package sources and applying automated security tools to detect and block fake or malicious packages.
This report discusses the manual creation of . NET serialization gadgets, which are components that can be exploited in deserialization attacks to execute arbitrary code. While no specific vulnerabilities or exploits are currently known in the wild, the technique highlights potential risks in . NET applications that use insecure deserialization. The threat is of medium severity due to the complexity of exploitation and the need for specific conditions. European organizations using . NET frameworks in their applications should be aware of this emerging technique and review their deserialization practices. Mitigations include avoiding deserialization of untrusted data, implementing strict input validation, and employing secure coding practices. Countries with significant . NET development ecosystems and critical infrastructure relying on .
Google has filed a lawsuit against China-based hackers responsible for operating the Lighthouse phishing platform, which is estimated to have caused over $1 billion in damages. The Lighthouse platform is a large-scale phishing operation targeting various victims to steal credentials and sensitive information. Although no specific affected software versions or exploits are detailed, the threat is categorized as high severity due to its scale and financial impact. The phishing campaigns likely employ sophisticated social engineering techniques to deceive users into divulging confidential data. European organizations, especially those with significant digital presence and valuable intellectual property, could be targeted due to their strategic importance. Mitigation requires enhanced email security, user awareness training, and deployment of advanced threat detection systems tailored to phishing. Countries with high technology adoption and geopolitical relevance to China are more likely to be affected. Given the ease of phishing exploitation and the broad scope of potential victims, the threat severity is assessed as high. Defenders should prioritize phishing detection, incident response readiness, and cross-border intelligence sharing to mitigate risks.
NTT’s chief cybersecurity strategist Mihoko Matsubara on the new geopolitics of hacking, the "chicken and egg" problem of 5G, and the AGI threat to society. The post China’s Cyber Silence Is More Worrying Than Russia’s Noise, Chief Cybersecurity Strategist Says appeared first on SecurityWeek .
Australia’s spy chief has issued a critical warning regarding cyber threats linked to China targeting critical infrastructure. Although specific technical details or exploited vulnerabilities are not provided, the alert highlights the strategic targeting of vital systems that support national security and essential services. The threat underscores the increasing geopolitical tensions and the use of cyber operations as a tool for state-level influence and disruption. European organizations with critical infrastructure sectors similar to Australia's could face analogous risks, especially those involved in energy, transportation, and communications. The warning calls for heightened vigilance and proactive defense measures to mitigate potential espionage or sabotage attempts. No known exploits or patches are currently identified, indicating a focus on threat intelligence and preparedness rather than immediate incident response. Given the nature of critical infrastructure and the potential for widespread disruption, the severity is assessed as critical. Countries with significant critical infrastructure and geopolitical interest in countering Chinese cyber activities are most likely to be affected. Defenders should prioritize intelligence sharing, network segmentation, and advanced monitoring to detect and respond to sophisticated state-linked threats.
A newly reported macOS infection vector leverages AppleScripts to bypass Apple's Gatekeeper security mechanism. Gatekeeper is designed to prevent untrusted or malicious software from executing, but attackers can exploit AppleScript capabilities to circumvent these protections. This technique does not rely on known vulnerabilities but abuses legitimate scripting functionality to execute malicious code. Although no active exploits have been observed in the wild yet, the method poses a medium-level threat due to its potential to evade standard macOS defenses. European organizations using macOS devices, especially in sectors with high reliance on Apple hardware, could be targeted. Mitigation requires enhanced monitoring of AppleScript execution, restricting script permissions, and user education about suspicious script behaviors. Countries with significant macOS adoption and strong tech sectors, such as Germany, the UK, France, and the Nordics, are more likely to be affected. The threat is assessed as medium severity given the moderate impact and the need for some user interaction or social engineering to trigger the script. Defenders should prioritize detection of unusual AppleScript activity and consider application whitelisting policies to reduce risk.
A recent ransomware attack attributed to the RansomHub group was uncovered following an unusual CPU spike detected in a system. The attack involves ransomware that encrypts data and demands payment for decryption keys, posing a significant threat to affected organizations. Although no specific affected software versions or exploits in the wild have been reported, the high severity rating indicates a serious risk. European organizations, especially those with critical infrastructure or high-value data, could face operational disruption and financial losses. Mitigation requires proactive monitoring of system performance anomalies, robust endpoint protection, network segmentation, and incident response readiness. Countries with high adoption of vulnerable systems and strategic importance in sectors like finance, manufacturing, and healthcare are more likely to be targeted. Given the ransomware's impact on confidentiality, integrity, and availability, ease of exploitation through typical ransomware infection vectors, and no need for user interaction beyond initial compromise, the threat severity is assessed as high. Defenders should prioritize detection of abnormal resource usage patterns and maintain updated backups to mitigate potential damage.
Recent reports highlight new attack techniques targeting secure enclave technologies, which are designed to protect sensitive data and code execution even from privileged system software. These attacks potentially undermine the confidentiality and integrity guarantees of secure enclaves by exploiting novel side-channel or implementation weaknesses. Although no known exploits are currently active in the wild, the medium severity rating reflects the potential risk if these vulnerabilities are weaponized. European organizations relying on secure enclave technologies for critical data protection, especially in finance, healthcare, and government sectors, could face increased exposure. Mitigation requires a combination of applying vendor patches when available, enhancing enclave usage policies, and adopting layered security controls to detect anomalous enclave behavior. Countries with high adoption of enclave-enabled hardware and strong digital infrastructure, such as Germany, France, and the UK, are more likely to be affected. Given the complexity of exploitation and the critical role of enclaves, the suggested severity is medium. Defenders should prioritize monitoring developments, validating enclave integrity, and preparing incident response plans tailored to enclave compromise scenarios.
The China-aligned threat actor UTA0388 is conducting global phishing campaigns leveraging AI tools to enhance the sophistication and effectiveness of their attacks. These campaigns aim to deceive targets by generating more convincing phishing content, increasing the likelihood of credential theft or malware deployment. While no specific affected software versions or exploits are noted, the use of AI indicates an evolution in phishing tactics that can bypass traditional detection methods. European organizations, especially those in sectors with strategic geopolitical importance, are at risk due to the global scope of these campaigns. Mitigation requires targeted user awareness training focused on AI-enhanced phishing, deployment of advanced email filtering solutions, and continuous monitoring for suspicious activity. Countries with significant digital infrastructure and geopolitical relevance to China are more likely targets. Given the high potential impact on confidentiality and integrity, ease of exploitation without authentication, and broad scope, this threat is assessed as high severity. Defenders should prioritize enhancing phishing defenses and incident response capabilities to counter this emerging AI-driven threat vector.
FileFix — the latest variation of the ClickFix attack using social engineering. How this scheme works, and how to protect your company against FileFix.
GlassWorm malware has been discovered embedded within three Visual Studio Code extensions that have collectively been installed thousands of times. This malware targets developers by leveraging the popularity of VS Code extensions to infiltrate systems. Once installed, GlassWorm can execute malicious activities potentially compromising confidentiality and integrity of affected systems. Although no known exploits are currently active in the wild, the high severity rating indicates significant risk if exploited. European organizations using these extensions are at risk, especially those in software development and IT sectors. Mitigation requires immediate auditing of installed VS Code extensions, removal of suspicious ones, and monitoring for unusual activity. Countries with high adoption of VS Code and strong software development industries, such as Germany, France, and the UK, are most likely to be affected. The threat is considered high severity due to the potential impact on sensitive development environments and ease of distribution via trusted extension marketplaces. Defenders should prioritize verifying extension authenticity and applying strict controls on extension installation policies.
Three more VS Code extensions were infected last week and the malware has emerged in GitHub repositories as well. The post GlassWorm Malware Returns to Open VSX, Emerges on GitHub appeared first on SecurityWeek .
The Lazarus Group, a DPRK-linked threat actor, has launched a targeted espionage campaign against aerospace and defense sectors using a new variant of the Comebacker backdoor. The attack employs spear phishing with highly specific lure documents to deliver macro-based malware. The infection chain is multi-staged, featuring custom decryption algorithms and encrypted command-and-control communications, indicating advanced evasion techniques. The campaign infrastructure remains active, suggesting ongoing operations. This threat poses risks to confidentiality and integrity of sensitive defense-related information. European aerospace and defense organizations should enhance phishing defenses and monitor for indicators such as specific file hashes and suspicious domains. No CVSS score is assigned, but the threat is assessed as high severity due to its targeted nature, potential impact, and sophisticated malware. Countries with significant aerospace and defense industries and geopolitical interest in DPRK activities are most at risk. Immediate mitigation includes user training, macro restrictions, network monitoring, and threat intelligence sharing.
The GlassWorm malware has resurfaced on the OpenVSX marketplace with three new malicious Visual Studio Code extensions. These extensions are designed to infiltrate developer environments, potentially compromising source code confidentiality and integrity. GlassWorm is known for its stealthy behavior and ability to exfiltrate sensitive data from infected systems. Although no known exploits are currently active in the wild, the presence of these extensions on a popular open-source extension repository poses a significant risk. European organizations relying on VSCode and OpenVSX for development are at risk of supply chain attacks. The malware’s return highlights the ongoing threat of malicious code injection via trusted development tools. Mitigation requires strict extension vetting, monitoring network traffic for unusual activity, and restricting extension installation policies. Countries with large software development sectors and high adoption of VSCode and OpenVSX are most vulnerable. Given the malware’s potential impact on confidentiality and integrity, ease of exploitation via trusted extensions, and broad scope, the threat severity is assessed as high.
The 'Whisper Leak' attack, uncovered by Microsoft, is a novel side-channel threat that can infer AI chat topics from encrypted traffic. This attack does not decrypt the content but uses traffic analysis techniques to identify the subject matter of AI conversations despite encryption. It poses a high risk to confidentiality, especially for organizations relying on AI chat services for sensitive communications. While no known exploits are currently active in the wild, the potential for privacy breaches is significant. European organizations using AI chat platforms could face exposure of confidential discussion topics, impacting competitive advantage and regulatory compliance. Mitigation requires advanced traffic obfuscation and network monitoring tailored to detect such side-channel leaks. Countries with high AI adoption and strict data privacy regulations are most vulnerable. The attack is rated high severity due to its impact on confidentiality, ease of exploitation via passive network observation, and broad scope affecting encrypted AI chat traffic without requiring user interaction or authentication.
A free, open-source file scanner hosted on GitHub has been highlighted in InfoSec news due to potential remote code execution (RCE) risks. Although no specific affected versions or exploits in the wild are currently reported, the mention of RCE indicates a high-severity threat if vulnerabilities exist. The tool's open-source nature means vulnerabilities could be discovered or exploited by attackers, especially if the scanner processes untrusted files. European organizations using or evaluating this tool should be cautious and perform thorough security assessments before deployment. Mitigations include code review, sandboxing, and restricting file inputs. Countries with strong open-source adoption and critical infrastructure relying on file scanning tools are more likely to be impacted. Given the potential for RCE and lack of authentication requirements, the threat is assessed as high severity. Defenders must prioritize monitoring and validation when integrating such tools.
