PyStoreRAT is a newly identified Remote Access Trojan (RAT) malware targeting OSINT researchers by leveraging GitHub repositories as its infection vector. It aims to compromise researchers who rely on open-source intelligence tools and resources hosted on GitHub. The malware's distribution through trusted platforms like GitHub increases the risk of successful infection due to perceived legitimacy. While no known exploits are currently active in the wild, the malware poses a medium-level threat given its targeted nature and potential to exfiltrate sensitive research data. European organizations involved in OSINT and cybersecurity research are at risk, especially those with active engagement in GitHub-based projects. Mitigation requires enhanced scrutiny of GitHub repositories, use of endpoint detection tools capable of identifying RAT behaviors, and strict network segmentation to limit lateral movement. Countries with strong cybersecurity research communities and high GitHub usage, such as Germany, the UK, France, and the Netherlands, are more likely to be affected. The threat is assessed as medium severity due to the targeted attack vector, moderate impact on confidentiality and integrity, and the absence of widespread exploitation or automated propagation. Defenders should prioritize monitoring for unusual GitHub repository activity and educate OSINT teams on the risks of downloading unverified code from public repositories.
We break down what happens to stolen data after a phishing attack: how it ends up on the shadow market and gets used in new phishing schemes, and what risks this poses. We also offer tips on how to protect your accounts, and minimize any impact.
The React2Shell vulnerability has escalated into large-scale global attacks, prompting emergency mitigation efforts worldwide. Although specific technical details and affected versions are not provided, the critical severity indicates a serious risk of exploitation. The attacks are reported globally, suggesting widespread impact potential. European organizations could face significant risks, especially those relying on React-based technologies or related ecosystems. No known exploits in the wild have been confirmed yet, but the rapid escalation and emergency response imply active exploitation attempts or imminent threats. Mitigation requires urgent patching once available, enhanced monitoring for suspicious activity, and network segmentation to limit potential spread. Countries with strong tech sectors and high adoption of React or JavaScript frameworks are likely more vulnerable. The threat severity is assessed as critical due to the potential for widespread compromise, ease of exploitation implied by rapid escalation, and the global scale of attacks. Defenders should prioritize immediate risk assessment and containment strategies while awaiting detailed technical advisories and patches.
Newly disclosed vulnerabilities in React's React Server Components (RSC) can lead to denial of service (DoS) attacks and potential exposure of source code. These vulnerabilities have been reported recently and are considered high severity due to their impact on availability and confidentiality. Although no known exploits are currently active in the wild, the issues pose significant risks to applications using React RSC. The vulnerabilities do not have assigned CVSS scores yet, but their potential for remote exploitation and sensitive data exposure makes them critical to address. European organizations relying on React for server-side rendering or server components should prioritize mitigation. Countries with strong software development sectors and high adoption of React frameworks are particularly at risk. Immediate mitigation involves monitoring official React updates, applying patches once available, and implementing strict access controls and input validation on server components. Proactive threat hunting and code audits are recommended to detect any exploitation attempts early. Overall, defenders must treat these vulnerabilities with urgency to prevent service disruption and intellectual property leakage.
Participants earned rewards at the hacking competition for Grafana, Linux Kernel, Redis, MariaDB, and PostgreSQL vulnerabilities. The post $320,000 Paid Out at Zeroday.Cloud for Open Source Software Exploits appeared first on SecurityWeek .
In the Microsoft Windows ecosystem, DLLs (Dynamic Load Libraries) are PE files like regular programs. One of the main differences is that they export functions that can be called by programs that load them. By example, to call RegOpenKeyExA(), the program must first load the ADVAPI32.dll. A PE files has a lot of headers (metadata) that contain useful information used by the loader to prepare the execution in memory. One of them is the EntryPoint, it contains the (relative virtual) address where the program will start to execute.
This report highlights challenges encountered when using pay-per-use AI security agents in blue-team operations. Deep reasoning tasks cause non-linear token consumption spikes, making metered billing models costly and disruptive during incident response. The analysis suggests unlimited usage AI models are better suited for continuous defensive workflows. Although not a direct vulnerability or exploit, this issue impacts operational efficiency and cost management in cybersecurity teams relying on AI. There are no known exploits or affected software versions. The threat is medium severity due to its impact on availability and workflow continuity. European organizations using AI-driven security tools with pay-per-use billing may face operational and financial challenges. Countries with advanced cybersecurity operations and AI adoption, such as Germany, France, and the UK, are most likely affected. Practical mitigation includes adopting unlimited usage AI plans, optimizing AI query design to reduce token consumption, and integrating AI tools with cost monitoring. This is not a traditional security vulnerability but a significant operational threat to AI-enabled security workflows.
The hack of 120 000 IP cameras across South Korea led to the production and sale of sexually explicit footage. We break down how IP cameras work — and how to secure them.
Eleven companies took part in the evaluations and several have boasted 100% detection and coverage rates. The post MITRE Posts Results of 2025 ATT&CK Enterprise Evaluations appeared first on SecurityWeek .
GOLD SALEM is a financially motivated cybercrime group deploying Warlock ransomware through sophisticated tradecraft, including exploiting SharePoint vulnerabilities for initial access. Over six months and 11 incidents, they targeted IT, industrial, and technology sectors using ransomware variants such as Warlock, LockBit, and Babuk. Their operations involve advanced techniques like zero-day exploitation and repurposing legitimate tools (Velociraptor, VMTools AV killer, Cloudflared) to evade detection and maintain persistence. Executables are often named after victim organizations, indicating targeted attacks. While evidence suggests possible Chinese origins, the group primarily pursues financial gain. The threat poses a medium severity risk but demonstrates capabilities that could escalate impact if defenses are weak. European organizations in critical infrastructure and technology sectors should be vigilant against these tactics.
A malicious campaign has compromised 19 Visual Studio Code extensions by embedding malware within dependency folders, specifically by modifying the legitimate npm package 'path-is-absolute'. Active since February 2025, the attackers disguise malicious binaries as PNG images within archives to evade detection. When VS Code starts, a JavaScript dropper decodes and executes two malicious binaries using living-off-the-land binaries, enabling stealthy execution. This attack leverages trusted components from the VS Code Marketplace, complicating detection and mitigation. Although no known exploits in the wild have been reported, the campaign demonstrates advanced evasion techniques and targets a widely used development environment. The malware involves a Rust-based trojan and employs multiple tactics such as code obfuscation, masquerading files, and abuse of legitimate binaries. European organizations using VS Code with affected extensions are at risk of compromise, data theft, or further lateral movement. Mitigation requires careful vetting of extensions, monitoring for suspicious activity, and restricting execution of untrusted binaries. Countries with strong software development sectors and high VS Code adoption are most likely to be impacted. Given the stealth, potential for privilege escalation, and broad impact, the threat severity is assessed as high.
Several months ago, I got a Nucbox K8 Plus minicomputer to use as a Proxmox 9 server. At the time of this acquisition, I didn&#;x26;#;39;t realize this minicomputer had an artificial intelligence (AI) engine [1] build in the CPU that could be used to run AI applications locally. A coworker recommended that I try Google Gemma 3 as a local AI open model to work with my use cases.
A new campaign involving the ClickFix malware is spreading a macOS infostealer by abusing the ChatGPT chat-sharing feature to post malicious user guides on the official ChatGPT website. This technique leverages social engineering by embedding harmful content within seemingly legitimate shared chats, potentially tricking users into downloading and executing the infostealer. Although no known exploits in the wild have been reported yet, the threat is considered high severity due to the sensitive data targeted and the innovative attack vector. European organizations using macOS devices are at risk, especially those with employees who frequently use ChatGPT and may be exposed to these malicious shared chats. The attack impacts confidentiality by stealing sensitive information and could lead to broader compromise if credentials or tokens are exfiltrated. Mitigation requires monitoring and restricting the use of chat-sharing features, educating users about the risks of downloading files from untrusted shared chats, and deploying endpoint detection solutions tailored for macOS. Countries with high macOS adoption and significant tech sector presence, such as Germany, the UK, France, and the Nordics, are more likely to be affected. Given the ease of exploitation via social engineering and the potential for significant data theft, the suggested severity is high.
Three newly discovered encryption weaknesses affect PCIe 5.0 and later systems, potentially causing faulty data handling during data transmission over PCIe links. These vulnerabilities could lead to data corruption, leakage, or unauthorized data manipulation within high-speed interconnects critical for modern computing platforms. Although no known exploits are currently in the wild, the high-speed and widespread adoption of PCIe 5.0+ in servers, workstations, and data centers make this a significant concern. European organizations relying on advanced computing infrastructure may face risks to data integrity and confidentiality. Mitigation requires close collaboration with hardware vendors for firmware and hardware updates, as well as monitoring for vendor advisories. Countries with strong technology sectors and data center presence, such as Germany, France, and the Netherlands, are most likely to be affected. Given the potential impact on confidentiality, integrity, and availability, combined with the complexity of exploitation and lack of authentication requirements, this threat is assessed as high severity. Defenders should prioritize patching and validating PCIe implementations and consider additional encryption or integrity verification layers where possible.
Highlights: Introduction Throughout 2025, we conducted and published several reports related to our research on the Silver Fox APT. In some of them (for example, here), the threat actor delivered the well-known ValleyRAT backdoor, also referred to as Winos or Winos4.0, as the final stage. Since this malware family is widely used, modular, and often associated with Chinese threat actors […] The post Cracking ValleyRAT: From Builder Secrets to Kernel Rootkits appeared first on Check Point Research .
A sophisticated malware campaign exploits user trust in AI platforms to deliver the AMOS stealer. Attackers use SEO poisoning to surface malicious ChatGPT and Grok conversations offering 'helpful' macOS disk cleanup advice. These conversations contain Terminal commands that, when executed, deploy AMOS, a multi-stage malware that harvests credentials, escalates privileges, and establishes persistence. The attack bypasses traditional security measures by leveraging legitimate platforms and user behavior, making it particularly insidious. AMOS targets cryptocurrency wallets, browser data, and system information, exfiltrating sensitive data to attacker-controlled servers. This campaign represents a significant evolution in social engineering techniques, exploiting the growing reliance on AI assistants for technical guidance.
Storm-0249, a seasoned initial access broker, has evolved from mass phishing to sophisticated post-exploitation tactics. The group now abuses legitimate Endpoint Detection and Response processes, particularly SentinelOne's SentinelAgentWorker.exe, through DLL sideloading. This allows them to conceal malicious activity as routine operations, bypass defenses, and maintain persistence. Their new tactics include Microsoft domain spoofing, curl-to-PowerShell piping, and fileless execution. Storm-0249's ability to weaponize trusted processes and conduct stealthy reconnaissance poses significant challenges for security teams. The group's evolution represents a broader trend in the ransomware-as-a-service ecosystem, lowering the technical barrier for attackers and accelerating the spread of ransomware across sectors.
Britain and its allies face escalating “hybrid threats … designed to weaken critical national infrastructure, undermine our interests and interfere in our democracies.” The post UK Sanctions Russian and Chinese Firms Suspected of Being ‘Malign Actors’ in Information Warfare appeared first on SecurityWeek .
The GeminiJack 0-Click flaw in Gemini AI is a recently disclosed vulnerability that allows data leaks without any user interaction. This zero-click nature means attackers can exploit the flaw remotely and silently, potentially accessing sensitive user data. Although no known exploits are currently observed in the wild, the medium severity rating suggests moderate risk. The vulnerability affects Gemini AI, a product whose market penetration and deployment details remain unclear. European organizations using Gemini AI or related services could face confidentiality breaches if targeted. Mitigation is complicated by the absence of patches or detailed technical disclosures, requiring heightened monitoring and cautious data handling. Countries with advanced AI adoption and critical infrastructure relying on Gemini AI are more likely to be impacted. Given the zero-click exploit vector and data exposure potential, the threat is assessed as medium severity. Defenders should prioritize detection capabilities and restrict unnecessary data exposure until official patches are available.
