Threats affecting Finland

North Korean (NK) hackers have distributed approximately 200 malicious npm packages containing the OtterCookie malware. These packages were uploaded to the npm repository, a popular package manager for JavaScript, potentially targeting developers and organizations relying on npm dependencies. OtterCookie malware is designed to stealthily compromise systems, potentially enabling data exfiltration or further malicious activity. Although no known exploits in the wild have been reported yet, the scale and nature of the campaign pose a significant risk. European organizations using npm packages in their software supply chain could be exposed to this threat, especially if they do not have strict dependency vetting processes. Mitigation requires enhanced supply chain security measures, including automated scanning of dependencies, restricting use of unverified packages, and continuous monitoring for anomalous behavior. Countries with strong software development sectors and high npm usage, such as Germany, the UK, France, and the Netherlands, are particularly at risk. Given the malware’s potential for confidentiality breaches and the ease of exploitation via package installation, the threat severity is assessed as high. Defenders should prioritize verifying package integrity and implementing zero-trust principles in software supply chains to mitigate this threat.

Malware#infosecnews#redditGermany+6

The Glassworm malware has resurfaced in a third wave, distributed via malicious Visual Studio Code (VS Code) packages. This malware campaign targets developers by leveraging the popularity of VS Code extensions to infiltrate systems. Once installed, Glassworm can execute malicious payloads, potentially compromising confidentiality, integrity, and availability of affected systems. Although no known exploits in the wild have been reported yet, the high severity rating reflects the risk posed by supply chain attacks through trusted development tools. European organizations relying on VS Code for software development are at risk, especially those in technology, finance, and critical infrastructure sectors. Mitigation requires strict controls on extension sourcing, enhanced monitoring for anomalous behaviors, and developer awareness training. Countries with strong software development industries and high VS Code adoption, such as Germany, the UK, France, and the Netherlands, are most likely to be affected. Given the ease of exploitation via user installation and the broad impact potential, the suggested severity is high.

Malware#infosecnews#redditGermany+5

Arkanix Stealer is a newly discovered information-stealing malware designed for short-term financial gain. Initially developed in Python, it has evolved into a more sophisticated C++ version employing VMProtect obfuscation and a technique called 'Chrome Elevator' to bypass App Bound Encryption. It targets browsers, crypto wallets, VPN accounts, Steam accounts, and system information. Distributed primarily via Discord and online forums disguised as legitimate tools, it offers threat actors a web panel with premium features for managing stolen data. The malware demonstrates advanced capabilities and rapid evolution, highlighting the ease of launching cybercrime operations for quick profits. While no known exploits in the wild have been reported yet, its medium severity reflects the potential impact on confidentiality and financial assets. European organizations using targeted browsers, crypto wallets, or VPN services are at risk, especially those with users active on Discord or similar platforms. Mitigation requires targeted detection of obfuscated binaries, network monitoring for suspicious domains like arkanix.pw, and user education on social engineering risks. Countries with high crypto adoption and active gaming communities are more likely to be affected.

Campaign#discord#pythonGermany+6

Shai Hulud 2.0 appears to be a security-related tool or analysis resource discussed on Reddit's NetSec community, associated with remote code execution (RCE) topics. There is no direct evidence of an active exploit or vulnerability disclosed. The information is primarily an external link to a community-driven analysis without concrete technical details or affected software versions. No known exploits in the wild have been reported, and the discussion level is minimal. The threat severity is assessed as medium based on limited information. European organizations should remain vigilant but no immediate critical threat is indicated. Mitigation should focus on monitoring for any emerging detailed disclosures or exploits related to Shai Hulud 2.0. Countries with strong cybersecurity research communities and high adoption of open-source security tools may be more aware or impacted indirectly.

Tool#netsec#redditGermany+5

How Kaspersky Embedded Systems Security protects embedded devices from relevant threats.

AnalysisGermanyFrance+9

For the latest discoveries in cyber research for the week of 1st December, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES OpenAI has experienced a data breach resulting from a compromise at third-party analytics provider Mixpanel, which exposed limited information of some ChatGPT API clients. The leaked data includes names, email addresses, approximate […] The post 1st December – Threat Intelligence Report appeared first on Check Point Research .

AnalysisFranceGermany+9

The HashJack attack leverages the URL fragment identifier ('#') to manipulate AI-powered browser behavior, potentially allowing attackers to influence how AI browsers process and render web content. This technique exploits the way AI browsers interpret URL fragments, which are typically client-side and not sent to servers, to inject commands or control instructions. While no known exploits are currently active in the wild, the attack vector poses a medium severity risk due to its potential to affect confidentiality and integrity without requiring authentication or significant user interaction. European organizations using AI-integrated browsers or web applications that rely on AI for content rendering or decision-making could be impacted, especially those in sectors with high AI adoption. Mitigation involves updating AI browser software to properly sanitize and validate URL fragments, implementing strict input handling, and monitoring for unusual AI browser behaviors. Countries with advanced digital infrastructure and high AI technology adoption, such as Germany, France, the UK, and the Netherlands, are more likely to be affected. Given the medium severity, organizations should proactively assess their exposure and apply targeted mitigations to prevent exploitation.

Campaign#infosecnews#redditGermany+5

North Korean threat actors have deployed 197 malicious npm packages to distribute an updated version of the OtterCookie malware. This malware campaign leverages the npm ecosystem to infect developers and organizations that use these packages, potentially compromising software supply chains. The updated OtterCookie malware is designed to exfiltrate sensitive data and maintain persistence on infected systems. Although no known exploits in the wild have been reported yet, the scale and sophistication of this campaign pose a significant risk. European organizations relying on npm packages for development are at risk of supply chain attacks, which can lead to data breaches and operational disruptions. Mitigation requires rigorous package vetting, use of software composition analysis tools, and restricting npm package usage to trusted sources. Countries with strong software development sectors and high npm usage, such as Germany, the UK, France, and the Netherlands, are likely to be most affected. Given the malware’s potential impact on confidentiality and integrity, ease of distribution via npm, and no authentication required for exploitation, the threat severity is assessed as high. Defenders should prioritize monitoring for suspicious npm package activity and implement strict supply chain security controls.

Malware#infosecnews#redditGermany+6

Multiple Python packages on PyPI contain legacy bootstrap scripts that create a domain takeover risk. These scripts reference domains that are no longer controlled by the original owners, allowing attackers to register these domains and potentially hijack package functionality or distribution. This vulnerability can lead to supply chain attacks, compromising the integrity and trustworthiness of affected Python packages. No known exploits are currently observed in the wild, but the risk is considered high due to the potential impact on software supply chains. European organizations relying on affected PyPI packages could face significant security risks, including unauthorized code execution and data compromise. Mitigation requires auditing dependencies for legacy bootstrap scripts, removing or updating vulnerable code, and monitoring domain ownership related to package infrastructure. Countries with strong Python developer communities and critical infrastructure relying on Python are most at risk. The threat severity is assessed as high given the ease of exploitation and potential widespread impact on confidentiality, integrity, and availability.

News#infosecnews#redditGermany+7

Public GitLab repositories have exposed over 17,000 secrets, including sensitive credentials and tokens, posing a significant security risk. This exposure can lead to unauthorized access, data breaches, and lateral movement within affected organizations. The incident highlights the risks of improper secret management and public code repository configurations. European organizations using GitLab or similar platforms are at risk, especially those with public repositories containing sensitive information. Attackers can exploit these exposed secrets to compromise systems without needing sophisticated exploits. Mitigation requires immediate secret rotation, auditing repository contents, and implementing strict access controls and secret scanning tools. Countries with high GitLab adoption and critical infrastructure sectors are more likely to be targeted. The severity is assessed as high due to the potential for widespread compromise and ease of exploitation without authentication. Defenders must prioritize secret hygiene and continuous monitoring to prevent similar exposures.

Breach#infosecnews#redditGermany+7

The Shai-hulud 2.0 campaign is an advanced malware operation targeting cloud platforms (AWS, GCP, Azure) and developer ecosystems by stealing credentials and secrets. It automates backdooring of NPM packages maintained by victims, enabling rapid supply chain propagation. The malware abuses GitHub Actions workflows for command-and-control and secret exfiltration, leveraging cloud secret management services and destructive failsafes to maintain stealth and persistence. This campaign threatens the confidentiality and integrity of cloud and developer environments, potentially impacting thousands of downstream users. It requires no known exploits in the wild but uses sophisticated tactics to evade detection. European organizations relying heavily on cloud services and open-source development are at risk, especially those with significant use of NPM packages and GitHub repositories. The threat severity is assessed as high due to the broad impact on supply chains and credential theft without requiring user interaction. Immediate mitigation includes securing cloud credentials, auditing GitHub workflows, and monitoring supply chain dependencies for unauthorized changes.

Malware#azure#githubGermany+7

Sha1-Hulud is a sophisticated new variant of an NPM supply chain attack that executes during the preinstall phase of popular packages like Postman, Zapier, and AsyncAPI. It harvests cloud credentials across AWS, Azure, and GCP, and establishes persistence by creating a self-hosted GitHub Actions runner named 'SHA1HULUD' with an injection-vulnerable workflow. This enables attackers to move laterally across cloud environments beyond the initial development environment. Immediate mitigation includes removing compromised packages, revoking and regenerating all tokens and credentials, and enforcing hardware-based MFA for developer accounts. The attack leverages multiple MITRE ATT&CK techniques related to execution, persistence, credential access, and lateral movement. No known exploits in the wild have been reported yet, but the threat poses a medium severity risk due to its potential impact on cloud infrastructure security and software supply chains.

Malware#github actions#sha1-huludGermany+6

Multiple Mixpanel customers were impacted by a recent cyberattack targeting the product analytics company. The post OpenAI User Data Exposed in Mixpanel Hack appeared first on SecurityWeek .

NewsGermanyFrance+5

Shai-Hulud 2.0 is a highly aggressive and automated supply-chain malware targeting the npm ecosystem, identified in November 2025. It rapidly compromises hundreds of npm packages within hours, behaving like a worm that harvests credentials and cloud secrets. The malware leverages GitHub Actions as a persistent backdoor and creates public repositories to exfiltrate stolen data. This attack represents a significant escalation in supply-chain attack sophistication, affecting major projects and organizations globally. It results in tens of thousands of attacker-created GitHub repositories, facilitating widespread propagation. The malware automates spreading to new npm accounts, increasing infection speed and scale. It does not require user interaction once initial compromise occurs and exploits trusted software supply chains. No CVE or patch is currently available, and no known exploits in the wild have been reported yet. The attack’s medium severity rating may underestimate its potential impact given its worm-like behavior and credential theft capabilities.

Malware#supply-chain attack#npmGermany+8

The Shai-Hulud v2 campaign is a high-severity supply chain attack spreading from the npm ecosystem to Maven repositories, targeting software development dependencies. It involves malicious packages designed to exfiltrate thousands of secrets, such as API keys and credentials, embedded in developer environments. This campaign exploits the trust in widely used package managers, increasing the risk of widespread compromise. European organizations relying on npm and Maven for software development are at risk of data leakage and potential downstream attacks. The campaign's expansion to Maven indicates a broader targeting of Java-based projects, which are prevalent in Europe. Mitigation requires proactive dependency auditing, secret scanning, and restricting automated credential access. Countries with strong software development sectors and high adoption of Java and JavaScript ecosystems, such as Germany, France, and the UK, are most likely affected. Given the ease of exploitation through popular package managers and the significant impact on confidentiality, the threat severity is assessed as high. Defenders should prioritize monitoring for suspicious package activity and implement strict supply chain security controls.

Campaign#infosecnews#redditGermany+6

Fake Battlefield 6 game downloads are being distributed to spread malware and steal player data. These malicious downloads impersonate the highly anticipated game to lure victims into installing harmful software. The malware aims to compromise user confidentiality by harvesting sensitive information from infected systems. While no known exploits or vulnerabilities in Battlefield 6 itself are involved, the threat leverages social engineering and fake distribution channels. European gamers and organizations with gaming communities may be targeted, especially where Battlefield 6 has significant popularity. The threat requires user interaction to download and execute the fake installer, limiting automated spread but increasing risk through deception. Mitigation involves educating users on verifying legitimate sources, employing endpoint protection with malware detection, and monitoring network traffic for suspicious activity. Countries with large gaming populations and strong Battlefield fanbases, such as the UK, Germany, France, and the Nordics, are more likely to be affected. Given the medium severity rating and the nature of the attack, defenders should prioritize awareness and technical controls to prevent infection and data theft.

Malware#infosecnews#redditGermany+9

This analysis details a sophisticated DPRK-linked operation called Contagious Interview, which uses a fake job platform to target U.S. AI talent. The campaign mimics legitimate recruitment processes, offering job listings from well-known tech companies to lure victims. The platform, hosted at lenvny[.]com, is designed to appear as a legitimate AI-powered interview tool. It employs various techniques to establish credibility, including professional design, fake testimonials, and comparisons with real companies. The attack culminates in a malware delivery through a clipboard hijacking technique, triggered when victims attempt to record a video introduction. This operation specifically targets high-value professionals in AI and cryptocurrency sectors, aiming to gain access to strategic information and financial assets.

Malware#social engineering#ai talentUnited Kingdom+5

FlexibleFerret is a sophisticated macOS malware campaign leveraging fake job assessment scams and social engineering to infect victims. It uses multi-stage attacks starting with JavaScript files on fraudulent recruitment websites that trick users into executing shell commands. These commands download and run a Golang backdoor that establishes persistence, enabling data theft and remote control. The malware can collect system info, steal Chrome credentials, upload/download files, and execute arbitrary commands. Attackers exfiltrate stolen data via Dropbox, complicating detection. The campaign is attributed to DPRK-aligned threat actors and targets macOS users globally. No CVSS score exists, but the threat is medium severity due to social engineering reliance and macOS focus. European organizations with macOS endpoints, especially in tech and government sectors, face risks. Mitigations include user education on phishing, restricting script execution, monitoring unusual Dropbox traffic, and deploying endpoint detection tuned for macOS threats.

Malware#flexibleferret#golang backdoorGermany+7

CISA has described the techniques used by attackers and pointed out that the focus is on high-value individuals. The post CISA Warns of Spyware Targeting Messaging App Users appeared first on SecurityWeek .

MalwareGermanyFrance+8

A recently reported security issue involves code beautifiers—tools used to format source code—accidentally exposing sensitive credentials from banks, government agencies, and technology organizations. These tools, when processing code, can inadvertently reveal secrets such as API keys, passwords, and tokens embedded in the code or configuration files. Although no known exploits are currently active in the wild, the exposure risk is high due to the sensitive nature of the leaked information. The threat primarily arises from the improper handling or display of code snippets by beautifiers, which may not sanitize or mask confidential data. European organizations using such tools in their development or code review processes could face significant confidentiality breaches. Mitigation requires careful auditing of code before formatting, implementing automated secret detection, and restricting access to formatted code outputs. Countries with large financial sectors, government digital services, and advanced tech industries are more likely to be impacted. Given the ease of exploitation and the criticality of exposed data, the threat severity is assessed as high. Defenders should prioritize securing development pipelines and educating developers about secret management best practices.

News#infosecnews#redditGermany+9