Under the new rules, measures for 5G cybersecurity would become mandatory. The post EU Plans Phase Out of High Risk Telecom Suppliers, in Proposals Seen as Targeting China appeared first on SecurityWeek .
A sophisticated multi-stage malware campaign targeting Windows users in Russia has been identified. The attack chain begins with social engineering lures and progresses to a full system compromise, including security bypass, surveillance, and ransomware delivery. It abuses Defendnot to disable Microsoft Defender and uses modular hosting across cloud services. The attack employs various techniques such as PowerShell scripts, obfuscated VBScript, and COM object manipulation. It deploys Amnesia RAT for data theft and surveillance, Hakuna Matata ransomware for file encryption, and a WinLocker component for system lockout. The campaign demonstrates how full system compromise can be achieved without exploiting software vulnerabilities, instead relying on social engineering and abuse of legitimate Windows features.
CVE-2025-33233 is a high-severity code injection vulnerability in NVIDIA Merlin Transformers4Rec affecting all versions prior to commit 27ddd49. It allows an attacker with local privileges and low complexity to execute arbitrary code without user interaction, potentially leading to privilege escalation, information disclosure, and data tampering. The vulnerability arises from improper control over code generation (CWE-94). Although no known exploits are currently in the wild, the impact on confidentiality, integrity, and availability is high. European organizations using Merlin Transformers4Rec in AI/ML recommendation systems should prioritize patching or mitigating this flaw. Countries with significant AI technology adoption and NVIDIA product usage, such as Germany, France, and the UK, are most at risk. Mitigation involves applying the fixed commit, restricting local access, and auditing code inputs. Given the CVSS 7.8 score, the threat is classified as high severity.
CVE-2025-54778 is a reflected cross-site scripting (XSS) vulnerability found in MedDream PACS Premium version 7.3.6.870, specifically in the existingUser functionality. This flaw allows an attacker to craft a malicious URL that, when visited by a user, executes arbitrary JavaScript code in the victim's browser. The vulnerability requires user interaction (clicking the malicious link) but does not require authentication, and it can lead to partial compromise of confidentiality and integrity of user sessions. Although no known exploits are currently reported in the wild, the medium severity CVSS score of 6.1 reflects the potential risk. European healthcare organizations using this PACS software should prioritize patching or applying mitigations to prevent exploitation. Countries with significant healthcare infrastructure and MedDream PACS deployments, such as Germany, France, and the UK, are likely to be most affected.
Providing cyberespionage and remote code execution capabilities, the malware is executed via DLL sideloading. The post APT-Grade PDFSider Malware Used by Ransomware Groups appeared first on SecurityWeek .
A simple payload allowed attackers to create a new event leaking summaries of the victim’s private meetings. The post Weaponized Invite Enabled Calendar Data Theft via Google Gemini appeared first on SecurityWeek .
IDNs or “International Domain Names” have been with us for a while now (see RFC3490[1]). They are (ab)used in many attack scenarios because.. it works! Who can immediately spot the difference between:
VoidLink is an advanced AI-generated malware framework exhibiting high maturity, modularity, and sophisticated techniques such as eBPF and LKM rootkits. It targets cloud and container environments with dedicated modules for enumeration and post-exploitation, indicating a focus on modern infrastructure. Although no known exploits in the wild have been reported yet, its architecture suggests a significant threat potential. European organizations relying on cloud-native and containerized deployments are at heightened risk due to the malware's capabilities. Mitigation requires advanced detection mechanisms tailored to eBPF and kernel-level rootkits, alongside strict cloud environment monitoring and segmentation. Countries with strong cloud adoption and critical infrastructure sectors, such as Germany, the UK, France, and the Netherlands, are likely to be most affected. Given its high impact on confidentiality, integrity, and availability, combined with ease of exploitation via AI-generated code, the suggested severity is high. Defenders should prioritize proactive threat hunting and behavioral analytics to detect this evolving threat.
A sophisticated spear-phishing campaign targeting Argentina's judicial sector has been uncovered. The operation uses a multi-stage infection chain to deploy a stealthy Remote Access Trojan (RAT). Attackers exploit trust in court communications by using authentic-looking judicial decoy documents. The campaign employs a weaponized LNK file, a BAT-based loader script, and a covert Rust-based RAT to establish persistent access within judicial environments. The malware performs extensive anti-VM and anti-debug checks, collects system information, and establishes resilient C2 connections. It supports various malicious activities including persistence, file transfer, data harvesting, encryption, and privilege escalation. The campaign demonstrates high operational sophistication and aims to gain long-term access to sensitive legal and institutional data.
The Evelyn Stealer campaign targets software developers through weaponized Visual Studio Code extensions, employing a multistage delivery of information-stealing malware. The attack chain involves a downloader disguised as a legitimate Lightshot DLL, an injector that uses process hollowing to inject the final payload, and the Evelyn Stealer itself. The malware implements sophisticated anti-analysis techniques, collects sensitive information including browser credentials and cryptocurrency data, and exfiltrates the stolen data via FTP. This campaign highlights the increasing threat to developer communities and the need for enhanced security measures in development environments.
CVE-2025-66803 is a medium-severity race condition vulnerability in the turbo-frame element handler of Hotwired Turbo before version 8.0.x. This flaw causes logout operations to fail because delayed frame responses can reapply session cookies after a user logs out, potentially allowing session persistence. Remote attackers can exploit this by inducing selective network delays, while physically proximate attackers may exploit naturally occurring race conditions on shared computers. The vulnerability impacts confidentiality and integrity by enabling unauthorized session continuation but does not affect availability. No known exploits are currently reported in the wild. European organizations using Hotwired Turbo in web applications should prioritize patching and implement network controls to mitigate exploitation risks. Countries with significant web development sectors and high adoption of Hotwired Turbo, such as Germany, the UK, and France, are more likely to be affected.
CVE-2025-56353 is a high-severity vulnerability in tinyMQTT broker software caused by improper handling of malformed UTF-8 strings in topic filters. An attacker can exploit this by sending repeated subscription requests with invalid or oversized topic filters, causing the broker to allocate memory without freeing it, resulting in a memory leak. This unbounded heap growth can lead to denial of service (DoS) conditions under sustained attack. The vulnerability requires no authentication or user interaction and can be exploited remotely over the network. There are no known exploits in the wild yet, and no patches have been published at this time. The CVSS score of 7.5 reflects the high impact on availability with no impact on confidentiality or integrity. European organizations using tinyMQTT brokers in IoT or messaging infrastructures are at risk, especially those with exposed MQTT brokers. Mitigations include implementing input validation and rate limiting at the network perimeter, monitoring broker memory usage, and isolating MQTT services. Countries with significant IoT deployments and industrial automation sectors, such as Germany, France, and the UK, are most likely to be affected.
CVE-2026-23846 is a high-severity vulnerability in Quenary's tugtainer versions prior to 1.16.1, where password authentication uses HTTP GET requests with sensitive query strings. This insecure design causes passwords to be exposed in server logs, browser history, Referer headers, and proxy logs, risking credential leakage. The vulnerability does not require authentication but does require user interaction, and it affects the confidentiality and integrity of credentials without impacting availability. The issue is patched in version 1.16.1. European organizations using tugtainer for Docker container automation should urgently update to mitigate exposure risks. Countries with significant container adoption and cloud infrastructure usage, such as Germany, France, and the Netherlands, are most likely to be affected.
Operating as an access broker, the defendant sold unauthorized access to compromised networks to an undercover agent. The post Jordanian Admits in US Court to Selling Access to 50 Enterprise Networks appeared first on SecurityWeek .
The information stealer abuses legitimate APIs and libraries to exfiltrate data to Discord webhooks. The post ‘SolyxImmortal’ Information Stealer Emerges appeared first on SecurityWeek .
US officials told The New York Times that cyberattacks were used to turn off the lights in Caracas and disrupt air defense radars. The post New Reports Reinforce Cyberattack’s Role in Maduro Capture Blackout appeared first on SecurityWeek .
Posing as an ad blocker, the malicious extension crashes the browser to lure victims into installing malware. The post Malicious Chrome Extension Crashes Browser in ClickFix Variant ‘CrashFix’ appeared first on SecurityWeek .
