A new cluster is spreading malware through phishing attacks targeting Russia. The attack methodology involves fake pages that imitate file downloads from Telegram. The article likely details the structure of these attacks, providing insights into how the malicious actors are exploiting user trust in the popular messaging platform to deliver their payload. This emerging threat, dubbed Vortex Werewolf, appears to be a sophisticated campaign specifically targeting Russian users or entities.
CVE-2025-14975 is a high-severity vulnerability in the Custom Login Page Customizer WordPress plugin versions before 2.5.4. It allows unauthenticated attackers to reset the password of any user, including administrators, by sending a few crafted requests with knowledge of the username. This improper privilege management flaw (CWE-269) enables full account takeover without requiring user interaction or prior authentication. The vulnerability impacts confidentiality, integrity, and availability of affected WordPress sites. Although no known exploits are currently in the wild, the ease of exploitation and critical impact make timely patching essential. European organizations using this plugin on WordPress sites are at risk, especially those with high-value targets or public-facing portals. Mitigation involves immediate plugin updates and enhanced monitoring of password reset activities. Countries with large WordPress user bases and significant e-commerce or governmental web presence, such as Germany, France, and the UK, are most likely to be affected.
CVE-2025-55704 is a medium-severity vulnerability affecting multiple Brother Industries MFPs, involving hidden functionality that allows attackers to access device logs containing sensitive information. The flaw can be exploited remotely without authentication or user interaction, potentially exposing confidential data stored in logs. Although no known exploits are currently in the wild, the vulnerability's network accessibility and low attack complexity pose a risk to organizations using affected devices. European organizations relying on Brother MFPs for document management and printing could face information disclosure risks, impacting privacy and compliance. Mitigation requires vendor patches once available and restricting network access to MFP management interfaces. Countries with high adoption of Brother MFPs in critical sectors, such as Germany, France, and the UK, are most likely to be affected. Due to the limited impact on integrity and availability, and no authentication required, the severity is medium. Defenders should prioritize monitoring network access to MFPs and prepare for patch deployment to reduce exposure.
CVE-2025-53869 is a vulnerability in multiple Brother Industries MFP devices where improper server certificate validation allows a man-in-the-middle attacker to replace the device's root certificate store with arbitrary certificates. This flaw does not impact confidentiality or availability directly but can lead to integrity issues by enabling attackers to intercept or manipulate communications. The vulnerability has a CVSS score of 3.7 (low severity) due to the high attack complexity and lack of authentication or user interaction requirements. No known exploits are currently reported in the wild. European organizations using affected Brother MFPs should be aware of this risk, especially those in sectors with sensitive document handling. Mitigation involves applying vendor patches once available and restricting network access to MFP management interfaces. Countries with high Brother MFP market penetration and strong reliance on secure document workflows, such as Germany, France, and the UK, are most likely to be impacted.
The KRVTZ-NET IDS alert from January 29, 2026, reports suspicious network reconnaissance activity involving an IP address (104.237.57.26) exhibiting anomalous User-Agent strings designed to evade detection. This activity is classified as reconnaissance in the cyber kill chain, indicating early-stage information gathering rather than active exploitation. No specific vulnerabilities or affected software versions are identified, and no known exploits or ransomware campaigns are linked to this event. The alert is of low severity and primarily serves as an early warning for potential future attacks. European organizations should treat this as an indicator of possible scanning attempts that could precede more serious intrusions. Mitigation involves enhancing network monitoring, updating IDS/IPS signatures, threat hunting, and employing deception technologies. Countries most likely affected include France, Germany, the United Kingdom, the Netherlands, and Belgium due to their strategic importance and market penetration.
CVE-2026-24857 is a medium-severity heap-based buffer overflow vulnerability in the simsong bulk_extractor tool, specifically in its embedded unrar code used for RAR PPM LZ decoding. The flaw exists in versions 1.4 through 2.1.1 and can be triggered by a crafted RAR archive inside a disk image, causing out-of-bounds writes leading to crashes or memory corruption. There is potential for remote code execution (RCE) exploitation, although no known exploits or patches are currently available. The vulnerability requires no authentication or user interaction and can be exploited remotely by processing malicious disk images. European organizations using bulk_extractor for digital forensics or incident response may face risks of system crashes or compromise. Mitigation currently relies on avoiding untrusted RAR files and monitoring for updates from the vendor. Countries with significant digital forensics operations and cybersecurity industries, such as Germany, the UK, France, and the Netherlands, are more likely to be affected due to their adoption of such tools.
CVE-2025-13983 is a medium severity Cross-Site Scripting (XSS) vulnerability in the Drupal Tagify module versions before 1.2.44. It arises from improper neutralization of input during web page generation, allowing attackers with low privileges and requiring user interaction to inject malicious scripts. The vulnerability impacts confidentiality and integrity by enabling script execution in the context of authenticated users, potentially leading to session hijacking or data manipulation. No known exploits are currently reported in the wild. European organizations using Drupal with the vulnerable Tagify versions should prioritize patching to mitigate risks. The vulnerability has a CVSS score of 5.4, reflecting its moderate impact and exploitability. Countries with significant Drupal adoption and critical web infrastructure, such as Germany, France, and the UK, are most likely to be affected.
CVE-2025-61728 is a medium severity vulnerability in the Go standard library's archive/zip package, caused by an inefficient super-linear file name indexing algorithm. When a file in a ZIP archive is opened for the first time, this algorithm is triggered, which can be exploited by a maliciously crafted ZIP archive to cause a denial of service (DoS) by consuming excessive CPU resources. The vulnerability affects all versions up to and including Go 1.25.0. Exploitation requires no privileges but does require user interaction to open a ZIP file. There are no known exploits in the wild yet, and no patches have been published at the time of this report. European organizations using Go for processing ZIP archives in network-facing or user-facing applications are at risk of service disruption. Mitigation involves avoiding untrusted ZIP files, implementing resource limits on ZIP processing, and monitoring for abnormal CPU usage. Countries with significant software development industries and critical infrastructure relying on Go, such as Germany, France, and the UK, are more likely to be impacted.
TA584, a prominent initial access broker targeting organizations globally, demonstrated significant changes in attack strategies throughout 2025. The actor expanded its global targeting, adopted ClickFix social engineering techniques, and began delivering new malware called Tsundere Bot. TA584's operational tempo increased, with monthly campaigns tripling from March to December. The actor uses various delivery methods via email, often sending from compromised individual accounts. TA584's campaigns now feature rapid succession and overlapping, with distinct lure themes and short operational lifespans. The actor has shown adaptability in social engineering, brand impersonation, and payload delivery, making static detection less effective. Recent payloads include XWorm with the 'P0WER' configuration and the newly observed Tsundere Bot, both likely part of Malware-as-a-Service offerings.
A Vietnamese threat actor is employing AI to develop code for an ongoing phishing campaign delivering PureRAT malware and other payloads. The attacks begin with phishing emails disguised as job opportunities, potentially targeting work computers. The attacker's use of AI is evidenced by detailed comments and numbered steps in scripts, as well as instructions in debug messages. The attack chain involves malicious archives, sideloaded DLLs, and batch scripts likely authored using AI. The attacker appears to be continually refining their methods and may be selling access to compromised organizations. This case demonstrates how AI can lower the barrier to entry for less skilled attackers, helping them write code and build attack toolkits.
A new campaign targeting Indian government entities was uncovered, utilizing three backdoors: SHEETCREEP, FIREPOWER, and MAILCREEP. These tools leverage legitimate cloud services like Google Sheets, Firebase, and Microsoft Graph API for command and control, enabling the attackers to blend in with normal traffic. The campaign, named Sheet Attack, employed PDFs and malicious LNK files as initial infection vectors. Evidence suggests the use of generative AI in malware development. While sharing similarities with APT36, the campaign's unique characteristics point to either a new Pakistan-linked group or an APT36 subgroup. The attackers demonstrated hands-on-keyboard activity and deployed additional payloads, including a document stealer, to selected targets.
The fastest way to squander the promise of AI is to mistake automation for assurance, and novelty for resilience. The post Why We Can’t Let AI Take the Wheel of Cyber Defense appeared first on SecurityWeek .
New Strict Account Settings allow users to block attachments and media and silence calls from unknown people. The post WhatsApp Boosts Account Security for At-Risk Individuals appeared first on SecurityWeek .
A total of 87 individuals, mostly Venezuelan nationals, have been charged for their role in the ATM jackpotting scheme. The post US Charges 31 More Defendants in Massive ATM Hacking Probe appeared first on SecurityWeek .
CVE-2025-71006 is a medium-severity vulnerability in the oneflow.reshape component of OneFlow v0.9.0 that allows attackers to cause a Denial of Service (DoS) via a crafted input triggering a floating point exception. The flaw does not impact confidentiality or integrity but can disrupt availability by crashing the affected system. Exploitation requires no privileges but does require user interaction to supply the malicious input. No known exploits are currently reported in the wild. European organizations using OneFlow for machine learning or data processing could face service interruptions if targeted. Mitigation involves input validation and patching when available. Countries with significant AI and machine learning adoption, such as Germany, France, and the UK, are more likely to be affected.
CVE-2025-71005 is a medium-severity vulnerability in OneFlow v0.9.0, specifically in the oneflow.view component, where a floating point exception can be triggered by crafted input. This flaw allows unauthenticated attackers to cause a denial of service (DoS) condition, impacting availability without affecting confidentiality or integrity. Exploitation requires user interaction but no privileges, and no known exploits are currently in the wild. The vulnerability stems from improper handling of floating point operations leading to exceptions that crash or hang the application. European organizations using OneFlow for machine learning or data processing may face service disruptions if targeted. Mitigation involves input validation and patching once updates become available, as no official patch links are currently provided. Countries with significant AI and tech sectors, such as Germany, France, and the UK, are most likely to be affected due to higher adoption of such frameworks.
CVE-2025-71003 is a high-severity input validation vulnerability in the flow.arange() component of OneFlow v0.9.0 that allows remote attackers to cause a Denial of Service (DoS) without authentication or user interaction. The flaw arises from improper input validation, enabling crafted inputs to crash or hang the application, impacting availability. There are no known exploits in the wild yet, and no patches have been published. European organizations using OneFlow for machine learning or data processing workloads could face service disruptions if targeted. Mitigation involves restricting access to OneFlow services, input sanitization, and monitoring for anomalous usage patterns. Countries with significant AI and data science sectors, such as Germany, France, and the UK, are more likely to be affected due to higher adoption rates of such frameworks. The vulnerability has a CVSS score of 7.
CVE-2025-71002 is a medium-severity vulnerability in OneFlow v0.9.0's flow.column_stack component, where a crafted input triggers a floating-point exception causing a denial of service (DoS). The vulnerability requires no privileges but does require user interaction and can be exploited remotely over the network. It impacts availability without affecting confidentiality or integrity. No known exploits are currently in the wild, and no patches have been published yet. European organizations using OneFlow for machine learning or data processing may experience service disruptions if targeted. Mitigation involves input validation, restricting access to vulnerable components, and monitoring for anomalous inputs. Countries with strong AI and data science sectors, such as Germany, France, and the UK, are more likely to be affected.
