Exposed Dixell/Copeland XWEB PRO refrigeration controllers with unpatched vulnerabilities, notably CVE-2026-25085, are being exploited as part of an SMTP botnet. These industrial control devices, commonly used in supermarkets and cold storage, are abused as tunnel gateways, residential proxy exits, and spam senders. Analysis shows coordinated outbound SMTP traffic targeting overlapping mail lists, indicating organized malicious use. The vulnerable devices lack security monitoring, enabling prolonged exploitation without detection.
Over 100 stores across multiple European countries experienced cyberattacks targeting internet-exposed refrigeration controllers, causing fridges and freezers to heat up and spoil food. The attacks affected stores in Belgium, Sweden, Ireland, and other countries, with some units set as high as 50°C. The incidents resemble a prior wave of attacks in France that disrupted around 700 supermarkets. The compromised devices include legacy Danfoss and Copeland refrigeration controllers, many of which have management interfaces exposed to the internet and lack available patches. The attackers exploited default credentials and internet exposure to force refrigeration units into defrost mode. Physical modifications alongside software updates are needed to fully mitigate the vulnerability. Investigations are ongoing, and no group has claimed responsibility.
A suspected Chinese-speaking threat actor linked to Red Heron conducted extensive exploitation campaigns from May to September 2026. The attacker exploited multiple vulnerabilities in WordPress (CVE-2026-63030, CVE-2026-60137) to breach a western government organization, stealing over 18,000 sensitive records including credentials and personally identifiable information. Additionally, the actor exploited CVE-2026-7273 in ZyXEL GS1900 switches, compromising 996 devices across 48 countries and exfiltrating configurations and credentials. The adversary demonstrated sophisticated capabilities such as custom tool development possibly using large language models, privilege escalation, and systematic data exfiltration via PowerShell-based techniques.
Beginning in August 2025, a sophisticated intrusion was discovered where attackers used log poisoning techniques to deploy a web shell on vulnerable phpMyAdmin panels. The threat actors exploited misconfigured web applications to plant China Chopper web shells, controlled via AntSword, before deploying Nezha, an open-source monitoring tool, to facilitate remote command execution. This led to the deployment of Ghost RAT on compromised systems. Analysis revealed over 100 compromised machines, predominantly located in Taiwan, Japan, South Korea, and Hong Kong. The attackers demonstrated technical proficiency through multi-stage operations, utilizing AWS and VPS infrastructure, with indicators pointing to China-nexus threat actors. The campaign highlights increasing abuse of legitimate publicly available tools to achieve malicious objectives while maintaining plausible deniability.
With the introduction of charges/taxes on certain items posted from outside the EU, threat actors appear to be leveraging the situation to send fraudulent SMS and email messages impersonating postal services in an attempt to harvest payment details and personal information. The campaign is already being observed targeting Irish users, and I'd like to highlight this activity publicly as part of a LinkedIn post around our Brand Protection, Threat Intelligence, and Domain Takedown capabilities.
A coordinated smishing operation spanning 19 countries across Europe, the Americas, and the Caucasus has been exposed, originating from fraudulent SMS messages impersonating Romania's government payment portal Ghișeul.ro. Investigation revealed 1,628 malicious URLs linked by a single 128-character campaign identifier, targeting government portals, traffic police departments, postal services including DPD and SEUR, tax authorities, and telecommunications providers like T-Mobile and Vodafone. The infrastructure utilizes 32 backend IP addresses distributed across Tencent Cloud, Alibaba Cloud, Cloudflare CDN, and ALEXHOST Moldova. Threat actors employ two distinct phishing templates: a Vue.js single-page application and a Bootstrap-based clone, executing a four-stage credential harvesting process that collects complete payment card details through fabricated traffic fines, toll payments, and delivery notifications.
A faulty software update led to the exposure of mobile banking users’ transactions to other users of the application. The post Lloyds Data Security Incident Impacts 450,000 Individuals appeared first on SecurityWeek .
The ShinyHunters hacker group claimed to have stolen over 350GB of information from European Commission cloud systems. The post European Commission Reports Cyber Intrusion and Data Theft appeared first on SecurityWeek .
The government agency confirmed the vulnerability could have been exploited to obtain company details and alter records. The post UK Companies House Exposed Details of Millions of Firms appeared first on SecurityWeek .
The UK data privacy authority has fined Reddit nearly $20 million due to failures in protecting children's personal information on its platform. This penalty highlights significant shortcomings in Reddit's compliance with data protection regulations, particularly regarding child safety. Although no specific technical vulnerability or exploit has been reported, the incident underscores risks related to inadequate data privacy controls and regulatory non-compliance. Organizations operating platforms that handle children's data must ensure strict adherence to privacy laws to avoid similar sanctions. The fine serves as a warning about the importance of safeguarding sensitive user data, especially for minors. No known exploits or active attacks have been associated with this issue. The severity is assessed as medium due to the regulatory and reputational impact rather than direct technical exploitation. Countries with strong data protection enforcement and large user bases on Reddit are most likely to be affected by similar risks. Practical mitigation involves enhancing data privacy policies, implementing robust age verification, and improving monitoring of child-related content and data. This case emphasizes the growing regulatory scrutiny on online platforms regarding child data protection.
A coordinated campaign of Chrome extensions posing as AI assistants has been uncovered, affecting over 260,000 users. These extensions, while appearing legitimate, embed remote, server-controlled interfaces inside extension-controlled surfaces, granting access to sensitive browser capabilities. The campaign consists of 30 different extensions sharing the same codebase, permissions, and backend infrastructure. Key features include remote iframe as the core UI, page content extraction, voice recognition capability, and Gmail integration. The extensions communicate with infrastructure under the tapnetic.pro domain, using subdomain segmentation for logical separation. The campaign employs extension spraying tactics to evade takedowns and quickly restore distribution. This approach breaks the browser security model, potentially allowing data harvesting and user behavior monitoring.
The latest Android version continues to improve security and privacy, according to its developers. The post Android 17 Beta Strengthens Secure-by-Default Design for Privacy and App Security appeared first on SecurityWeek .
The company says hackers stole the personal information of patients of affiliated physicians and practices. The post ApolloMD Data Breach Impacts 626,000 Individuals appeared first on SecurityWeek .
An attack campaign targeting organizations in the US, Canada, UK, and Northern Ireland exploits ConnectWise ScreenConnect vulnerabilities. The attack chain begins with a spoofed email containing a malicious .cmd attachment, which executes silently, escalates privileges, disables Windows SmartScreen, and removes the Mark-of-the-Web. It then installs a legitimate Remote Monitoring and Management tool, ScreenConnect, which is abused as a Remote Access Trojan for persistent command-and-control access. The campaign focuses on sectors with high-value data, including government, healthcare, and logistics. The attackers use various techniques to evade detection, including UAC bypass, registry modification, and silent MSI installation. The ScreenConnect client used has a revoked certificate, highlighting the importance of blocking vulnerable software versions and enforcing strict RMM allowlists.
WSL or “Windows Subsystem Linux”[1] is a feature in the Microsoft Windows ecosystem that allows users to run a real Linux environment directly inside Windows without needing a traditional virtual machine or dual boot setup. The latest version, WSL2, runs a lightweight virtualized Linux kernel for better compatibility and performance, making it especially useful for development, DevOps, and cybersecurity workflows where Linux tooling is essential but Windows remains the primary operating system. It was introduced a few years ago (2016) as part of Windows 10.
VoidLink is a Linux C2 framework that generates implant binaries for cloud and enterprise environments. The implant, likely built using an LLM coding agent, demonstrates advanced capabilities including multi-cloud targeting, container awareness, and kernel-level stealth. It fingerprints cloud environments across AWS, GCP, Azure, Alibaba Cloud, and Tencent Cloud, harvesting credentials and detecting container runtimes. The malware includes plugins for container escape and Kubernetes privilege escalation, as well as a kernel-level rootkit that adapts its approach based on the host's kernel version. C2 communications use AES-256-GCM over HTTPS, disguised as normal web traffic. VoidLink highlights the growing concern of LLM-generated implants reducing the skill barrier for producing sophisticated malware.
VS Code-integrated configuration files are automatically executed in Codespaces when the user opens a repository or pull request. The post VS Code Configs Expose GitHub Codespaces to Attacks appeared first on SecurityWeek .
An AWS environment was targeted in a sophisticated attack, with the threat actor gaining administrative privileges in under 10 minutes. The operation showed signs of leveraging large language models for automation and decision-making. Initial access was obtained through credentials found in public S3 buckets, followed by rapid privilege escalation via Lambda function code injection. The attacker moved laterally across 19 AWS principals, abused Amazon Bedrock for LLMjacking, and launched GPU instances for potential model training. The attack involved extensive reconnaissance, data exfiltration, and attempts to establish persistence. Notable techniques included IP rotation, role chaining, and the use of AI-generated code.
Transparent Tribe, also known as APT36, has expanded its targeting to include India's startup ecosystem, particularly those in the cybersecurity domain. The group is using startup-oriented themed lure material delivered via ISO container-based files to deploy Crimson RAT. This campaign deviates from their typical government and defense targets, suggesting a shift in strategy towards companies providing open-source intelligence services and collaborating with law enforcement agencies. The attack chain involves spear-phishing emails, malicious LNK files, and batch scripts to execute the Crimson RAT payload. The malware employs extensive obfuscation techniques and uses a custom TCP protocol for command and control communications. This activity demonstrates the group's adaptation of proven tooling for new victim profiles while maintaining its core behavioral tactics, techniques, and procedures.
Infostealer threats are expanding beyond Windows, targeting macOS and leveraging cross-platform languages like Python. Recent campaigns use social engineering to deploy macOS-specific infostealers such as DigitStealer, MacSync, and AMOS. These stealers use fileless execution and native macOS utilities to harvest credentials and sensitive data. Python-based stealers are also on the rise, allowing attackers to quickly adapt and target diverse environments. Additionally, threat actors are abusing trusted platforms like WhatsApp and PDF converter tools to distribute malware such as Eternidade Stealer. These evolving threats blend into legitimate ecosystems and evade conventional defenses, posing significant risks to organizations across various operating systems and delivery channels.
