TA584, a prominent initial access broker targeting organizations globally, demonstrated significant changes in attack strategies throughout 2025. The actor expanded its global targeting, adopted ClickFix social engineering techniques, and began delivering new malware called Tsundere Bot. TA584's operational tempo increased, with monthly campaigns tripling from March to December. The actor uses various delivery methods via email, often sending from compromised individual accounts. TA584's campaigns now feature rapid succession and overlapping, with distinct lure themes and short operational lifespans. The actor has shown adaptability in social engineering, brand impersonation, and payload delivery, making static detection less effective. Recent payloads include XWorm with the 'P0WER' configuration and the newly observed Tsundere Bot, both likely part of Malware-as-a-Service offerings.
New Strict Account Settings allow users to block attachments and media and silence calls from unknown people. The post WhatsApp Boosts Account Security for At-Risk Individuals appeared first on SecurityWeek .
This investigation exposes a complex fraud ecosystem targeting Canadians through impersonation of government services and trusted brands. Attackers exploit digital dependencies for transportation, taxation, parcel delivery, and travel using convincing campaigns. The activity is linked to the 'PayTool' phishing framework, specializing in traffic violation scams. Additional infrastructure impersonates Canada Revenue Agency, Air Canada, and Canada Post. Threat actors commercialize these campaigns on underground forums, selling phishing kits mimicking official services. Victims are lured via SMS and malicious ads, using high-pressure tactics. The infrastructure employs fake validation phases and fraudulent payment gateways to harvest personal and financial data. The campaign's scope spans multiple provinces, utilizing shared hosting and domain generation patterns for scalability.
Crunchbase was targeted alongside SoundCloud and Betterment in a ShinyHunters campaign. The post Crunchbase Confirms Data Breach After Hacking Claims appeared first on SecurityWeek .
This comprehensive analysis covers cyber threats and security issues in the financial industry, both in Korea and globally. It examines malware and phishing cases, lists top malware strains, and provides statistics on leaked Korean accounts. Key issues on the deep and dark web are highlighted, including a major database leak from Indonesia's largest bank, exposing sensitive financial data of approximately 3 million customers. A ransomware attack on a leading African financial services company by INC Ransom group is also detailed, with 100GB of data reportedly stolen. The report emphasizes the potential for widespread damage and chain attacks, urging proactive measures among financial institutions and related companies.
The title of this diary is perhaps a bit catchy but the question is important. I don't consider myself as a good developer. That's not my day job and I'm writing code to improve my daily tasks. I like to say “I'm writing sh*ty code! It works for me, no warranty that it will for for you”. Today, most of my code (the skeleton of the program) is generated by AI, probably like most of you.
Threat actors may have wanted to take advantage of the holiday weekend in the United States to increase their chances of success. The post LastPass Users Targeted With Backup-Themed Phishing Emails appeared first on SecurityWeek .
The hackers trick victims into accessing GitHub or GitLab repositories that are opened using Visual Studio Code. The post North Korean Hackers Target macOS Developers via Malicious VS Code Projects appeared first on SecurityWeek .
North Korean threat actors have evolved their techniques in the Contagious Interview campaign, now abusing Microsoft Visual Studio Code task configuration files. The infection chain begins when a victim opens a malicious Git repository, often disguised as part of a recruitment process. If trust is granted, arbitrary commands are executed on the system. The malware uses JavaScript payloads hosted on vercel.app to implement backdoor logic, including remote code execution, system fingerprinting, and persistent command-and-control communication. The backdoor collects host information and beacons to a C2 server every five seconds. Recent observations show further execution of similar payloads, indicating ongoing development of these tactics.
Visual Studio Code is a popular open-source code editor[1]. But it's much more than a simple editor, it's a complete development platform that supports many languages and it is available on multiple platforms. Used by developers worldwide, it's a juicy target for threat actors because it can be extended with extensions.
VoidLink is an advanced AI-generated malware framework exhibiting high maturity, modularity, and sophisticated techniques such as eBPF and LKM rootkits. It targets cloud and container environments with dedicated modules for enumeration and post-exploitation, indicating a focus on modern infrastructure. Although no known exploits in the wild have been reported yet, its architecture suggests a significant threat potential. European organizations relying on cloud-native and containerized deployments are at heightened risk due to the malware's capabilities. Mitigation requires advanced detection mechanisms tailored to eBPF and kernel-level rootkits, alongside strict cloud environment monitoring and segmentation. Countries with strong cloud adoption and critical infrastructure sectors, such as Germany, the UK, France, and the Netherlands, are likely to be most affected. Given its high impact on confidentiality, integrity, and availability, combined with ease of exploitation via AI-generated code, the suggested severity is high. Defenders should prioritize proactive threat hunting and behavioral analytics to detect this evolving threat.
The Evelyn Stealer campaign targets software developers through weaponized Visual Studio Code extensions, employing a multistage delivery of information-stealing malware. The attack chain involves a downloader disguised as a legitimate Lightshot DLL, an injector that uses process hollowing to inject the final payload, and the Evelyn Stealer itself. The malware implements sophisticated anti-analysis techniques, collects sensitive information including browser credentials and cryptocurrency data, and exfiltrates the stolen data via FTP. This campaign highlights the increasing threat to developer communities and the need for enhanced security measures in development environments.
The Sysdig Threat Research Team analyzed VoidLink, a sophisticated Linux malware framework targeting cloud environments. Key findings include the first documented Serverside Rootkit Compilation, Chinese development with AI assistance, adaptive detection evasion, and use of the Zig programming language. VoidLink employs a multi-stage loader architecture, fileless execution techniques, and kernel-level stealth mechanisms. It features three control channels, including a covert ICMP channel, and specialized functionality for cloud and container environments. Despite its sophistication, VoidLink can be detected using runtime monitoring tools. The malware shows indicators of Chinese-speaking developers with significant kernel expertise, likely using AI-assisted development methods.
The incident impacted the personal information of CIRO member firms and their registered employees. The post 750,000 Impacted by Data Breach at Canadian Investment Watchdog appeared first on SecurityWeek .
Designed for long-term access, the framework targets cloud and container environments with loaders, implants, and rootkits. The post VoidLink Linux Malware Framework Targets Cloud Environments appeared first on SecurityWeek .
A threat actor breached Betterment’s systems, accessed customer information, and sent scam crypto-related messages. The post Robo-Advisor Betterment Discloses Data Breach appeared first on SecurityWeek .
A new automated red-team tool has been developed to identify critical vulnerabilities in AI applications that integrate large language models (LLMs) such as GPT-4. The tool focuses on discovering prompt injection or jailbreak attacks, system prompt leaks, and potential leakage of personally identifiable information (PII) from the model's context or training data. Early tests on AI startups revealed prompt leaks within minutes, highlighting the immature state of LLM security. This threat exposes significant risks including unauthorized command execution, data exposure, and compromise of AI system integrity. European organizations adopting AI solutions without robust security controls may face data breaches and operational disruptions. Mitigation requires specialized security assessments tailored to LLM-based applications, including prompt sanitization, strict access controls, and continuous monitoring. Countries with high AI adoption and technology sectors, such as Germany, France, and the UK, are particularly at risk. Given the critical impact on confidentiality, integrity, and availability and ease of exploitation without authentication, the severity is assessed as critical. Defenders must prioritize securing AI integrations to prevent exploitation of these novel attack surfaces.
The RondoDox botnet is actively exploiting a vulnerability known as React2Shell to compromise Next.js servers. This flaw allows attackers to breach server environments running Next.js, a popular React framework for server-side rendering. Although no CVSS score is assigned, the threat is rated high severity due to the potential for unauthorized access and control over affected servers. The exploitation enables attackers to deploy botnet activities, which can lead to data breaches, service disruption, and further lateral movement within compromised networks. European organizations using Next.js for web applications are at risk, especially those in countries with high adoption of modern web technologies. Mitigation requires immediate patching once available, network segmentation, and monitoring for unusual outbound traffic indicative of botnet command and control. Countries such as Germany, the United Kingdom, France, and the Netherlands are likely to be most affected due to their large tech sectors and extensive use of Next.
A modified variant of the Shai-Hulud worm has been detected testing payloads on the npm registry, raising concerns about potential malware propagation through widely used JavaScript packages. Although no known exploits are currently active in the wild, the presence of this malware on a major package repository poses a significant risk to software supply chains. The worm’s modifications suggest an evolution in its capabilities, potentially increasing its stealth or infection vectors. European organizations relying on npm packages for development and production environments could face risks to their code integrity and operational availability if infected packages are introduced. Mitigation requires proactive monitoring of package dependencies, strict validation of third-party code, and enhanced supply chain security practices. Countries with large software development sectors and high npm usage, such as Germany, the United Kingdom, France, and the Netherlands, are more likely to be impacted. Given the high severity rating and potential for widespread impact, organizations should prioritize detection and prevention measures. The threat is assessed as high severity due to its potential impact on confidentiality, integrity, and availability, combined with the ease of exploitation through trusted package repositories and no need for user interaction once dependencies are installed.
