Threats affecting Ireland

North Korean threat actors have deployed 197 malicious npm packages to distribute an updated version of the OtterCookie malware. This malware campaign leverages the npm ecosystem to infect developers and organizations that use these packages, potentially compromising software supply chains. The updated OtterCookie malware is designed to exfiltrate sensitive data and maintain persistence on infected systems. Although no known exploits in the wild have been reported yet, the scale and sophistication of this campaign pose a significant risk. European organizations relying on npm packages for development are at risk of supply chain attacks, which can lead to data breaches and operational disruptions. Mitigation requires rigorous package vetting, use of software composition analysis tools, and restricting npm package usage to trusted sources. Countries with strong software development sectors and high npm usage, such as Germany, the UK, France, and the Netherlands, are likely to be most affected. Given the malware’s potential impact on confidentiality and integrity, ease of distribution via npm, and no authentication required for exploitation, the threat severity is assessed as high. Defenders should prioritize monitoring for suspicious npm package activity and implement strict supply chain security controls.

Malware#infosecnews#redditGermany+6

Multiple Python packages on PyPI contain legacy bootstrap scripts that create a domain takeover risk. These scripts reference domains that are no longer controlled by the original owners, allowing attackers to register these domains and potentially hijack package functionality or distribution. This vulnerability can lead to supply chain attacks, compromising the integrity and trustworthiness of affected Python packages. No known exploits are currently observed in the wild, but the risk is considered high due to the potential impact on software supply chains. European organizations relying on affected PyPI packages could face significant security risks, including unauthorized code execution and data compromise. Mitigation requires auditing dependencies for legacy bootstrap scripts, removing or updating vulnerable code, and monitoring domain ownership related to package infrastructure. Countries with strong Python developer communities and critical infrastructure relying on Python are most at risk. The threat severity is assessed as high given the ease of exploitation and potential widespread impact on confidentiality, integrity, and availability.

News#infosecnews#redditGermany+7

A recently reported security issue involves Microsoft Teams guest access functionality, where joining external tenants can inadvertently disable Microsoft Defender protections. This vulnerability arises when users participate as guests in other organizations' Teams environments, potentially allowing malicious actors to bypass endpoint security controls. The threat is significant due to the widespread use of Teams for collaboration across organizational boundaries, increasing the attack surface. No known exploits are currently in the wild, but the impact could be severe if leveraged. European organizations using Teams extensively for inter-company collaboration are at risk, especially those with guest access enabled. Mitigation requires strict control over guest access policies, monitoring of Defender status changes, and applying any forthcoming patches or configuration updates from Microsoft. Countries with high Teams adoption and critical infrastructure sectors relying on Microsoft 365 services are most likely to be affected. Given the ease of exploitation through legitimate collaboration features and the potential to disable critical security controls, the severity is assessed as high. Defenders should prioritize reviewing guest access configurations and enhance endpoint monitoring to detect anomalous Defender status changes.

News#infosecnews#redditGermany+9

Ahead of Black Friday and festive sales, over 2,000 holiday-themed fake online stores have been detected, organized into two main clusters. These sites impersonate major retailers like Amazon and use uniform holiday banners, fake trust indicators, and phishing kits to deceive shoppers. They employ urgency tactics and fake checkout pages to steal sensitive financial information. The scams are timed to activate during peak shopping periods to maximize victim traffic and financial theft. This campaign leverages social engineering, typosquatting, and e-commerce impersonation to exploit consumer trust during high-volume shopping events. Although no direct exploits target software vulnerabilities, the threat poses significant risks to consumers and indirectly to organizations handling payment and customer data. European organizations involved in e-commerce, payment processing, and consumer protection are particularly at risk. Mitigation requires proactive detection of fraudulent domains, consumer awareness campaigns, and enhanced monitoring of payment fraud. Countries with high e-commerce adoption and large consumer markets are most likely affected. The threat severity is assessed as high due to the potential financial impact and widespread exposure without requiring user authentication but relying on user interaction.

Campaign#social engineering#fake online storesGermany+9

The Shai-hulud 2.0 campaign is an advanced malware operation targeting cloud platforms (AWS, GCP, Azure) and developer ecosystems by stealing credentials and secrets. It automates backdooring of NPM packages maintained by victims, enabling rapid supply chain propagation. The malware abuses GitHub Actions workflows for command-and-control and secret exfiltration, leveraging cloud secret management services and destructive failsafes to maintain stealth and persistence. This campaign threatens the confidentiality and integrity of cloud and developer environments, potentially impacting thousands of downstream users. It requires no known exploits in the wild but uses sophisticated tactics to evade detection. European organizations relying heavily on cloud services and open-source development are at risk, especially those with significant use of NPM packages and GitHub repositories. The threat severity is assessed as high due to the broad impact on supply chains and credential theft without requiring user interaction. Immediate mitigation includes securing cloud credentials, auditing GitHub workflows, and monitoring supply chain dependencies for unauthorized changes.

Malware#azure#githubGermany+7

Sha1-Hulud is a sophisticated new variant of an NPM supply chain attack that executes during the preinstall phase of popular packages like Postman, Zapier, and AsyncAPI. It harvests cloud credentials across AWS, Azure, and GCP, and establishes persistence by creating a self-hosted GitHub Actions runner named 'SHA1HULUD' with an injection-vulnerable workflow. This enables attackers to move laterally across cloud environments beyond the initial development environment. Immediate mitigation includes removing compromised packages, revoking and regenerating all tokens and credentials, and enforcing hardware-based MFA for developer accounts. The attack leverages multiple MITRE ATT&CK techniques related to execution, persistence, credential access, and lateral movement. No known exploits in the wild have been reported yet, but the threat poses a medium severity risk due to its potential impact on cloud infrastructure security and software supply chains.

Malware#github actions#sha1-huludGermany+6

A threat campaign linked to the Scattered Lapsus$ Hunters group is targeting Zendesk users through over 40 typosquatted domains impersonating Zendesk and various organizations. These domains host phishing pages to harvest credentials. Attackers also submit fraudulent tickets to Zendesk portals to infect support staff with remote access trojans (RATs). This campaign follows similar attacks on other SaaS platforms like Salesforce, with Discord reportedly breached via its Zendesk support system. The attack leverages phishing, typosquatting, and social engineering to compromise customer service environments. Organizations are advised to implement strong authentication, monitor for typosquatted domains, and secure Zendesk chat to mitigate risks. The threat poses a medium severity risk due to its potential to compromise sensitive support operations and enable persistent access. No CVSS score is available, but the attack's impact on confidentiality and integrity, combined with ease of exploitation, warrants a medium severity rating.

Malware#customer service#saas platformsGermany+8

Multiple Mixpanel customers were impacted by a recent cyberattack targeting the product analytics company. The post OpenAI User Data Exposed in Mixpanel Hack appeared first on SecurityWeek .

NewsGermanyFrance+5

Following a recent Salesforce security alert, Gainsight has expanded the list of impacted customers potentially affected by a high-severity remote code execution (RCE) vulnerability. The threat involves exploitation risks related to Salesforce integrations or components used by Gainsight, a customer success platform. Although no known exploits are currently in the wild, the vulnerability's nature and the expansion of affected customers indicate a significant risk. European organizations using Gainsight integrated with Salesforce may face confidentiality, integrity, and availability impacts if exploited. Mitigation requires immediate review of Salesforce and Gainsight configurations, applying any available patches, and enhancing monitoring for suspicious activity. Countries with high Salesforce and Gainsight adoption, such as the UK, Germany, France, and the Netherlands, are most likely to be affected. Given the high potential impact, ease of exploitation, and lack of authentication barriers, the suggested severity is high. Defenders should prioritize incident response readiness and validate the security posture of their Salesforce-Gainsight environments.

News#infosecnews#redditGermany+6

A recent report highlights a method to disrupt Next.js servers at an extremely low cost, approximately 0.0001 cents per attack instance. The threat involves leveraging a vulnerability or design characteristic in Next.js server deployments to cause denial of service or resource exhaustion. Although no specific affected versions or patches are identified, the attack's low cost and potential scalability raise concerns. There is no evidence of widespread exploitation yet, and technical details remain sparse, with the primary source being a Reddit post linking to an external article. European organizations using Next.js for web applications could face service disruptions, impacting availability and potentially business continuity. Mitigation requires careful resource management, rate limiting, and monitoring of server performance to detect anomalous traffic patterns.

News#netsec#redditGermany+5

A recently disclosed edge case vulnerability affects the mysql and mysql2 Node.js packages, where prepared statements—commonly trusted to prevent SQL injection—can be exploited under certain conditions. This vulnerability undermines the assumption that using prepared statements alone guarantees SQL injection safety, potentially allowing attackers to execute arbitrary SQL commands. While no known exploits are currently in the wild, the issue poses a medium severity risk due to its impact on data confidentiality and integrity. European organizations using Node.js applications with these database libraries should carefully review their usage of prepared statements and apply mitigations promptly. Countries with significant Node.js development ecosystems and industries relying on web applications and databases are at higher risk. Mitigation involves auditing code for unsafe prepared statement usage, applying any forthcoming patches, and employing additional input validation and query parameterization techniques. Given the ease of exploitation once the vulnerability is understood and the widespread use of these packages, the threat demands immediate attention despite limited current exploitation evidence.

News#netsec#redditGermany+6

JSONFormatter and CodeBeautify users exposed credentials, authentication keys, configuration information, private keys, and other secrets. The post Thousands of Secrets Leaked on Code Formatting Platforms appeared first on SecurityWeek .

BreachGermanyFrance+5

Salesforce Gainsight Security Advisory - Nov 2025

Malware#recorded-future:threat-actor=scattered lapsus$ hunters#ransomwareUnited Kingdom+5

The new self-replicating worm iteration has destructive capabilities, erasing home directory contents if it cannot spread to more repositories. The post 640 NPM Packages Infected in New ‘Shai-Hulud’ Supply Chain Attack appeared first on SecurityWeek .

MalwareGermanyFrance+5

The Shai Hulud npm worm is a supply chain malware attack that has compromised over 26,000 repositories, including high-profile projects such as Zapier, ENS, and Postman. This attack propagates through the npm package ecosystem, leveraging the trust developers place in widely used dependencies. Although no known exploits are actively observed in the wild yet, the scale of affected repositories indicates a significant risk to software supply chains. The worm’s propagation method involves injecting malicious code into npm packages, which then spreads as developers update or install dependencies. European organizations relying on affected npm packages face risks of code integrity compromise, potential data leakage, and disruption of development workflows. Mitigation requires rigorous dependency auditing, use of package integrity verification tools, and restricting automated dependency updates without validation. Countries with strong software development sectors and high npm usage, such as Germany, the UK, France, and the Netherlands, are most likely to be impacted. Given the widespread impact on supply chains and ease of propagation without user interaction, the threat severity is assessed as high. Defenders should prioritize supply chain security measures to prevent infiltration and propagation of such malware in their development environments.

Malware#infosecnews#redditGermany+5

The Shai Hulud npm worm is a supply chain malware infection that compromised approximately 19,000 npm packages, representing a significant threat to the software development ecosystem. This attack propagates through the npm package manager, widely used in JavaScript development, by injecting malicious code into legitimate packages, which then infect downstream projects. Although no known exploits are currently active in the wild, the scale of infection and the nature of supply chain attacks pose a medium-level risk. European organizations relying on npm packages for their software development could face risks including code execution, data exfiltration, or further malware deployment. Mitigation requires thorough auditing of dependencies, use of package integrity verification tools, and restricting automated dependency updates without review. Countries with strong software development sectors and high npm usage, such as Germany, the UK, France, and the Netherlands, are more likely to be impacted. Given the medium severity, the threat demands proactive defensive measures to prevent potential exploitation. Defenders should prioritize supply chain security hygiene and monitor for any emerging exploit activity related to this worm.

Malware#infosecnews#redditGermany+6

The 'Second Sha1-Hulud Wave' is a high-severity supply chain attack targeting over 25,000 npm repositories by exploiting the npm preinstall script mechanism to steal credentials. This attack leverages malicious code injected into the preinstall phase of npm packages, allowing threat actors to exfiltrate sensitive authentication tokens or credentials during package installation. The widespread impact on repositories indicates a significant risk to software supply chains, particularly for organizations relying heavily on npm packages. European organizations using npm in development or production environments could face confidentiality breaches, unauthorized access, and potential downstream compromise. Mitigation requires rigorous auditing of npm dependencies, restricting preinstall script execution, and implementing strict credential management policies. Countries with strong software development sectors and high npm usage, such as Germany, the UK, France, and the Netherlands, are most at risk. Given the ease of exploitation and broad scope without requiring user interaction, the suggested severity is high. Defenders should prioritize supply chain security controls and continuous monitoring to detect anomalous preinstall behaviors.

News#infosecnews#redditGermany+5

The FCC has rolled back cybersecurity regulations for telecommunications providers, reducing mandated security requirements despite ongoing risks from state-sponsored hacking. This regulatory rollback potentially weakens the security posture of critical telecom infrastructure, which is a vital component of national and international communications. European organizations relying on transatlantic telecom services or interconnected networks may face increased risks due to diminished security standards in US-based telcos. The rollback does not represent a direct vulnerability or exploit but increases systemic risk by lowering baseline protections against sophisticated cyber threats. Mitigation requires European entities to independently enforce stringent security controls and closely monitor telecom service providers' security practices. Countries with strong transatlantic telecom links and high-value targets in finance, government, and critical infrastructure sectors are most at risk. Given the indirect nature of the threat, the suggested severity is medium, reflecting increased exposure but no immediate exploit. Defenders should prioritize supply chain risk management and enhance network monitoring to compensate for reduced regulatory oversight in the US telecom sector.

News#infosecnews#redditGermany+6

The infamous ShinyHunters hackers have targeted customer-managed Gainsight-published applications to steal data from Salesforce instances. The post Salesforce Instances Hacked via Gainsight Integrations appeared first on SecurityWeek .

Breach#rceGermany+5

A persistent cross-site scripting (XSS) vulnerability was discovered in esbuild, a widely used JavaScript bundler with over 5 billion downloads. This bug bypassed HTML sanitization mechanisms, allowing malicious scripts to be injected and executed in affected applications. Although no known exploits are currently in the wild, the vulnerability poses a medium risk due to its potential to compromise web application security. The flaw could lead to unauthorized data access, session hijacking, or further exploitation if leveraged by attackers. European organizations using esbuild in their web development pipelines may be at risk, especially those in sectors with heavy reliance on JavaScript frameworks. Mitigation requires updating to patched versions once available, implementing additional input validation, and employing robust Content Security Policies (CSP). Countries with significant software development industries and high adoption of modern web technologies, such as Germany, the UK, France, and the Netherlands, are more likely to be affected. Given the ease of exploitation through crafted inputs and the broad usage of esbuild, the suggested severity is medium. Defenders should prioritize monitoring for suspicious script injections and prepare to apply patches promptly.

News#netsec#redditGermany+5