Threats affecting Ireland

Microsoft recently mitigated the largest cloud-based Distributed Denial of Service (DDoS) attack ever recorded, peaking at 15.7 Tbps. This attack leveraged a massive botnet to overwhelm cloud infrastructure with traffic, aiming to disrupt service availability. Although no specific vulnerabilities or exploits were involved, the scale of the attack highlights the increasing capability of threat actors to launch volumetric DDoS attacks. European organizations relying on cloud services, especially those using Microsoft Azure, could face indirect impacts from such large-scale attacks. The mitigation demonstrates the importance of robust DDoS defenses and traffic filtering at cloud provider levels. No direct exploitation or data breach was reported, but service disruption risks remain significant. Countries with high cloud adoption and critical infrastructure dependent on cloud services are more likely to be affected. Mitigation requires advanced traffic monitoring, scalable scrubbing centers, and collaboration with cloud providers. Given the attack's scale and potential for service disruption, the severity is assessed as high despite no direct exploit or data compromise.

Botnet#infosecnews#redditGermany+6

For the latest discoveries in cyber research for the week of 17th November, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES Cl0p’s Oracle E-Business Suite (CVE-2025-61882) zero-day campaign continues to expand. There are new confirmed breaches at The Washington Post, Logitech, Allianz UK, and GlobalLogic, as well as a newly listed but unconfirmed […] The post 17th November – Threat Intelligence Report appeared first on Check Point Research .

KEVAnalysisGermanyDenmark+9

Checkout.com experienced a high-severity data breach involving the hacking group ShinyHunters. The attackers attempted to extort a ransom, which Checkout.com refused to pay, opting instead to donate the ransom amount to charity. Although no specific technical details about the breach vector or affected systems were disclosed, the incident highlights risks to payment processing platforms. There are no known exploits in the wild at this time, and the discussion level on public forums remains minimal. The breach could impact confidentiality of sensitive customer and transaction data, potentially damaging trust and regulatory compliance for European organizations using Checkout.com's services. Mitigation focuses on enhanced monitoring, incident response readiness, and vendor risk management. Countries with significant fintech sectors and high adoption of Checkout.

Breach#infosecnews#redditGermany+5

A financially motivated threat actor automated the package publishing process in a coordinated tea.xyz token farming campaign. The post Amazon Detects 150,000 NPM Packages in Worm-Powered Campaign appeared first on SecurityWeek .

MalwareGermanyFrance+5

In October 2025, DoorDash experienced a significant data breach exposing user information. The breach was reported via Reddit's InfoSecNews and covered by a trusted cybersecurity news outlet, BleepingComputer. Although specific technical details and affected versions are not disclosed, the incident is classified as high severity due to the exposure of sensitive user data. No known exploits are currently active in the wild, and discussion around the breach remains minimal. European organizations using DoorDash services could face indirect risks, particularly if user data includes European residents or if DoorDash is integrated into corporate environments. Mitigation focuses on monitoring for suspicious activity, enforcing strong authentication, and preparing incident response plans. Countries with higher DoorDash usage or strategic interest in food delivery platforms, such as the UK, Germany, France, and the Netherlands, are more likely to be impacted. Given the breach's potential impact on confidentiality and the lack of detailed technical information, the suggested severity is high. Defenders should prioritize user notification, credential resets, and enhanced monitoring to mitigate risks stemming from this breach.

Breach#infosecnews#redditGermany+6

Scammers are exploiting WhatsApp's screen sharing feature to trick users into revealing one-time passwords (OTPs) and stealing funds. Attackers initiate screen sharing sessions under false pretenses, gaining real-time visibility into sensitive information such as OTPs used for two-factor authentication. This social engineering tactic bypasses technical controls by manipulating user trust and interaction. The threat primarily targets individuals but can have broader implications for organizations relying on WhatsApp for communication or authentication. No direct software vulnerability is exploited; rather, the attack leverages user behavior and the screen sharing capability. The ease of exploitation is moderate, requiring user interaction and deception. European organizations with employees or clients using WhatsApp are at risk, especially in countries with high WhatsApp penetration. Mitigation involves user education, strict policies on screen sharing, and alternative secure authentication methods. The threat is assessed as medium severity due to its impact on confidentiality and potential financial loss, despite requiring user cooperation.

News#infosecnews#redditGermany+7

A large-scale spam attack has flooded the npm registry with over 67,000 fake packages, mimicking a worm-like propagation pattern. These counterfeit packages may contain malicious code or be used to distribute malware, posing significant risks to developers and organizations relying on npm for software dependencies. Although no known exploits in the wild have been reported yet, the sheer volume and automated nature of the attack increase the likelihood of accidental inclusion of malicious packages in projects. European organizations using npm extensively for development and production environments face risks including supply chain compromise, data breaches, and service disruptions. Mitigation requires enhanced package vetting, use of trusted package sources, dependency auditing, and implementation of strict CI/CD pipeline controls. Countries with strong software development sectors and high npm usage, such as Germany, the UK, France, and the Netherlands, are particularly vulnerable. Given the potential for widespread impact on confidentiality, integrity, and availability, and the ease of exploitation via automated package installation, this threat is assessed as high severity. Defenders must prioritize monitoring npm package sources and applying automated security tools to detect and block fake or malicious packages.

Malware#infosecnews#redditGermany+6

A critical vulnerability in WatchGuard Fireware has been flagged by CISA, exposing approximately 54,000 Firebox devices to no-login attacks. This flaw allows attackers to bypass authentication entirely, potentially gaining unauthorized access to affected devices. The vulnerability impacts network security appliances widely used for perimeter defense, increasing risks of network compromise, data breaches, and lateral movement within corporate networks. Although no known exploits are currently reported in the wild, the critical nature and scale of affected devices necessitate immediate attention. European organizations using WatchGuard Firebox devices are at heightened risk, especially those in sectors with stringent security requirements. Mitigation requires prompt patching once updates are available, network segmentation, and enhanced monitoring for anomalous access attempts. Countries with significant deployments of WatchGuard products and critical infrastructure reliance on these devices are more vulnerable. Given the ease of exploitation without authentication and the broad impact on confidentiality, integrity, and availability, this vulnerability is assessed as critical. Defenders should prioritize identification of affected devices and implement compensating controls while awaiting patches.

News#infosecnews#redditGermany+9

A newly reported macOS infection vector leverages AppleScripts to bypass Apple's Gatekeeper security mechanism. Gatekeeper is designed to prevent untrusted or malicious software from executing, but attackers can exploit AppleScript capabilities to circumvent these protections. This technique does not rely on known vulnerabilities but abuses legitimate scripting functionality to execute malicious code. Although no active exploits have been observed in the wild yet, the method poses a medium-level threat due to its potential to evade standard macOS defenses. European organizations using macOS devices, especially in sectors with high reliance on Apple hardware, could be targeted. Mitigation requires enhanced monitoring of AppleScript execution, restricting script permissions, and user education about suspicious script behaviors. Countries with significant macOS adoption and strong tech sectors, such as Germany, the UK, France, and the Nordics, are more likely to be affected. The threat is assessed as medium severity given the moderate impact and the need for some user interaction or social engineering to trigger the script. Defenders should prioritize detection of unusual AppleScript activity and consider application whitelisting policies to reduce risk.

News#netsec#redditGermany+9

A fake NPM package with over 206,000 downloads was discovered targeting GitHub credentials through phishing techniques. The malicious package masqueraded as a legitimate module to trick developers into installing it, thereby exposing their GitHub authentication tokens or credentials. Although no known exploits in the wild have been reported yet, the scale of downloads indicates significant exposure risk. This threat primarily affects developers and organizations relying on NPM packages for software development, potentially leading to unauthorized access to source code repositories. European organizations using NPM and GitHub for development are at risk, especially those with large developer communities. Mitigation requires strict verification of package authenticity, use of scoped packages, and implementation of least privilege principles for tokens. Countries with strong software development sectors and high adoption of open-source tooling, such as Germany, the UK, France, and the Netherlands, are more likely to be impacted. Given the potential for credential compromise and unauthorized access, the threat severity is assessed as high. Defenders should prioritize supply chain security hygiene and continuous monitoring for suspicious package activity.

Phishing#infosecnews#redditGermany+5

GlassWorm malware has been discovered embedded within three Visual Studio Code extensions that have collectively been installed thousands of times. This malware targets developers by leveraging the popularity of VS Code extensions to infiltrate systems. Once installed, GlassWorm can execute malicious activities potentially compromising confidentiality and integrity of affected systems. Although no known exploits are currently active in the wild, the high severity rating indicates significant risk if exploited. European organizations using these extensions are at risk, especially those in software development and IT sectors. Mitigation requires immediate auditing of installed VS Code extensions, removal of suspicious ones, and monitoring for unusual activity. Countries with high adoption of VS Code and strong software development industries, such as Germany, France, and the UK, are most likely to be affected. The threat is considered high severity due to the potential impact on sensitive development environments and ease of distribution via trusted extension marketplaces. Defenders should prioritize verifying extension authenticity and applying strict controls on extension installation policies.

Malware#infosecnews#redditGermany+6

Recent reports highlight dangerous vulnerabilities in runC, the container runtime used by Docker, that could allow attackers to escape container isolation. Exploiting these flaws would enable malicious actors to break out of Docker containers and gain unauthorized access to the host system. Although no known exploits are currently in the wild, the high severity rating underscores the critical nature of these vulnerabilities. The threat primarily impacts environments running containerized applications using vulnerable versions of runC. European organizations relying heavily on Docker for cloud-native deployments and microservices architectures are at risk, especially those in countries with large tech sectors and cloud infrastructure. Mitigation requires prompt patching of runC once updates are released, restricting container privileges, and employing runtime security tools to detect anomalous behavior. Countries such as Germany, the United Kingdom, France, and the Netherlands are likely most affected due to their extensive use of container technologies and cloud services. Given the potential for complete host compromise without user interaction, the suggested severity is critical. Defenders should prioritize monitoring for updates from runC maintainers and prepare incident response plans for container breakout scenarios.

News#infosecnews#redditGermany+5

The GlassWorm malware has resurfaced on the OpenVSX marketplace with three new malicious Visual Studio Code extensions. These extensions are designed to infiltrate developer environments, potentially compromising source code confidentiality and integrity. GlassWorm is known for its stealthy behavior and ability to exfiltrate sensitive data from infected systems. Although no known exploits are currently active in the wild, the presence of these extensions on a popular open-source extension repository poses a significant risk. European organizations relying on VSCode and OpenVSX for development are at risk of supply chain attacks. The malware’s return highlights the ongoing threat of malicious code injection via trusted development tools. Mitigation requires strict extension vetting, monitoring network traffic for unusual activity, and restricting extension installation policies. Countries with large software development sectors and high adoption of VSCode and OpenVSX are most vulnerable. Given the malware’s potential impact on confidentiality and integrity, ease of exploitation via trusted extensions, and broad scope, the threat severity is assessed as high.

Malware#infosecnews#redditGermany+7

ClickFix prompts typically contain instructions for Windows users, but now they are tailored for macOS and they are getting increasingly convincing. The post ClickFix Attacks Against macOS Users Evolving appeared first on SecurityWeek .

News#windows#macosGermany+7

A malicious Visual Studio Code (VS Code) extension named 'Vibe-Coded' has been discovered containing built-in ransomware capabilities. This threat involves a seemingly legitimate extension that, once installed, can encrypt user files and demand ransom, leveraging the widespread use of VS Code among developers. Although no known exploits in the wild have been reported yet, the presence of ransomware functionality within a popular development tool extension poses a significant risk. European organizations using VS Code, especially those in software development and IT sectors, could face data loss and operational disruption. The threat is rated as high severity due to the potential impact on confidentiality, integrity, and availability of data, combined with the ease of exploitation through user installation. Mitigation requires strict extension vetting policies, use of trusted sources only, and enhanced endpoint protection with behavioral detection. Countries with large tech industries and high VS Code adoption, such as Germany, France, the UK, and the Netherlands, are most likely to be affected. Immediate awareness and proactive defense measures are critical to prevent compromise from this emerging ransomware threat.

Malware#infosecnews#redditGermany+5

Between 2016 and 2021, the suspects defrauded 4.3 million cardholders in 193 countries of €300 million (~$346 million). The post 18 Arrested in Crackdown on Credit Card Fraud Rings appeared first on SecurityWeek .

NewsGermanyFrance+8

Recent data analysis from AWS highlights that the majority of cloud breaches stem from compromised credentials and misconfigurations within cloud environments. These issues primarily involve improper management of access keys, overly permissive IAM roles, and unsecured storage buckets. European organizations relying on AWS cloud services are at risk of unauthorized access, data leakage, and service disruption if such vulnerabilities are present. The threat does not involve a specific exploit but reflects a widespread security posture problem. Mitigation requires rigorous credential management, least privilege enforcement, continuous configuration auditing, and automated detection of anomalies. Countries with high AWS adoption and significant cloud infrastructure usage, such as Germany, the UK, France, and the Netherlands, are particularly vulnerable. Given the ease of exploitation through stolen credentials and the broad impact on confidentiality and availability, the severity is assessed as high. Defenders should prioritize identity and access management hygiene and cloud security posture management to reduce exposure.

News#infosecnews#redditGermany+5

A critical vulnerability has been discovered in the React Native CLI tool, potentially exposing millions of developers to remote attacks. This flaw could allow attackers to execute arbitrary code or compromise developer environments remotely. Although no known exploits are currently active in the wild, the severity is rated critical due to the widespread use of React Native in mobile app development. The vulnerability affects the CLI tool used during development, which could lead to supply chain risks if exploited. European organizations relying on React Native for app development could face significant risks including intellectual property theft, codebase compromise, and disruption of development workflows. Immediate mitigation involves monitoring official React Native channels for patches and restricting CLI tool usage to trusted networks and environments. Countries with large software development sectors and high adoption of React Native, such as Germany, the UK, France, and the Netherlands, are most likely to be impacted. Given the potential for remote exploitation without user interaction and the critical role of the CLI in development, the suggested severity is critical. Defenders should prioritize patching once available and implement strict access controls around development tools.

Breach#infosecnews#redditGermany+5

Google's AI tool 'Big Sleep' has identified five new high-severity vulnerabilities in Apple's Safari WebKit engine. These vulnerabilities affect the core rendering engine used by Safari and other applications on Apple platforms. Although no known exploits are currently active in the wild, the discovery highlights potential risks to confidentiality, integrity, and availability for users of Safari. The vulnerabilities have not yet been assigned CVEs or patches, and technical details remain limited. European organizations relying on Safari for web access could face targeted attacks exploiting these flaws, especially in sectors with high-value data. Mitigation requires close monitoring of Apple security advisories and rapid deployment of patches once available. Countries with significant Apple user bases and strategic technology sectors are at higher risk. The threat is assessed as high severity due to the critical nature of WebKit in web browsing, the potential for remote code execution, and the lack of current mitigations. Defenders should prioritize vulnerability management and consider temporary mitigations such as limiting Safari use or sandboxing until patches are released.

News#infosecnews#redditGermany+9

This threat involves phishing attacks exploiting the OAuth device code authorization flow, comparing techniques targeting Microsoft Azure and Google accounts. Attackers trick users into authorizing malicious applications by presenting fake device code prompts, leading to credential compromise or unauthorized access. The phishing leverages the OAuth device code flow, which is designed for devices with limited input capabilities, making it a novel vector for social engineering. Although no known exploits are currently widespread, the technique poses a medium risk due to its potential to bypass traditional phishing defenses. European organizations using Azure or Google identity services are at risk, especially those with remote or hybrid workforces relying on OAuth device code authentication. Mitigation requires user education on recognizing legitimate device code prompts, implementing conditional access policies, and monitoring OAuth consent grants for anomalies. Countries with high adoption of Microsoft and Google cloud services, such as the UK, Germany, France, and the Netherlands, are most likely to be affected. The suggested severity is medium, given the moderate impact on confidentiality and the social engineering nature of the attack, which requires user interaction but no prior authentication. Defenders should focus on awareness, monitoring, and restricting OAuth app consent to reduce risk.

Phishing#infosecnews#redditGermany+5