Threats affecting Ireland

The customer information published on the dark web includes names, addresses, phone numbers, and email addresses. The post Toys ‘R’ Us Canada Customer Information Leaked Online appeared first on SecurityWeek .

Breach#webGermany+5

A financially motivated Vietnamese threat actor group UNC6229 is conducting a campaign using fake job postings on legitimate platforms to target remote workers in digital advertising and marketing. They create credible fake company profiles and lure victims with attractive remote job offers. Upon victim engagement, they deliver malware attachments or phishing links, often leveraging legitimate business and CRM platforms to increase trust. The goal is to steal credentials and compromise high-value corporate and digital advertising accounts. The campaign relies heavily on social engineering and victim-initiated contact. Indicators include malware hashes and a suspicious domain (staffvirtual.website). This medium-severity threat poses risks to confidentiality and integrity of corporate accounts, especially in organizations with remote digital advertising staff.

Campaign#fake job postings#credential theftGermany+5

An individual reported their AWS account was compromised, sharing their experience on a public blog linked from a Reddit NetSec post. The incident highlights risks associated with cloud account security, though specific technical details on the attack vector or exploited vulnerabilities are not provided. No known exploits or automated attacks are currently linked to this breach. The severity is assessed as medium due to potential exposure of sensitive cloud resources, but the lack of detailed indicators limits broader impact assessment. European organizations using AWS should be aware of the risks of credential compromise and ensure robust identity and access management. Countries with high AWS adoption and significant cloud infrastructure usage are more likely to be affected. Mitigation should focus on enforcing multi-factor authentication, monitoring account activity, and securing credentials beyond generic advice. Given the limited technical detail, the threat is rated medium severity based on potential impact and ease of exploitation through credential theft or phishing. Defenders should prioritize cloud account security hygiene and incident response readiness.

Breach#netsec#redditGermany+7

On the first day of the Pwn2Own Ireland hacking competition, attackers successfully exploited 34 zero-day vulnerabilities across various software and hardware platforms. These zero-days represent previously unknown security flaws that have not yet been patched, posing significant risks if weaponized outside controlled environments. Although no known exploits in the wild have been reported, the sheer volume and diversity of these zero-days highlight the evolving threat landscape. European organizations could face increased risks, especially those relying on affected technologies or with high-value targets attractive to advanced attackers. Immediate attention to vendor advisories and proactive vulnerability management is critical. Mitigation should include enhanced monitoring, network segmentation, and rapid patch deployment once fixes become available. Countries with large technology sectors, critical infrastructure, and financial hubs are most likely to be targeted. Given the high impact potential and ease of exploitation demonstrated in a controlled setting, the suggested severity is high. Defenders must prioritize awareness and preparedness to mitigate potential exploitation attempts stemming from these zero-days.

Vulnerability#infosecnews#redditIreland

Cursor and Windsurf integrated development environments (IDEs) have been found to contain over 94 unpatched (n-day) vulnerabilities originating from their embedded Chromium components. These vulnerabilities span a wide range of security issues inherent to Chromium, potentially exposing users to risks such as remote code execution, privilege escalation, and data leakage. Although no known exploits are currently active in the wild, the sheer volume and severity of these vulnerabilities pose a significant threat, especially given the widespread use of these IDEs in software development. European organizations using these IDEs may face increased risk of compromise, intellectual property theft, or disruption of development workflows. Immediate attention to patching or mitigating these vulnerabilities is critical. The threat is assessed as high severity due to the potential impact on confidentiality, integrity, and availability, combined with the ease of exploitation of Chromium vulnerabilities. Countries with strong software development sectors and high adoption of these IDEs, such as Germany, France, and the UK, are likely to be most affected. Defenders should prioritize updating Chromium components, applying vendor patches when available, and implementing network-level protections to reduce exposure. Continuous monitoring for suspicious activity related to these IDEs is also recommended.

News#infosecnews#redditGermany+6

A new tech support scam campaign exploits Microsoft's trusted brand to deceive users. It starts with phishing emails promising payments, leading victims to fake CAPTCHA challenges. After completion, users are redirected to a browser-locked landing page mimicking ransomware, with multiple pop-ups resembling Microsoft security alerts. These pop-ups urge victims to call a fraudulent support number, enabling phone-based social engineering. The scam combines browser manipulation, phishing, and social engineering to potentially gain system access. No direct malware or exploits are involved, but the psychological manipulation can lead to financial loss or unauthorized access. The campaign underscores the risks of trusting familiar branding without verification and highlights the need for user awareness and layered defenses. Indicators include multiple malicious URLs and domains used in the campaign. The threat is medium severity due to its social engineering nature and potential impact on confidentiality and integrity.

Campaign#microsoft impersonation#browser manipulationGermany+9

Windows 11 23H2 is approaching its end of life (EOL), meaning Microsoft will cease providing security updates and patches for this version after the designated date. Organizations continuing to use this version post-EOL will be exposed to unpatched vulnerabilities, increasing their risk of compromise. Although no specific exploits are currently known in the wild targeting this EOL, the lack of security updates inherently raises the threat level. European organizations relying on Windows 11 23H2 should plan timely upgrades to supported versions to maintain security posture. Failure to upgrade may lead to increased exposure to malware, ransomware, and other cyberattacks exploiting unpatched vulnerabilities. The impact is particularly significant for sectors with strict compliance requirements and critical infrastructure. Countries with high Windows 11 adoption and strong digital economies are at greater risk. Proactive asset management and patching strategies are essential to mitigate risks associated with this EOL. This threat is assessed as medium severity due to the indirect nature of the risk and absence of active exploits.

News#infosecnews#redditGermany+9

A significant AWS outage caused widespread service disruptions affecting major platforms such as Amazon, PrimeVideo, Fortnite, and Perplexity. The outage was reported on October 20, 2025, and led to downtime and degraded service availability for these high-profile services. Although no direct security breach or exploit has been reported, the incident highlights the risks associated with reliance on cloud infrastructure providers. European organizations using AWS or dependent on affected services may experience operational impacts. The outage underscores the importance of cloud resilience, multi-region deployments, and incident response preparedness. No known exploits or vulnerabilities were identified in relation to this outage. Mitigation involves enhancing cloud architecture redundancy and monitoring. Countries with significant AWS adoption and digital service dependencies, such as Germany, the UK, France, and the Netherlands, are most likely to be affected. The severity of this threat is assessed as high due to the broad impact on availability and critical business services without requiring user interaction or authentication.

News#infosecnews#redditGermany+5

Experian was fined $3.2 million for mass-collecting personal data, highlighting significant privacy and regulatory compliance issues. This incident underscores risks related to unauthorized or excessive data collection practices by large data brokers. Although no direct technical exploit or vulnerability is reported, the event signals potential privacy violations that could lead to reputational damage and regulatory penalties. European organizations should be aware of similar risks under GDPR and other data protection laws. The fine emphasizes the importance of strict data governance and compliance with privacy regulations. No active exploitation or technical attack vectors are indicated. The threat is primarily regulatory and compliance-related rather than a direct cybersecurity vulnerability. Organizations handling personal data must ensure lawful data collection and processing practices. Countries with strong data protection enforcement and large financial or data services sectors are most likely to be impacted.

News#infosecnews#redditGermany+6

A hacker involved in compromising PowerSchool systems was sentenced to four years in prison. The incident highlights the risks associated with attacks on educational software platforms that manage sensitive student and staff data. While no specific technical details or exploited vulnerabilities are provided, the case underscores the importance of securing such critical infrastructure. The threat does not describe an ongoing or new vulnerability but rather reports on a legal outcome following a cyberattack. European organizations using PowerSchool or similar educational management systems should remain vigilant. The severity of the threat is assessed as medium due to the potential impact on confidentiality and integrity of educational data, though exploitation details are lacking. No active exploits or patches are mentioned, limiting immediate technical mitigation steps. Countries with significant educational technology adoption and digital infrastructure in schools may be more concerned. Overall, this is a security incident report rather than a new technical threat or vulnerability disclosure.

News#infosecnews#redditGermany+6

A sophisticated campaign targeting macOS developers has been uncovered, utilizing fake websites impersonating trusted platforms like Homebrew, TradingView, and LogMeIn to distribute Odyssey Stealer and AMOS malware. The attackers employ social engineering tactics, prompting users to paste base64-encoded commands in Terminal, which downloads malicious payloads. Over 85 phishing domains were identified, linked through shared SSL certificates and infrastructure. The campaign's infrastructure includes long-standing IP addresses showing multi-year activity. The malware attempts privilege escalation, performs anti-analysis checks, and disrupts backup services. This coordinated operation demonstrates the attackers' ability to adapt tactics and maintain persistence in the macOS ecosystem.

Malware#stealer#macosGermany+7

A phishing campaign is impersonating LastPass by sending scam emails with alarming subjects like 'We Have Been Hacked' to trick users into clicking malicious links. These links lead to fake websites hosted on domains such as lastpassdesktop.com, designed to steal credentials and secret keys, potentially compromising users' password vaults. LastPass has confirmed it has not been breached and is actively working with partners like Cloudflare to take down these fraudulent domains and warn users. Similar phishing attacks have targeted other password managers, increasing the risk to users relying on these services. The campaign leverages social engineering tactics to create urgency and exploit trust in the LastPass brand. No direct system vulnerabilities are exploited, but the threat targets user credentials through deception. European organizations using LastPass or similar password managers are at risk of credential theft if users fall for these scams. Mitigation requires user education, domain blocking, and enhanced email filtering to detect and prevent phishing attempts.

Campaign#phishing#credential theftGermany+9

Summary Check Point Research (CPR) identified a security vulnerability in January 2025 affecting the new Rust-based kernel component of the Graphics Device Interface (commonly known as GDI) in Windows. We promptly reported this issue to Microsoft and they fixed the vulnerability starting with OS Build 26100.4202 in the KB5058499 update preview released on May 28th 2025. In the following sections, we […] The post Denial of Fuzzing: Rust in the Windows kernel appeared first on Check Point Research .

Analysis#windowsGermany+10

A newly discovered Android vulnerability, dubbed 'Pixnapping,' allows malicious apps to steal two-factor authentication (2FA) codes without requiring any special permissions. This flaw exploits a weakness in how Android handles screen content or notifications, enabling rogue applications to capture sensitive 2FA codes silently. Although no known exploits are currently in the wild, the high severity rating indicates significant risk if weaponized. European organizations relying on Android devices for 2FA could face increased risks of account compromise and unauthorized access. Mitigation requires immediate attention to app vetting, restricting app sources, and monitoring for suspicious app behavior. Countries with high Android usage and critical infrastructure reliant on 2FA are most vulnerable. The threat is assessed as high severity due to the potential confidentiality breach, ease of exploitation without permissions, and broad impact scope. Defenders should prioritize patching once available and enhance multi-layered authentication security measures.

News#infosecnews#redditGermany+9

Hackers have posted over 1 Tb of information allegedly stolen from Harvard on the Cl0p data leak website. The post Harvard Is First Confirmed Victim of Oracle EBS Zero-Day Hack appeared first on SecurityWeek .

News#webGermany+9

Certain malicious packages published on popular software repositories npm, PyPI, and RubyGems have been discovered exfiltrating developer data to Discord channels. These packages covertly send sensitive information such as environment variables, source code snippets, or credentials to attacker-controlled Discord servers. The threat affects developers who incorporate these packages into their projects, potentially exposing confidential data and intellectual property. Although no known exploits in the wild have been reported yet, the high severity rating is due to the risk of data leakage and supply chain compromise. This issue highlights the risks inherent in open-source software supply chains and the need for rigorous package vetting. European organizations relying on these ecosystems for software development could face confidentiality breaches and reputational damage. Mitigations include auditing dependencies, using software composition analysis tools, and restricting network egress from development environments. Countries with strong software development sectors and high adoption of these package managers, such as Germany, the UK, France, and the Netherlands, are more likely to be impacted. The threat is assessed as high severity given the potential for significant data exposure without requiring user interaction or authentication. Defenders should prioritize dependency hygiene and monitoring for suspicious outbound traffic from development systems.

News#infosecnews#redditGermany+6

Oracle has released an emergency patch addressing a critical security flaw in its E-Business Suite. Although specific technical details about the vulnerability are not disclosed, the severity is rated critical, indicating a high risk of exploitation. No known exploits are currently reported in the wild, but the urgency of the patch suggests potential for significant impact if left unpatched. European organizations using Oracle E-Business Suite should prioritize applying this patch to prevent possible compromise. The flaw could affect confidentiality, integrity, and availability of enterprise resource planning data and processes. Countries with a high adoption of Oracle E-Business Suite and significant enterprise infrastructure are most at risk. Immediate mitigation involves deploying the official patch and reviewing access controls and monitoring for suspicious activity. Given the critical nature and potential for broad impact, this vulnerability demands swift action to avoid operational disruption or data breaches.

News#infosecnews#redditGermany+9

For the latest discoveries in cyber research for the week of 13th October, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES Qilin ransomware group has claimed responsibility for targeting Asahi, Japan’s largest brewing company, that had been hacked on September 29th. The attack resulted in the exfiltration of over 9,300 files totaling 27GB […] The post 13th October – Threat Intelligence Report appeared first on Check Point Research .

AnalysisGermanyFrance+8

A phishing campaign using fake 'Inflation Refund' text messages is targeting New Yorkers, attempting to deceive recipients into revealing sensitive information or installing malware. The scam exploits current economic concerns to lure victims with promises of financial relief. Although primarily reported in New York, the tactic could potentially spread to other regions. The attack does not require prior authentication but relies on user interaction to succeed. There are no known exploits in the wild beyond the phishing messages themselves. The threat poses a high risk due to potential financial loss and identity theft. European organizations should be aware of similar scams exploiting economic anxieties. Mitigation requires user education, robust SMS filtering, and verification procedures for unsolicited financial communications. Countries with significant US financial or diaspora connections may be more exposed. Overall, the threat severity is assessed as high due to its social engineering effectiveness and potential impact on confidentiality and financial integrity.

Phishing#infosecnews#redditGermany+9

A recent report details a method to bypass Air Canada's in-flight network restrictions, potentially allowing unauthorized access to restricted network segments or services during flights. The technique involves exploiting weaknesses in the network segmentation or filtering controls implemented on the aircraft's Wi-Fi system. While no known exploits are currently active in the wild, the medium severity rating reflects the potential for unauthorized network access and data exposure. European organizations with employees frequently traveling on Air Canada flights or using similar in-flight networks could face risks of data interception or unauthorized access. Mitigation requires enhanced network segmentation, robust filtering rules, and continuous monitoring of in-flight network traffic. Countries with high volumes of transatlantic flights to Canada, such as the UK, Germany, and France, are more likely to be affected. Given the ease of exploitation and potential confidentiality impact but limited scope and no authentication bypass, the threat is assessed as medium severity. Defenders should prioritize awareness and technical controls to prevent misuse of in-flight network access.

News#netsec#redditGermany+5