Threats affecting Italy

Freedom Mobile has disclosed a data breach that exposed customer data, as reported by a trusted cybersecurity news source. The breach involves unauthorized access to sensitive customer information, though specific technical details and the extent of the data compromised have not been publicly disclosed. There are no known exploits in the wild related to this breach at this time. The incident is considered high severity due to the potential impact on customer privacy and trust. European organizations should be alert to potential phishing or social engineering attacks leveraging leaked data. Mitigation should focus on monitoring for suspicious activity, enhancing customer data protection, and preparing incident response plans. Countries with significant Freedom Mobile customer bases or related telecom infrastructure may be more affected. Given the lack of detailed technical information, the severity is assessed as high based on the breach's impact on confidentiality and potential for misuse of exposed data. Defenders should prioritize detection and response capabilities and communicate transparently with affected customers.

Breach#infosecnews#redditGermany+5

Leroy Merlin, a major French DIY retail company, has disclosed a data breach impacting its systems. The breach was recently reported and is considered high severity due to potential exposure of sensitive customer or corporate data. Although technical details are limited, the incident is confirmed by a trusted cybersecurity news source. There are no known exploits in the wild linked to this breach at this time. The breach could affect confidentiality and integrity of data, with possible repercussions for customer privacy and corporate operations. European organizations, especially in France and neighboring countries, should be alert to potential phishing or fraud attempts leveraging leaked data. Mitigation should focus on enhanced monitoring, incident response readiness, and customer notification procedures. Given Leroy Merlin’s market presence, France is the most impacted country, with potential spillover effects in other European markets where the company operates. The severity is assessed as high due to the nature of the breach and potential data exposure without requiring user interaction or authentication for exploitation. Defenders should prioritize detection of suspicious activity and review access controls and data protection measures.

Breach#infosecnews#redditFrance+5

The ShadyPanda threat actor has conducted a sophisticated seven-year malware campaign infecting 4.3 million Chrome and Edge browsers via malicious extensions that were verified and featured by Google, enabling widespread trust and distribution. The campaign operates two main components: a 300,000-user remote code execution (RCE) backdoor and a 4-million-user spyware operation that harvests extensive user data such as browsing history, search queries, and mouse clicks, sending it to servers in China. This malware exploits vulnerabilities in browser extension marketplaces and trusted update mechanisms to maintain persistence and evade detection. The campaign highlights significant risks to user privacy and organizational security, especially for entities relying heavily on Chrome and Edge browsers. European organizations face risks of data exfiltration, espionage, and potential lateral movement within networks. Mitigation requires proactive extension management, network monitoring for suspicious domains, and enhanced user awareness. Countries with high Chrome/Edge usage and strategic geopolitical interest in China-related cyber espionage are most at risk. The threat severity is assessed as high due to the scale, stealth, and potential impact on confidentiality and integrity without requiring user interaction post-installation.

Malware#browser extension#malware campaignGermany+9

Albiriox is a newly discovered Android RAT malware offered as Malware-as-a-Service, primarily targeting financial and cryptocurrency applications globally. It uses a sophisticated two-stage deployment involving dropper apps and packing to evade detection. The malware enables remote control of infected devices via VNC-based access and overlay attacks, allowing real-time interaction and unauthorized operations such as screen manipulation and device takeover. It targets over 400 financial and crypto wallet apps, facilitating on-device fraud while remaining stealthy. The MaaS model and ongoing development indicate potential rapid spread among cybercriminals. Although no known exploits in the wild are reported yet, its advanced capabilities pose a significant threat to mobile users, especially in finance sectors. The malware is linked to Russian-speaking threat actors and uses multiple fake domains for distribution. European organizations with mobile banking and crypto wallet users are at risk, particularly in countries with high Android usage and financial sector prominence. Mitigation requires targeted detection of dropper apps, user education on app sources, and enhanced mobile endpoint protection. Given its impact on confidentiality, integrity, and availability with ease of exploitation and no user interaction needed post-installation, the threat severity is assessed as high.

Malware#android#vncGermany+9

Albiriox is a newly identified Android banking malware family that enables cybercriminals to remotely control infected devices and conduct financial fraud. It operates as Malware-as-a-Service (MaaS), featuring modular components such as loaders, command modules, and control panels designed specifically for targeting banking, fintech, payment, and cryptocurrency applications. Distributed via fake apps and social engineering, it mimics legitimate brands and app stores to deceive users. The malware abuses Android accessibility features and employs black-screen masking to hide malicious activity. Notably, it can bypass multi-factor authentication and device fingerprinting, increasing its effectiveness. Although currently rated medium severity, its capabilities pose significant risks to user confidentiality and financial integrity. European organizations with mobile banking users are at risk, especially in countries with high Android adoption and fintech usage. Mitigation requires verifying app sources, maintaining updated devices, deploying advanced anti-malware solutions, and educating users about social engineering tactics.

Malware#android#albirioxAustria+9

A critical vulnerability in the WordPress King Addons plugin is actively exploited in the wild, allowing attackers to create unauthorized administrator accounts. This flaw enables privilege escalation without requiring prior authentication or user interaction, posing a significant risk to affected WordPress sites. Exploitation can lead to full site compromise, data theft, and potential use of the site for further malicious activities. The vulnerability is currently under active attack, emphasizing the urgency for site administrators to take immediate protective measures. No official patches or CVEs have been published yet, increasing the risk window. European organizations using this plugin are at heightened risk, especially those with high-value web assets. Mitigation requires immediate plugin updates once available, restricting access to WordPress admin areas, and monitoring for suspicious account creations. Countries with large WordPress user bases and significant e-commerce or media sectors are most likely to be targeted. Given the ease of exploitation and impact, the threat severity is assessed as critical. Defenders must prioritize detection and response to prevent full administrative takeover of their WordPress environments.

Campaign#infosecnews#redditGermany+7

Russia has blocked access to the Roblox platform citing the distribution of LGBT "propaganda" as the reason. This action is a government-imposed restriction rather than a direct cybersecurity threat or vulnerability affecting the Roblox platform or its users. There is no indication of exploitation, malware, or technical compromise involved. The event reflects geopolitical and regulatory censorship impacting access to online services. European organizations are indirectly affected mainly through potential disruptions in user access and content availability. No technical vulnerabilities or exploits have been reported in connection with this event. The block may influence companies relying on Roblox for marketing, education, or community engagement within Russia. The situation underscores the importance of monitoring geopolitical risks and regulatory environments. Defenders should focus on understanding regional access restrictions and preparing for potential service disruptions. This is not a cybersecurity threat in the traditional sense but a political and regulatory action affecting service availability.

News#infosecnews#redditGermany+7

Microsoft has silently patched a long-standing vulnerability in the Windows LNK file handling mechanism after years of active exploitation. The flaw allowed attackers to execute arbitrary code by tricking users into opening or previewing specially crafted shortcut (. LNK) files, a technique historically used in targeted attacks and malware campaigns. Although Microsoft did not publicly announce the patch initially, the fix addresses a high-severity issue that impacts Windows systems globally. European organizations using Windows are at risk due to the widespread use of the OS and the potential for this exploit to be used in spear-phishing or supply chain attacks. The vulnerability affects the confidentiality, integrity, and availability of affected systems by enabling remote code execution without user authentication, often requiring minimal user interaction. Mitigation involves applying the latest Windows updates immediately, disabling the parsing of LNK files in untrusted locations, and enhancing endpoint detection capabilities for suspicious LNK file activity. Countries with high Windows market penetration and significant critical infrastructure, such as Germany, France, the UK, and the Netherlands, are most likely to be targeted. Given the ease of exploitation, the scope of affected systems, and the impact on core security properties, this threat is assessed as high severity. Defenders should prioritize patching and monitoring for related attack indicators to reduce exposure to this stealthy but dangerous vulnerability.

News#infosecnews#redditGermany+9

Currently, in order to provide basic DDoS protection and filter aggressive bots, some form of Content Delivery Network (CDN) is usually the simplest and most cost-effective way to protect a web application. In a typical setup, DNS is used to point clients to the CDN, and the CDN will then forward the request to the actual web server. There are a number of companies offering services like this, and cloud providers will usually have solutions like this as well.

News#web#dosGermany+6

This threat describes a novel approach to detecting and mitigating Layer 7 (L7) Distributed Denial of Service (DDoS) attacks and bot traffic using ClickHouse analytics combined with Tempesta FW, an open-source HTTP reverse proxy and firewall. Traditional L7 mitigation techniques relying on challenges or static rules are increasingly ineffective against modern botnets using impersonation libraries and proxy networks. The solution collects access logs in real time from Tempesta FW and uses WebShield, a Python daemon, to analyze traffic spikes, classify clients, and automatically block malicious actors based on IP, TLS, or HTTP fingerprints. This method enables near real-time detection and mitigation of sophisticated multi-thousand-IP botnets without relying on user challenges. The approach is particularly relevant for organizations facing advanced botnet threats and requiring scalable, automated L7 defense mechanisms.

Botnet#netsec#redditGermany+7

A recent analysis reveals that 68% of phishing websites utilize Cloudflare's services to protect their infrastructure. This trend complicates detection and takedown efforts because Cloudflare acts as a reverse proxy, masking the true hosting location and providing DDoS protection. While not a vulnerability in Cloudflare itself, this widespread abuse of its platform enables phishing actors to evade traditional security controls. European organizations face increased risks as phishing remains a primary vector for credential theft and malware delivery. Mitigation requires enhanced email filtering, user awareness, and collaboration with Cloudflare for rapid takedown. Countries with high Cloudflare adoption and significant financial or governmental targets are most at risk. The threat is assessed as medium severity due to the indirect nature of the risk and the reliance on social engineering. Defenders should prioritize detection of phishing URLs behind Cloudflare and strengthen incident response capabilities.

Phishing#netsec#redditGermany+6

The threat actor leveraged Evilginx (likely version 3.0), an open source, advanced phishing adversary-in-the-middle (AITM, aka MITM) framework designed to steal login credentials and session cookies. Evilginx is widely used by cybercriminals to undermine multi-factor authentication (MFA) security, and this actor has used it to target at least 18 universities and educational institutions across the United States since April 2025. The campaigns were delivered through email and the phishing domains used subdomains that mimicked the legitimate SSO sites.

Campaign#evilginx#aitmUnited Kingdom+6

DragonForce ransomware is a high-severity malware threat linked to the Scattered Spider threat group, known for targeted ransomware attacks. It employs advanced tactics to gain remote code execution (RCE) capabilities, enabling attackers to infiltrate and encrypt critical systems. Although no known exploits are currently active in the wild, the malware's connection to a sophisticated threat actor increases its risk profile. European organizations, especially those in critical infrastructure and high-value sectors, face significant risks due to potential data loss, operational disruption, and financial extortion. Mitigation requires proactive threat hunting, network segmentation, and enhanced monitoring for indicators of compromise related to Scattered Spider activity. Countries with strong digital economies and critical infrastructure, such as Germany, France, the UK, and the Netherlands, are particularly at risk. Given the ransomware's impact on confidentiality, integrity, and availability, ease of exploitation through RCE, and the broad scope of potential targets, the threat severity is assessed as high. Defenders should prioritize detection of lateral movement and privilege escalation attempts associated with this ransomware family.

Malware#infosecnews#redditGermany+7

Researchers have observed Lazarus Group actors operating as remote IT workers, indicating a sophisticated approach to cyber espionage and intrusion. This activity suggests the group is leveraging legitimate remote work frameworks to infiltrate target organizations. While no specific vulnerabilities or exploits have been identified, the tactic increases the risk of insider threats and supply chain compromises. European organizations, especially those with remote work policies and critical infrastructure, may be targeted due to the group's known geopolitical motivations. Mitigations require enhanced monitoring of remote access, strict verification of IT personnel, and robust anomaly detection. Countries with significant financial, governmental, and technological sectors are at higher risk. The threat is assessed as medium severity due to the indirect nature of the compromise and lack of known exploits but remains concerning due to the potential for stealthy, persistent access. Defenders should prioritize visibility into remote worker activities and strengthen identity and access management controls.

News#infosecnews#redditGermany+7

The University of Phoenix disclosed a data breach resulting from a hack of Oracle systems. The breach stems from a compromise of Oracle infrastructure, which impacted the university's data security. While specific technical details about the attack vector or exploited vulnerabilities are not provided, the incident highlights risks associated with third-party cloud or software providers. The breach is classified as high severity due to the potential exposure of sensitive personal and academic information. No known exploits are currently active in the wild, and the discussion level in public forums remains minimal. European organizations relying on Oracle cloud services or similar third-party providers should be alert to similar risks. Mitigation requires enhanced monitoring of third-party integrations, rigorous access controls, and incident response preparedness. Countries with significant Oracle customer bases and higher education institutions are more likely to be affected. Given the potential impact on confidentiality and the indirect attack vector, the suggested severity is high.

Breach#infosecnews#redditGermany+6

A campaign targeting Russian corporate entities, particularly HR, payroll, and administrative departments, has been uncovered. The attack uses realistic decoy documents themed around employee bonuses and financial policies. The malware ecosystem involves a malicious LNK file leading to an implant dubbed DUPERUNNER, which then loads the AdaptixC2 Beacon to connect to the threat actor's infrastructure. The infection chain begins with a spear-phishing ZIP archive containing PDF-themed LNK files. The DUPERUNNER implant, programmed in C++, performs various functions including downloading and opening decoy PDFs, process enumeration, and shellcode injection. The final stage involves the AdaptixC2 Beacon, which communicates with the command-and-control server. The campaign, tracked as UNG0902, uses multiple malicious infrastructures and is believed to be targeting employees of various organizations.

Malware#spear-phishing#c2 communicationRussia+7

The Aisuru botnet has been identified as the source of a new record-breaking distributed denial-of-service (DDoS) attack reaching 29.7 Tbps. This attack represents one of the largest volumetric DDoS attacks ever recorded, leveraging a massive network of compromised devices to overwhelm targeted infrastructure. Such an attack can severely disrupt online services, degrade network performance, and cause significant operational downtime. European organizations, especially those with critical online services or digital infrastructure, are at risk of service outages and reputational damage. Mitigation requires advanced DDoS protection strategies, including traffic filtering, rate limiting, and collaboration with upstream providers and ISPs. Countries with high internet penetration, significant digital economies, and strategic infrastructure are more likely to be targeted. Given the scale and potential impact, this threat is assessed as high severity. Defenders should prioritize monitoring for unusual traffic spikes and ensure robust incident response plans are in place.

Campaign#infosecnews#redditGermany+7

Arizona is the latest state to sue Temu and its parent company PDD Holdings over allegations that the Chinese online retailer is stealing customers’ data. The post Arizona Attorney General Sues Chinese Online Retailer Temu Over Data Theft Claims appeared first on SecurityWeek .

NewsGermanyFrance+5

The University of Pennsylvania and the University of Phoenix confirm that they are victims of the recent Oracle EBS hacking campaign. The post Penn and Phoenix Universities Disclose Data Breach After Oracle Hack appeared first on SecurityWeek .

BreachGermanyFrance+5

The ShadyPanda campaign is a long-running espionage operation that targeted approximately 4.3 million users of Chrome and Edge browsers over a seven-year period. It involved persistent spying activities, likely through malicious extensions or other browser-based mechanisms, to collect sensitive user data. Although no specific affected versions or technical exploit details are provided, the campaign's longevity and scale indicate a sophisticated threat actor with sustained access. The medium severity rating reflects the significant privacy and confidentiality risks, though exploitation complexity and exact attack vectors remain unclear. European organizations using Chrome and Edge browsers are at risk, particularly those in countries with high adoption of these browsers and strategic geopolitical relevance. Mitigation requires enhanced browser security hygiene, monitoring for suspicious extensions, and user awareness. Countries such as Germany, France, the UK, Italy, and the Netherlands are likely most affected due to their large user bases and critical infrastructure. Given the lack of detailed exploit information, the suggested severity is medium, balancing the impact on confidentiality against the unknown ease of exploitation and scope. Defenders should prioritize detection of unusual browser activity and ensure timely updates and audits of browser extensions.

Campaign#infosecnews#redditGermany+7