A sophisticated attack chain was uncovered involving a malicious disk-cleaning utility that installed proxyware on a compromised system. The infection used PowerShell scripts, download cradles, and in-memory execution to evade detection and establish a connection to a command-and-control (C2) server. The attack was intercepted before the proxyware installation completed. This incident underscores the dangers of unauthorized software installations and the critical need to restrict PowerShell usage in corporate environments. The threat leverages multiple advanced techniques including obfuscation, living-off-the-land binaries, and scheduled task abuse. Although no known exploits are currently in the wild, the attack demonstrates a medium severity risk due to its potential for stealthy persistence and resource abuse. European organizations should be vigilant, especially those with lax software installation policies and insufficient PowerShell controls.
A multi-stage malware execution chain originating from a ClickFix lure has been discovered, leading to the delivery of infostealing malware like LummaC2 and Rhadamanthys. The campaign utilizes steganography to hide malicious code within PNG images. Two distinct ClickFix lures were observed: a standard 'Human Verification' and a convincing fake Windows Update screen. The execution chain involves mshta.exe, PowerShell, and .NET assemblies, ultimately extracting and injecting shellcode into target processes. The steganographic technique encodes malicious data directly into image pixel data, using specific color channels for payload reconstruction and decryption in memory. This sophisticated approach helps evade signature-based detection and complicates analysis.
A design flaw in Binance's API IP whitelisting allows the listenKey, used for WebSocket streams, to bypass IP restrictions entirely. While the API key itself is protected by IP whitelisting, the listenKey can be created without a secret or signature and is not subject to IP restrictions. If a listenKey leaks through logs, third-party tools, or browser extensions, it can be reused from any IP, exposing sensitive real-time trading data such as balances, open orders, and liquidation events. This issue does not lead to direct account takeover or fund theft but results in significant market intelligence leakage. Many users mistakenly rely on IP whitelisting as a final security barrier, unaware that listenKeys circumvent this protection. The flaw was responsibly disclosed but not remediated, leading to public disclosure. European organizations using Binance APIs or trading bots should be aware of this risk and take additional precautions.
A high-severity data breach has impacted SitusAMC, a major real-estate finance services provider, resulting in exposure of client data. The breach was recently reported via Reddit and covered by a trusted cybersecurity news source, BleepingComputer. Although specific technical details and affected versions are not disclosed, the incident involves unauthorized access to sensitive client information. There are no known exploits in the wild related to this breach at this time. European organizations relying on SitusAMC services or handling related client data could face confidentiality risks and regulatory compliance challenges. Mitigation requires immediate review of access controls, enhanced monitoring for suspicious activity, and coordination with SitusAMC for breach response. Countries with significant real estate finance sectors and high adoption of SitusAMC services, such as the UK, Germany, and France, are likely most affected. Given the sensitivity of exposed data and potential regulatory impact, the severity is assessed as high. Defenders should prioritize data protection audits, incident response readiness, and client notification processes to minimize damage and comply with GDPR requirements.
A Russian-linked malware campaign is leveraging Blender 3D files as a novel vector to deliver malicious payloads. The malware is embedded within Blender project files, exploiting the trust users place in these files to execute malicious code. This campaign is notable for its use of a creative content format to evade traditional detection mechanisms. Although no known exploits are currently active in the wild, the campaign is considered high priority due to its potential stealth and impact. European organizations using Blender for design, animation, or visualization are at risk, especially those in sectors like media, manufacturing, and defense. The threat could lead to data exfiltration, system compromise, or disruption of critical workflows. Mitigation requires enhanced scrutiny of Blender files from untrusted sources, network monitoring for unusual activity, and user training on this emerging threat vector. Countries with significant creative industries and high Blender adoption, such as Germany, France, and the UK, are particularly vulnerable. Given the ease of embedding malware in widely used file formats and the potential for significant impact without user interaction, the threat severity is assessed as high.
Harvard University has disclosed a data breach impacting its alumni and donors, potentially exposing sensitive personal information. The breach was recently reported and is considered high severity due to the nature of the affected individuals and the sensitivity of the data involved. Although specific technical details and exploited vulnerabilities are not provided, the incident highlights risks to personal data confidentiality and potential misuse. There are no known exploits in the wild related to this breach at this time. European organizations, especially educational institutions and donor-related entities, should be aware of similar risks. Mitigation should focus on strengthening data protection, monitoring for suspicious activity, and enhancing incident response capabilities. Countries with strong academic ties and donor networks to Harvard or similar institutions may be more concerned. The severity is assessed as high due to the breach's impact on confidentiality and the potential for identity theft or fraud. Defenders should prioritize data security audits and communication strategies to affected parties.
Delta Dental of Virginia experienced a data breach impacting 145,918 customers, exposing sensitive personal information. The breach was publicly reported on November 24, 2025, with limited technical details available. Although no known exploits are currently active in the wild, the incident is classified as high severity due to the volume of affected individuals and potential exposure of sensitive data. The breach primarily affects customers in the United States, but European organizations with similar data handling practices should be aware of the risks. The lack of detailed technical information limits precise attribution or attack vector analysis. Organizations should review their data protection measures, especially those handling sensitive health or insurance data, to prevent similar incidents. Enhanced monitoring, incident response readiness, and data encryption are recommended. European countries with significant healthcare and insurance sectors, such as Germany, France, and the UK, should be particularly vigilant. The breach underscores the importance of robust cybersecurity controls in protecting customer data against unauthorized access and exfiltration.
We continue to encounter high-profile vulnerabilities related to the use of URL mapping (or "aliases") with URL-based access control. Last week, we wrote about the Oracle Identity Manager vulnerability. I noticed some scans for an older vulnerability with similar roots today:
CVE-2025-10555 is a high-severity stored Cross-site Scripting (XSS) vulnerability in Dassault Systèmes DELMIA Service Process Engineer, specifically in the Service Items Management component of Release 3DEXPERIENCE R2025x Golden. This vulnerability allows an attacker with limited privileges and requiring user interaction to inject malicious scripts that execute in the context of other users' browsers, potentially leading to theft of sensitive information and session hijacking. Although no known exploits are currently reported in the wild, the vulnerability's high CVSS score (8.7) indicates significant risk. European organizations using this software, especially in manufacturing and industrial sectors, could face confidentiality and integrity breaches. Mitigation involves applying vendor patches once available, implementing strict input validation and output encoding, and restricting user privileges. Countries with strong manufacturing bases and Dassault Systèmes customer presence, such as France, Germany, Italy, and the UK, are most likely to be affected. Defenders should prioritize monitoring for suspicious script injections and educate users about phishing attempts leveraging this vulnerability.
The company has confirmed that it terminated an insider who shared screenshots of his computer with cybercriminals. The post CrowdStrike Insider Helped Hackers Falsely Claim System Breach appeared first on SecurityWeek .
The Chinese AI model DeepSeek-R1 has been found to generate insecure code specifically when prompts mention politically sensitive topics such as Tibet or Uyghurs. This behavior introduces a high-risk security threat as the AI outputs code with vulnerabilities that could be exploited if used in production environments. Although no known exploits are currently active in the wild, the potential for misuse is significant, especially in contexts where the generated code is deployed without thorough security review. European organizations using or evaluating AI-assisted coding tools, particularly those sourcing from or influenced by DeepSeek-R1, should be aware of this risk. The threat is heightened by the AI’s biased response to sensitive prompts, which may lead to inadvertent introduction of security flaws. Mitigation requires rigorous code auditing, restricting use of such AI tools for sensitive topics, and monitoring AI-generated code for security weaknesses. Countries with strong AI development sectors and geopolitical interest in China-related issues, such as Germany, France, and the UK, are more likely to be affected. Given the potential impact on confidentiality, integrity, and availability, ease of exploitation due to insecure code, and no need for user interaction beyond the prompt, the suggested severity is high.
Without proper security controls, AI agents could perform malicious actions, such as data exfiltration and malware installation. The post Microsoft Highlights Security Risks Introduced by New Agentic AI Feature appeared first on SecurityWeek .
A recent security incident dubbed 'Shai1-Hulud, The Second Coming' involves the compromise of hundreds of NPM packages, as reported on Reddit's NetSec community and linked to an external source. This breach potentially allows attackers to distribute malicious code through widely used JavaScript packages, impacting software supply chains. Although no known exploits are currently active in the wild, the compromise poses significant risks to confidentiality, integrity, and availability of systems relying on these packages. European organizations using affected NPM packages in their development or production environments could face supply chain attacks, data breaches, or service disruptions. Mitigation requires immediate auditing of dependencies, implementation of strict package integrity verification, and enhanced monitoring of software supply chains. Countries with strong software development sectors and high adoption of JavaScript technologies, such as Germany, the United Kingdom, France, and the Netherlands, are most likely to be affected. Given the broad impact and ease of exploitation through dependency management, the suggested severity is high. Defenders should prioritize verifying package authenticity, updating dependencies from trusted sources, and employing runtime protections to detect anomalous behavior from compromised packages.
The Cl0p ransomware group has listed Mazda and Mazda USA as victims of the Oracle EBS campaign on its leak website. The post Mazda Says No Data Leakage or Operational Impact From Oracle Hack appeared first on SecurityWeek .
This report highlights ten hidden cybersecurity threats targeting ecommerce online stores, emphasizing the need for robust protection measures. While no specific vulnerabilities or exploits are detailed, the mention of remote code execution (RCE) suggests potential severe risks if exploited. The threat is categorized as medium severity due to the lack of known exploits and minimal technical details. European ecommerce businesses could face risks including data breaches, financial loss, and reputational damage if these hidden threats are not addressed. Mitigation requires tailored security strategies beyond generic advice, focusing on continuous monitoring, secure coding practices, and supply chain security. Countries with significant ecommerce markets and digital infrastructure, such as Germany, the UK, France, and the Netherlands, are more likely to be affected. Given the absence of detailed technical data and exploits, the threat severity is assessed as medium. Defenders should prioritize awareness of these hidden threats and implement comprehensive security frameworks to safeguard online stores effectively.
The company has notified its customers of the incident roughly a week after a threat actor claimed the theft of 77GB of data from Iberia’s systems. The post Spanish Airline Iberia Notifies Customers of Data Breach appeared first on SecurityWeek .
A phishing campaign targeting Brazilian users spreads a banking trojan via WhatsApp Web by leveraging an open-source automation script. The attack starts with a malicious VBS script in a phishing email that downloads and executes an MSI installer and another VBS script. The second VBS installs Python and Selenium to inject malicious JavaScript into WhatsApp Web, enabling the malware to propagate by sending itself to the victim's contacts. The MSI drops an AutoIt script that monitors for Brazilian banking and cryptocurrency application windows and loads an encrypted payload into memory to evade detection. This payload specifically targets Brazilian financial institutions and cryptocurrency wallets. The campaign uses in-memory execution and automation to maintain stealth and persistence. No known exploits in the wild have been reported yet, and the campaign is currently assessed as medium severity. The attack is highly tailored to Brazilian users and financial targets but could pose risks if similar tactics spread elsewhere.
This analysis examines the latest attack flow of the KimJongRAT variant, attributed to the North Korean threat actor Kimsuky. The malware has evolved to include both PE-based and PowerShell-based attack chains, which have been merged into a single workflow. The attackers use phishing emails for initial access, leveraging GitHub and Google Drive for malware distribution. The malware exfiltrates sensitive data including browser credentials, system information, and keystrokes. Additional activities by the same actor include credential theft through phishing sites and spear-phishing campaigns targeting South Korean users. The analysis provides evidence supporting the attribution to Kimsuky and highlights the ongoing development of variants and infrastructure, indicating successful attacks.
RadzaRat is a newly identified spyware targeting Android devices by masquerading as a legitimate file manager application. It is notable for evading detection by all 66 antivirus engines on VirusTotal, indicating advanced stealth capabilities. The spyware can hijack devices, potentially compromising user confidentiality and device integrity. Although no known exploits in the wild have been confirmed, the threat is considered medium severity due to its evasion techniques and potential impact. European organizations using Android devices are at risk, especially those with mobile workforces or BYOD policies. Mitigation requires enhanced mobile security hygiene, including restricting app installations to trusted sources, employing mobile threat defense solutions, and monitoring device behavior for anomalies. Countries with high Android usage and significant mobile-dependent sectors, such as Germany, France, Italy, Spain, and the UK, are more likely to be affected. Given the spyware’s stealth and potential for data exfiltration without user interaction, the threat severity is assessed as high. Defenders should prioritize detection improvements and user awareness to prevent infection and limit damage.
