Reddit NetSec

CVE Database V5

AlienVault OTX General

Exploit-DB RSS Feed

Reddit InfoSec News

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

Employee gets $920 for credentials used in $140 million bank heist

Source: https://www.bleepingcomputer.com/news/security/employee-gets-920-for-credentials-used-in-140-million-bank-heist/

This security incident involves an employee whose credentials were used in a massive $140 million bank heist, for which the employee received only $920. The event highlights a significant insider threat or credential compromise scenario where legitimate access was leveraged to conduct a large-scale financial fraud. Although specific technical details such as the attack vector, exploited vulnerabilities, or the exact method of credential compromise are not provided, the incident underscores the critical risk posed by compromised or malicious insider credentials in high-value financial environments. The attack likely involved unauthorized access to banking systems or transaction platforms, enabling the perpetrators to execute fraudulent transfers or withdrawals amounting to $140 million. The employee's relatively small payout suggests either a coercion or a minor accomplice role, or possibly that the credentials were sold or leaked without full knowledge of the ensuing fraud. The lack of known exploits or patches indicates this is more of a threat actor exploitation of existing access rather than a software vulnerability. The minimal discussion and low Reddit score imply limited public technical discourse, but the high severity rating and newsworthiness from a trusted source confirm the incident's significance. This case exemplifies the dangers of credential theft, insider threats, and the need for robust identity and access management controls in financial institutions.

Detailed information about Employee gets $920 for credentials used in $140 million bank heist. Get real-time updates, technical details, and mitigation strategi

Employee gets $920 for credentials used in $140 million bank heist - Live Threat Intelligence - Threat Radar | OffSeq.com

Employee gets $920 for credentials used in $140 million bank heist

Reddit Discussion: Employee gets $920 for credentials used in $140 million bank heist

Ahold Delhaize Confirms Data Breach of 2.2M amid INC Ransomware Claims

Source: https://hackread.com/ahold-delhaize-data-breach-amid-inc-ransomware-claims/

Ahold Delhaize, a major international retail group operating supermarkets and e-commerce platforms, has confirmed a significant data breach affecting approximately 2.2 million individuals. This incident coincides with claims of an ongoing ransomware attack attributed to the INC ransomware group. While detailed technical specifics of the attack vector or exploited vulnerabilities are not disclosed, the breach involves unauthorized access to sensitive data, likely including personal and possibly financial information of customers and employees. The ransomware aspect suggests that attackers not only exfiltrated data but also attempted to encrypt internal systems to disrupt operations and extort ransom payments. The breach was publicly reported via a Reddit InfoSec news post linking to an external source (hackread.com), indicating the information is recent but with minimal discussion and limited technical details. The lack of known exploits in the wild and absence of patch information imply that the attack leveraged either zero-day vulnerabilities or social engineering tactics rather than widely known software flaws. The incident highlights the increasing threat posed by ransomware groups that combine data theft with encryption to maximize pressure on victims. Given Ahold Delhaize's extensive retail footprint, the breach could impact multiple subsidiaries and regions, exposing a broad customer base to identity theft and fraud risks.

Detailed information about Ahold Delhaize Confirms Data Breach of 2.2M amid INC Ransomware Claims. Get real-time updates, technical details, and mitigation stra

Ahold Delhaize Confirms Data Breach of 2.2M amid INC Ransomware Claims - Live Threat Intelligence - Threat Radar | OffSeq.com

Ahold Delhaize Confirms Data Breach of 2.2M amid INC Ransomware Claims

Reddit Discussion: Ahold Delhaize Confirms Data Breach of 2.2M amid INC Ransomware Claims

Retail giant Ahold Delhaize says data breach affects 2.2 million people

Source: https://www.bleepingcomputer.com/news/security/retail-giant-ahold-delhaize-says-data-breach-affects-22-million-people/

Ahold Delhaize, a major international retail conglomerate operating numerous supermarket chains across Europe and the United States, has disclosed a significant data breach impacting approximately 2.2 million individuals. While specific technical details of the breach have not been publicly disclosed, the scale suggests unauthorized access to sensitive customer or employee data. Such breaches typically involve exploitation of vulnerabilities in corporate IT infrastructure, potentially including compromised credentials, unpatched software, or social engineering attacks. The breach likely exposed personally identifiable information (PII) such as names, contact details, payment information, or loyalty program data. Given the retailer's extensive operations, the breach may have affected multiple countries and business units. The absence of known exploits in the wild indicates the breach was discovered post-compromise, possibly through internal detection or external notification. The incident underscores the ongoing risks faced by large retail organizations, which are attractive targets due to their vast customer databases and complex supply chains. The breach's public disclosure via a reputable cybersecurity news outlet and discussion on InfoSec forums highlights its significance and potential for follow-on attacks such as phishing or identity theft targeting affected individuals.

Detailed information about Retail giant Ahold Delhaize says data breach affects 2.2 million people. Get real-time updates, technical details, and mitigation str

Retail giant Ahold Delhaize says data breach affects 2.2 million people - Live Threat Intelligence - Threat Radar | OffSeq.com

Retail giant Ahold Delhaize says data breach affects 2.2 million people

Reddit Discussion: Retail giant Ahold Delhaize says data breach affects 2.2 million people

So I cooked up a fake transaction for shits and giggles.
No valid IBAN. No real user. No device. No signature. No token. No nothing.
Just pure distilled bullshit in a JSON payload.

Guess what?
“Transaction accepted”
“attack_success”: true
“fraud_score”: 0.99999
System looked at it and said: “yeah, looks good to me.”

I even told the sandbox I was sending 10k EUR from FAKE_IBAN_901 to INVALID_IBAN_123 using a spoofed IMEI and some RSA nonsense I made up in Notepad.
Bunq backend? Nodded politely 

The reported security threat involves a critical vulnerability in bunq's sandbox environment, a digital banking platform primarily operating in the Netherlands. The researcher demonstrated the ability to submit a completely fabricated transaction payload containing invalid IBANs, spoofed device identifiers (IMEI), and fabricated cryptographic signatures without any valid authentication tokens or user credentials. Despite the lack of any legitimate transaction data or cryptographic proof, the sandbox backend accepted the transaction as valid, assigning it a near-perfect fraud score (0.99999) and marking the attack as successful. This indicates a fundamental flaw in the transaction validation logic within the sandbox environment, allowing unauthenticated and unauthorised transaction requests to be processed without proper verification. Although this was demonstrated in a sandbox environment, the implications suggest that similar validation weaknesses could exist in production systems, potentially enabling attackers to spoof transactions, bypass fraud detection, and manipulate financial operations. The absence of any patch or known exploits in the wild suggests this issue is newly discovered and not yet exploited at scale. The vulnerability stems from insufficient input validation, authentication bypass, and inadequate fraud detection mechanisms, which together create a high-risk scenario for financial fraud and system compromise.

Detailed information about Just casually broke bunq’s sandbox with 0day-level spoofing, and nobody seems to care 🇳🇱. Get real-time updates, technical details,

Just casually broke bunq’s sandbox with 0day-level spoofing, and nobody seems to care 🇳🇱 - Live Threat Intelligence - Threat Radar | OffSeq.com

Just casually broke bunq’s sandbox with 0day-level spoofing, and nobody seems to care 🇳🇱

Reddit Discussion: Just casually broke bunq’s sandbox with 0day-level spoofing, and nobody seems to care 🇳🇱

🚨 Hack Our Smart Contract, Keep the ETH – $500K Open-Source Heist Challenge Is Live

Source: https://foom.cash/hack

The reported security threat revolves around a public challenge titled "Hack Our Smart Contract, Keep the ETH – $500K Open-Source Heist Challenge Is Live," hosted on the domain foom.cash and discussed on the Reddit NetSec subreddit. This challenge invites security researchers and hackers to find vulnerabilities within a specific smart contract, presumably deployed on the Ethereum blockchain, with a reward of up to $500,000 in ETH for successful exploits. The nature of the challenge implies that the smart contract is intentionally exposed for testing and exploitation, likely as a bug bounty or security research exercise. However, the presence of such a challenge also highlights the inherent risks associated with smart contracts, which are immutable once deployed and can hold significant financial value. The tags associated with the threat include "rce" (remote code execution), suggesting that the challenge or the underlying smart contract may involve vulnerabilities that could allow execution of arbitrary code or manipulation of contract logic. Although no specific affected versions or CVEs are listed, the challenge's existence underscores the ongoing security concerns in decentralized finance (DeFi) and blockchain ecosystems, where smart contract vulnerabilities can lead to substantial financial losses. The technical details indicate minimal discussion and a low Reddit score, suggesting limited community engagement or awareness at this time. No known exploits in the wild have been reported, and the source domain is not marked as trusted, which may indicate a need for caution when interacting with the challenge platform itself. Overall, this threat highlights the dual-edged nature of open-source smart contract challenges: they promote security research but also expose potential attack vectors that could be exploited if similar vulnerabilities exist in production contracts.

Detailed information about 🚨 Hack Our Smart Contract, Keep the ETH – $500K Open-Source Heist Challenge Is Live. Get real-time updates, technical details, and m

🚨 Hack Our Smart Contract, Keep the ETH – $500K Open-Source Heist Challenge Is Live - Live Threat Intelligence - Threat Radar | OffSeq.com

🚨 Hack Our Smart Contract, Keep the ETH – $500K Open-Source Heist Challenge Is Live

Reddit Discussion: 🚨 Hack Our Smart Contract, Keep the ETH – $500K Open-Source Heist Challenge Is Live

Akamai Report Warns of Sophisticated DDoS Campaigns Crippling Global Banks

Source: https://hackread.com/sophisticated-ddos-campaigns-crippling-global-banks/

The reported threat involves sophisticated Distributed Denial of Service (DDoS) campaigns targeting global banking institutions, as highlighted in a recent Akamai report referenced via a Reddit InfoSec News post. These campaigns leverage botnets—networks of compromised devices—to overwhelm the online services of banks, rendering them inaccessible to legitimate users. The sophistication likely refers to the use of advanced techniques such as multi-vector attacks combining volumetric floods, application-layer assaults, and potentially evasion tactics that bypass traditional DDoS mitigation solutions. Although specific affected versions or exploited vulnerabilities are not detailed, the attack's nature suggests a focus on network and application infrastructure rather than software flaws. The campaigns are ongoing and recent, indicating active threat actors with significant resources. The lack of known exploits in the wild for specific software vulnerabilities implies the attack relies on sheer traffic volume and complexity rather than exploiting software bugs. Given the target—global banks—the attackers aim to disrupt critical financial services, potentially causing operational downtime, reputational damage, and financial losses. The technical details emphasize the source as a Reddit post linking to an external news article, with minimal discussion but a moderate newsworthiness score, underscoring the emerging nature of this threat.

Detailed information about Akamai Report Warns of Sophisticated DDoS Campaigns Crippling Global Banks. Get real-time updates, technical details, and mitigation 

Akamai Report Warns of Sophisticated DDoS Campaigns Crippling Global Banks - Live Threat Intelligence - Threat Radar | OffSeq.com

Akamai Report Warns of Sophisticated DDoS Campaigns Crippling Global Banks

Reddit Discussion: Akamai Report Warns of Sophisticated DDoS Campaigns Crippling Global Banks

The Kaspersky security firm has identified and identified the BlueNoroff group as one of the world’s most prolific cyberattack groups, which has been targeting Japanese banks and venture capital companies.

BlueNoroff is a well-known advanced persistent threat (APT) group primarily targeting financial institutions, notably Japanese banks and venture capital firms. Recently, Kaspersky security researchers identified new methods employed by BlueNoroff to bypass the Mark of the Web (MoTW) security feature. MoTW is a Windows security mechanism designed to flag files downloaded from the internet, restricting their execution and reducing the risk of malware infection. By circumventing MoTW, BlueNoroff enhances its ability to execute malicious payloads without triggering typical security warnings or restrictions. The group employs a sophisticated malware toolkit that leverages multiple attack techniques, as indicated by the associated MITRE ATT&CK tactics and techniques tags. These include command and control communications (T1041), input capture (T1221), spearphishing via attachments and links (T1566.001, T1566.002), execution through scripting (T1059.003, T1059.005), user execution (T1204.001, T1204.002), persistence mechanisms (T1547.008), obfuscated files or information (T1027.002), indicator removal on host (T1497.001), process injection (T1055.002), signed binary proxy execution (T1553.005), and use of system utilities (T1218.007, T1218.011), as well as application layer protocol communications (T1071.001). The combination of these techniques demonstrates BlueNoroff’s capability to infiltrate networks stealthily, maintain persistence, evade detection, and exfiltrate sensitive data. Although the group has historically focused on Japanese financial targets, the evolution of their methods to bypass MoTW suggests an increased sophistication that could threaten other regions and sectors. No specific affected software versions or known exploits in the wild are currently reported, but the threat remains active and evolving. The referenced Kaspersky report provides in-depth technical details on the bypass techniques and malware behavior.

SHA256 of a17e9fc78706431ffc8b3085380fe29f

SHA256 of 21e9ddd5753363c9a1f36240f989d3a9

SHA256 of 931d0969654af3f77fc1dab9e2bd66b1

Detailed information about BlueNoroff introduces new methods bypassing MoTW. Get real-time updates, technical details, and mitigation strategies.

BlueNoroff introduces new methods bypassing MoTW - Live Threat Intelligence - Threat Radar | OffSeq.com

BlueNoroff introduces new methods bypassing MoTW

The application is vulnerable to Server-Side Request Forgery (SSRF). An endpoint can be used to send server internal requests to other ports.

CVE-2025-49190 is a Server-Side Request Forgery (SSRF) vulnerability identified in all versions of SICK AG's SICK Field Analytics product. SSRF vulnerabilities occur when an attacker can abuse a server-side application to send crafted requests from the vulnerable server to internal or external systems. In this case, the vulnerability allows an attacker to leverage an exposed endpoint within the SICK Field Analytics application to initiate requests to arbitrary ports on internal network hosts. This can enable attackers to scan internal services, access sensitive internal resources, or potentially exploit other vulnerabilities on internal systems that are not directly accessible from the internet. The vulnerability has a CVSS 3.1 base score of 4.3, indicating a medium severity level. The vector string (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) shows that the attack can be performed remotely over the network with low attack complexity, requires low privileges (authenticated user), does not require user interaction, and impacts confidentiality with limited impact on integrity and availability. No known exploits are currently reported in the wild, and no patches have been published yet. The vulnerability is classified under CWE-918, which specifically relates to SSRF issues. Given that SICK Field Analytics is an industrial analytics platform often used in manufacturing and industrial automation environments, the SSRF vulnerability could be leveraged to pivot into internal operational technology (OT) networks or to access sensitive analytics data, potentially leading to information disclosure or further compromise within industrial control systems (ICS).

Detailed information about CVE-2025-49190: CWE-918 Server-Side Request Forgery (SSRF) in SICK AG SICK Field Analytics affecting SICK AG SICK Field Analytics. Ge

CVE-2025-49190: CWE-918 Server-Side Request Forgery (SSRF) in SICK AG SICK Field Analytics - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-49190: CWE-918 Server-Side Request Forgery (SSRF) in SICK AG SICK Field Analytics

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Richard Perdaan WC MyParcel Belgium allows Reflected XSS. This issue affects WC MyParcel Belgium: from 4.5.5 through beta.

CVE-2025-48279 is a high-severity reflected Cross-site Scripting (XSS) vulnerability identified in the WC MyParcel Belgium plugin developed by Richard Perdaan, specifically affecting versions from 4.5.5 through beta. The vulnerability arises due to improper neutralization of user-supplied input during web page generation, classified under CWE-79. This flaw allows an attacker to inject malicious scripts into web pages viewed by other users. The vulnerability is exploitable remotely over the network without requiring authentication (AV:N/AC:L/PR:N), but it does require user interaction (UI:R), such as clicking a crafted link or visiting a maliciously crafted URL. The scope is classified as changed (S:C), indicating that exploitation can affect resources beyond the vulnerable component, potentially impacting the entire web application context. The impact includes low confidentiality, integrity, and availability losses (C:L/I:L/A:L), meaning that an attacker could steal limited information, manipulate some data, or cause minor disruptions. Reflected XSS typically enables attackers to execute arbitrary JavaScript in the victim's browser, which can lead to session hijacking, phishing, or redirection to malicious sites. Although no known exploits are currently reported in the wild, the vulnerability's characteristics and the widespread use of the WC MyParcel Belgium plugin in e-commerce environments make it a significant risk. The absence of available patches at the time of publication increases the urgency for mitigation. The vulnerability affects the plugin's handling of input parameters that are reflected back in HTTP responses without proper encoding or sanitization, allowing injection of malicious payloads. Given the plugin's integration with WooCommerce platforms, the attack surface includes many online retailers using this plugin for parcel and shipping management in Belgium and potentially other European markets where the plugin is deployed.

Detailed information about CVE-2025-48279: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Richard Perdaan WC MyP

CVE-2025-48279: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Richard Perdaan WC MyParcel Belgium - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-48279: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Richard Perdaan WC MyParcel Belgium

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Alex Zaytseff Multi CryptoCurrency Payments allows SQL Injection. This issue affects Multi CryptoCurrency Payments: from n/a through 2.0.3.

CVE-2025-48141 is a critical SQL Injection vulnerability (CWE-89) found in the Alex Zaytseff Multi CryptoCurrency Payments software, affecting versions up to 2.0.3. This vulnerability arises due to improper neutralization of special elements in SQL commands, allowing an attacker to inject malicious SQL code. The vulnerability has a CVSS 3.1 base score of 9.3, indicating a critical severity level. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L) highlights that the attack can be performed remotely over the network without any privileges or user interaction, with low attack complexity. The scope is changed, meaning the vulnerability affects resources beyond the initially vulnerable component. The impact on confidentiality is high, allowing attackers to read sensitive data from the backend database, while integrity impact is none and availability impact is low. Although no known exploits are currently reported in the wild, the nature of SQL Injection vulnerabilities makes exploitation relatively straightforward for skilled attackers. The affected product, Multi CryptoCurrency Payments, is a payment processing system used to facilitate cryptocurrency transactions, which typically involves sensitive financial data and user credentials. Exploitation could lead to unauthorized data disclosure, potentially exposing transaction details, user identities, and wallet information. Given the criticality and the financial context, this vulnerability poses a significant risk to organizations relying on this software for cryptocurrency payment processing.

Detailed information about CVE-2025-48141: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in Alex Zaytseff Multi Cr

CVE-2025-48141: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in Alex Zaytseff Multi CryptoCurrency Payments - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-48141: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in Alex Zaytseff Multi CryptoCurrency Payments

Title	Severity	Type	Source	Date

Threats Affecting Luxembourg

Filter Threats

Threats Affecting Luxembourg

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility