The information stealer abuses legitimate APIs and libraries to exfiltrate data to Discord webhooks. The post ‘SolyxImmortal’ Information Stealer Emerges appeared first on SecurityWeek .
US officials told The New York Times that cyberattacks were used to turn off the lights in Caracas and disrupt air defense radars. The post New Reports Reinforce Cyberattack’s Role in Maduro Capture Blackout appeared first on SecurityWeek .
Posing as an ad blocker, the malicious extension crashes the browser to lure victims into installing malware. The post Malicious Chrome Extension Crashes Browser in ClickFix Variant ‘CrashFix’ appeared first on SecurityWeek .
The compromised personal information includes names, dates of birth, Social Security numbers, and employment-related data. The post 42,000 Impacted by Ingram Micro Ransomware Attack appeared first on SecurityWeek .
The Sysdig Threat Research Team analyzed VoidLink, a sophisticated Linux malware framework targeting cloud environments. Key findings include the first documented Serverside Rootkit Compilation, Chinese development with AI assistance, adaptive detection evasion, and use of the Zig programming language. VoidLink employs a multi-stage loader architecture, fileless execution techniques, and kernel-level stealth mechanisms. It features three control channels, including a covert ICMP channel, and specialized functionality for cloud and container environments. Despite its sophistication, VoidLink can be detected using runtime monitoring tools. The malware shows indicators of Chinese-speaking developers with significant kernel expertise, likely using AI-assisted development methods.
A data breach was disclosed by Spanish energy company Endesa following unauthorized access to a commercial platform managing customer information. Attackers reportedly exfiltrated over 1 terabyte of data, including sensitive financial details such as IBANs. This incident highlights risks to critical infrastructure sectors in Europe, particularly energy providers. The breach's medium severity reflects significant confidentiality impact but no known active exploits or public patches yet. European organizations, especially in energy and utilities, face potential risks from similar unauthorized access attacks. Mitigation should focus on strengthening access controls, continuous monitoring, and rapid incident response tailored to commercial platforms handling sensitive customer data. Spain and neighboring European countries with interconnected energy markets are most likely affected due to shared infrastructure and market penetration. Given the data volume and sensitivity, the threat severity is assessed as high, considering the potential for financial fraud and reputational damage. Defenders should prioritize securing customer data platforms and enhancing threat intelligence sharing within the sector.
The KRVTZ IDS alerts from January 19, 2026, report low-severity reconnaissance and scanning activities targeting AjaxPro Remote Code Execution vulnerability (CVE-2021-23758) and IIS 8.3 web servers. These include brute force attempts, suspicious user-agent strings linked to InfoBot malware, and directory brute forcing. No active exploits or patches are currently associated with these alerts, but early-stage probing could lead to more serious attacks. European countries such as Germany, France, the UK, Netherlands, Italy, Spain, and Poland are highlighted as likely affected due to market presence. The overall threat severity is medium given the potential impact if exploitation occurs.
PDFSIDER is a newly identified malware variant that utilizes DLL side-loading to deploy a covert backdoor with encrypted command-and-control capabilities. It exploits vulnerabilities in legitimate software like PDF24 Creator to bypass endpoint detection mechanisms. The malware operates primarily in memory, minimizing disk artifacts, and employs advanced anti-VM technology to evade sandboxes and analysis labs. PDFSIDER features a robust cryptographic implementation using the Botan library for secure communications. It gathers system information and provides attackers with an interactive, hidden command shell for remote execution. The malware's characteristics align with APT tradecraft, suggesting its use in cyber-espionage operations. Distribution occurs through spear-phishing emails containing ZIP archives with legitimate-looking executables.
KongTuke, a threat actor tracked since 2025, has launched a new campaign using a malicious browser extension called NexShield that impersonates uBlock Origin Lite. The extension causes browser crashes and displays fake security warnings to trick users into executing malicious commands. The campaign targets both home and corporate users, with domain-joined machines receiving a more sophisticated Python-based RAT named ModeloRAT. The attack chain involves multiple stages of obfuscation, anti-analysis techniques, and a Domain Generation Algorithm (DGA) for C2 communication. KongTuke employs extensive fingerprinting to avoid detection in analysis environments. The campaign demonstrates evolving social engineering tactics and a focus on infiltrating enterprise networks for potential lateral movement and data exfiltration.
Nicholas Moore pleaded guilty to repeatedly hacking the U.S. Supreme Court’s filing system and illegally accessing computer systems belonging to AmeriCorps and the Department of Veterans Affairs. The post Tennessee Man Pleads Guilty to Repeatedly Hacking Supreme Court’s Filing System appeared first on SecurityWeek .
This analysis examines Infostealer malware trends during December 2025, focusing on distribution methods, volume, and disguising techniques. Key findings include the prevalence of ACRStealer, LummaC2, and Stealc Infostealers, with malware primarily distributed through SEO poisoning and compromised legitimate websites. The report highlights two significant trends: the abuse of Python scripts for malware distribution and the emergence of cryptocurrency-stealing malware using Tor. Distribution methods evolved from direct blog posts to leveraging legitimate websites and forums. The analysis also notes a shift in malware execution methods, with 65.8% distributed as EXE files and 34.2% using DLL Sideloading techniques. The report emphasizes the importance of vigilance against these evolving threats and provides detailed insights into the malware's behavior and infrastructure.
CVE-2026-0613 is a high-severity vulnerability in TheLibrarian.io that allows unauthorized internal port scanning via SSRF-like behavior through its web_fetch tool. This flaw exposes sensitive system information by enabling attackers to perform GET requests to internal IP addresses and services within the Hetzner cloud environment used by TheLibrarian. The vulnerability does not require authentication or user interaction and can be exploited remotely over the network. Although no known exploits are currently in the wild, the vendor has released patches for all affected versions. European organizations using TheLibrarian.io, especially those hosted on Hetzner infrastructure, are at risk of internal network reconnaissance that could facilitate further attacks. Mitigation involves promptly applying vendor patches, restricting internal service exposure, and monitoring for unusual internal request patterns. Countries with significant Hetzner data center presence and TheLibrarian adoption, such as Germany and the Netherlands, are most likely to be affected.
The incident impacted the personal information of CIRO member firms and their registered employees. The post 750,000 Impacted by Data Breach at Canadian Investment Watchdog appeared first on SecurityWeek .
