Threat actors are leveraging complex routing scenarios and misconfigured spoof protections to send phishing emails that appear to be internal communications. These attacks, which have increased since May 2025, use various lures like voicemails, shared documents, and password resets to conduct credential phishing and financial scams. The campaigns, often using PhaaS platforms like Tycoon2FA, are opportunistic and target multiple industries. While Microsoft detects most attempts, organizations can further mitigate risks by properly configuring spoof protections and third-party connectors. The attacks do not affect customers whose Microsoft Exchange MX records point to Office 365, as they are protected by built-in spoofing detections.
Threat actors spoof legitimate domains to make their phishing emails appear to have been sent internally. The post Complex Routing, Misconfigurations Exploited for Domain Spoofing in Phishing Attacks appeared first on SecurityWeek .
Malicious use of QR codes has long been ubiquitous, both in the real world as well as in electronic communication. This is hardly surprising given that a scan of a QR code can lead one to a phishing page as easily as clicking a link in an e-mail.
CVE-2026-20893 is a high-severity origin validation vulnerability in Fujitsu Security Solution AuthConductor Client Basic V2 (version 2.0.25.0 and earlier). An attacker with login access to a Windows system running the affected software can exploit this flaw to execute arbitrary code with SYSTEM privileges and/or modify registry values. The vulnerability arises from improper origin validation, allowing privilege escalation without requiring user interaction. Although no known exploits are currently in the wild, the impact on confidentiality, integrity, and availability is significant. European organizations using this Fujitsu security product on Windows endpoints are at risk, especially in sectors relying on Fujitsu hardware and software. Mitigation involves promptly updating to a fixed version once available, restricting local user privileges, and monitoring registry changes. Countries with strong Fujitsu market presence and critical infrastructure using these solutions, such as Germany, the UK, and the Netherlands, are most likely to be affected.
Using fake accounts and synthetic data to lure the hackers, the researchers gathered information on their servers. The post Researchers Trap Scattered Lapsus$ Hunters in Honeypot appeared first on SecurityWeek .
The initial access broker (IAB) relies on credentials exfiltrated using information stealers to hack organizations. The post Dozens of Major Data Breaches Linked to Single Threat Actor appeared first on SecurityWeek .
The VPN company has conducted an investigation after a threat actor claimed to have hacked its systems. The post NordVPN Denies Breach After Hacker Leaks Data appeared first on SecurityWeek .
The hacking group Crimson Collective has claimed the theft of personal information pertaining to over 1 million Brightspeed customers. The post Brightspeed Investigating Cyberattack appeared first on SecurityWeek .
Recently, a new "breed" of IP-based KVM devices has been released. In the past, IP-based KVM devices required dedicated "server-grade" hardware using IPMI. They often cost several $100 per server, and are only available for specific systems that support the respective add-on cards. These cards are usually used to provide "Lights Out" access to servers, allowing a complete reboot and interaction with the pre-boot environment via simple web-based tools. In some cases, these IPMI tools can also be used via various enterprise/data center management tools.
Hackers have compromised a file transfer system at Sedgwick’s subsidiary that serves government agencies. The post Sedgwick Confirms Cyberattack on Government Subsidiary appeared first on SecurityWeek .
CVE-2025-14346 is a critical vulnerability affecting WHILL Model C2 Electric Wheelchairs and Model F Power Chairs, where Bluetooth connections lack authentication. An attacker within Bluetooth range can pair with the device without credentials or user interaction, allowing full control over movement commands, speed settings, and configuration profiles. This vulnerability poses severe risks to user safety and privacy. The CVSS score is 9.8, reflecting high impact on confidentiality, integrity, and availability. No patches are currently available, and no exploits have been observed in the wild yet. European organizations involved in healthcare, rehabilitation centers, and mobility services using these devices are at risk. Mitigation requires disabling Bluetooth when not in use, physical security controls, and close coordination with the vendor for firmware updates. Countries with higher adoption of assistive mobility devices and strong healthcare infrastructure, such as Germany, France, the UK, and the Netherlands, are likely most affected. Immediate attention is critical to prevent potential harm to vulnerable users.
The 2-million-device-strong botnet allows monetization through DDoS attacks, app installs, and the selling of proxy bandwidth. The post Kimwolf Android Botnet Grows Through Residential Proxy Networks appeared first on SecurityWeek .
For the latest discoveries in cyber research for the week of 5th January, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES Two US banks, Artisans’ Bank and VeraBank, disclosed that customer data was exposed in an August ransomware attack on their vendor, Marquis Software. The vendor was breached via SonicWall vulnerability, and while […] The post 5th January – Threat Intelligence Report appeared first on Check Point Research .
WhatsApp device fingerprinting can be useful in the delivery of sophisticated spyware, but impact is very limited without a zero-day. The post Researcher Spotlights WhatsApp Metadata Leak as Meta Begins Rolling Out Fixes appeared first on SecurityWeek .
The ShinyHunters threat actor claims to have breached US cybersecurity firm Resecurity, allegedly gaining internal access as evidenced by screenshots shared publicly. This breach involves unauthorized access to sensitive internal systems of a cybersecurity company, which could expose confidential client data and internal security methodologies. Although detailed technical specifics and affected versions are not disclosed, the breach is considered high severity due to the nature of the victim and potential data sensitivity. No known exploits or patches are currently available, and the discussion around this incident remains minimal. European organizations relying on Resecurity’s services or sharing threat intelligence with them could face indirect risks from this breach. Mitigation requires heightened vigilance around any data or communications linked to Resecurity, enhanced monitoring for suspicious activity, and verification of the integrity of shared threat intelligence. Countries with strong cybersecurity sectors and significant use of Resecurity’s services, such as the UK, Germany, and France, are more likely to be impacted. Given the breach involves unauthorized internal access without known exploitation details, the suggested severity is high due to potential confidentiality and integrity impacts and the strategic importance of the victim. Defenders should prioritize incident response readiness and scrutinize any data originating from Resecurity until further details emerge.
