A fake torrent titled 'One Battle After Another' is distributing malware hidden within subtitle files. This malware delivery method exploits users downloading pirated content, where malicious code is embedded in subtitle files that media players may process. The threat is classified as high severity due to the stealthy infection vector and potential for system compromise without user awareness. No known exploits in the wild have been reported yet, but the risk remains significant. European organizations could be impacted if employees or users download such torrents on corporate or personal devices connected to enterprise networks. Mitigation requires strict controls on unauthorized software downloads, subtitle file handling, and endpoint security monitoring. Countries with high torrent usage and large gaming or media consumption communities, such as Germany, the UK, France, and the Netherlands, are more likely to be affected. Given the ease of exploitation and potential for confidentiality and integrity breaches, the suggested severity is high. Defenders should focus on user education, network filtering, and endpoint detection to prevent infection from this malware vector.
The Coupang data breach was caused by a former employee who retained unauthorized system access after leaving the company. This insider threat led to a high-severity data breach compromising sensitive information. Although no known exploits are currently active in the wild, the breach highlights significant gaps in access revocation and internal security controls. European organizations should be vigilant about insider threats and ensure strict offboarding procedures. The breach primarily affects companies with similar access management challenges and those operating in e-commerce or data-sensitive sectors. Countries with strong e-commerce markets and data privacy regulations, such as Germany, France, and the UK, are particularly at risk. Mitigation requires immediate review and enforcement of identity and access management (IAM) policies, continuous monitoring for anomalous access, and comprehensive employee offboarding protocols. Given the ease of exploitation via retained access and the potential exposure of confidential data, the severity is assessed as high. Defenders must prioritize internal security hygiene to prevent similar incidents.
PyStoreRAT is a newly identified Remote Access Trojan (RAT) malware targeting OSINT researchers by leveraging GitHub repositories as its infection vector. It aims to compromise researchers who rely on open-source intelligence tools and resources hosted on GitHub. The malware's distribution through trusted platforms like GitHub increases the risk of successful infection due to perceived legitimacy. While no known exploits are currently active in the wild, the malware poses a medium-level threat given its targeted nature and potential to exfiltrate sensitive research data. European organizations involved in OSINT and cybersecurity research are at risk, especially those with active engagement in GitHub-based projects. Mitigation requires enhanced scrutiny of GitHub repositories, use of endpoint detection tools capable of identifying RAT behaviors, and strict network segmentation to limit lateral movement. Countries with strong cybersecurity research communities and high GitHub usage, such as Germany, the UK, France, and the Netherlands, are more likely to be affected. The threat is assessed as medium severity due to the targeted attack vector, moderate impact on confidentiality and integrity, and the absence of widespread exploitation or automated propagation. Defenders should prioritize monitoring for unusual GitHub repository activity and educate OSINT teams on the risks of downloading unverified code from public repositories.
Other noteworthy stories that might have slipped under the radar: Pentagon orders accelerated move to PQC, US shuts down scheme to smuggle GPUs to China, DroidLock Android ransomware. The post In Other News: PromptPwnd Attack, macOS Bounty Complaints, Chinese Hackers Trained in Cisco Academy appeared first on SecurityWeek .
The Akira ransomware group took credit for the Fieldtex Products hack in November, claiming to have stolen 14 Gb of data. The post Fieldtex Data Breach Impacts 238,000 appeared first on SecurityWeek .
We break down what happens to stolen data after a phishing attack: how it ends up on the shadow market and gets used in new phishing schemes, and what risks this poses. We also offer tips on how to protect your accounts, and minimize any impact.
The React2Shell vulnerability has escalated into large-scale global attacks, prompting emergency mitigation efforts worldwide. Although specific technical details and affected versions are not provided, the critical severity indicates a serious risk of exploitation. The attacks are reported globally, suggesting widespread impact potential. European organizations could face significant risks, especially those relying on React-based technologies or related ecosystems. No known exploits in the wild have been confirmed yet, but the rapid escalation and emergency response imply active exploitation attempts or imminent threats. Mitigation requires urgent patching once available, enhanced monitoring for suspicious activity, and network segmentation to limit potential spread. Countries with strong tech sectors and high adoption of React or JavaScript frameworks are likely more vulnerable. The threat severity is assessed as critical due to the potential for widespread compromise, ease of exploitation implied by rapid escalation, and the global scale of attacks. Defenders should prioritize immediate risk assessment and containment strategies while awaiting detailed technical advisories and patches.
MITRE has published its list of the top 25 most dangerous software weaknesses projected for 2025, highlighting critical areas of software security risk. This list serves as a prioritized guide for developers, security professionals, and organizations to focus their vulnerability management and secure coding efforts. While no specific exploits are currently known in the wild for these weaknesses, their identification underscores potential future attack vectors. European organizations relying on software development and deployment must pay close attention to these weaknesses to prevent exploitation that could compromise confidentiality, integrity, and availability. The threat landscape outlined by MITRE is relevant globally but particularly impactful in regions with high software development activity and critical infrastructure. Mitigation requires targeted secure coding practices, rigorous code reviews, and integration of automated vulnerability detection tools tailored to these weaknesses. Countries with strong technology sectors and critical infrastructure, such as Germany, France, the UK, and the Netherlands, are most likely to be affected. Given the broad scope and potential impact of these weaknesses, the suggested severity is high. Defenders should prioritize awareness and remediation efforts based on this authoritative guidance to reduce future risk exposure.
Newly disclosed vulnerabilities in React's React Server Components (RSC) can lead to denial of service (DoS) attacks and potential exposure of source code. These vulnerabilities have been reported recently and are considered high severity due to their impact on availability and confidentiality. Although no known exploits are currently active in the wild, the issues pose significant risks to applications using React RSC. The vulnerabilities do not have assigned CVSS scores yet, but their potential for remote exploitation and sensitive data exposure makes them critical to address. European organizations relying on React for server-side rendering or server components should prioritize mitigation. Countries with strong software development sectors and high adoption of React frameworks are particularly at risk. Immediate mitigation involves monitoring official React updates, applying patches once available, and implementing strict access controls and input validation on server components. Proactive threat hunting and code audits are recommended to detect any exploitation attempts early. Overall, defenders must treat these vulnerabilities with urgency to prevent service disruption and intellectual property leakage.
CISA has issued an urgent directive for federal agencies to patch a high-severity vulnerability in GeoServer that is actively being exploited. GeoServer is an open-source server for sharing geospatial data, widely used in government and enterprise environments. Although specific technical details and affected versions are not provided, the active exploitation and CISA's involvement indicate a significant risk to confidentiality, integrity, and availability of affected systems. No known public exploits have been confirmed yet, but the threat is considered high priority. European organizations using GeoServer, especially in government, urban planning, and critical infrastructure sectors, face potential risks from this flaw. Immediate patching and monitoring are essential to mitigate potential impacts. Countries with strong adoption of geospatial technologies and critical infrastructure reliance on GeoServer are most at risk. The threat severity is assessed as high due to active exploitation, potential for broad impact, and critical nature of affected data. Defenders should prioritize patch deployment, enhance network monitoring for suspicious activity, and review access controls to GeoServer instances.
All critical vulnerabilities in Microsoft, third-party, and open source code are eligible for rewards if they impact Microsoft services. The post Microsoft Bug Bounty Program Expanded to Third-Party Code appeared first on SecurityWeek .
A sophisticated Android malware campaign distributes a malicious 'RTO Challan / e-Challan' APK via WhatsApp, targeting users with a fraudulent payment app. The malware employs advanced obfuscation and hidden installation techniques to maintain persistence and control over infected devices. It establishes a custom VPN tunnel to conceal network traffic and harvests extensive personal, device, and financial data. Key capabilities include OTP interception, call behavior manipulation, and presenting fake payment interfaces to steal banking credentials. The command-and-control infrastructure uses obfuscated Base64-encoded URLs linked to malicious domains. This campaign combines social engineering, mobile malware, and financial fraud, posing a significant risk of monetary loss and identity theft. Although no CVSS score is assigned, the threat severity is assessed as high due to the impact and exploitation ease. European organizations with Android users, especially those using WhatsApp and mobile banking, should be vigilant. Mitigation requires targeted user awareness, mobile security hygiene, and network monitoring for suspicious VPN tunnels and domain connections.
The BlackForce phishing kit, first seen in August 2025, is a sophisticated phishing toolkit designed to steal credentials and bypass multi-factor authentication (MFA) using Man-in-the-Browser (MitB) attacks. It impersonates popular brands, leveraging advanced evasion techniques such as blocklists for security vendors and web crawlers to avoid detection. The kit uses a dual-channel communication setup, separating phishing servers from Telegram-based data drops, enabling real-time alerts to attackers. Its attack chain includes user validation, credential capture, and session management via a command-and-control panel. Rapid version updates indicate active development to enhance resilience and evade defenses. The kit targets users through multiple phishing domains, many mimicking streaming services, suggesting a broad attack surface. European organizations face risks from credential theft and MFA bypass, potentially leading to unauthorized access and data breaches. Mitigation requires targeted detection of phishing domains, enhanced user awareness, and monitoring of Telegram-based communications. Countries with high streaming service usage and digital service adoption, such as Spain, Germany, and the UK, are likely most affected.
Operation MoneyMount is a Russian phishing campaign targeting finance and accounting sectors by delivering Phantom stealer malware through fake payment confirmation emails. The attack uses a ZIP file containing an ISO image; when mounted, it reveals an executable that loads the stealer. Phantom stealer employs anti-analysis techniques and steals sensitive data including cryptocurrency wallets, browser data, and Discord tokens. It also features keylogging and clipboard monitoring to capture additional credentials and information. Stolen data is exfiltrated via Telegram, Discord webhooks, or FTP, making detection and blocking more challenging. The use of ISO files for initial access helps evade traditional security controls. This campaign highlights the growing sophistication of commodity stealers and the strategic targeting of financial sectors. No known exploits in the wild or CVE identifiers are associated with this malware yet. The campaign’s medium severity reflects its targeted nature and complexity of attack chain.
Participants earned rewards at the hacking competition for Grafana, Linux Kernel, Redis, MariaDB, and PostgreSQL vulnerabilities. The post $320,000 Paid Out at Zeroday.Cloud for Open Source Software Exploits appeared first on SecurityWeek .
In the Microsoft Windows ecosystem, DLLs (Dynamic Load Libraries) are PE files like regular programs. One of the main differences is that they export functions that can be called by programs that load them. By example, to call RegOpenKeyExA(), the program must first load the ADVAPI32.dll. A PE files has a lot of headers (metadata) that contain useful information used by the loader to prepare the execution in memory. One of them is the EntryPoint, it contains the (relative virtual) address where the program will start to execute.
In 2022, LastPass experienced a significant data breach impacting approximately 1.6 million users, leading to a regulatory fine by UK authorities. The breach exposed sensitive user data, raising concerns about confidentiality and user trust. Although no known exploits are currently active in the wild, the incident highlights vulnerabilities in password management services. European organizations relying on LastPass for credential management face potential risks of credential theft and subsequent unauthorized access. The breach underscores the importance of robust security controls around password vaults and multi-factor authentication. UK regulators' enforcement actions signal increased scrutiny on data protection compliance. Organizations should review their use of password managers, enforce strict access controls, and monitor for suspicious activities. The breach severity is assessed as high due to the sensitivity of compromised data and potential for widespread impact. Countries with high LastPass adoption and stringent data protection laws are most likely to be affected.
A high-severity vulnerability in Notepad++ allowed attackers to push malicious update files to users, potentially compromising their systems. The flaw enabled unauthorized code execution via the update mechanism, posing risks to confidentiality, integrity, and availability. Although no known exploits are currently in the wild, the issue was serious enough to warrant an urgent fix by the Notepad++ development team. European organizations using Notepad++ for development or administrative tasks could be targeted if attackers leverage this flaw. Mitigation involves promptly applying the fixed update and verifying update sources. Countries with high software development activity and widespread Notepad++ usage, such as Germany, France, and the UK, are most likely to be affected. The threat is assessed as high severity due to the potential for remote code execution without user interaction and broad impact scope. Defenders should prioritize patching and monitoring update channels for anomalies to prevent exploitation.
