Reddit NetSec

AlienVault OTX General

CVE Database V5

Exploit-DB RSS Feed

Reddit InfoSec News

CIRCL OSINT Feed

ThreatFox MISP Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

New Predator spyware infrastructure revealed activity in Mozambique for first time

Source: https://securityaffairs.com/179036/hacking/new-predator-spyware-infrastructure-revealed-activity-in-mozambique-for-first-time.html

The newly revealed Predator spyware infrastructure has been observed operating in Mozambique for the first time, marking an expansion of its known geographical footprint. Predator is a sophisticated spyware platform typically used for targeted surveillance and intelligence gathering. It is capable of infiltrating devices to exfiltrate sensitive data, monitor communications, and potentially manipulate device functions. While specific technical details about this particular infrastructure instance are limited, Predator spyware is known to exploit zero-day vulnerabilities and employs stealth techniques to evade detection. The spyware often targets mobile devices and computers, leveraging social engineering or direct exploitation to gain initial access. The revelation of Predator activity in Mozambique suggests a strategic targeting of entities within this region, possibly linked to political, economic, or security interests. Although no known exploits are currently reported in the wild for this infrastructure, the presence of such spyware indicates a high level of threat sophistication and potential for significant data compromise. The medium severity rating reflects the spyware's capabilities and the current limited scope of observed activity, but the risk remains substantial given the nature of spyware operations.

Detailed information about New Predator spyware infrastructure revealed activity in Mozambique for first time. Get real-time updates, technical details, and mit

New Predator spyware infrastructure revealed activity in Mozambique for first time - Live Threat Intelligence - Threat Radar | OffSeq.com

New Predator spyware infrastructure revealed activity in Mozambique for first time

Reddit Discussion: New Predator spyware infrastructure revealed activity in Mozambique for first time

Paraguay Suffered Data Breach: 7.4 Million Citizen Records Leaked on Dark Web

Source: https://securityaffairs.com/178970/data-breach/paraguay-suffered-data-breach-7-4-million-citizen-records-leaked-on-dark-web.html

The reported security incident involves a significant data breach affecting Paraguay, where approximately 7.4 million citizen records were leaked and subsequently made available on the dark web. Although specific technical details about the breach vector, exploited vulnerabilities, or affected systems are not provided, the scale of the data exposure suggests a compromise of a major government or public sector database containing sensitive personal information. The leaked data likely includes personally identifiable information (PII) such as names, identification numbers, addresses, and possibly other sensitive demographic or biometric data. The breach was publicly disclosed via a Reddit post on the InfoSecNews subreddit, referencing an external news source (securityaffairs.com), which confirms the incident's authenticity and newsworthiness. There is no indication of known exploits in the wild related to this breach, nor are there patch links or specific affected software versions mentioned. The breach's high severity classification reflects the potential for widespread identity theft, fraud, and privacy violations for the affected population. Given the absence of detailed technical indicators, the breach likely resulted from either a compromise of government infrastructure, insider threats, or inadequate security controls protecting citizen data repositories.

Detailed information about Paraguay Suffered Data Breach: 7.4 Million Citizen Records Leaked on Dark Web. Get real-time updates, technical details, and mitigati

Paraguay Suffered Data Breach: 7.4 Million Citizen Records Leaked on Dark Web - Live Threat Intelligence - Threat Radar | OffSeq.com

Paraguay Suffered Data Breach: 7.4 Million Citizen Records Leaked on Dark Web

Reddit Discussion: Paraguay Suffered Data Breach: 7.4 Million Citizen Records Leaked on Dark Web

Use of fixed learning codes, one code to lock the car and the other code to unlock it, the Key Fob Transmitter in KIA-branded Aftermarket Generic Smart  Keyless Entry System, primarily distributed in Ecuador, which allows a replay attack.

Manufacture is unknown at the time of release.  CVE Record will be updated once this is clarified.

CVE-2025-6029 is a critical vulnerability identified in the KIA-branded Aftermarket Generic Smart Keyless Entry System, specifically affecting key fobs distributed primarily in Ecuador for the 2022 and 2023 versions. The core technical issue stems from the use of fixed learning codes—one code for locking and another for unlocking the vehicle. This design flaw violates secure authentication principles by allowing replay attacks, where an attacker can capture and retransmit these fixed codes to gain unauthorized access to the vehicle. The vulnerability is classified under CWE-307 (Improper Restriction of Excessive Authentication Attempts) and CWE-294 (Authentication Bypass by Capture-Replay), indicating that the system neither limits repeated authentication attempts nor employs dynamic or rolling codes to prevent replay. The CVSS 4.0 score of 9.4 (critical) reflects the high impact and ease of exploitation: the attack vector is adjacent (likely requiring proximity), no privileges or user interaction are needed, and the vulnerability affects confidentiality, integrity, and availability at a high level. The lack of authentication requirement and the absence of user interaction make this vulnerability particularly dangerous for vehicle owners. Although the manufacturer of the aftermarket system is currently unknown, the vulnerability affects KIA-branded key fobs, which suggests a supply chain or third-party component risk. No patches or known exploits in the wild have been reported yet, but the critical severity and straightforward attack method imply a high risk of exploitation once publicized. The vulnerability's technical details emphasize the systemic failure to restrict excessive authentication attempts and the use of static codes, which are outdated and insecure for keyless entry systems.

Detailed information about CVE-2025-6029: CWE-307 Improper Restriction of Excessive Authentication Attempts in KIA Aftermarket Generic Smart Keyless Entry Syste

CVE-2025-6029: CWE-307 Improper Restriction of Excessive Authentication Attempts in KIA Aftermarket Generic Smart Keyless Entry System - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-6029: CWE-307 Improper Restriction of Excessive Authentication Attempts in KIA Aftermarket Generic Smart Keyless Entry System

A vulnerability, which was classified as problematic, has been found in PHPGurukul Restaurant Table Booking System 1.0. Affected by this issue is some unknown functionality of the file /check-status.php. The manipulation of the argument searchdata leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

CVE-2025-5974 is a cross-site scripting (XSS) vulnerability identified in version 1.0 of the PHPGurukul Restaurant Table Booking System, specifically within the /check-status.php file. The vulnerability arises from improper sanitization or validation of the 'searchdata' parameter, which an attacker can manipulate to inject malicious scripts. This flaw allows an attacker to execute arbitrary JavaScript code in the context of a victim's browser when they access a crafted URL or interact with the vulnerable functionality. The attack vector is remote and does not require prior authentication, although user interaction is necessary to trigger the payload (e.g., clicking a malicious link). The CVSS 4.0 score is 5.1, indicating a medium severity level. The vulnerability impacts confidentiality and integrity to a limited extent by potentially stealing session cookies, performing actions on behalf of the user, or defacing the user interface. Availability impact is negligible. The vulnerability is exploitable with low attack complexity and no privileges required, but user interaction is needed. No public exploits are currently known in the wild, but the exploit details have been disclosed publicly, increasing the risk of exploitation. The affected product is a niche web application used for restaurant table booking, which may be deployed by small to medium-sized hospitality businesses. The lack of available patches or vendor advisories suggests that mitigation relies on manual intervention or custom fixes.

Detailed information about CVE-2025-5974: Cross Site Scripting in PHPGurukul Restaurant Table Booking System affecting PHPGurukul Restaurant Table Booking Syste

CVE-2025-5974: Cross Site Scripting in PHPGurukul Restaurant Table Booking System - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-5974: Cross Site Scripting in PHPGurukul Restaurant Table Booking System

Hive0131 is conducting email campaigns targeting users in Colombia with fake electronic notifications of criminal proceedings, purportedly from The Judiciary of Colombia. The campaigns deliver DCRat, a banking trojan operated as Malware-as-a-Service, through embedded links or PDF lures. DCRat's presence has increased in Latin America since 2024. The infection chain involves downloading a loader called VMDetectLoader, which uses process hollowing to inject DCRat into memory. VMDetectLoader can detect virtual machines and create persistence through scheduled tasks or registry keys. DCRat has various capabilities including recording victims, file manipulation, and keystroke logging. IBM X-Force assesses that Latin America will continue facing targeting from actors deploying banking trojans via phishing campaigns.

The threat involves a growing campaign by the threat actor Hive0131 targeting users primarily in Colombia through phishing emails masquerading as official communications from The Judiciary of Colombia. These emails contain embedded links or PDF attachments designed to lure victims into downloading a loader known as VMDetectLoader. This loader employs advanced evasion techniques such as virtual machine detection to avoid sandbox analysis and uses process hollowing to inject the DCRat banking trojan directly into memory, thereby minimizing its footprint on disk and evading traditional antivirus detection. VMDetectLoader also establishes persistence on infected systems via scheduled tasks or registry modifications. DCRat itself is a Malware-as-a-Service (MaaS) banking trojan with a broad range of capabilities including keystroke logging, file manipulation, and recording victim activity, enabling attackers to steal sensitive financial credentials and other confidential information. The campaign leverages multiple MITRE ATT&CK techniques such as T1566 (phishing), T1055 (process hollowing), T1547 (persistence), and T1056 (input capture), demonstrating a sophisticated multi-stage infection chain. Although currently focused on Latin America, particularly Colombia, the malware’s modularity and MaaS model suggest potential for expansion. IBM X-Force notes an increasing trend of banking trojan campaigns in the region since 2024, indicating sustained threat activity. Indicators of compromise include specific malicious domains and file hashes associated with the loader and trojan components. No known public exploits exist, but the campaign’s reliance on social engineering and evasion techniques makes it a persistent threat vector.

Detailed information about Threat Analysis: DCRat presence growing in Latin America. Get real-time updates, technical details, and mitigation strategies.

Threat Analysis: DCRat presence growing in Latin America - Live Threat Intelligence - Threat Radar | OffSeq.com

Threat Analysis: DCRat presence growing in Latin America

A spam campaign targeting Brazilian users, particularly C-level executives and financial/HR accounts, has been identified since January 2025. The campaign exploits commercial remote monitoring and management (RMM) tools, specifically PDQ Connect and N-able remote access tools. Attackers use Brazilian electronic invoice system (NF-e) as bait, leading victims to malicious content on Dropbox. The threat actor, likely an initial access broker, abuses free trial periods of RMM tools to gain complete control of target machines. The campaign's objective is to create a network of compromised machines for potential sale to third parties, including ransomware operators and state-sponsored actors. The abuse of commercial RMM tools is increasing due to their digital signatures, full backdoor capabilities, and low cost.

Since January 2025, a spam campaign has been targeting Brazilian users, with a particular focus on C-level executives and financial or HR personnel. The attackers leverage commercial Remote Monitoring and Management (RMM) tools, specifically PDQ Connect and N-able remote access software, to gain unauthorized access to victim machines. The campaign uses the Brazilian electronic invoice system (NF-e) as a lure, sending emails that appear legitimate and entice victims to click links leading to malicious content hosted on Dropbox. The threat actors exploit free trial periods of these RMM tools to deploy fully signed backdoors, enabling complete remote control over compromised systems. This access is then monetized by creating a network of infected machines, which are potentially sold to ransomware operators or state-sponsored groups. The abuse of commercial RMM tools is increasingly attractive to attackers due to their trusted digital signatures, comprehensive remote access capabilities, and relatively low cost. The campaign employs multiple tactics including social engineering (T1566), masquerading (T1036), command execution (T1059.001), and credential access (T1078), consistent with initial access broker behavior. Although no specific vulnerable versions are identified, the campaign exploits the inherent trust and functionality of legitimate RMM software rather than software vulnerabilities. No known exploits in the wild have been reported beyond this campaign. The campaign's technical details and indicators of compromise are documented by AlienVault and Talos Intelligence, providing actionable intelligence for detection and response.

Detailed information about Spam campaign targeting Brazil abuses Remote Monitoring and Management tools. Get real-time updates, technical details, and mitigatio

Spam campaign targeting Brazil abuses Remote Monitoring and Management tools - Live Threat Intelligence - Threat Radar | OffSeq.com

Spam campaign targeting Brazil abuses Remote Monitoring and Management tools

Missing Authorization vulnerability in facturaone TicketBAI Facturas para WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects TicketBAI Facturas para WooCommerce: from n/a through 3.19.

CVE-2025-24762 is a Missing Authorization vulnerability (CWE-862) identified in the TicketBAI Facturas para WooCommerce plugin developed by facturaone. This plugin integrates TicketBAI invoicing functionality into WooCommerce, a widely used e-commerce platform on WordPress. The vulnerability arises due to improperly configured access control mechanisms, allowing users with limited privileges (requiring at least low-level privileges, as indicated by PR:L) to perform actions or access resources beyond their authorization scope. The CVSS 3.1 base score of 5.4 (medium severity) reflects that the vulnerability can be exploited remotely over the network (AV:N) with low attack complexity (AC:L), does not require user interaction (UI:N), and impacts integrity and availability (I:L, A:L) but not confidentiality (C:N). The scope remains unchanged (S:U), meaning the impact is confined to the vulnerable component without affecting other system components. Exploitation could lead to unauthorized modifications or disruptions in the invoicing process, potentially causing data integrity issues or service availability problems within the WooCommerce environment. No known exploits are currently reported in the wild, and no patches have been published yet. The vulnerability affects all versions up to 3.19, with no specific version range provided. Given the plugin’s role in financial transactions and compliance reporting (TicketBAI is a Basque Country invoicing regulation), the vulnerability could have significant operational and regulatory implications if exploited.

Detailed information about CVE-2025-24762: CWE-862 Missing Authorization in facturaone TicketBAI Facturas para WooCommerce affecting facturaone TicketBAI Factur

CVE-2025-24762: CWE-862 Missing Authorization in facturaone TicketBAI Facturas para WooCommerce - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-24762: CWE-862 Missing Authorization in facturaone TicketBAI Facturas para WooCommerce

Intelbras Action RF 1200 routers 1.2.2 and earlier and Action RG 1200 routers 2.1.7 and earlier expose the Password in Cookie resulting in Login Bypass.

CVE-2024-22773 is a high-severity vulnerability affecting Intelbras Action RF 1200 routers (version 1.2.2 and earlier) and Action RG 1200 routers (version 2.1.7 and earlier). The core issue involves the exposure of the router's administrative password within a cookie, which leads to a login bypass vulnerability. This means that an attacker can potentially gain unauthorized administrative access to the router's management interface without needing valid credentials or user interaction. The vulnerability is classified under CWE-922 (Improper Restriction of Operations within the Bounds of a Memory Buffer), indicating a flaw in how sensitive information is handled and protected. According to the CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), the attack vector is network-based, requiring high attack complexity but no privileges or user interaction, and impacts confidentiality, integrity, and availability to a high degree. The absence of known exploits in the wild suggests that this vulnerability is newly disclosed and may not yet be actively exploited, but the potential for severe impact remains significant. The lack of vendor or product-specific patch information highlights a possible delay or absence of official remediation at the time of publication, increasing the urgency for affected organizations to implement compensating controls.

Detailed information about CVE-2024-22773: n/a in n/a affecting n/a n/a. Get real-time updates, technical details, and mitigation strategies.

CVE-2024-22773: n/a in n/a - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2024-22773: n/a in n/a

A vulnerability was found in SoluçõesCoop iSoluçõesWEB up to 20250519 and classified as problematic. Affected by this issue is some unknown functionality of the file /fluxos-dashboard of the component Flow Handler. The manipulation of the argument Descrição da solicitação leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component.

CVE-2025-5713 is a Cross Site Scripting (XSS) vulnerability identified in the SoluçõesCoop iSoluçõesWEB product, specifically affecting versions up to 20250519. The vulnerability resides in the Flow Handler component, within the /fluxos-dashboard file, where improper handling of the 'Descrição da solicitação' parameter allows an attacker to inject malicious scripts. This injection can be exploited remotely without requiring authentication, although user interaction is necessary to trigger the payload. The vulnerability is classified as problematic and has a CVSS 4.0 base score of 5.1 (medium severity), reflecting its moderate impact and ease of exploitation. The attack vector is network-based (AV:N), with low attack complexity (AC:L), no privileges required (PR:L indicates low privileges, but the vector states no privileges needed), and user interaction required (UI:P). The vulnerability impacts the confidentiality and integrity of user sessions by potentially allowing attackers to execute arbitrary scripts in the context of the victim's browser, leading to session hijacking, defacement, or redirection to malicious sites. There is no indication that the vulnerability affects availability or requires special conditions such as scope changes or elevated privileges. Although no public exploits are currently known in the wild, the disclosure of the vulnerability and its exploitability suggest a risk of future exploitation. No official patches or updates have been linked yet, but upgrading the affected component is recommended once available.

Detailed information about CVE-2025-5713: Cross Site Scripting in SoluçõesCoop iSoluçõesWEB affecting SoluçõesCoop iSoluçõesWEB. Get real-time updates, technica

CVE-2025-5713: Cross Site Scripting in SoluçõesCoop iSoluçõesWEB - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-5713: Cross Site Scripting in SoluçõesCoop iSoluçõesWEB

A vulnerability was found in SoluçõesCoop iSoluçõesWEB up to 20250516. It has been classified as problematic. This affects an unknown part of the file /sys/up.upload.php of the component Profile Information Update. The manipulation of the argument nomeArquivo leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component.

CVE-2025-5714 is a path traversal vulnerability identified in the SoluçõesCoop iSoluçõesWEB product, specifically affecting versions up to 20250516. The vulnerability resides in the /sys/up.upload.php file within the Profile Information Update component. It is triggered by manipulation of the 'nomeArquivo' parameter, which allows an attacker to traverse directories on the server's filesystem. This can enable unauthorized access to files outside the intended directory scope. The vulnerability can be exploited remotely without requiring user interaction or authentication, as indicated by the CVSS vector (AV:N/AC:L/AT:N/UI:N/PR:L). The CVSS 4.0 base score is 5.3, categorizing it as a medium severity issue. The exploit has been publicly disclosed, increasing the risk of exploitation, although no known active exploits in the wild have been reported yet. The vulnerability impacts confidentiality primarily, as unauthorized file access could expose sensitive information. Integrity and availability impacts are limited or not evident from the current information. The vulnerability requires low attack complexity and no privileges beyond low-level access, which may be available to authenticated users or certain service accounts. No patch links are currently provided, but upgrading the affected component is recommended to remediate the issue. Given the nature of the vulnerability, attackers could potentially read sensitive configuration files, user data, or other critical files on the server, which could lead to further compromise or data leakage if leveraged in a multi-stage attack.

Detailed information about CVE-2025-5714: Path Traversal in SoluçõesCoop iSoluçõesWEB affecting SoluçõesCoop iSoluçõesWEB. Get real-time updates, technical deta

Title	Severity	Type	Source	Date

Threats Affecting Portugal

Filter Threats

Threats Affecting Portugal