BlueVoyant researchers have uncovered a broad, multi-pronged phishing campaign targeting Spanish-speaking users in organizations across Latin America and now Europe as well. While recent industry intelligence heavily documented attacks utilizing WhatsApp to deliver banking trojans under the umbrella of the Brazil-based eCrime group Augmented Marauder (a.k.a. Water Saci)
The ShinyHunters hacker group claimed to have stolen over 350GB of information from European Commission cloud systems. The post European Commission Reports Cyber Intrusion and Data Theft appeared first on SecurityWeek .
This report details the discovery and analysis of a Horabot malware campaign targeting primarily Mexican users. The attack chain begins with a fake CAPTCHA page leading to multiple stages of obfuscated scripts, ultimately delivering an AutoIT loader and a Delphi-based banking Trojan. The malware employs sophisticated encryption techniques, anti-VM checks, and a custom protocol for C2 communication. It also includes a spreader component written in PowerShell that harvests and exfiltrates email addresses to distribute phishing emails. The analysis reveals Brazilian Portuguese comments in the code, suggesting the threat actor's origin. The report provides detection opportunities including YARA rules and hunting queries to identify this threat.
BeatBanker is a sophisticated Android malware campaign targeting Brazil. It spreads through phishing attacks using a fake Google Play Store website. The malware combines a cryptocurrency miner and a banking Trojan capable of hijacking devices and overlaying screens. It employs creative persistence mechanisms, including playing an inaudible audio loop. BeatBanker monitors device status, disguises itself as legitimate apps, and targets cryptocurrency transactions on Binance and Trust Wallet. Recent variants have replaced the banking module with the BTMOB remote administration tool, expanding its capabilities. The threat demonstrates advanced evasion techniques, uses Firebase Cloud Messaging for command and control, and targets multiple browsers for data collection. Victims are primarily located in Brazil, with some samples spreading via WhatsApp.
Due to missing authorization check in SAP S/4HANA HCM Portugal and SAP ERP HCM Portugal, a user with high privileges could access sensitive data belonging to another company. This vulnerability has a high impact on confidentiality and does not affect integrity and availability.
A new Android banking Trojan named Massiv has been discovered, posing a significant threat to mobile banking users. This malware allows remote control of infected devices and enables Device Takeover attacks, leading to fraudulent transactions from victims' accounts. Massiv is distributed through side-loading, often masquerading as IPTV applications. It features overlay functionality, keylogging, and SMS/Push message interception to steal sensitive data. The malware has targeted government applications and digital identity wallets, particularly in Portugal. Massiv supports screen streaming and UI-tree modes for remote control, bypassing screen capture protections. The trend of malware masquerading as IPTV apps is increasing, exploiting users' willingness to install from unofficial sources.
A sophisticated spam campaign exploited Atlassian Jira Cloud to bypass security controls and target government and corporate entities. The attackers used legitimate Atlassian Cloud infrastructure to create disposable Jira instances, leveraging the platform's trusted domain reputation. The campaign targeted specific language groups, including English, French, German, Italian, Portuguese, and Russian speakers, with tailored emails redirecting to investment scams and online casinos. The operation demonstrated high automation and abuse of SaaS workflows, highlighting the need for reassessing trust assumptions in cloud-generated emails. The campaign utilized Keitaro Traffic Distribution System for redirects and focused on organizations already using Atlassian Jira, exploiting their familiarity with Jira-related emails.
A data breach was disclosed by Spanish energy company Endesa following unauthorized access to a commercial platform managing customer information. Attackers reportedly exfiltrated over 1 terabyte of data, including sensitive financial details such as IBANs. This incident highlights risks to critical infrastructure sectors in Europe, particularly energy providers. The breach's medium severity reflects significant confidentiality impact but no known active exploits or public patches yet. European organizations, especially in energy and utilities, face potential risks from similar unauthorized access attacks. Mitigation should focus on strengthening access controls, continuous monitoring, and rapid incident response tailored to commercial platforms handling sensitive customer data. Spain and neighboring European countries with interconnected energy markets are most likely affected due to shared infrastructure and market penetration. Given the data volume and sensitivity, the threat severity is assessed as high, considering the potential for financial fraud and reputational damage. Defenders should prioritize securing customer data platforms and enhancing threat intelligence sharing within the sector.
The Boto Cor-de-Rosa campaign reveals Astaroth's new strategy of exploiting WhatsApp Web for propagation. This Brazilian banking malware now uses a Python-based worm module to retrieve victims' WhatsApp contact lists and automatically send malicious messages, expanding its infection reach. The attack begins with a malicious ZIP file sent via WhatsApp, containing a Visual Basic script that downloads additional components. The malware then operates two parallel modules: a propagation module for spreading through WhatsApp contacts, and a banking module for credential stealing. This campaign demonstrates Astaroth's evolution, combining traditional malware techniques with sophisticated social engineering and multi-platform propagation, primarily targeting Brazilian users.
CVE-2026-22541 is a high-severity vulnerability affecting EFACEC QC 60/90/120 electric vehicle chargers. It involves uncontrolled resource consumption (CWE-400) triggered by a massive flood of ICMP requests targeting a critical control board within the charger. This denial of service (DoS) condition disrupts the board's operation, which is essential for managing EV interfaces, thereby rendering the charger non-functional. The vulnerability requires no authentication or user interaction and can be exploited remotely over the network. Although no known exploits are currently reported in the wild, the ease of exploitation and potential impact on EV charging infrastructure make this a significant threat. European organizations operating EFACEC chargers, especially in countries with high EV adoption and EFACEC market presence, are at risk. Mitigation involves network-level filtering of ICMP traffic, segmentation of EV charger management networks, and close collaboration with EFACEC for firmware updates once available. Countries like Portugal, Germany, France, and the Netherlands are likely most affected due to EFACEC's market footprint and EV infrastructure density.
Fake Booking reservation cancellations and fake BSODs trick victims into executing malicious code leading to RAT infections. The post Sophisticated ClickFix Campaign Targeting Hospitality Sector appeared first on SecurityWeek .
Portugal has updated its cybercrime legislation to explicitly exempt security researchers from prosecution when conducting legitimate security research activities. This legal change aims to encourage vulnerability discovery and responsible disclosure by providing legal protections to researchers who act in good faith. While this update reduces legal risks for security professionals in Portugal, it is not a direct security threat or vulnerability. Instead, it reflects a positive regulatory development that may indirectly improve cybersecurity posture by fostering more open security research. European organizations should be aware of this legal environment as it may influence the volume and nature of vulnerability disclosures originating from Portugal. No direct exploitation or attack vectors are associated with this update. The change primarily affects legal frameworks and researcher protections rather than technical systems or software. Given the nature of this information, it does not represent an immediate security threat to organizations but rather a policy shift with potential long-term benefits for cybersecurity research and defense.
Leroy Merlin, a major French DIY retail company, has disclosed a data breach impacting its systems. The breach was recently reported and is considered high severity due to potential exposure of sensitive customer or corporate data. Although technical details are limited, the incident is confirmed by a trusted cybersecurity news source. There are no known exploits in the wild linked to this breach at this time. The breach could affect confidentiality and integrity of data, with possible repercussions for customer privacy and corporate operations. European organizations, especially in France and neighboring countries, should be alert to potential phishing or fraud attempts leveraging leaked data. Mitigation should focus on enhanced monitoring, incident response readiness, and customer notification procedures. Given Leroy Merlin’s market presence, France is the most impacted country, with potential spillover effects in other European markets where the company operates. The severity is assessed as high due to the nature of the breach and potential data exposure without requiring user interaction or authentication for exploitation. Defenders should prioritize detection of suspicious activity and review access controls and data protection measures.
The Water Saci campaign is a sophisticated malware operation primarily targeting Brazilian banking and cryptocurrency platforms via WhatsApp. It employs multi-format malware delivery using various scripting languages, including a shift from PowerShell to Python, likely enhanced by AI tools to evade detection and complicate analysis. The malware features aggressive anti-sandbox techniques, extensive backdoor capabilities, and persistence mechanisms. Although currently focused on Brazil, the use of WhatsApp as a propagation vector and targeting financial applications poses a potential risk to European organizations with ties to Brazilian markets or users. The campaign’s complexity and AI-enhanced development pipeline indicate a medium severity threat with significant evasion and persistence capabilities. Defenders should prioritize monitoring WhatsApp-based phishing attempts, scrutinize multi-format file attachments, and implement advanced behavioral detection to mitigate risks. Countries with strong economic or diaspora links to Brazil and high WhatsApp usage are more likely to be affected.
A phishing campaign targeting Brazilian users spreads a banking trojan via WhatsApp Web by leveraging an open-source automation script. The attack starts with a malicious VBS script in a phishing email that downloads and executes an MSI installer and another VBS script. The second VBS installs Python and Selenium to inject malicious JavaScript into WhatsApp Web, enabling the malware to propagate by sending itself to the victim's contacts. The MSI drops an AutoIt script that monitors for Brazilian banking and cryptocurrency application windows and loads an encrypted payload into memory to evade detection. This payload specifically targets Brazilian financial institutions and cryptocurrency wallets. The campaign uses in-memory execution and automation to maintain stealth and persistence. No known exploits in the wild have been reported yet, and the campaign is currently assessed as medium severity. The attack is highly tailored to Brazilian users and financial targets but could pose risks if similar tactics spread elsewhere.
A Python-based worm propagates through WhatsApp, spreading the Eternidade stealer malware primarily targeting Brazilian devices. This malware harvests sensitive information from infected systems, leveraging social engineering via WhatsApp to self-replicate and infect new victims. Although currently focused on Brazil, the worm's propagation method and malware payload pose risks to any WhatsApp users, including European organizations with employees or contacts linked to Brazil. The worm does not require complex exploits but relies on user interaction to propagate. There is no known CVSS score, but the threat is assessed as high severity due to its potential impact on confidentiality and ease of spread. Defenders should focus on user awareness, endpoint detection, and network monitoring to mitigate infection risks. Countries with strong economic or cultural ties to Brazil and high WhatsApp usage are more likely to be affected in Europe.
Russian threat actors have created approximately 4,300 fake travel websites designed to impersonate legitimate hotel booking platforms. These fraudulent sites aim to steal payment card data from unsuspecting hotel guests by capturing their payment information during the booking process. The campaign leverages phishing tactics and domain spoofing to deceive users into trusting these fake portals. There is no indication that these sites exploit software vulnerabilities; rather, they rely on social engineering and fraudulent web infrastructure. The threat poses a high risk to travelers and hospitality businesses, particularly in Europe where travel and tourism are significant economic sectors. Organizations should be vigilant about monitoring for fraudulent domains and educating customers about verifying legitimate booking sites. Mitigation involves enhanced domain monitoring, customer awareness campaigns, and deployment of anti-phishing technologies. Countries with large tourism industries and high volumes of international travelers, such as Spain, Italy, France, Germany, and the UK, are most likely to be targeted. Given the ease of exploitation and potential for significant financial theft, the severity of this threat is assessed as high.
This intelligence report examines the connection between two Brazilian banking trojans, Maverick and Coyote. The malware spreads through WhatsApp, using a multi-stage attack that begins with a malicious LNK file. Both trojans share similarities in their infection methods, targeting Brazilian users and banks. The attack chain involves obfuscated PowerShell commands, downloading additional payloads from command and control servers. The malware employs anti-analysis techniques and targets specific browsers. Persistence is achieved through a batch file in the startup folder. The report provides technical details, including code samples and infection chain analysis, as well as indicators of compromise for the identified malware campaign.
A large-scale phishing campaign named ClickFix is targeting hotel systems by delivering PureRAT malware. The attack uses phishing emails to trick hotel employees into executing malicious payloads, compromising system confidentiality and integrity. PureRAT is a remote access trojan capable of data exfiltration, credential theft, and persistent access. European hotel organizations face risks of operational disruption, data breaches, and reputational damage. The threat is high severity due to the malware's capabilities and the scale of the phishing campaign. Mitigation requires targeted employee training, enhanced email filtering, network segmentation, and endpoint detection tuned for RAT behaviors. Countries with significant tourism industries and large hospitality sectors, such as Spain, Italy, France, Germany, and the UK, are most likely affected. Given the ease of phishing exploitation and the critical nature of hospitality systems, this threat demands immediate attention from European cybersecurity teams.
A sophisticated phishing campaign targets Booking.com hotel partners and their customers by compromising hotel administrators' systems with malware such as PureRAT. Attackers gain access to booking management accounts and use spear-phishing emails impersonating Booking.com to trick guests into paying twice for reservations. The campaign employs social engineering tactics, malicious sites, and a complex infrastructure involving compromised legitimate websites and bulletproof hosting. This operation is part of a broader cybercrime ecosystem offering specialized services to facilitate attacks on booking platforms. The threat impacts the confidentiality and financial integrity of hotel bookings and customer payments. European hospitality businesses relying on Booking.com, especially in countries with large tourism sectors, are at risk. Mitigation requires targeted security controls on hotel admin systems, user awareness training, and monitoring for unusual booking activities.
