Reddit NetSec

CVE Database V5

AlienVault OTX General

Reddit InfoSec News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

The Partnerský systém Martinus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'martinus' shortcode in all versions up to, and including, 1.7.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVE-2025-7661 is a stored Cross-Site Scripting (XSS) vulnerability identified in the Partnerský systém Martinus WordPress plugin developed by maxomatos. This vulnerability affects all versions up to and including 1.7.1. The root cause is improper neutralization of input during web page generation, specifically insufficient sanitization and output escaping of user-supplied attributes in the plugin's 'martinus' shortcode. An authenticated attacker with contributor-level privileges or higher can exploit this vulnerability by injecting arbitrary JavaScript code into pages via the shortcode attributes. Because the malicious script is stored, it executes whenever any user accesses the compromised page, potentially leading to session hijacking, defacement, or further exploitation of user accounts. The vulnerability has a CVSS 3.1 base score of 6.4, indicating a medium severity level. The attack vector is network-based, requires low attack complexity, and privileges at the contributor level, but no user interaction is needed for exploitation. The scope is changed, meaning the vulnerability can affect resources beyond the initially compromised component, such as other users viewing the injected content. No known public exploits have been reported yet, and no patches are currently linked, indicating that mitigation may require manual intervention or updates from the vendor once available.

Detailed information about CVE-2025-7661: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in maxomatos Partnerský sy

CVE-2025-7661: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in maxomatos Partnerský systém Martinus - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-7661: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in maxomatos Partnerský systém Martinus

This report examines recent activities attributed to the XDSpy threat actor, focusing on an ongoing campaign targeting Eastern European and Russian governmental entities using the XDigo malware since March 2025. The investigation stemmed from analyzing a vulnerability in LNK files, leading to the discovery of a multi-stage infection chain. The report provides analysis of the XDigo implant and its connections to previous XDSpy activities. It also details the exploitation of LNK parsing issues and infrastructure used across different campaigns. The research uncovered additional, more recent XDSpy activity employing an alternative infection chain. Targets include government entities in Eastern Europe, with a confirmed victim in Belarus.

The threat known as SadFuture represents the latest evolution of the XDSpy threat actor's activities, focusing on a sophisticated multi-stage malware campaign targeting governmental entities primarily in Eastern Europe and Russia. The campaign has been active since at least March 2025 and centers around the deployment of the XDigo implant, a malware strain linked to previous XDSpy operations. The infection chain exploits a vulnerability in the parsing of LNK (Windows shortcut) files, enabling initial compromise without requiring user authentication but potentially involving user interaction to trigger the payload. This exploitation leverages Windows' handling of LNK files to execute malicious code, a technique that bypasses some traditional security controls. The campaign infrastructure and tactics have evolved, with recent activity showing an alternative infection chain, indicating adaptability and ongoing development by the threat actor. The attack techniques include a range of tactics and procedures such as etdownloader usage, living-off-the-land binaries (LOLBins) exploitation (e.g., T1218.011), credential dumping, data staging, and command and control communications, reflecting a comprehensive and persistent attack methodology. The confirmed targeting of government entities, including a victim in Belarus, underscores the geopolitical motivations behind the campaign. The threat actor's use of multiple techniques to maintain persistence, evade detection, and exfiltrate data highlights the advanced nature of this threat. No known public exploits are currently reported, but the exploitation of LNK parsing vulnerabilities remains a critical vector. The campaign's complexity and targeted nature suggest a well-resourced adversary with significant operational capabilities.

Detailed information about SadFuture: Mapping XDSpy latest evolution. Get real-time updates, technical details, and mitigation strategies.

SadFuture: Mapping XDSpy latest evolution - Live Threat Intelligence - Threat Radar | OffSeq.com

SadFuture: Mapping XDSpy latest evolution

Cybercriminals are exploiting Discord's invite system and content delivery features to distribute malware and steal sensitive data. They use fake invite links, expired codes, and vanity URLs to redirect users to malicious servers. The attack chain involves a sophisticated combination of social engineering, multi-stage loaders, and time-based evasion tactics. Victims are tricked into authorizing a fake bot, which leads to the deployment of AsyncRAT and a customized Skuld Stealer. These malware variants target browser credentials, Discord tokens, and cryptocurrency wallets. The campaign uses trusted platforms like GitHub and Bitbucket to host encrypted payloads, and employs advanced techniques to bypass security measures and maintain persistence.

The Discord Invite Hijacking campaign is a sophisticated multi-stage attack leveraging Discord's invite system and content delivery mechanisms to distribute malware aimed at stealing sensitive information. Attackers craft fake Discord invite links, expired invite codes, and vanity URLs to redirect users to malicious Discord servers. The attack chain begins with social engineering tactics that trick victims into authorizing a malicious bot within Discord. Once authorized, this bot facilitates the deployment of two primary malware payloads: AsyncRAT, a remote access trojan capable of extensive system control, and a customized variant of Skuld Stealer, which targets browser credentials, Discord authentication tokens, and cryptocurrency wallets. The campaign employs advanced evasion techniques including time-based payload delivery and encrypted multi-stage loaders hosted on trusted platforms such as GitHub and Bitbucket, which help bypass traditional security controls and maintain persistence on infected systems. The malware leverages techniques such as credential dumping (T1005), process injection (T1055), persistence mechanisms (T1547.001), and command and control communication over standard protocols (T1071.001). The use of wallet injection techniques and targeting of cryptocurrency assets highlights a financial motivation. This campaign does not require exploitation of software vulnerabilities but relies heavily on social engineering and user interaction to initiate the infection chain. No known exploits in the wild have been reported yet, but the campaign’s use of trusted infrastructure and sophisticated evasion tactics make it a credible threat vector for users of Discord and related platforms.

Detailed information about Discord Invite Hijacking: How Fake Links Are Delivering Infostealers. Get real-time updates, technical details, and mitigation strate

Discord Invite Hijacking: How Fake Links Are Delivering Infostealers - Live Threat Intelligence - Threat Radar | OffSeq.com

Discord Invite Hijacking: How Fake Links Are Delivering Infostealers

An investigation into domains associated with the LummaC2 infostealing-malware campaign revealed a broader network of nearly 500 domains with highly malicious risk scores. These domains share similar registration patterns, including the use of Eastern European names and the inbox[.]eu email domain. The domains predominantly advertise technical education courses, but are likely lures for malware delivery. Four domains were identified as LummaC2 login panels. The campaign's infrastructure uses specific TLDs, naming conventions, and a Hong Kong address linked to OFAC-sanctioned entities. Security teams are advised to monitor for similar domain patterns, scrutinize suspicious training sites, and educate users about the risks.

The LummaC2 campaign represents a sophisticated infostealing malware operation that leverages an extensive and covert domain infrastructure to facilitate malware delivery and command-and-control (C2) activities. Investigations have uncovered nearly 500 domains linked to this campaign, characterized by highly malicious risk scores and consistent registration patterns. These domains predominantly use Eastern European personal names and the inbox[.]eu email domain for registration, suggesting a coordinated effort to mask the true operators. The domains primarily masquerade as providers of technical education courses, a tactic designed to lure victims into engaging with malicious content under the guise of legitimate training resources. Among these, four domains have been identified as actual LummaC2 login panels, serving as interfaces for threat actors to manage infected systems or distribute malware payloads. The infrastructure employs specific top-level domains (TLDs) and naming conventions, and intriguingly, includes a Hong Kong address linked to entities sanctioned by the Office of Foreign Assets Control (OFAC), indicating potential geopolitical or regulatory evasion strategies. The campaign aligns with several MITRE ATT&CK techniques, including spearphishing via service (T1566.002), establishing and using infrastructure (T1583.001), domain generation algorithms or domain fronting (T1589.002), and leveraging compromised or malicious domains (T1585, T1584.001). Although no known exploits are currently active in the wild, the campaign’s infrastructure and tactics pose a significant risk for credential theft, data exfiltration, and further malware dissemination. Security teams are advised to monitor for domain registration patterns similar to those identified, scrutinize suspicious technical education websites, and implement user awareness programs to mitigate the risk of social engineering attacks associated with this campaign.

Detailed information about Part 2: Tracking LummaC2 Infrastructure. Get real-time updates, technical details, and mitigation strategies.

Part 2: Tracking LummaC2 Infrastructure - Live Threat Intelligence - Threat Radar | OffSeq.com

Part 2: Tracking LummaC2 Infrastructure

Check Point Research uncovered a malware campaign exploiting expired Discord invite links to redirect users to malicious servers. The attackers use a combination of techniques including ClickFix phishing, multi-stage loaders, and time-based evasions to deliver AsyncRAT and a customized Skuld Stealer targeting crypto wallets. The campaign leverages trusted cloud services for payload delivery and data exfiltration to avoid detection. The operation continues to evolve, with threat actors now able to bypass Chrome's App Bound Encryption using adapted tools like ChromeKatz to steal cookies from new Chromium browser versions. The campaign highlights how subtle features in Discord's invite system can be exploited as attack vectors.

The threat campaign titled "From Trust to Threat: Hijacked Discord Invites Used for Multi-Stage Malware Delivery" involves a sophisticated multi-stage malware distribution operation exploiting expired Discord invite links. Attackers hijack these expired invites to redirect users to malicious servers, leveraging the inherent trust users place in Discord invite links. The campaign employs ClickFix phishing techniques to lure victims into interacting with malicious content. It uses multi-stage loaders and time-based evasion tactics to avoid detection by security solutions. The primary payloads delivered are AsyncRAT, a remote access trojan capable of extensive system control, and a customized variant of the Skuld Stealer malware specifically targeting cryptocurrency wallets, aiming to exfiltrate sensitive financial data. The attackers utilize trusted cloud services for both payload delivery and data exfiltration, which helps them blend their malicious traffic with legitimate network activity, further complicating detection efforts. Notably, the campaign has evolved to bypass Chrome's App Bound Encryption, a security feature designed to protect browser cookies, by using an adapted tool named ChromeKatz. This capability allows the threat actors to steal cookies from the latest Chromium-based browsers, potentially enabling session hijacking and unauthorized access to web accounts. The exploitation of subtle features in Discord's invite system as an attack vector highlights the innovative approach of the adversaries. Indicators of compromise include multiple malware hashes, IP addresses, and domains such as captchaguard.me and microads.top, which are involved in the campaign's infrastructure. The campaign is ongoing and continues to adapt, underscoring the persistent threat it poses to users relying on Discord and Chromium browsers.

Detailed information about From Trust to Threat: Hijacked Discord Invites Used for Multi-Stage Malware Delivery. Get real-time updates, technical details, and m

From Trust to Threat: Hijacked Discord Invites Used for Multi-Stage Malware Delivery - Live Threat Intelligence - Threat Radar | OffSeq.com

From Trust to Threat: Hijacked Discord Invites Used for Multi-Stage Malware Delivery

New PathWiper Malware Strikes Ukraine's Critical Infrastructure

Source: https://hackread.com/pathwiper-malware-hit-ukraines-critical-infrastructure/

The PathWiper malware is a newly identified malicious software campaign targeting Ukraine's critical infrastructure. While detailed technical specifics of the malware's operation are limited, the designation as 'PathWiper' suggests destructive capabilities, likely involving the wiping or deletion of file system paths or critical data. The malware's targeting of critical infrastructure implies an intent to disrupt essential services such as energy, water, transportation, or communications networks. Given the critical infrastructure context, the malware may employ sophisticated techniques to evade detection, persist within operational technology (OT) environments, and cause significant operational disruption. The lack of detailed indicators or affected versions suggests this is an emerging threat with limited public technical disclosure, but the critical severity rating underscores the potential for severe impact. The source of information is a Reddit post linking to a cybersecurity news article, indicating early-stage reporting rather than comprehensive technical analysis. No known exploits in the wild have been confirmed, but the urgency and critical classification imply active or imminent threat activity. Overall, PathWiper represents a high-risk malware threat aimed at destabilizing vital infrastructure systems, likely leveraging destructive payloads to impair availability and operational continuity.

Detailed information about New PathWiper Malware Strikes Ukraine's Critical Infrastructure. Get real-time updates, technical details, and mitigation strategies.

New PathWiper Malware Strikes Ukraine's Critical Infrastructure - Live Threat Intelligence - Threat Radar | OffSeq.com

New PathWiper Malware Strikes Ukraine's Critical Infrastructure

New PathWiper Data Wiper Malware Disrupts Ukrainian Critical Infrastructure in 2025 Attack

The PathWiper malware is a newly identified data wiper malware that reportedly disrupted Ukrainian critical infrastructure in an attack occurring in 2025. Data wiper malware is designed to irreversibly delete or corrupt data on infected systems, rendering them unusable and causing significant operational disruption. Although specific technical details such as infection vectors, propagation methods, or targeted systems are not provided, the critical severity classification and the targeting of critical infrastructure suggest a sophisticated attack aimed at causing maximum damage to essential services. Data wipers typically overwrite or erase data at the file system or disk level, often bypassing recovery mechanisms, which can lead to prolonged outages and require extensive recovery efforts. The attack on Ukrainian critical infrastructure aligns with a pattern of cyberattacks targeting national infrastructure to cause disruption and potentially influence geopolitical situations. The lack of known exploits in the wild and minimal discussion on Reddit indicates this is a newly emerging threat with limited public technical analysis available. However, the critical impact on infrastructure highlights the urgency for organizations to understand and prepare for such threats.

Detailed information about New PathWiper Data Wiper Malware Disrupts Ukrainian Critical Infrastructure in 2025 Attack. Get real-time updates, technical details,

New PathWiper Data Wiper Malware Disrupts Ukrainian Critical Infrastructure in 2025 Attack - Live Threat Intelligence - Threat Radar | OffSeq.com

A spear phishing campaign targeting Polish entities has been observed, exploiting the CVE-2024-42009 vulnerability in Roundcube to steal user credentials. The campaign, attributed to UNC1151, involves sending emails with malicious JavaScript that installs a Service Worker in the victim's browser. This worker intercepts login attempts and sends credentials to the attackers. The exploit allows code execution when an email is opened. A new vulnerability, CVE-2025-49113, has also been discovered in Roundcube, potentially creating a more effective attack chain. The attackers use harvested credentials to analyze mailboxes, download address books, and spread further phishing messages. Organizations using Roundcube are advised to update their installations and review logs for indicators of compromise.

This threat involves a spearphishing campaign attributed to the threat actor UNC1151 targeting Polish entities by exploiting a critical vulnerability in the Roundcube webmail client, specifically CVE-2024-42009. Roundcube is a widely used open-source webmail solution deployed by many organizations for email access. The attack vector leverages malicious JavaScript embedded in spearphishing emails that, when opened, execute code allowing the installation of a Service Worker in the victim's browser. This Service Worker operates stealthily to intercept login attempts to Roundcube, capturing user credentials and transmitting them to attacker-controlled infrastructure. The exploit allows code execution simply upon opening the email, bypassing traditional security controls that rely on user interaction beyond opening the message. Additionally, a newly discovered vulnerability, CVE-2025-49113, in Roundcube may be chained with CVE-2024-42009 to create a more effective and persistent attack vector, potentially increasing the scope and impact of the campaign. After credential theft, UNC1151 uses the compromised accounts to analyze mailboxes, extract address books, and propagate further phishing emails internally, facilitating lateral movement and expanding their foothold within targeted organizations. The campaign employs advanced tactics such as service worker abuse (T1059.007), credential access (T1078), and spearphishing (T1566.001). Indicators of compromise include specific IP addresses, domains, URLs, and file hashes linked to the campaign. Organizations running Roundcube installations are urged to update their software promptly and conduct thorough log reviews for signs of compromise, such as unusual service worker registrations or unexpected login patterns.

Detailed information about UNC1151 exploiting Roundcube to steal user credentials in a spearphishing campaign. Get real-time updates, technical details, and mit

UNC1151 exploiting Roundcube to steal user credentials in a spearphishing campaign - Live Threat Intelligence - Threat Radar | OffSeq.com

UNC1151 exploiting Roundcube to steal user credentials in a spearphishing campaign

A destructive attack on Ukrainian critical infrastructure using a new wiper malware called 'PathWiper' has been observed. The attack, attributed to a Russia-nexus APT group, utilized a legitimate endpoint administration framework to deploy the wiper across connected endpoints. PathWiper overwrites file system artifacts with random data, targeting physical drives, volumes, and network shared drives. Its capabilities are similar to HermeticWiper, previously used against Ukrainian entities. The malware's sophisticated approach to identifying and corrupting connected drives and volumes distinguishes it from earlier wipers. This attack underscores the ongoing threat to Ukrainian infrastructure despite the prolonged conflict with Russia.

PathWiper is a newly identified destructive wiper malware targeting critical infrastructure in Ukraine, attributed to a Russia-nexus advanced persistent threat (APT) group. The malware is deployed using a legitimate endpoint administration framework, allowing it to propagate stealthily across connected endpoints within a network. Unlike ransomware or data theft malware, PathWiper's primary objective is data destruction. It overwrites file system artifacts with random data, targeting physical drives, logical volumes, and network shared drives, rendering affected systems unusable and data irrecoverable. This destructive behavior is similar to the previously observed HermeticWiper but PathWiper distinguishes itself with a more sophisticated mechanism for identifying and corrupting connected drives and volumes. The use of legitimate administrative tools for deployment indicates a high level of operational security and sophistication, complicating detection and response efforts. The malware's tactics align with multiple MITRE ATT&CK techniques, including persistence (T1543), credential access (T1078), discovery (T1082, T1083), defense evasion (T1070), lateral movement (T1135), command and control (T1059.003, T1059.005), and impact (T1490). No public exploits or patches currently exist, and detection relies on indicators such as the provided malware hash. This attack highlights the ongoing cyber threat to Ukrainian critical infrastructure amid geopolitical conflict, emphasizing the use of destructive malware as a strategic weapon to disrupt essential services.

Detailed information about Newly identified wiper malware 'PathWiper' targets critical infrastructure in Ukraine. Get real-time updates, technical details, and 

Newly identified wiper malware 'PathWiper' targets critical infrastructure in Ukraine - Live Threat Intelligence - Threat Radar | OffSeq.com

Newly identified wiper malware 'PathWiper' targets critical infrastructure in Ukraine

International law enforcement agencies have taken additional actions in Operation Endgame, targeting cybercriminal organizations, particularly those behind DanaBot. DanaBot is a powerful modular malware family written in Delphi, capable of keylogging, capturing screenshots, recording desktop videos, exfiltrating files, injecting content into web browsers, and deploying second-stage malware. It operates as a Malware-as-a-Service platform, enabling various attacks. DanaBot has been used in targeted attacks against government officials in the Middle East and Eastern Europe, and for DDoS attacks against Ukrainian servers. The malware implements a custom binary protocol encrypted with RSA and AES, and uses hardcoded C2 servers with Tor as a backup communication channel. Over 50 nicknames have been associated with DanaBot affiliates.

Operation Endgame 2.0 represents a coordinated international law enforcement effort targeting cybercriminal groups operating the DanaBot malware family. DanaBot is a sophisticated modular malware platform developed in Delphi, notable for its extensive capabilities including keylogging, screenshot capture, desktop video recording, file exfiltration, web browser content injection, and deployment of secondary malware payloads. Functioning as Malware-as-a-Service (MaaS), DanaBot enables affiliates to conduct a variety of cyberattacks without requiring deep technical expertise. The malware communicates with its command and control (C2) infrastructure using a custom binary protocol secured with RSA and AES encryption, enhancing its resilience against interception and analysis. It relies on hardcoded C2 servers and employs Tor as a fallback communication channel, complicating efforts to disrupt its operations. Historically, DanaBot has been leveraged in targeted espionage campaigns against government officials in the Middle East and Eastern Europe, as well as in distributed denial-of-service (DDoS) attacks targeting Ukrainian servers. The presence of over 50 known affiliate nicknames indicates a broad and decentralized operator base. The malware’s use of advanced techniques such as credential dumping (T1003), persistence mechanisms (T1543, T1547), lateral movement (T1090), and execution through user interaction (T1204) underscores its versatility and threat level. Despite the absence of known exploits in the wild for specific software vulnerabilities, DanaBot’s modularity and MaaS model make it a persistent and adaptable threat vector.

Detailed information about Operation Endgame 2.0. Get real-time updates, technical details, and mitigation strategies.

Title	Severity	Type	Source	Date

Threats Affecting Slovakia

Filter Threats

Threats Affecting Slovakia

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility