Reddit NetSec

CVE Database V5

AlienVault OTX General

Exploit-DB RSS Feed

Reddit InfoSec News

CIRCL OSINT Feed

ThreatFox MISP Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

Check Point Research uncovered a malware campaign exploiting expired Discord invite links to redirect users to malicious servers. The attackers use a combination of techniques including ClickFix phishing, multi-stage loaders, and time-based evasions to deliver AsyncRAT and a customized Skuld Stealer targeting crypto wallets. The campaign leverages trusted cloud services for payload delivery and data exfiltration to avoid detection. The operation continues to evolve, with threat actors now able to bypass Chrome's App Bound Encryption using adapted tools like ChromeKatz to steal cookies from new Chromium browser versions. The campaign highlights how subtle features in Discord's invite system can be exploited as attack vectors.

The threat campaign titled "From Trust to Threat: Hijacked Discord Invites Used for Multi-Stage Malware Delivery" involves a sophisticated multi-stage malware distribution operation exploiting expired Discord invite links. Attackers hijack these expired invites to redirect users to malicious servers, leveraging the inherent trust users place in Discord invite links. The campaign employs ClickFix phishing techniques to lure victims into interacting with malicious content. It uses multi-stage loaders and time-based evasion tactics to avoid detection by security solutions. The primary payloads delivered are AsyncRAT, a remote access trojan capable of extensive system control, and a customized variant of the Skuld Stealer malware specifically targeting cryptocurrency wallets, aiming to exfiltrate sensitive financial data. The attackers utilize trusted cloud services for both payload delivery and data exfiltration, which helps them blend their malicious traffic with legitimate network activity, further complicating detection efforts. Notably, the campaign has evolved to bypass Chrome's App Bound Encryption, a security feature designed to protect browser cookies, by using an adapted tool named ChromeKatz. This capability allows the threat actors to steal cookies from the latest Chromium-based browsers, potentially enabling session hijacking and unauthorized access to web accounts. The exploitation of subtle features in Discord's invite system as an attack vector highlights the innovative approach of the adversaries. Indicators of compromise include multiple malware hashes, IP addresses, and domains such as captchaguard.me and microads.top, which are involved in the campaign's infrastructure. The campaign is ongoing and continues to adapt, underscoring the persistent threat it poses to users relying on Discord and Chromium browsers.

Detailed information about From Trust to Threat: Hijacked Discord Invites Used for Multi-Stage Malware Delivery. Get real-time updates, technical details, and m

From Trust to Threat: Hijacked Discord Invites Used for Multi-Stage Malware Delivery - Live Threat Intelligence - Threat Radar | OffSeq.com

From Trust to Threat: Hijacked Discord Invites Used for Multi-Stage Malware Delivery

New PathWiper Malware Strikes Ukraine's Critical Infrastructure

Source: https://hackread.com/pathwiper-malware-hit-ukraines-critical-infrastructure/

The PathWiper malware is a newly identified malicious software campaign targeting Ukraine's critical infrastructure, as reported on June 9, 2025. Although detailed technical specifics such as infection vectors, payload mechanisms, or exploited vulnerabilities are not provided, the malware's designation as 'PathWiper' suggests destructive capabilities, likely involving the deletion or corruption of file system paths or critical data. This type of malware typically aims to disrupt operations by wiping essential files, rendering systems inoperable, or causing data loss. The attack on critical infrastructure indicates a strategic intent to impair essential services such as energy, water, transportation, or communication networks. Given the critical infrastructure context, the malware may employ sophisticated evasion techniques and possibly leverage zero-day exploits or social engineering to gain initial access. The absence of known exploits in the wild and minimal discussion levels imply that the malware is either newly discovered or under active investigation. The source of information is a Reddit InfoSecNews post linking to hackread.com, which, while newsworthy, lacks detailed technical disclosures or official advisories. The critical severity assigned reflects the potential for significant operational disruption and national security implications. Overall, PathWiper represents a high-impact threat with destructive intent against vital infrastructure systems in Ukraine, possibly serving as a geopolitical cyberweapon or sabotage tool.

Detailed information about New PathWiper Malware Strikes Ukraine's Critical Infrastructure. Get real-time updates, technical details, and mitigation strategies.

New PathWiper Malware Strikes Ukraine's Critical Infrastructure - Live Threat Intelligence - Threat Radar | OffSeq.com

New PathWiper Malware Strikes Ukraine's Critical Infrastructure

New PathWiper Data Wiper Malware Disrupts Ukrainian Critical Infrastructure in 2025 Attack

The PathWiper malware is a newly identified data wiper threat that emerged in 2025 and has been reported to disrupt critical infrastructure in Ukraine. As a data wiper, PathWiper is designed to irreversibly delete or corrupt data on infected systems, rendering them inoperable and causing significant operational disruption. Unlike ransomware, which typically encrypts data for extortion, data wipers aim solely to destroy data and system functionality, often as part of sabotage or cyberwarfare campaigns. The attack on Ukrainian critical infrastructure suggests a targeted campaign likely intended to impair essential services such as energy, transportation, or communications. Although detailed technical specifics of PathWiper are limited, the malware’s classification as a data wiper implies it operates at a low level, potentially leveraging administrative privileges to overwrite or delete critical system files and backups. The lack of known exploits in the wild and minimal public discussion indicates this threat is either newly discovered or tightly controlled by its operators. The critical severity rating reflects the high impact potential of such malware on system availability and operational continuity, especially within critical infrastructure sectors. Given the geopolitical context, this malware is likely part of a broader cyber conflict scenario. The absence of patch links or affected versions suggests that PathWiper may exploit zero-day vulnerabilities or rely on social engineering or supply chain vectors to gain initial access. Overall, PathWiper represents a sophisticated and destructive threat with the capability to cause widespread disruption in targeted environments.

Detailed information about New PathWiper Data Wiper Malware Disrupts Ukrainian Critical Infrastructure in 2025 Attack. Get real-time updates, technical details,

New PathWiper Data Wiper Malware Disrupts Ukrainian Critical Infrastructure in 2025 Attack - Live Threat Intelligence - Threat Radar | OffSeq.com

A spear phishing campaign targeting Polish entities has been observed, exploiting the CVE-2024-42009 vulnerability in Roundcube to steal user credentials. The campaign, attributed to UNC1151, involves sending emails with malicious JavaScript that installs a Service Worker in the victim's browser. This worker intercepts login attempts and sends credentials to the attackers. The exploit allows code execution when an email is opened. A new vulnerability, CVE-2025-49113, has also been discovered in Roundcube, potentially creating a more effective attack chain. The attackers use harvested credentials to analyze mailboxes, download address books, and spread further phishing messages. Organizations using Roundcube are advised to update their installations and review logs for indicators of compromise.

The threat involves a spearphishing campaign attributed to the threat actor UNC1151 targeting Polish entities by exploiting a known vulnerability in the Roundcube webmail client, specifically CVE-2024-42009. Roundcube is a widely used open-source webmail solution, often deployed by organizations for email access. The attack vector leverages malicious JavaScript embedded in spearphishing emails that, when opened, execute code allowing the installation of a Service Worker in the victim's browser. This Service Worker operates stealthily to intercept login attempts to Roundcube, capturing user credentials and transmitting them to attacker-controlled infrastructure. The campaign exploits the ability to execute code upon email opening, bypassing traditional security controls that rely on user interaction beyond opening the message. Additionally, a newly discovered vulnerability, CVE-2025-49113, in Roundcube may be chained with CVE-2024-42009 to create a more effective and persistent attack vector, potentially increasing the scope and impact of the campaign. After credential theft, UNC1151 uses the compromised accounts to analyze mailboxes, extract address books, and propagate further phishing emails internally, facilitating lateral movement and expanding their foothold within targeted organizations. The campaign's technical details include the use of advanced tactics such as service worker abuse (T1059.007), credential access (T1078), and spearphishing (T1566.001). Indicators of compromise include specific IP addresses, domains, URLs, and file hashes linked to the campaign. Organizations running Roundcube installations are urged to update their software promptly and conduct thorough log reviews for signs of compromise, such as unusual service worker registrations or unexpected login patterns.

Detailed information about UNC1151 exploiting Roundcube to steal user credentials in a spearphishing campaign. Get real-time updates, technical details, and mit

UNC1151 exploiting Roundcube to steal user credentials in a spearphishing campaign - Live Threat Intelligence - Threat Radar | OffSeq.com

UNC1151 exploiting Roundcube to steal user credentials in a spearphishing campaign

A destructive attack on Ukrainian critical infrastructure using a new wiper malware called 'PathWiper' has been observed. The attack, attributed to a Russia-nexus APT group, utilized a legitimate endpoint administration framework to deploy the wiper across connected endpoints. PathWiper overwrites file system artifacts with random data, targeting physical drives, volumes, and network shared drives. Its capabilities are similar to HermeticWiper, previously used against Ukrainian entities. The malware's sophisticated approach to identifying and corrupting connected drives and volumes distinguishes it from earlier wipers. This attack underscores the ongoing threat to Ukrainian infrastructure despite the prolonged conflict with Russia.

PathWiper is a newly identified wiper malware deployed in destructive attacks targeting critical infrastructure in Ukraine. Attributed to a Russia-nexus advanced persistent threat (APT) group, this malware leverages a legitimate endpoint administration framework to propagate across connected endpoints within a network. Unlike typical ransomware or data theft malware, PathWiper's primary objective is data destruction. It achieves this by overwriting file system artifacts with random data, effectively corrupting physical drives, logical volumes, and network shared drives. This approach renders affected systems unusable and data irrecoverable, causing significant operational disruption. PathWiper shares functional similarities with HermeticWiper, a previously observed destructive malware used against Ukrainian entities, but distinguishes itself through a more sophisticated mechanism for identifying and corrupting connected drives and volumes. The malware’s deployment via legitimate administrative tools indicates a high level of operational security and sophistication, complicating detection and response efforts. The attack techniques align with several MITRE ATT&CK tactics and techniques, including persistence (T1543), credential access (T1078), discovery (T1082, T1083), defense evasion (T1070), lateral movement (T1135), command and control (T1059.003, T1059.005), and impact (T1490). No known public exploits or patches are currently available, and the malware’s hash is provided for detection purposes. This attack underscores the persistent and evolving cyber threat landscape faced by Ukrainian critical infrastructure amid ongoing geopolitical conflict, highlighting the use of destructive malware as a strategic weapon to disrupt essential services and infrastructure.

Detailed information about Newly identified wiper malware 'PathWiper' targets critical infrastructure in Ukraine. Get real-time updates, technical details, and 

Newly identified wiper malware 'PathWiper' targets critical infrastructure in Ukraine - Live Threat Intelligence - Threat Radar | OffSeq.com

Newly identified wiper malware 'PathWiper' targets critical infrastructure in Ukraine

International law enforcement agencies have taken additional actions in Operation Endgame, targeting cybercriminal organizations, particularly those behind DanaBot. DanaBot is a powerful modular malware family written in Delphi, capable of keylogging, capturing screenshots, recording desktop videos, exfiltrating files, injecting content into web browsers, and deploying second-stage malware. It operates as a Malware-as-a-Service platform, enabling various attacks. DanaBot has been used in targeted attacks against government officials in the Middle East and Eastern Europe, and for DDoS attacks against Ukrainian servers. The malware implements a custom binary protocol encrypted with RSA and AES, and uses hardcoded C2 servers with Tor as a backup communication channel. Over 50 nicknames have been associated with DanaBot affiliates.

Operation Endgame 2.0 represents a coordinated international law enforcement effort targeting cybercriminal groups associated with the DanaBot malware family. DanaBot is a sophisticated modular malware platform developed in Delphi, notable for its extensive capabilities including keylogging, screenshot capture, desktop video recording, file exfiltration, web browser content injection, and deployment of secondary malware payloads. Functioning as a Malware-as-a-Service (MaaS), DanaBot enables affiliates to conduct a variety of cyberattacks, ranging from espionage to distributed denial-of-service (DDoS) operations. The malware communicates with its command and control (C2) infrastructure using a custom binary protocol secured by RSA and AES encryption, enhancing its stealth and resilience. It employs hardcoded C2 servers with fallback communication via Tor hidden services, complicating detection and takedown efforts. Historically, DanaBot has been leveraged in targeted attacks against government officials primarily in the Middle East and Eastern Europe, as well as in DDoS attacks against Ukrainian servers, indicating a focus on geopolitical and strategic targets. The malware ecosystem is extensive, with over 50 known affiliate nicknames, suggesting a broad and decentralized operator base. Indicators of compromise include multiple file hashes, IP addresses predominantly located in Eastern Europe, and a Tor onion domain used for backup C2 communications. The medium severity rating reflects the malware's potent capabilities balanced against ongoing law enforcement disruptions. The modular design and MaaS model imply that DanaBot can rapidly adapt to new targets and tactics, posing a persistent threat to organizations with insufficient defenses.

Detailed information about Operation Endgame 2.0. Get real-time updates, technical details, and mitigation strategies.

Operation Endgame 2.0 - Live Threat Intelligence - Threat Radar | OffSeq.com

Operation Endgame 2.0

A vulnerability has been identified in QMS Automotive (All versions < V12.39), QMS Automotive (All versions < V12.39). User credentials are stored in plaintext in the database without any hashing mechanism. This could allow an attacker to gain access to credentials and impersonate other users.

CVE-2022-43958 is a medium-severity vulnerability identified in Siemens QMS Automotive software versions prior to V12.39. The core issue involves the insecure storage of user credentials in plaintext within the product's database, violating secure password storage best practices. Specifically, the software does not implement any hashing or encryption mechanisms to protect stored passwords, making them directly accessible in their original form. This vulnerability is classified under CWE-256, which pertains to the plaintext storage of sensitive information such as passwords. An attacker who gains access to the database—whether through SQL injection, compromised credentials, or other means—can retrieve user passwords in cleartext. This enables the attacker to impersonate legitimate users, potentially escalating privileges, accessing sensitive automotive quality management data, or disrupting operations. Although no known exploits are currently reported in the wild, the vulnerability presents a significant risk due to the critical nature of the affected system in automotive manufacturing and quality assurance processes. Siemens QMS Automotive is widely used in the automotive industry for quality management, making the confidentiality and integrity of user credentials paramount. The lack of password hashing indicates a fundamental security design flaw that could be exploited if combined with other attack vectors such as network breaches or insider threats. The vulnerability was publicly disclosed on November 8, 2022, and affects all versions before V12.39, for which no patch links have been provided yet, suggesting that remediation may require upgrading to the fixed version or applying vendor guidance once available.

Detailed information about CVE-2022-43958: CWE-256: Plaintext Storage of a Password in Siemens QMS Automotive affecting Siemens QMS Automotive. Get real-time up

CVE-2022-43958: CWE-256: Plaintext Storage of a Password in Siemens QMS Automotive - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2022-43958: CWE-256: Plaintext Storage of a Password in Siemens QMS Automotive

The WPify Woo Czech plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the maybe_send_to_packeta function in all versions up to, and including, 4.0.8. This makes it possible for unauthenticated attackers to obtain shipping details for orders as long as the order number is known.

CVE-2024-1492 is a medium-severity vulnerability identified in the WPify Woo Czech plugin for WordPress, affecting all versions up to and including 4.0.8. The vulnerability stems from improper access control (CWE-284) due to a missing capability check in the function maybe_send_to_packeta. This function is responsible for handling shipping details related to orders. Because the plugin fails to verify whether the requester is authorized, unauthenticated attackers can exploit this flaw to retrieve sensitive shipping information for any order, provided they know the order number. The exposure of shipping details can include recipient addresses, contact information, and potentially other logistics data. Although no known exploits are currently reported in the wild, the vulnerability presents a significant privacy risk and could be leveraged for targeted attacks such as social engineering, fraud, or further compromise of customer data. The plugin’s widespread use in e-commerce sites that cater to Czech and possibly broader European markets increases the risk profile. The vulnerability was reserved and published in February 2024, with no official patch available at the time of reporting, highlighting the urgency for mitigation.

Detailed information about CVE-2024-1492: CWE-284 Improper Access Control in wpify WPify Woo Czech affecting wpify WPify Woo Czech. Get real-time updates, techn

CVE-2024-1492: CWE-284 Improper Access Control in wpify WPify Woo Czech - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2024-1492: CWE-284 Improper Access Control in wpify WPify Woo Czech

Latte is an open source template engine for PHP. Versions since 2.8.0 Latte has included a template sandbox and in affected versions it has been found that a sandbox escape exists allowing for injection into web pages generated from Latte. This may lead to XSS attacks. The issue is fixed in the versions 2.8.8, 2.9.6 and 2.10.8. Users unable to upgrade should not accept template input from untrusted sources.

CVE-2022-21648 is a medium-severity vulnerability classified under CWE-79, which pertains to improper neutralization of input during web page generation, commonly known as Cross-site Scripting (XSS). This vulnerability affects the Latte template engine, an open-source PHP templating system widely used in web applications for generating HTML content. Since version 2.8.0, Latte introduced a sandbox feature designed to restrict template execution and improve security. However, in affected versions (>= 2.8.0 and < 2.8.8, >= 2.9.0 and < 2.9.6, >= 2.10.0 and < 2.10.8), a sandbox escape vulnerability exists. This flaw allows an attacker to inject malicious scripts into web pages generated by Latte, bypassing the sandbox restrictions. The injection occurs due to improper sanitization or neutralization of input during template rendering, enabling execution of arbitrary JavaScript in the context of the victim's browser. Such XSS attacks can lead to session hijacking, credential theft, defacement, or distribution of malware. The vulnerability was publicly disclosed on January 4, 2022, and fixed in versions 2.8.8, 2.9.6, and 2.10.8. No known exploits have been reported in the wild to date, but the risk remains significant for applications that accept template input from untrusted sources and have not applied the patches. Users unable to upgrade are strongly advised to avoid processing untrusted template data to mitigate risk.

Detailed information about CVE-2022-21648: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in nette latte affecting

CVE-2022-21648: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in nette latte - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2022-21648: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in nette latte

The Skaut bazar WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to the use of $_SERVER['PHP_SELF'] in the ~/skaut-bazar.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.3.2.

CVE-2021-34643 is a Reflected Cross-Site Scripting (XSS) vulnerability identified in the Skaut Bazar WordPress plugin, specifically affecting versions up to and including 1.3.2. The vulnerability arises from the unsafe use of the PHP superglobal $_SERVER['PHP_SELF'] within the ~/skaut-bazar.php file. This variable contains the filename of the currently executing script, and if not properly sanitized, it can be manipulated by an attacker to inject arbitrary JavaScript code into the web page. When a victim visits a crafted URL containing malicious script code, the injected script executes in the context of the victim’s browser, potentially leading to session hijacking, credential theft, or other malicious actions. The vulnerability is classified under CWE-79, which covers improper neutralization of input leading to XSS. The CVSS v3.1 base score is 6.1 (medium severity), with an attack vector of network (remote), low attack complexity, no privileges required, but user interaction is necessary (the victim must visit a malicious link). The scope is changed (S:C), indicating that the vulnerability can affect resources beyond the vulnerable component, and the impact affects confidentiality and integrity but not availability. No known exploits have been reported in the wild, and no official patches or updates are linked in the provided data. The plugin is used within WordPress environments, which are widely deployed across various sectors, including e-commerce and community platforms, making the vulnerability relevant for sites using this plugin.

Detailed information about CVE-2021-34643: CWE-79 Cross-site Scripting (XSS) in Skaut Bazar Skaut Bazar affecting Skaut Bazar Skaut Bazar. Get real-time updates

Title	Severity	Type	Source	Date

Threats Affecting Slovakia

Filter Threats

Threats Affecting Slovakia