The Water Saci campaign is a sophisticated malware operation primarily targeting Brazilian banking and cryptocurrency platforms via WhatsApp. It employs multi-format malware delivery using various scripting languages, including a shift from PowerShell to Python, likely enhanced by AI tools to evade detection and complicate analysis. The malware features aggressive anti-sandbox techniques, extensive backdoor capabilities, and persistence mechanisms. Although currently focused on Brazil, the use of WhatsApp as a propagation vector and targeting financial applications poses a potential risk to European organizations with ties to Brazilian markets or users. The campaign’s complexity and AI-enhanced development pipeline indicate a medium severity threat with significant evasion and persistence capabilities. Defenders should prioritize monitoring WhatsApp-based phishing attempts, scrutinize multi-format file attachments, and implement advanced behavioral detection to mitigate risks. Countries with strong economic or diaspora links to Brazil and high WhatsApp usage are more likely to be affected.
The extensions were seen profiling users, reading cookie data to create unique identifiers, and executing payloads with browser API access. The post Chrome, Edge Extensions Caught Tracking Users, Creating Backdoors appeared first on SecurityWeek .
CVE-2025-11782 is a high-severity stack-based buffer overflow vulnerability in Circutor SGE-PLC1000 and SGE-PLC50 devices, specifically version 9.0.2. The flaw exists in the 'ShowDownload()' function, which uses an unsafe sprintf() call to copy user-controlled input from the 'meter' parameter into a fixed 64-byte buffer without length validation. An attacker with low privileges but network access can exploit this vulnerability by sending a crafted 'meter' parameter value exceeding the buffer size, potentially leading to arbitrary code execution or denial of service. No user interaction is required, and the vulnerability affects confidentiality, integrity, and availability. Although no known exploits are currently in the wild, the high CVSS score (8.5) indicates significant risk. European organizations using these Circutor PLC devices, especially in critical infrastructure or industrial environments, should prioritize patching or mitigating this issue. Countries with substantial industrial automation sectors and Circutor product deployments, such as Germany, France, Spain, and Italy, are most likely to be impacted.
The Proxyearth tool reportedly enables tracing the location of users in India using only their mobile phone numbers. This capability raises significant privacy and security concerns, as it could facilitate unauthorized surveillance and stalking. Although the tool is currently focused on Indian mobile numbers, the underlying technique could inspire similar tools targeting other regions. The tool's availability on public platforms like Reddit suggests ease of access and potential misuse by malicious actors. There is no evidence of known exploits in the wild beyond the tool's existence, and technical details remain limited. European organizations could face indirect risks if similar tools emerge targeting European mobile users or if attackers leverage such capabilities for social engineering or espionage. Mitigation requires enhanced mobile network security, user awareness, and regulatory enforcement on data privacy. Countries with large mobile user bases and advanced telecom infrastructure, such as Germany, France, and the UK, are more likely to be targeted if the tool or similar variants expand. Given the medium severity rating and the potential impact on user privacy and confidentiality, vigilance and proactive defense measures are advised.
Google has released patches addressing 107 vulnerabilities in the Android operating system, including two critical framework bugs that have been actively exploited in the wild. These flaws affect multiple components of Android, potentially allowing attackers to execute arbitrary code, escalate privileges, or cause denial of service. The vulnerabilities are considered high severity due to their exploitation status and broad impact on Android devices globally. European organizations relying on Android devices face risks including data breaches, device compromise, and operational disruption. Immediate patching is essential to mitigate these threats. Countries with high Android adoption and significant mobile-dependent infrastructure are most at risk. The threat requires no user interaction for exploitation in some cases, increasing its danger. Defenders should prioritize deploying official Google security updates and monitor for indicators of compromise related to these framework bugs. Enhanced mobile device management and network-level protections can further reduce exposure.
Names, addresses, email addresses, and phone numbers were compromised in a five-month-long data breach. The post Personal Information of 33.7 Million Stolen From Coupang appeared first on SecurityWeek .
The SitusAMC cyberattack resulted in the exposure of client data, highlighting significant risks associated with third-party vendors and emerging AI-related threats. Although specific technical details and exploited vulnerabilities are not disclosed, the incident underscores the challenges organizations face in securing data when relying on external service providers. The attack's medium severity reflects potential confidentiality impacts without confirmed widespread exploitation or system outages. European organizations using SitusAMC services or similar third-party platforms should be vigilant about their supply chain security and data protection measures. Mitigation should focus on enhanced third-party risk management, continuous monitoring, and AI threat awareness. Countries with substantial real estate, mortgage, and financial services sectors—such as the UK, Germany, France, and the Netherlands—are more likely to be affected due to higher adoption of related services. Given the lack of detailed exploit information, the threat is assessed as medium severity, balancing the data exposure risk against limited exploitation evidence. Defenders must prioritize verifying third-party security postures and preparing for evolving AI-driven attack vectors to reduce future risks.
&#;x26;#;x5b;This is a Guest Diary by James Woodworth, an ISC intern as part of the SANS.edu Bachelor&#;x26;#;39;s Degree in Applied Cybersecurity (BACS) program &#;x26;#;x5b;1].
A significant data breach has impacted Coupang, a major retail company, compromising personal data of approximately 33.7 million customers. The breach was recently disclosed via a trusted cybersecurity news source and discussed briefly on Reddit's InfoSecNews community. Although technical details about the breach vector or exploited vulnerabilities are not provided, the scale and nature of the incident indicate a high-severity event with potential widespread consequences. The breach likely involves exposure of sensitive customer information, which could lead to identity theft, fraud, and reputational damage. European organizations are indirectly affected through potential supply chain or partnership connections, as well as increased phishing and fraud attempts targeting European customers of Coupang or related entities. Mitigation should focus on enhanced monitoring for suspicious activity, customer notification, and strengthening data protection controls. Countries with strong e-commerce markets and significant digital retail engagement, such as Germany, the UK, France, and the Netherlands, are most likely to be impacted due to customer overlap and cybercriminal targeting patterns. Given the large scale, high impact on confidentiality, and no requirement for user interaction to exploit the breach, the suggested severity is high.
ShadyPanda is a spyware campaign that has compromised popular browser extensions with a combined 4.3 million installs, turning them into tools for covert data collection. The threat involves injecting malicious code into legitimate extensions, enabling attackers to spy on users by harvesting sensitive information such as browsing activity, credentials, and potentially other personal data. This campaign poses a high risk due to the widespread use of affected extensions and the stealthy nature of spyware infections. European organizations using these extensions are at risk of data leakage and espionage, especially if extensions are used in corporate environments. Mitigation requires immediate auditing of installed browser extensions, removal of suspicious or untrusted add-ons, and enforcing strict extension policies. Countries with high browser extension adoption and significant tech sector presence, such as Germany, France, and the UK, are likely to be most affected. Given the ease of exploitation through trusted extensions and the broad impact on confidentiality and integrity, the severity is assessed as high. Defenders should prioritize detection and removal of compromised extensions and educate users on extension risks.
A significant data breach has impacted Coupang, a major South Korean e-commerce platform, compromising all 33.7 million user accounts. The breach potentially exposes sensitive personal information of the entire user base, posing risks of identity theft, fraud, and targeted phishing attacks. Although no known exploits are currently active, the breach's scale and the sensitivity of the data involved make it a high-priority incident. European organizations connected to South Korean markets or with users who have accounts on Coupang should be vigilant. The breach highlights the importance of robust data protection and incident response strategies. Mitigation involves monitoring for suspicious activities, enhancing authentication mechanisms, and ensuring data encryption. Countries with strong economic ties to South Korea and significant e-commerce engagement are more likely to be affected. Given the breach's scope and impact, the severity is assessed as high. Defenders must prioritize user notification, forensic analysis, and cross-border cooperation to mitigate downstream risks.
A security audit of the OpenEXR library was announced via a Reddit NetSec post linking to Luma.com. The announcement provides minimal technical details and no specific vulnerabilities or exploits are disclosed. There are no affected versions or patches mentioned, and no known exploits in the wild have been reported. The threat is currently assessed as medium severity based on limited information. OpenEXR is a high dynamic range image file format widely used in visual effects and media industries. European organizations using OpenEXR in media production or related workflows should monitor for further updates. No direct impact or exploitation details are available at this time. Mitigation should focus on following up on the audit results and applying any future patches promptly. Countries with strong media production sectors and visual effects industries, such as the UK, Germany, and France, may be more likely to be affected.
Albiriox is a banking trojan offered under a malware-as-a-service model for $720 per month. The post New Albiriox Android Malware Developed by Russian Cybercriminals appeared first on SecurityWeek .
A medium-severity security incident involving a compromise of the europa.eu domain was reported via a blog post linked from a Reddit NetSec discussion. The compromise was discovered through an unconventional method related to cricket, as detailed by the author. There is minimal technical detail publicly available, and no known exploits in the wild have been reported. The incident highlights potential risks to European Union digital infrastructure and sensitive information. European organizations relying on europa.eu services may face confidentiality and integrity risks. Mitigation should focus on enhanced monitoring, incident response readiness, and verification of domain and service integrity. Countries with significant EU institutional presence and digital infrastructure are most likely affected. Given the limited technical details and no active exploitation, the threat severity is assessed as medium.
An attacker employed an 'Evil Twin' Wi-Fi hotspot to intercept and steal data from passengers during a flight, resulting in a 7-year jail sentence. The attack involved setting up a rogue Wi-Fi access point mimicking the legitimate in-flight network to trick users into connecting. This type of attack can compromise confidentiality by capturing sensitive information transmitted over the network. Although no specific technical details or exploits are provided, the incident highlights the risks of unsecured or poorly secured public Wi-Fi environments, especially in constrained settings like airplanes. European organizations with employees who travel frequently or rely on public Wi-Fi should be aware of such threats. Mitigation requires strong user awareness, use of VPNs, and network authentication improvements. Countries with high volumes of international air travel and business connectivity are more likely to be affected. The threat is assessed as medium severity due to the need for user interaction and limited scope but significant confidentiality impact.
The U. S. Cybersecurity and Infrastructure Security Agency (CISA) has added a vulnerability affecting OpenPLC ScadaBR to its Known Exploited Vulnerabilities catalog. This flaw pertains to the OpenPLC ScadaBR platform, which is used for industrial control systems and SCADA environments. Although no specific CVSS score or detailed technical exploit information is provided, the vulnerability is assessed as medium severity. There are no known exploits in the wild at this time, and technical discussion and details remain minimal. The vulnerability could potentially impact the confidentiality, integrity, and availability of industrial control systems if exploited. European organizations using OpenPLC ScadaBR, especially in critical infrastructure sectors, should be vigilant. Mitigation should focus on monitoring for updates from vendors, applying patches promptly once available, and implementing network segmentation and access controls. Countries with significant industrial automation and critical infrastructure sectors, such as Germany, France, and the UK, are likely to be most affected.
An Australian man was sentenced to seven years in prison for operating an 'evil twin' Wi-Fi hotspot, a malicious technique where attackers create a fraudulent wireless access point mimicking a legitimate one to intercept user data. This form of attack enables attackers to capture sensitive information such as credentials, financial data, and personal communications by tricking victims into connecting to the rogue network. While the news highlights a legal consequence rather than a new technical vulnerability, the underlying threat of evil twin Wi-Fi attacks remains significant. European organizations are at risk due to widespread use of Wi-Fi networks in public and corporate environments, making them potential targets for similar attacks. The threat does not require sophisticated software vulnerabilities but exploits user trust and network configuration weaknesses. Mitigation involves user education, use of VPNs, strong Wi-Fi authentication protocols, and network monitoring to detect rogue access points. Countries with high public Wi-Fi usage and advanced digital economies, such as Germany, the UK, France, and the Netherlands, are more likely to be affected. Given the ease of exploitation and potential for data compromise without user awareness, the suggested severity of this threat is high. Defenders should prioritize detection and prevention of rogue Wi-Fi networks to protect confidentiality and integrity of communications.
For the latest discoveries in cyber research for the week of 1st December, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES OpenAI has experienced a data breach resulting from a compromise at third-party analytics provider Mixpanel, which exposed limited information of some ChatGPT API clients. The leaked data includes names, email addresses, approximate […] The post 1st December – Threat Intelligence Report appeared first on Check Point Research .
