Threats affecting Spain

How a dashcam can be hacked and turned it into a surveillance tool

BreachGermanyFrance+8

A threat campaign linked to the Scattered Lapsus$ Hunters group is targeting Zendesk users through over 40 typosquatted domains impersonating Zendesk and various organizations. These domains host phishing pages to harvest credentials. Attackers also submit fraudulent tickets to Zendesk portals to infect support staff with remote access trojans (RATs). This campaign follows similar attacks on other SaaS platforms like Salesforce, with Discord reportedly breached via its Zendesk support system. The attack leverages phishing, typosquatting, and social engineering to compromise customer service environments. Organizations are advised to implement strong authentication, monitor for typosquatted domains, and secure Zendesk chat to mitigate risks. The threat poses a medium severity risk due to its potential to compromise sensitive support operations and enable persistent access. No CVSS score is available, but the attack's impact on confidentiality and integrity, combined with ease of exploitation, warrants a medium severity rating.

Malware#customer service#saas platformsGermany+8

The ShadowV2 botnet malware recently leveraged an AWS outage as a testing ground for its operations, indicating opportunistic behavior by threat actors to exploit cloud service disruptions. This malware represents a high-severity threat due to its botnet capabilities, which can facilitate large-scale distributed attacks, data exfiltration, or service disruption. Although detailed technical specifics and affected versions are not disclosed, the malware's use of a major cloud provider outage highlights its potential to exploit infrastructure instability. European organizations relying on AWS or interconnected cloud services may face increased risk from such botnets, especially during service interruptions. Mitigation requires enhanced monitoring during cloud outages, network segmentation, and proactive threat hunting to detect botnet activity. Countries with significant AWS usage and critical cloud-dependent infrastructure, such as Germany, the UK, France, and the Netherlands, are likely to be most affected. Given the malware's botnet nature, ease of exploitation during outages, and potential for widespread impact, the threat severity is assessed as high. Defenders should prioritize detection capabilities for anomalous traffic patterns and ensure incident response plans account for cloud service disruptions exploited by malware.

Malware#infosecnews#redditGermany+5

Shai-Hulud 2.0 is a highly aggressive and automated supply-chain malware targeting the npm ecosystem, identified in November 2025. It rapidly compromises hundreds of npm packages within hours, behaving like a worm that harvests credentials and cloud secrets. The malware leverages GitHub Actions as a persistent backdoor and creates public repositories to exfiltrate stolen data. This attack represents a significant escalation in supply-chain attack sophistication, affecting major projects and organizations globally. It results in tens of thousands of attacker-created GitHub repositories, facilitating widespread propagation. The malware automates spreading to new npm accounts, increasing infection speed and scale. It does not require user interaction once initial compromise occurs and exploits trusted software supply chains. No CVE or patch is currently available, and no known exploits in the wild have been reported yet. The attack’s medium severity rating may underestimate its potential impact given its worm-like behavior and credential theft capabilities.

Malware#supply-chain attack#npmGermany+8

ThreatFox IOCs for 2025-11-27

Indicator#type:osint#tlp:whiteGermany+6

Comcast suffered a data breach through a vendor, impacting approximately 270,000 customers and resulting in a $1.5 million fine. The breach involved unauthorized access to customer data, though specific technical details of the intrusion are not disclosed. This incident highlights risks associated with third-party vendors and supply chain security. European organizations with similar vendor relationships should be vigilant about their third-party risk management. The breach underscores the importance of stringent vendor security assessments and continuous monitoring. Given the scale and sensitivity of customer data involved, the breach poses significant confidentiality risks. No known exploits are currently active in the wild related to this incident. The fine imposed reflects regulatory scrutiny and the financial consequences of inadequate vendor security controls. Organizations should enhance contractual security requirements and incident response plans involving vendors.

Breach#infosecnews#redditGermany+5

A holistic approach to securing Exchange servers beyond Exchange 2016 and 2019 end-of-life.

AnalysisGermanyFrance+8

Multiple London councils experienced disruption to their IT systems due to a cyberattack reported in late November 2025. The attack affected various council services, causing operational interruptions and potential data access issues. While specific technical details and attack vectors have not been disclosed, the incident is classified as high severity due to its impact on public sector infrastructure. No known exploits or vulnerabilities have been publicly identified in relation to this attack. European organizations, especially local government bodies, should be alert to similar threats targeting critical municipal services. Mitigation should focus on enhancing incident response capabilities, network segmentation, and continuous monitoring of council IT environments. The UK is the most directly affected country, with potential spillover risks to other European nations with similar council IT infrastructures. Given the disruption scale and public service impact, the suggested severity is high. Defenders should prioritize rapid detection, containment, and recovery measures to minimize service downtime and data compromise risks.

News#infosecnews#redditGermany+5

The information provided discusses 'Rey,' the admin of the cybercriminal group ‘Scattered Lapsus$ Hunters,’ as reported by KrebsOnSecurity and shared on Reddit's InfoSecNews. While the report is newsworthy and highlights the existence of this threat actor, it lacks technical details about specific vulnerabilities, exploits, or attack methods. There are no affected software versions, no known exploits in the wild, and no concrete indicators of compromise provided. The threat is categorized as high severity based on the source's assessment, but the absence of technical specifics limits actionable defensive measures. European organizations should remain vigilant about groups like Lapsus$ due to their history of targeting high-profile entities globally. However, this particular report serves more as an intelligence update on threat actor activity rather than a direct technical threat or vulnerability. Organizations should continue monitoring for further detailed disclosures and maintain robust security postures against ransomware and extortion groups. Given the lack of exploit details, the suggested severity is medium, reflecting the potential risk from the group but the absence of immediate technical exploitation information.

News#infosecnews#redditGermany+6

A medium-severity vulnerability in Microsoft Teams guest chat functionality has been reported, potentially allowing attackers to deliver malware to users. The flaw enables malicious actors to exploit guest chat interactions to distribute malware payloads. Although no known exploits are currently active in the wild, the issue poses a risk to organizations relying on Teams for collaboration, especially those with frequent guest user interactions. The lack of detailed technical information and absence of patches increases uncertainty, but the threat is credible given Teams' widespread use. European organizations using Microsoft Teams extensively for internal and external communications could face confidentiality and integrity risks if exploited. Mitigation should focus on restricting guest access, enhancing user awareness, and monitoring for suspicious activity. Countries with high Microsoft Teams adoption and significant international collaboration, such as Germany, France, and the UK, are likely to be most affected. Given the potential impact and ease of exploitation through social engineering, the suggested severity is medium. Defenders should prioritize awareness and access controls while awaiting official patches or detailed advisories.

Malware#infosecnews#redditGermany+6

Cybercriminals impersonating financial institutions have targeted individuals, businesses, and organizations of different sizes. The post Account Takeover Fraud Caused $262 Million in Losses in 2025: FBI appeared first on SecurityWeek .

NewsGermanyFrance+5

A cyberattack targeted OnSolve CodeRED, a critical emergency alert system, causing emergency alerts to go dark. This disruption poses a severe risk to public safety by preventing timely dissemination of urgent warnings. The attack highlights vulnerabilities in emergency communication infrastructure. No specific technical details or exploited vulnerabilities have been disclosed yet. There are no known exploits in the wild at this time. The incident underscores the importance of securing alerting platforms to maintain public trust and safety. European organizations relying on similar alerting systems could face analogous risks. Immediate mitigation and resilience planning are essential to prevent similar outages. The attack's critical severity stems from its impact on availability and potential to endanger lives. Defenders should prioritize securing emergency communication systems and establishing robust incident response protocols.

News#infosecnews#redditGermany+10

ASUS has disclosed a critical authentication bypass vulnerability affecting its AiCloud routers. This flaw allows attackers to circumvent authentication mechanisms, potentially granting unauthorized access to router management interfaces. Exploitation could lead to full control over the device, enabling attackers to manipulate network traffic, steal sensitive data, or deploy further attacks within the network. No known exploits are currently reported in the wild, but the severity and nature of the flaw demand immediate attention. European organizations using ASUS AiCloud routers are at risk, especially those in sectors relying heavily on secure network infrastructure. Mitigation requires prompt firmware updates once available, network segmentation, and enhanced monitoring of router access logs. Countries with high ASUS router market penetration and critical infrastructure reliance on such devices are more likely to be impacted. Given the critical impact on confidentiality, integrity, and availability, ease of exploitation without authentication, and broad potential scope, this vulnerability is assessed as critical severity. Defenders should prioritize patching and implement compensating controls to reduce exposure until updates are deployed.

News#infosecnews#redditGermany+9

This report discusses concerns about Huawei and Chinese surveillance activities as highlighted by Bruce Schneier, a well-known security expert. It is a security news article rather than a direct vulnerability or exploit. The content focuses on geopolitical and supply chain risks related to Huawei's telecommunications equipment and potential surveillance implications. There are no specific technical vulnerabilities, exploits, or affected software versions detailed. The threat is medium severity due to the potential impact on confidentiality and national security, but lacks direct exploitability information. European organizations using Huawei infrastructure may face risks of unauthorized data access or espionage. Mitigation involves careful supply chain risk management, network segmentation, and enhanced monitoring of Huawei equipment. Countries with significant Huawei infrastructure deployment and geopolitical tensions with China, such as Germany, France, and the UK, are most likely affected. The threat is indirect, stemming from surveillance concerns rather than technical exploits, requiring strategic and policy-level responses.

News#infosecnews#redditGermany+8

Fake Battlefield 6 game downloads are being distributed to spread malware and steal player data. These malicious downloads impersonate the highly anticipated game to lure victims into installing harmful software. The malware aims to compromise user confidentiality by harvesting sensitive information from infected systems. While no known exploits or vulnerabilities in Battlefield 6 itself are involved, the threat leverages social engineering and fake distribution channels. European gamers and organizations with gaming communities may be targeted, especially where Battlefield 6 has significant popularity. The threat requires user interaction to download and execute the fake installer, limiting automated spread but increasing risk through deception. Mitigation involves educating users on verifying legitimate sources, employing endpoint protection with malware detection, and monitoring network traffic for suspicious activity. Countries with large gaming populations and strong Battlefield fanbases, such as the UK, Germany, France, and the Nordics, are more likely to be affected. Given the medium severity rating and the nature of the attack, defenders should prioritize awareness and technical controls to prevent infection and data theft.

Malware#infosecnews#redditGermany+9

CISA has described the techniques used by attackers and pointed out that the focus is on high-value individuals. The post CISA Warns of Spyware Targeting Messaging App Users appeared first on SecurityWeek .

MalwareGermanyFrance+8

The Everest ransomware group has claimed a significant breach of Spain’s national airline, Iberia, reportedly stealing 596 GB of data. This incident involves ransomware activity combined with data exfiltration, indicating a double-extortion tactic where attackers encrypt systems and threaten to leak stolen data. The breach highlights vulnerabilities in critical infrastructure sectors such as aviation, which are highly sensitive and impactful. Although no specific exploited vulnerabilities or affected software versions are disclosed, the attack's scale and target underscore a high-risk scenario. European organizations, especially in Spain and neighboring countries, face increased risks from similar ransomware operations targeting critical transport and infrastructure sectors. Mitigation requires tailored incident response plans, enhanced network segmentation, and proactive threat hunting focused on ransomware behaviors. Spain is the most directly affected country, but given Iberia's international operations, other European countries with strong aviation ties may also be at risk. The threat is assessed as high severity due to the large data theft, potential operational disruption, and the critical nature of the airline sector. Defenders must prioritize monitoring for ransomware indicators, securing remote access, and ensuring robust data backup and recovery capabilities.

Malware#infosecnews#redditSpain+5

ToddyCat, a threat actor, has developed new hacking tools designed to steal Outlook emails and Microsoft 365 access tokens. These tools enable attackers to gain unauthorized access to sensitive email communications and cloud resources by compromising authentication tokens. The threat is considered high severity due to the potential for extensive data exposure and lateral movement within compromised environments. Although no known exploits in the wild have been reported yet, the tools represent a significant risk to organizations relying on Microsoft 365 services. European organizations using Outlook and Microsoft 365 are particularly at risk, especially those in countries with high adoption of these platforms. Mitigation requires targeted detection of token theft, enhanced monitoring of Microsoft 365 account activities, and strict access controls. Countries such as the United Kingdom, Germany, France, and the Netherlands are likely to be most affected due to their widespread use of Microsoft cloud services and strategic importance. The threat is assessed as high severity given the impact on confidentiality and integrity, ease of exploitation once initial access is gained, and the broad scope of affected systems without requiring user interaction. Defenders should prioritize monitoring for unusual token usage patterns and implement conditional access policies to reduce risk.

News#infosecnews#redditGermany+6

A recently reported security issue involves code beautifiers—tools used to format source code—accidentally exposing sensitive credentials from banks, government agencies, and technology organizations. These tools, when processing code, can inadvertently reveal secrets such as API keys, passwords, and tokens embedded in the code or configuration files. Although no known exploits are currently active in the wild, the exposure risk is high due to the sensitive nature of the leaked information. The threat primarily arises from the improper handling or display of code snippets by beautifiers, which may not sanitize or mask confidential data. European organizations using such tools in their development or code review processes could face significant confidentiality breaches. Mitigation requires careful auditing of code before formatting, implementing automated secret detection, and restricting access to formatted code outputs. Countries with large financial sectors, government digital services, and advanced tech industries are more likely to be impacted. Given the ease of exploitation and the criticality of exposed data, the threat severity is assessed as high. Defenders should prioritize securing development pipelines and educating developers about secret management best practices.

News#infosecnews#redditGermany+9

This threat concerns the use of scam phone numbers employed in phishing attempts to defraud individuals. Attackers use deceptive phone numbers to trick victims into divulging sensitive information or transferring money. Although widespread and impactful on individuals, this threat does not target specific software vulnerabilities or systems. European organizations may face indirect risks through social engineering attacks on employees, potentially leading to credential compromise or financial loss. The threat is medium severity due to its social engineering nature, requiring user interaction but having broad potential impact. Mitigation involves employee training, verification procedures for unsolicited calls, and use of call-blocking technologies. Countries with high mobile phone usage and significant financial sectors, such as the UK, Germany, France, and the Netherlands, are more likely to be affected. Overall, defenders should focus on awareness, verification, and technical controls to reduce risk from scam phone number phishing attacks.

Phishing#infosecnews#redditGermany+6