Palo Alto Networks has conducted an analysis of malicious LLMs that help threat actors with phishing, malware development, and reconnaissance. The post WormGPT 4 and KawaiiGPT: New Dark LLMs Boost Cybercrime Automation appeared first on SecurityWeek .
The 'Hide the threat - GPO lateral movement' threat involves attackers leveraging Group Policy Objects (GPOs) within Windows Active Directory environments to move laterally and evade detection. This technique allows adversaries to manipulate GPOs to execute malicious code or gain elevated privileges across networked systems. Although no known exploits are currently in the wild, the method poses a medium-level risk due to its potential to bypass traditional security controls and persist undetected. European organizations relying heavily on Active Directory for identity and access management are particularly at risk. Mitigation requires enhanced monitoring of GPO changes, strict access controls, and auditing of privileged accounts. Countries with large enterprise sectors and extensive AD deployments, such as Germany, France, and the UK, are more likely to be targeted. Given the ease of exploitation once access is gained and the broad impact on confidentiality and integrity, this threat is assessed as medium severity. Defenders should prioritize detection capabilities around GPO modifications and implement least privilege principles to reduce exposure.
CISA has issued a warning about active spyware campaigns targeting high-value users of Signal and WhatsApp messaging platforms. These campaigns aim to hijack accounts and compromise communications through sophisticated spyware infections. The threat actors focus on individuals with sensitive or strategic communications, leveraging vulnerabilities or social engineering to deploy spyware. This poses significant risks to confidentiality and privacy, especially for organizations relying on these encrypted messaging services. European organizations using Signal and WhatsApp for secure communications are at risk of espionage and data theft. The campaigns do not currently have known exploits in the wild but are considered high priority due to their targeted nature and potential impact. Mitigation requires enhanced user awareness, strict device hygiene, and monitoring for suspicious activity. Countries with high adoption of these messaging apps and strategic geopolitical interests are most vulnerable. The severity is assessed as high given the potential for significant confidentiality breaches and the difficulty in detecting spyware infections.
SitusAMC has confirmed a data breach that compromised customer information. The breach was publicly disclosed via a Reddit InfoSec News post linking to a security news website. Although technical details are limited and no specific vulnerabilities or exploits have been identified, the incident is classified as high severity due to the exposure of sensitive customer data. There is no evidence of known exploits in the wild or patches available at this time. European organizations using SitusAMC services may face risks related to data confidentiality and regulatory compliance. Mitigation should focus on immediate incident response, customer notification, and enhanced monitoring. Countries with significant real estate and mortgage service markets, such as the UK, Germany, and France, are likely most affected. Given the breach impacts confidentiality and involves sensitive personal data, with unknown exploitation complexity but confirmed data exposure, the suggested severity is high.
More than 100 alleged victims of the Oracle EBS campaign have been added to the Cl0p ransomware website. The post Canon Says Subsidiary Impacted by Oracle EBS Hack appeared first on SecurityWeek .
A sophisticated attack chain was uncovered involving a malicious disk-cleaning utility that installed proxyware on a compromised system. The infection used PowerShell scripts, download cradles, and in-memory execution to evade detection and establish a connection to a command-and-control (C2) server. The attack was intercepted before the proxyware installation completed. This incident underscores the dangers of unauthorized software installations and the critical need to restrict PowerShell usage in corporate environments. The threat leverages multiple advanced techniques including obfuscation, living-off-the-land binaries, and scheduled task abuse. Although no known exploits are currently in the wild, the attack demonstrates a medium severity risk due to its potential for stealthy persistence and resource abuse. European organizations should be vigilant, especially those with lax software installation policies and insufficient PowerShell controls.
A multi-stage malware execution chain originating from a ClickFix lure has been discovered, leading to the delivery of infostealing malware like LummaC2 and Rhadamanthys. The campaign utilizes steganography to hide malicious code within PNG images. Two distinct ClickFix lures were observed: a standard 'Human Verification' and a convincing fake Windows Update screen. The execution chain involves mshta.exe, PowerShell, and .NET assemblies, ultimately extracting and injecting shellcode into target processes. The steganographic technique encodes malicious data directly into image pixel data, using specific color channels for payload reconstruction and decryption in memory. This sophisticated approach helps evade signature-based detection and complicates analysis.
A design flaw in Binance's API IP whitelisting allows the listenKey, used for WebSocket streams, to bypass IP restrictions entirely. While the API key itself is protected by IP whitelisting, the listenKey can be created without a secret or signature and is not subject to IP restrictions. If a listenKey leaks through logs, third-party tools, or browser extensions, it can be reused from any IP, exposing sensitive real-time trading data such as balances, open orders, and liquidation events. This issue does not lead to direct account takeover or fund theft but results in significant market intelligence leakage. Many users mistakenly rely on IP whitelisting as a final security barrier, unaware that listenKeys circumvent this protection. The flaw was responsibly disclosed but not remediated, leading to public disclosure. European organizations using Binance APIs or trading bots should be aware of this risk and take additional precautions.
A high-severity data breach has impacted SitusAMC, a major real-estate finance services provider, resulting in exposure of client data. The breach was recently reported via Reddit and covered by a trusted cybersecurity news source, BleepingComputer. Although specific technical details and affected versions are not disclosed, the incident involves unauthorized access to sensitive client information. There are no known exploits in the wild related to this breach at this time. European organizations relying on SitusAMC services or handling related client data could face confidentiality risks and regulatory compliance challenges. Mitigation requires immediate review of access controls, enhanced monitoring for suspicious activity, and coordination with SitusAMC for breach response. Countries with significant real estate finance sectors and high adoption of SitusAMC services, such as the UK, Germany, and France, are likely most affected. Given the sensitivity of exposed data and potential regulatory impact, the severity is assessed as high. Defenders should prioritize data protection audits, incident response readiness, and client notification processes to minimize damage and comply with GDPR requirements.
A Russian-linked malware campaign is leveraging Blender 3D files as a novel vector to deliver malicious payloads. The malware is embedded within Blender project files, exploiting the trust users place in these files to execute malicious code. This campaign is notable for its use of a creative content format to evade traditional detection mechanisms. Although no known exploits are currently active in the wild, the campaign is considered high priority due to its potential stealth and impact. European organizations using Blender for design, animation, or visualization are at risk, especially those in sectors like media, manufacturing, and defense. The threat could lead to data exfiltration, system compromise, or disruption of critical workflows. Mitigation requires enhanced scrutiny of Blender files from untrusted sources, network monitoring for unusual activity, and user training on this emerging threat vector. Countries with significant creative industries and high Blender adoption, such as Germany, France, and the UK, are particularly vulnerable. Given the ease of embedding malware in widely used file formats and the potential for significant impact without user interaction, the threat severity is assessed as high.
Harvard University has disclosed a data breach impacting its alumni and donors, potentially exposing sensitive personal information. The breach was recently reported and is considered high severity due to the nature of the affected individuals and the sensitivity of the data involved. Although specific technical details and exploited vulnerabilities are not provided, the incident highlights risks to personal data confidentiality and potential misuse. There are no known exploits in the wild related to this breach at this time. European organizations, especially educational institutions and donor-related entities, should be aware of similar risks. Mitigation should focus on strengthening data protection, monitoring for suspicious activity, and enhancing incident response capabilities. Countries with strong academic ties and donor networks to Harvard or similar institutions may be more concerned. The severity is assessed as high due to the breach's impact on confidentiality and the potential for identity theft or fraud. Defenders should prioritize data security audits and communication strategies to affected parties.
Delta Dental of Virginia experienced a data breach impacting 145,918 customers, exposing sensitive personal information. The breach was publicly reported on November 24, 2025, with limited technical details available. Although no known exploits are currently active in the wild, the incident is classified as high severity due to the volume of affected individuals and potential exposure of sensitive data. The breach primarily affects customers in the United States, but European organizations with similar data handling practices should be aware of the risks. The lack of detailed technical information limits precise attribution or attack vector analysis. Organizations should review their data protection measures, especially those handling sensitive health or insurance data, to prevent similar incidents. Enhanced monitoring, incident response readiness, and data encryption are recommended. European countries with significant healthcare and insurance sectors, such as Germany, France, and the UK, should be particularly vigilant. The breach underscores the importance of robust cybersecurity controls in protecting customer data against unauthorized access and exfiltration.
We continue to encounter high-profile vulnerabilities related to the use of URL mapping (or "aliases") with URL-based access control. Last week, we wrote about the Oracle Identity Manager vulnerability. I noticed some scans for an older vulnerability with similar roots today:
The company has confirmed that it terminated an insider who shared screenshots of his computer with cybercriminals. The post CrowdStrike Insider Helped Hackers Falsely Claim System Breach appeared first on SecurityWeek .
Without proper security controls, AI agents could perform malicious actions, such as data exfiltration and malware installation. The post Microsoft Highlights Security Risks Introduced by New Agentic AI Feature appeared first on SecurityWeek .
The Cl0p ransomware group has listed Mazda and Mazda USA as victims of the Oracle EBS campaign on its leak website. The post Mazda Says No Data Leakage or Operational Impact From Oracle Hack appeared first on SecurityWeek .
This report highlights ten hidden cybersecurity threats targeting ecommerce online stores, emphasizing the need for robust protection measures. While no specific vulnerabilities or exploits are detailed, the mention of remote code execution (RCE) suggests potential severe risks if exploited. The threat is categorized as medium severity due to the lack of known exploits and minimal technical details. European ecommerce businesses could face risks including data breaches, financial loss, and reputational damage if these hidden threats are not addressed. Mitigation requires tailored security strategies beyond generic advice, focusing on continuous monitoring, secure coding practices, and supply chain security. Countries with significant ecommerce markets and digital infrastructure, such as Germany, the UK, France, and the Netherlands, are more likely to be affected. Given the absence of detailed technical data and exploits, the threat severity is assessed as medium. Defenders should prioritize awareness of these hidden threats and implement comprehensive security frameworks to safeguard online stores effectively.
The company has notified its customers of the incident roughly a week after a threat actor claimed the theft of 77GB of data from Iberia’s systems. The post Spanish Airline Iberia Notifies Customers of Data Breach appeared first on SecurityWeek .
A phishing campaign targeting Brazilian users spreads a banking trojan via WhatsApp Web by leveraging an open-source automation script. The attack starts with a malicious VBS script in a phishing email that downloads and executes an MSI installer and another VBS script. The second VBS installs Python and Selenium to inject malicious JavaScript into WhatsApp Web, enabling the malware to propagate by sending itself to the victim's contacts. The MSI drops an AutoIt script that monitors for Brazilian banking and cryptocurrency application windows and loads an encrypted payload into memory to evade detection. This payload specifically targets Brazilian financial institutions and cryptocurrency wallets. The campaign uses in-memory execution and automation to maintain stealth and persistence. No known exploits in the wild have been reported yet, and the campaign is currently assessed as medium severity. The attack is highly tailored to Brazilian users and financial targets but could pose risks if similar tactics spread elsewhere.
RadzaRat is a newly identified spyware targeting Android devices by masquerading as a legitimate file manager application. It is notable for evading detection by all 66 antivirus engines on VirusTotal, indicating advanced stealth capabilities. The spyware can hijack devices, potentially compromising user confidentiality and device integrity. Although no known exploits in the wild have been confirmed, the threat is considered medium severity due to its evasion techniques and potential impact. European organizations using Android devices are at risk, especially those with mobile workforces or BYOD policies. Mitigation requires enhanced mobile security hygiene, including restricting app installations to trusted sources, employing mobile threat defense solutions, and monitoring device behavior for anomalies. Countries with high Android usage and significant mobile-dependent sectors, such as Germany, France, Italy, Spain, and the UK, are more likely to be affected. Given the spyware’s stealth and potential for data exfiltration without user interaction, the threat severity is assessed as high. Defenders should prioritize detection improvements and user awareness to prevent infection and limit damage.
