Fantasy Hub is a newly identified Android Remote Access Trojan (RAT) offered as Malware-as-a-Service (MaaS) on Russian-language platforms. It provides extensive espionage capabilities including SMS exfiltration, contact and call log theft, and bulk media extraction. The malware can intercept, reply to, and delete incoming notifications, and uses fake Google Play pages to evade detection. It specifically targets financial institutions by deploying fake windows to steal banking credentials. The MaaS model includes comprehensive documentation and a bot-driven subscription system, lowering the barrier for novice attackers. Although no known exploits in the wild have been reported yet, the threat poses a medium severity risk due to its broad capabilities and ease of use. European organizations, especially financial institutions, are at risk due to the malware’s targeting profile and Android’s widespread use. Mitigation requires targeted detection of fake app pages, enhanced mobile security hygiene, and user awareness focused on banking credential phishing. Countries with large financial sectors and high Android adoption, such as Germany, France, and the UK, are most likely to be affected.
The Lazarus Group, a DPRK-linked threat actor, has launched a targeted espionage campaign against aerospace and defense sectors using a new variant of the Comebacker backdoor. The attack employs spear phishing with highly specific lure documents to deliver macro-based malware. The infection chain is multi-staged, featuring custom decryption algorithms and encrypted command-and-control communications, indicating advanced evasion techniques. The campaign infrastructure remains active, suggesting ongoing operations. This threat poses risks to confidentiality and integrity of sensitive defense-related information. European aerospace and defense organizations should enhance phishing defenses and monitor for indicators such as specific file hashes and suspicious domains. No CVSS score is assigned, but the threat is assessed as high severity due to its targeted nature, potential impact, and sophisticated malware. Countries with significant aerospace and defense industries and geopolitical interest in DPRK activities are most at risk. Immediate mitigation includes user training, macro restrictions, network monitoring, and threat intelligence sharing.
A malware campaign in Latin America uses oversized SVG files containing the full malicious payload to deliver AsyncRAT, a remote access trojan. The attack employs social engineering via emails impersonating trusted institutions with urgent legal warnings, primarily targeting Colombia. Clicking the SVG file opens a fake judicial portal to deceive victims. The campaign uses DLL sideloading to evade detection and AI-generated templates for customization. This method avoids external connections by embedding the payload directly in the SVG file. Attacks peaked mid-week in August, focusing on judicial system impersonation. No CVSS score is available, but the threat is medium severity due to its stealth and control capabilities. European organizations should be aware of this evolving tactic as it could be adapted to target other regions. Vigilance against suspicious SVG attachments and advanced detection techniques are critical for defense.
Operation DreamJob is a cyberespionage campaign by the North Korea-aligned Lazarus group targeting European defense companies specializing in UAV technology. The attackers use social engineering and trojanized open-source software to deliver a sophisticated malware toolset including ScoringMathTea RAT and BinMergeLoader. The campaign aims to steal intellectual property and manufacturing knowledge to support North Korea's drone program. Attack techniques involve multiple stages with droppers, loaders, and downloaders, exploiting user interaction and system reconnaissance. The threat poses a medium severity risk due to targeted espionage with potential long-term strategic impact on defense capabilities. European UAV manufacturers and defense contractors are primary targets, especially in countries with significant aerospace industries. Mitigation requires enhanced supply chain security, strict validation of open-source software, user training against social engineering, and robust endpoint detection. Countries like Germany, France, Italy, and the UK are most likely affected given their UAV sector prominence and defense industry size. The campaign does not require zero-day exploits but leverages social engineering and trojanized software, increasing the risk of successful infiltration. Defenders should prioritize monitoring for known malware components and suspicious network activity related to this campaign.
Paragon’s Graphite spyware has been used to target an Italian citizen, highlighting the presence of advanced surveillance tools in Europe. This spyware is known for its stealth and capability to exfiltrate sensitive data from infected devices. The targeting of an individual in Italy suggests potential risks to privacy and national security, especially if such spyware is used against activists, journalists, or government officials. Although there are no known widespread exploits or patches available, the threat is considered high due to the spyware's capabilities and the sensitive nature of its targets. European organizations should be vigilant about spyware threats and implement advanced detection and response strategies. The countries most likely affected are those with significant use of targeted devices and geopolitical relevance, including Italy, Germany, France, and the UK. Mitigation requires proactive threat hunting, endpoint protection with behavioral analytics, and strict access controls. Given the spyware’s sophistication and potential impact on confidentiality and integrity without requiring user interaction, the severity is assessed as high. Defenders must prioritize monitoring for unusual device behavior and ensure rapid incident response capabilities to mitigate risks from such spyware threats.
A security issue exists in Android Enterprise BYOD devices managed via Microsoft Intune, allowing users to install arbitrary applications within the Work Profile. This vulnerability was discovered in late 2023 and remains unpatched as of late 2025. Despite the potential risk, Android has classified this behavior as not a security risk. The flaw could enable users to bypass intended app restrictions, potentially leading to data leakage or introduction of malicious apps in a corporate environment. No known exploits are currently active in the wild. The issue specifically affects Android Enterprise BYOD setups using Microsoft Intune management. Organizations relying on this configuration should be aware of the risk and consider additional controls. The severity is assessed as medium due to the potential impact on corporate data integrity and confidentiality, balanced against the need for user interaction and existing management controls. European organizations with widespread Intune-managed Android BYOD deployments should evaluate their exposure and mitigation strategies accordingly.
Cisco firewall vulnerabilities are currently being actively exploited to conduct Denial of Service (DoS) attacks. These flaws allow attackers to disrupt network availability by overwhelming or crashing affected firewall devices. Although no specific affected versions or CVEs are detailed, the threat is rated high severity due to active exploitation and potential widespread impact. European organizations relying on Cisco firewalls for perimeter defense face risks of service outages and operational disruption. Mitigation requires immediate attention to Cisco advisories, network segmentation, and enhanced monitoring for anomalous traffic patterns. Countries with significant Cisco firewall deployments and critical infrastructure reliance are at greater risk. The threat is assessed as high severity given the ease of exploitation, impact on availability, and lack of authentication requirements. Defenders should prioritize patching once available, implement DoS protection mechanisms, and conduct incident response preparedness. This threat underscores the importance of proactive firewall security management in Europe’s cybersecurity landscape.
Chinese state-sponsored hackers are leveraging legacy vulnerabilities, such as those in Log4j and Microsoft IIS, to conduct global espionage campaigns. These attacks exploit well-known, often unpatched bugs in widely deployed software to gain unauthorized access and maintain persistence. The threat actors focus on legacy systems that remain in use due to operational constraints, turning them into espionage tools. European organizations running outdated or unpatched versions of these technologies are at significant risk. The attacks can compromise confidentiality and integrity of sensitive data, with potential impacts on national security and critical infrastructure. Mitigation requires targeted patch management, legacy system audits, and enhanced monitoring for exploitation attempts. Countries with high adoption of affected technologies and strategic geopolitical relevance are more likely targets. The threat is assessed as high severity due to the potential for widespread impact and the sophistication of the adversaries. Defenders must prioritize legacy vulnerability remediation and threat intelligence sharing to reduce exposure.
A sophisticated malware campaign is increasingly targeting WordPress websites to inject online casino spam content. This malware uses multiple redundancy and reinfection techniques, storing payloads in databases and non-standard file extensions to evade detection and maintain persistence. The campaign exploits the popularity of online gambling and leverages the decline of other spam sources, such as essay writing services, to focus on lucrative casino spam. Although primarily noted in Indonesia due to strict gambling laws, the campaign has international reach. The malware's complexity and persistence mechanisms pose risks to website integrity, SEO rankings, and user trust. European organizations running WordPress sites could be targeted, especially those with lax security or outdated plugins. Mitigation requires advanced detection, continuous monitoring, and tailored cleanup strategies. The threat is assessed as medium severity due to its impact on website integrity and SEO rather than direct data breach or system compromise.
The “I Paid Twice” scam targets users of Booking.com and other booking platforms by leveraging phishing techniques to deliver the PureRAT malware through a malicious tool called ClickFix. Victims are deceived into believing they have been charged twice for bookings, prompting them to interact with fraudulent links or downloads. This interaction results in the installation of PureRAT, a remote access trojan capable of stealing sensitive data and enabling persistent unauthorized access. The scam exploits user trust in popular travel booking sites and uses social engineering to bypass technical defenses. While no known exploits are currently widespread, the potential for data theft and account compromise is significant. European organizations and individuals using these platforms are at risk, especially given the high volume of travel-related transactions. Mitigation requires user education, enhanced email and web filtering, and monitoring for unusual account activity. Countries with high tourism activity and frequent use of Booking.com, such as Germany, France, and the UK, are most likely to be targeted.
Threat actors exploited CVE-2025-21042 to deliver malware via specially crafted images to users in the Middle East. The post Landfall Android Spyware Targeted Samsung Phones via Zero-Day appeared first on SecurityWeek .
The DragonForce Cartel, also known as Scattered Spider, is a threat actor group recently highlighted in a security news post referencing potential remote code execution (RCE) risks. Although detailed technical information and confirmed exploits are currently minimal, the group is associated with targeted cyber intrusions that could lead to unauthorized system control. The threat is assessed as medium severity due to the potential impact of RCE vulnerabilities, even though no active exploits have been reported. European organizations should be vigilant, especially those in sectors with high-value targets or critical infrastructure. Mitigation should focus on proactive threat hunting, network segmentation, and monitoring for suspicious activity linked to this group. Countries with significant digital infrastructure and prior exposure to similar threat actors, such as Germany, France, and the UK, are more likely to be targeted. Given the lack of detailed exploit data, the threat is rated medium severity, balancing potential impact against current exploitation evidence. Defenders should prioritize awareness and early detection to prevent escalation.
Cisco has identified a new attack variant targeting its Secure Firewall ASA and FTD devices. Although detailed technical specifics and affected versions are not disclosed, the threat is categorized as a campaign with medium severity. No known exploits are currently observed in the wild, and discussion around this attack is minimal, limiting public technical insights. The attack potentially targets firewall devices critical for network security, which could impact confidentiality, integrity, and availability if exploited. European organizations relying on Cisco Secure Firewall ASA and FTD devices are at risk, especially in countries with high Cisco market penetration and strategic infrastructure. Mitigation should focus on close monitoring of Cisco advisories, network segmentation, and enhanced logging to detect anomalous activity. Countries like Germany, France, the UK, Italy, and the Netherlands are likely most affected due to their extensive use of Cisco security products and critical infrastructure. Given the limited public information but the critical role of the targeted devices, the suggested severity is medium. Defenders should prioritize awareness and readiness for potential updates or patches from Cisco.
The Clop ransomware group has claimed responsibility for breaching The Washington Post, a major US media organization. This incident involves unauthorized access and potential data compromise by a ransomware threat actor known for targeting high-profile entities. While technical details and exploit specifics remain limited, the breach underscores the ongoing risk ransomware groups pose to critical media outlets. European organizations should be alert to similar tactics, as ransomware attacks increasingly target media and information sectors globally. The breach could lead to data theft, operational disruption, and reputational damage. Mitigation requires enhanced monitoring, network segmentation, and incident response readiness. Countries with significant media presence and digital infrastructure, such as the UK, Germany, and France, may be more exposed. Given the high-profile nature and potential impact, the threat severity is assessed as high. Defenders must prioritize proactive threat hunting and patch management to reduce risk.
A sophisticated phishing campaign targets Booking.com hotel partners and their customers by compromising hotel administrators' systems with malware such as PureRAT. Attackers gain access to booking management accounts and use spear-phishing emails impersonating Booking.com to trick guests into paying twice for reservations. The campaign employs social engineering tactics, malicious sites, and a complex infrastructure involving compromised legitimate websites and bulletproof hosting. This operation is part of a broader cybercrime ecosystem offering specialized services to facilitate attacks on booking platforms. The threat impacts the confidentiality and financial integrity of hotel bookings and customer payments. European hospitality businesses relying on Booking.com, especially in countries with large tourism sectors, are at risk. Mitigation requires targeted security controls on hotel admin systems, user awareness training, and monitoring for unusual booking activities.
Between 2016 and 2021, the suspects defrauded 4.3 million cardholders in 193 countries of €300 million (~$346 million). The post 18 Arrested in Crackdown on Credit Card Fraud Rings appeared first on SecurityWeek .
