SquareX has shown how malicious browser extensions can impersonate AI sidebar interfaces. The post AI Sidebar Spoofing Puts ChatGPT Atlas, Perplexity Comet and Other Browsers at Risk appeared first on SecurityWeek .
Research by: Antonis Terefos (@Tera0017) Key Points Introduction In recent years, threat actors have continuously adapted their tactics to discover new and effective methods for malware distribution. While email remains one of the most prominent infection vectors, its effectiveness has diminished due to widespread deployment of security solutions and increased user awareness. Consequently, attackers have sought […] The post Dissecting YouTube’s Malware Distribution Network appeared first on Check Point Research .
A large dataset containing 183 million credentials stolen by the Synthient stealer malware has been added to the Have I Been Pwned database. This dataset likely includes usernames, passwords, and possibly other sensitive information harvested from infected systems. Although no active exploits are currently reported, the availability of such a massive credential dump poses significant risks of credential stuffing and account takeover attacks. European organizations using affected credentials are at risk of unauthorized access and data breaches. The threat is medium severity due to the scale of data exposure and the potential for widespread abuse, despite the lack of direct exploitation evidence. Defenders should prioritize credential hygiene, multi-factor authentication, and monitoring for suspicious login attempts. Countries with high internet penetration and large digital economies, such as Germany, the UK, France, and the Netherlands, are most likely to be impacted. The threat underscores the ongoing risks from malware-based credential theft and the importance of proactive identity and access management controls.
Infostealers landscape exploded in 2024 and they remain a top threat today. If Windows remains a nice target (read: Attackers&#;x26;#;39; favorite), I spotted an Infostealer targeting Android devices. This sounds logical that attackers pay attention to our beloved mobile devices because all our life is stored on them.
A critical vulnerability in Lanscope Endpoint Manager has been confirmed by CISA to be actively exploited in ongoing cyberattacks. Lanscope Endpoint Manager is an endpoint management solution used to monitor and control enterprise devices. The vulnerability allows attackers to potentially execute unauthorized actions on affected systems, posing a significant risk to confidentiality, integrity, and availability. Although specific technical details and affected versions are not disclosed, the critical severity indicates a high-impact flaw. European organizations using Lanscope Endpoint Manager are at risk, especially those in sectors with high endpoint management reliance. No official patches or CVSS score are currently available, but the threat is urgent. Mitigation should focus on immediate risk reduction, including network segmentation, monitoring for suspicious activity, and vendor engagement for updates. Countries with strong adoption of Lanscope products and critical infrastructure sectors are most likely to be targeted. The ease of exploitation and active attacks justify a suggested severity rating of critical. Defenders must prioritize detection and containment to prevent compromise.
Verizon’s 2025 Mobile Security Index shows that 85% of organizations believe mobile device attacks are on the rise. The post Mobile Security: Verizon Says Attacks Soar, AI-Powered Threats Raise Alarm appeared first on SecurityWeek .
The Iran-linked threat actor group MuddyWater has launched a global espionage campaign targeting over 100 organizations worldwide. This campaign focuses on intelligence gathering and is characterized by high-priority targeting of entities likely involved in sensitive sectors. Although specific technical details and exploited vulnerabilities are not disclosed, MuddyWater is known for using sophisticated tactics including spear-phishing and custom malware. The campaign poses significant risks to confidentiality and integrity of targeted organizations’ data. European organizations, especially those in critical infrastructure, government, and defense sectors, are at heightened risk due to their strategic value. Mitigation requires enhanced threat hunting, network monitoring for MuddyWater TTPs, and strict access controls. Countries with strong geopolitical ties or adversarial relations with Iran, and those with high adoption of targeted technologies, are more likely to be affected. Given the espionage nature, ease of exploitation is moderate but impact on confidentiality is high, warranting a high severity rating. Defenders should prioritize detection of MuddyWater indicators and implement proactive cyber threat intelligence sharing.
A critical vulnerability named "SessionReaper" in Adobe Magento is being actively exploited by hackers. This flaw affects Magento e-commerce platforms, potentially allowing attackers to hijack or manipulate user sessions. Although no specific affected versions or patches have been detailed, the exploit's critical severity indicates a high risk to confidentiality, integrity, and availability of Magento-based online stores. European organizations using Magento are at risk of data breaches, financial fraud, and service disruptions. Immediate mitigation steps include monitoring for unusual session activity, applying any forthcoming patches promptly, and implementing enhanced session management controls. Countries with significant e-commerce sectors and widespread Magento adoption, such as Germany, the UK, France, and the Netherlands, are most likely to be targeted. Given the critical nature, ease of exploitation, and potential impact, the suggested severity is critical. Defenders should prioritize detection and response measures to prevent exploitation and protect customer data and business operations.
The 'HijackServer' malicious IIS module is actively compromising IIS servers by exploiting exposed ASP . NET machine keys, enabling unauthenticated remote command execution. This threat, attributed to the RudePanda group, uses a customized rootkit and off-the-shelf tools to maintain persistent access. While primarily used to manipulate search engine results for cryptocurrency scams, the module's capabilities allow attackers or third parties to conduct espionage or build malicious infrastructure. Hundreds of servers worldwide have been affected, indicating a broad impact. The exploitation does not require authentication, and the attack leverages a critical misconfiguration or exposure of sensitive cryptographic keys. European organizations running IIS with exposed ASP . NET machine keys are at risk, especially those in countries with high IIS usage and strategic value. Mitigation requires immediate review and protection of ASP . NET machine keys, deployment of advanced monitoring for rootkit activity, and hardening of IIS configurations.
Rival hacker groups have publicly exposed the alleged operators behind the Lumma Stealer malware, a threat known for stealing sensitive information from infected systems. This doxing event aims to undermine the operators by revealing their identities, potentially disrupting their activities. While the Lumma Stealer malware itself poses a medium-level threat due to its data theft capabilities, this particular incident is focused on the interpersonal conflict between threat actors rather than a new technical vulnerability or exploit. There are no known active exploits or new versions of the malware associated with this event. European organizations using systems vulnerable to information stealers like Lumma Stealer should remain vigilant, as such malware can compromise confidentiality and lead to data breaches. The doxing may lead to retaliatory attacks or shifts in threat actor tactics, increasing the risk landscape. Mitigation should focus on strengthening endpoint security, monitoring for indicators of compromise related to Lumma Stealer, and maintaining robust incident response capabilities. Countries with significant digital infrastructure and high usage of targeted platforms may be more exposed to risks stemming from Lumma Stealer infections and related threat actor activity. Given the medium severity of the malware and the nature of this event, the overall threat level is assessed as medium. Defenders should prioritize detection and prevention of Lumma Stealer infections while monitoring threat actor developments.
SocGholish is a malware campaign that leverages compromised websites to deliver ransomware through fake software update prompts. Users visiting these compromised sites are tricked into installing malicious payloads disguised as legitimate updates, leading to ransomware infection. This attack vector exploits social engineering and website vulnerabilities to bypass traditional security controls. The malware's medium severity reflects its potential to disrupt operations but requires user interaction for execution. European organizations with significant web presence or reliance on third-party software updates are at risk. Mitigation involves securing web assets, monitoring for unauthorized changes, and educating users on update verification. Countries with high internet usage, advanced digital infrastructure, and targeted ransomware history, such as Germany, France, and the UK, are more likely to be affected. The threat does not require advanced exploitation techniques but depends on compromised sites and user deception, warranting a medium severity rating. Defenders should prioritize detection of fake update prompts and strengthen web application security to reduce exposure.
Yesterday, Chinese security services published a story alleging a multi-year attack against the systems operating the Chinese standard time (CST), sometimes called Beijing Standard Time. China uses only one time zone across the country, and has not used daylight saving time since 1991. Most operating systems use UTC internally and display local time zones for user convenience. Modern operating systems use NTP to synchronize time. Popular implementations are ntpd and chrony. The client will poll several servers, disregard outliers, and usually sync with the "best" time server based on latency and jitter detected.
The Jingle Thief campaign, conducted by financially motivated threat actors from Morocco, targets global enterprises in retail and consumer services sectors to execute gift card fraud. Using phishing and smishing tactics, the attackers gain access to Microsoft 365 environments, exploiting cloud services for reconnaissance, lateral movement, and persistence. They focus on compromising gift card issuance systems, leveraging internal documentation and communication channels. The campaign demonstrates sophisticated techniques, including tailored phishing, internal email manipulation, and device registration abuse. The attackers maintain long-term access, sometimes over a year, making detection challenging. Their activities often align with holiday periods to maximize impact.
Vidar Stealer 2.0 is a malware variant that enhances its data theft capabilities by implementing multi-threaded operations and improved evasion techniques. It targets sensitive user information by stealing data more efficiently and stealthily than previous versions. Although no known exploits in the wild have been reported yet, its high-priority classification and recent emergence warrant immediate attention. The malware’s multi-threaded design allows it to exfiltrate data faster, increasing the risk of significant data loss. European organizations, especially those handling large volumes of personal or financial data, are at risk due to the potential for rapid and covert data compromise. Mitigation requires advanced endpoint detection, behavioral analysis, and network monitoring tailored to detect multi-threaded suspicious activities. Countries with high adoption of Windows-based systems and significant financial or industrial sectors are more likely to be targeted. Given the high impact on confidentiality and ease of exploitation without user interaction, the threat severity is assessed as high.
Participants exploited 34 previously unknown vulnerabilities to hack printers, NAS devices, and smart home products. The post Hackers Earn Over $520,000 on First Day of Pwn2Own Ireland 2025 appeared first on SecurityWeek .
A method has been disclosed that allows unlocking free WiFi access on British Airways flights by bypassing the usual payment or authentication mechanisms. This technique was shared on Reddit's NetSec community and detailed on an external blog, but it currently lacks evidence of widespread exploitation. The vulnerability or weakness appears to be related to the airline's inflight WiFi access controls. While the severity is assessed as medium, the impact could include unauthorized network access and potential misuse of airline resources. European organizations, especially those involved in aviation and travel sectors, should be aware of this threat. Mitigation requires British Airways to review and strengthen their WiFi authentication and payment validation processes. Countries with significant British Airways operations and high passenger volumes are more likely to be affected. Given the nature of the exploit, the suggested severity is medium due to limited impact on confidentiality and integrity but moderate impact on availability and business operations.
The Brazilian Caminho loader is a sophisticated malware delivery mechanism active since March 2025, leveraging LSB steganography to hide . NET payloads within images hosted on legitimate platforms. It initiates infection via phishing emails containing malicious scripts that download these steganographic images. The loader executes payloads filelessly in memory and establishes persistence using scheduled tasks. Caminho operates as a Loader-as-a-Service, delivering multiple malware families such as Remcos RAT, Xworm, and Katz stealer across South America, Africa, and Eastern Europe. Its use of bulletproof hosting and Portuguese language artifacts indicates a Brazilian origin and professional operation. The campaign targets multiple industries opportunistically without a specific sector focus. The infection chain employs multiple advanced techniques including fileless execution, steganography, and obfuscation, complicating detection and mitigation efforts. European organizations, especially in Eastern Europe, face risks of data theft, espionage, and system compromise. Mitigation requires targeted email security, memory scanning, and monitoring of scheduled tasks for persistence.
Mirai, a notorious botnet targeting IoT devices, has evolved since its 2016 debut. Initially known for massive DDoS attacks, newer variants employ sophisticated techniques like UPX packing and common network utilities for evasion and adaptability. Modern Mirai samples extend beyond DDoS, focusing on data exfiltration and long-term persistence. The analysis compares a June 2025 variant with the original, highlighting differences in execution, network behavior, and file characteristics. The new variant demonstrates increased stealth, modularity, and versatility, making it a more significant threat in the interconnected device landscape. Prevention strategies include updated antivirus software, avoiding suspicious links, and regular system and network monitoring.
Tykit is a newly identified phishing kit targeting Microsoft 365 accounts, active since May 2025. It uses SVG files as delivery vectors and a multi-stage attack chain to mimic Microsoft login pages and steal credentials. The kit employs evasion techniques including Cloudflare Turnstile anti-bot protection and basic anti-debugging measures. It primarily targets industries such as finance, construction, IT, professional services, government, and telecom, with victims globally including the EMEA region. Stolen credentials are exfiltrated via API calls to attacker-controlled servers. The campaign requires user interaction through phishing but does not require prior authentication. This threat poses a medium severity risk due to its potential impact on confidentiality and the widespread use of Microsoft 365 in Europe.
Salt Typhoon is an advanced persistent threat (APT) group identified as targeting global telecommunications and energy sectors. The campaign was recently reported by Darktrace and highlighted in infosec news sources. While specific technical details and indicators of compromise are limited, the group’s focus on critical infrastructure sectors suggests a strategic intent to disrupt or gather intelligence from vital services. The threat is assessed as medium severity due to the lack of known exploits in the wild and minimal public technical details, but the potential impact on confidentiality and availability in critical sectors remains significant. European telecom and energy organizations are at risk given the continent's reliance on these sectors for economic stability and national security. Mitigation should focus on enhanced network monitoring, anomaly detection, and threat hunting tailored to APT behaviors. Countries with large telecom and energy infrastructures, such as Germany, France, the UK, Italy, and Spain, are most likely to be affected. Given the medium severity, organizations should prioritize proactive defense measures and incident response readiness to mitigate potential disruptions or espionage activities.
