A 2025 study analyzing 6 billion stolen passwords reveals that user password behavior remains stagnant, with common weak passwords like '123456', 'admin', and 'password' dominating. This widespread use of easily guessable passwords continues to expose organizations to credential-based attacks. Although no specific software vulnerability is identified, the persistence of weak passwords significantly increases risks of unauthorized access and data breaches. European organizations remain vulnerable due to reliance on password authentication and insufficient enforcement of strong password policies. Mitigation requires enforcing multi-factor authentication, implementing password blacklists, and user education to reduce weak password usage. Countries with large digital economies and high internet penetration, such as Germany, the UK, France, and the Netherlands, are particularly at risk. Given the ease of exploitation and potential for broad impact, the threat severity is assessed as high. Defenders must prioritize strengthening authentication controls and monitoring for credential abuse to mitigate this ongoing risk.
Under the new rules, measures for 5G cybersecurity would become mandatory. The post EU Plans Phase Out of High Risk Telecom Suppliers, in Proposals Seen as Targeting China appeared first on SecurityWeek .
A simple payload allowed attackers to create a new event leaking summaries of the victim’s private meetings. The post Weaponized Invite Enabled Calendar Data Theft via Google Gemini appeared first on SecurityWeek .
IDNs or “International Domain Names” have been with us for a while now (see RFC3490[1]). They are (ab)used in many attack scenarios because.. it works! Who can immediately spot the difference between:
VoidLink is an advanced AI-generated malware framework exhibiting high maturity, modularity, and sophisticated techniques such as eBPF and LKM rootkits. It targets cloud and container environments with dedicated modules for enumeration and post-exploitation, indicating a focus on modern infrastructure. Although no known exploits in the wild have been reported yet, its architecture suggests a significant threat potential. European organizations relying on cloud-native and containerized deployments are at heightened risk due to the malware's capabilities. Mitigation requires advanced detection mechanisms tailored to eBPF and kernel-level rootkits, alongside strict cloud environment monitoring and segmentation. Countries with strong cloud adoption and critical infrastructure sectors, such as Germany, the UK, France, and the Netherlands, are likely to be most affected. Given its high impact on confidentiality, integrity, and availability, combined with ease of exploitation via AI-generated code, the suggested severity is high. Defenders should prioritize proactive threat hunting and behavioral analytics to detect this evolving threat.
The Evelyn Stealer campaign targets software developers through weaponized Visual Studio Code extensions, employing a multistage delivery of information-stealing malware. The attack chain involves a downloader disguised as a legitimate Lightshot DLL, an injector that uses process hollowing to inject the final payload, and the Evelyn Stealer itself. The malware implements sophisticated anti-analysis techniques, collects sensitive information including browser credentials and cryptocurrency data, and exfiltrates the stolen data via FTP. This campaign highlights the increasing threat to developer communities and the need for enhanced security measures in development environments.
The information stealer abuses legitimate APIs and libraries to exfiltrate data to Discord webhooks. The post ‘SolyxImmortal’ Information Stealer Emerges appeared first on SecurityWeek .
The Sysdig Threat Research Team analyzed VoidLink, a sophisticated Linux malware framework targeting cloud environments. Key findings include the first documented Serverside Rootkit Compilation, Chinese development with AI assistance, adaptive detection evasion, and use of the Zig programming language. VoidLink employs a multi-stage loader architecture, fileless execution techniques, and kernel-level stealth mechanisms. It features three control channels, including a covert ICMP channel, and specialized functionality for cloud and container environments. Despite its sophistication, VoidLink can be detected using runtime monitoring tools. The malware shows indicators of Chinese-speaking developers with significant kernel expertise, likely using AI-assisted development methods.
A data breach was disclosed by Spanish energy company Endesa following unauthorized access to a commercial platform managing customer information. Attackers reportedly exfiltrated over 1 terabyte of data, including sensitive financial details such as IBANs. This incident highlights risks to critical infrastructure sectors in Europe, particularly energy providers. The breach's medium severity reflects significant confidentiality impact but no known active exploits or public patches yet. European organizations, especially in energy and utilities, face potential risks from similar unauthorized access attacks. Mitigation should focus on strengthening access controls, continuous monitoring, and rapid incident response tailored to commercial platforms handling sensitive customer data. Spain and neighboring European countries with interconnected energy markets are most likely affected due to shared infrastructure and market penetration. Given the data volume and sensitivity, the threat severity is assessed as high, considering the potential for financial fraud and reputational damage. Defenders should prioritize securing customer data platforms and enhancing threat intelligence sharing within the sector.
PDFSIDER is a newly identified malware variant that utilizes DLL side-loading to deploy a covert backdoor with encrypted command-and-control capabilities. It exploits vulnerabilities in legitimate software like PDF24 Creator to bypass endpoint detection mechanisms. The malware operates primarily in memory, minimizing disk artifacts, and employs advanced anti-VM technology to evade sandboxes and analysis labs. PDFSIDER features a robust cryptographic implementation using the Botan library for secure communications. It gathers system information and provides attackers with an interactive, hidden command shell for remote execution. The malware's characteristics align with APT tradecraft, suggesting its use in cyber-espionage operations. Distribution occurs through spear-phishing emails containing ZIP archives with legitimate-looking executables.
Nicholas Moore pleaded guilty to repeatedly hacking the U.S. Supreme Court’s filing system and illegally accessing computer systems belonging to AmeriCorps and the Department of Veterans Affairs. The post Tennessee Man Pleads Guilty to Repeatedly Hacking Supreme Court’s Filing System appeared first on SecurityWeek .
The critical issue impacts Bluetooth audio accessories with improper Google Fast Pair implementations. The post WhisperPair Attack Leaves Millions of Audio Accessories Open to Hijacking appeared first on SecurityWeek .
