Threats affecting Sweden

CERT-FR has issued a recommendation to completely deactivate Wi-Fi whenever it is not in use to reduce attack surfaces and prevent potential unauthorized access. This advisory highlights the risks associated with leaving Wi-Fi enabled unnecessarily, which can expose devices and networks to various wireless attacks such as unauthorized access, man-in-the-middle, and exploitation of Wi-Fi protocol vulnerabilities. Although no specific vulnerability or exploit is detailed, the guidance aims to mitigate risks by minimizing wireless exposure. European organizations, especially those with sensitive data or critical infrastructure, should consider this practice to enhance their security posture. The recommendation is particularly relevant for environments where Wi-Fi is not continuously needed, such as offices after hours or industrial settings. Countries with high adoption of Wi-Fi-enabled devices and critical infrastructure reliant on wireless connectivity are more likely to benefit from this advice. Given the medium severity rating and lack of known exploits, the threat is more about reducing risk exposure than responding to an active exploit. Practical mitigation includes disabling Wi-Fi radios when idle, enforcing strict network access controls, and monitoring for unauthorized wireless activity. This advisory serves as a reminder that wireless interfaces represent a persistent attack vector and should be managed proactively to reduce potential compromise.

News#infosecnews#redditFrance+7

Nathan Austad admitted in court to launching a credential stuffing attack against a fantasy sports and betting website. The post Third DraftKings Hacker Pleads Guilty appeared first on SecurityWeek .

News#webGermany+6

This discussion highlights that traditional identity-based delegation models are insufficient for securely managing delegated authority. Instead, capability-based authorization systems treat delegation as a first-class, enforceable operation on authority itself, enabling more precise and secure control. The threat centers on the risks inherent in delegation mechanisms that rely on identity attributes, which can lead to unauthorized privilege escalation or remote code execution (RCE). Although no known exploits are currently in the wild, the concept underscores a medium-severity risk in systems that do not implement capability-based delegation. European organizations relying on legacy or identity-based delegation models may face increased risks of unauthorized access or RCE attacks. Mitigation involves adopting capability-based security models that enforce monotonic reduction of authority and explicit delegation tokens. Countries with significant technology sectors and critical infrastructure, such as Germany, France, and the UK, are more likely to be impacted due to their reliance on complex delegated systems. The threat is assessed as medium severity given the potential for RCE but the lack of active exploitation and the complexity of exploitation. Defenders should prioritize reviewing delegation mechanisms and consider transitioning to capability-based authorization frameworks to reduce attack surfaces related to delegation misuse.

Campaign#netsec#redditGermany+5

A new phishing threat involves abuse of PayPal subscription services to send fake purchase confirmation emails to users. Attackers exploit PayPal's subscription mechanism to generate seemingly legitimate transaction emails, tricking recipients into believing they have made purchases. These emails may contain malicious links or prompt users to provide sensitive information, increasing the risk of credential theft and financial fraud. The threat is categorized as high severity due to the potential for widespread deception and financial impact. European organizations and consumers using PayPal are at risk, especially those with frequent subscription payments. Mitigation requires enhanced email filtering, user awareness training focused on subscription fraud, and verification of transaction details directly via official PayPal channels. Countries with high PayPal usage and significant e-commerce activity, such as Germany, the UK, France, and the Netherlands, are most likely to be affected. Given the ease of exploitation without needing system vulnerabilities or user authentication, the threat severity is assessed as high. Defenders should prioritize detection of subscription-based phishing emails and educate users to verify suspicious purchase notifications independently.

Phishing#infosecnews#redditGermany+6

Wireshark release 4.6.2 fixes 2 vulnerabilities and 5 bugs.

NewsGermanyFrance+7

A massive unsecured database containing 16TB of data with 4.3 billion professional records was discovered, exposing sensitive personal and professional information. The database was publicly accessible without authentication, posing a significant risk of data theft and misuse. Although no known exploits are currently active, the sheer volume and sensitivity of the data make this breach highly impactful. European organizations and individuals whose data may be included face risks of identity theft, phishing, and reputational damage. Immediate action to identify and secure such databases is critical. This incident highlights the ongoing challenges in securing large-scale data repositories. Organizations should audit their data storage configurations and enforce strict access controls. Countries with large professional populations and significant use of cloud or database services are at higher risk. The threat severity is assessed as high due to the scale, sensitivity, and ease of unauthorized access.

Breach#infosecnews#redditGermany+7

Offline Decryption Messaging is a proposed security model designed to protect communications even when online devices are compromised by spyware. It uses two devices per user: an online device for transmitting encrypted messages and an air-gapped offline device for writing, encrypting, decrypting, and displaying messages. This separation ensures that spyware on the online device cannot access plaintext messages or cryptographic keys, while spyware on the offline device cannot exfiltrate data due to lack of network connectivity. The concept aims to address the limitations of traditional end-to-end encrypted messengers like Signal, which become ineffective if the device itself is compromised. The project, called HelioSphere, is in early prototype stages and seeks community feedback on security, usability, and cryptographic improvements. While promising for high-risk users such as activists, the approach introduces operational complexity and usability challenges. No known exploits exist yet, and the threat is currently a conceptual proposal rather than an active attack vector. The suggested severity is medium due to the potential to mitigate spyware risks but also the practical challenges in deployment.

Breach#netsec#redditGermany+8

The UK Information Commissioner's Office (ICO) has fined LastPass £1.2 million due to a security breach that occurred in 2022. This breach involved unauthorized access to LastPass systems, potentially exposing sensitive customer data. Although no known exploits are currently active in the wild, the incident highlights significant risks related to password management services. European organizations relying on LastPass could face confidentiality and integrity risks if their stored credentials were compromised. The fine underscores regulatory scrutiny on data protection compliance within the EU and UK. Mitigation requires organizations to review their password management practices, enforce multi-factor authentication, and monitor for suspicious activity. Countries with high adoption of LastPass and stringent data protection laws, such as the UK, Germany, and France, are most likely to be affected. Given the breach's impact on sensitive data confidentiality and the ease of exploitation through compromised credentials, the severity is assessed as high. Defenders should prioritize incident response readiness and vendor risk management related to password managers.

Breach#infosecnews#redditGermany+5

Apple has released security updates addressing two WebKit vulnerabilities that were actively exploited in the wild. These flaws affect the WebKit browser engine used in Safari and other Apple applications, potentially allowing attackers to execute arbitrary code or compromise user data. Although specific technical details and affected versions are not disclosed, the high severity rating indicates significant risk. European organizations using Apple devices are at risk of targeted exploitation, especially those in sectors reliant on Safari or WebKit-based applications. Immediate patching is critical to mitigate these threats. Mitigation involves applying Apple’s security updates promptly, restricting untrusted web content, and monitoring for suspicious activity. Countries with high Apple device usage and strategic tech sectors, such as Germany, France, and the UK, are likely most impacted. Given the active exploitation and potential for code execution without user interaction, the threat severity is assessed as critical. Defenders should prioritize update deployment and enhance network defenses against web-based attacks leveraging these WebKit flaws.

News#infosecnews#redditGermany+6

BRICKSTORM Backdoor - MAR-251165.c1.v1

Unknown#misp-galaxy:producer="geminiproduction_cma"#acs-marking:privilege_action="cisauses"Germany+7

The Coupang data breach was caused by a former employee who retained unauthorized system access after leaving the company. This insider threat led to a high-severity data breach compromising sensitive information. Although no known exploits are currently active in the wild, the breach highlights significant gaps in access revocation and internal security controls. European organizations should be vigilant about insider threats and ensure strict offboarding procedures. The breach primarily affects companies with similar access management challenges and those operating in e-commerce or data-sensitive sectors. Countries with strong e-commerce markets and data privacy regulations, such as Germany, France, and the UK, are particularly at risk. Mitigation requires immediate review and enforcement of identity and access management (IAM) policies, continuous monitoring for anomalous access, and comprehensive employee offboarding protocols. Given the ease of exploitation via retained access and the potential exposure of confidential data, the severity is assessed as high. Defenders must prioritize internal security hygiene to prevent similar incidents.

Breach#infosecnews#redditGermany+6

PyStoreRAT is a newly identified Remote Access Trojan (RAT) malware targeting OSINT researchers by leveraging GitHub repositories as its infection vector. It aims to compromise researchers who rely on open-source intelligence tools and resources hosted on GitHub. The malware's distribution through trusted platforms like GitHub increases the risk of successful infection due to perceived legitimacy. While no known exploits are currently active in the wild, the malware poses a medium-level threat given its targeted nature and potential to exfiltrate sensitive research data. European organizations involved in OSINT and cybersecurity research are at risk, especially those with active engagement in GitHub-based projects. Mitigation requires enhanced scrutiny of GitHub repositories, use of endpoint detection tools capable of identifying RAT behaviors, and strict network segmentation to limit lateral movement. Countries with strong cybersecurity research communities and high GitHub usage, such as Germany, the UK, France, and the Netherlands, are more likely to be affected. The threat is assessed as medium severity due to the targeted attack vector, moderate impact on confidentiality and integrity, and the absence of widespread exploitation or automated propagation. Defenders should prioritize monitoring for unusual GitHub repository activity and educate OSINT teams on the risks of downloading unverified code from public repositories.

Malware#infosecnews#redditGermany+5

Other noteworthy stories that might have slipped under the radar: Pentagon orders accelerated move to PQC, US shuts down scheme to smuggle GPUs to China, DroidLock Android ransomware. The post In Other News: PromptPwnd Attack, macOS Bounty Complaints, Chinese Hackers Trained in Cisco Academy appeared first on SecurityWeek .

Malware#macos#androidGermany+4

We break down what happens to stolen data after a phishing attack: how it ends up on the shadow market and gets used in new phishing schemes, and what risks this poses. We also offer tips on how to protect your accounts, and minimize any impact.

PhishingGermanyFrance+9

The React2Shell vulnerability has escalated into large-scale global attacks, prompting emergency mitigation efforts worldwide. Although specific technical details and affected versions are not provided, the critical severity indicates a serious risk of exploitation. The attacks are reported globally, suggesting widespread impact potential. European organizations could face significant risks, especially those relying on React-based technologies or related ecosystems. No known exploits in the wild have been confirmed yet, but the rapid escalation and emergency response imply active exploitation attempts or imminent threats. Mitigation requires urgent patching once available, enhanced monitoring for suspicious activity, and network segmentation to limit potential spread. Countries with strong tech sectors and high adoption of React or JavaScript frameworks are likely more vulnerable. The threat severity is assessed as critical due to the potential for widespread compromise, ease of exploitation implied by rapid escalation, and the global scale of attacks. Defenders should prioritize immediate risk assessment and containment strategies while awaiting detailed technical advisories and patches.

News#infosecnews#redditGermany+7

MITRE has published its list of the top 25 most dangerous software weaknesses projected for 2025, highlighting critical areas of software security risk. This list serves as a prioritized guide for developers, security professionals, and organizations to focus their vulnerability management and secure coding efforts. While no specific exploits are currently known in the wild for these weaknesses, their identification underscores potential future attack vectors. European organizations relying on software development and deployment must pay close attention to these weaknesses to prevent exploitation that could compromise confidentiality, integrity, and availability. The threat landscape outlined by MITRE is relevant globally but particularly impactful in regions with high software development activity and critical infrastructure. Mitigation requires targeted secure coding practices, rigorous code reviews, and integration of automated vulnerability detection tools tailored to these weaknesses. Countries with strong technology sectors and critical infrastructure, such as Germany, France, the UK, and the Netherlands, are most likely to be affected. Given the broad scope and potential impact of these weaknesses, the suggested severity is high. Defenders should prioritize awareness and remediation efforts based on this authoritative guidance to reduce future risk exposure.

News#infosecnews#redditGermany+6

Newly disclosed vulnerabilities in React's React Server Components (RSC) can lead to denial of service (DoS) attacks and potential exposure of source code. These vulnerabilities have been reported recently and are considered high severity due to their impact on availability and confidentiality. Although no known exploits are currently active in the wild, the issues pose significant risks to applications using React RSC. The vulnerabilities do not have assigned CVSS scores yet, but their potential for remote exploitation and sensitive data exposure makes them critical to address. European organizations relying on React for server-side rendering or server components should prioritize mitigation. Countries with strong software development sectors and high adoption of React frameworks are particularly at risk. Immediate mitigation involves monitoring official React updates, applying patches once available, and implementing strict access controls and input validation on server components. Proactive threat hunting and code audits are recommended to detect any exploitation attempts early. Overall, defenders must treat these vulnerabilities with urgency to prevent service disruption and intellectual property leakage.

News#infosecnews#redditGermany+7

CISA has issued an urgent directive for federal agencies to patch a high-severity vulnerability in GeoServer that is actively being exploited. GeoServer is an open-source server for sharing geospatial data, widely used in government and enterprise environments. Although specific technical details and affected versions are not provided, the active exploitation and CISA's involvement indicate a significant risk to confidentiality, integrity, and availability of affected systems. No known public exploits have been confirmed yet, but the threat is considered high priority. European organizations using GeoServer, especially in government, urban planning, and critical infrastructure sectors, face potential risks from this flaw. Immediate patching and monitoring are essential to mitigate potential impacts. Countries with strong adoption of geospatial technologies and critical infrastructure reliance on GeoServer are most at risk. The threat severity is assessed as high due to active exploitation, potential for broad impact, and critical nature of affected data. Defenders should prioritize patch deployment, enhance network monitoring for suspicious activity, and review access controls to GeoServer instances.

News#infosecnews#redditGermany+7

All critical vulnerabilities in Microsoft, third-party, and open source code are eligible for rewards if they impact Microsoft services. The post Microsoft Bug Bounty Program Expanded to Third-Party Code appeared first on SecurityWeek .

News#rceGermany+6

A sophisticated Android malware campaign distributes a malicious 'RTO Challan / e-Challan' APK via WhatsApp, targeting users with a fraudulent payment app. The malware employs advanced obfuscation and hidden installation techniques to maintain persistence and control over infected devices. It establishes a custom VPN tunnel to conceal network traffic and harvests extensive personal, device, and financial data. Key capabilities include OTP interception, call behavior manipulation, and presenting fake payment interfaces to steal banking credentials. The command-and-control infrastructure uses obfuscated Base64-encoded URLs linked to malicious domains. This campaign combines social engineering, mobile malware, and financial fraud, posing a significant risk of monetary loss and identity theft. Although no CVSS score is assigned, the threat severity is assessed as high due to the impact and exploitation ease. European organizations with Android users, especially those using WhatsApp and mobile banking, should be vigilant. Mitigation requires targeted user awareness, mobile security hygiene, and network monitoring for suspicious VPN tunnels and domain connections.

Malware#social engineering#apkGermany+9