Researchers have identified malicious packages targeting popular developer ecosystems including VS Code extensions, Go modules, npm packages, and Rust crates. These malicious packages are designed to steal sensitive developer data, potentially including credentials, environment variables, and source code. The threat is significant due to the widespread use of these package managers and development tools across the software industry. Exploitation does not require advanced user interaction beyond installing or updating packages, making it relatively easy to execute. Although no known exploits are currently active in the wild, the potential for data exfiltration and supply chain compromise is high. European organizations relying heavily on these development environments are at risk, especially those in software development, technology services, and critical infrastructure sectors. Mitigation requires strict vetting of third-party packages, use of code signing, dependency auditing, and monitoring for unusual network activity from development environments. Countries with large software industries and strong developer communities such as Germany, France, the UK, and the Netherlands are most likely to be affected. Given the high potential impact on confidentiality and integrity, ease of exploitation, and broad scope, this threat is assessed as high severity. Defenders should prioritize supply chain security controls and developer awareness to reduce risk.
Vitas, the largest for-profit hospice chain in the United States, discovered a cybersecurity intrusion in October. The post Over 300,000 Individuals Impacted by Vitas Hospice Data Breach appeared first on SecurityWeek .
We break down a new infostealer attack that combines the ClickFix technique with a shared chat containing malicious user guides on the official ChatGPT website.
JS#SMUGGLER is a threat actor or campaign leveraging compromised legitimate websites to deliver the NetSupport Remote Access Trojan (RAT). The attack involves injecting malicious JavaScript payloads into trusted sites, which then silently deploy NetSupport RAT onto victims' systems. This RAT enables attackers to gain persistent remote access, potentially leading to data theft, espionage, or further network compromise. The threat is considered high severity due to the use of trusted sites for delivery, the capabilities of NetSupport RAT, and the stealthy infection vector. European organizations relying on web traffic from compromised sites are at risk, especially those with remote workforce or critical infrastructure. Mitigation requires proactive monitoring of web assets, enhanced endpoint detection, and network segmentation to limit RAT impact. Countries with high internet usage, significant remote workforces, and strategic industries are more likely targets. Given the ease of exploitation via compromised sites and the high impact on confidentiality and integrity, the threat is assessed as high severity. Defenders should prioritize detection of unusual RAT activity and patch any web application vulnerabilities that could lead to site compromise.
Cybercriminals are increasingly manipulating online photos to fabricate virtual kidnapping scenarios, demanding ransoms from victims or their families. This social engineering tactic leverages altered images to create believable threats without physical abduction. The FBI has highlighted this emerging trend, emphasizing the psychological pressure on victims. Although no direct software vulnerabilities are exploited, the threat exploits human trust and fear. European organizations and individuals may face increased targeting due to widespread social media use and digital photo sharing. The threat's medium severity reflects its significant impact on confidentiality and integrity of personal safety perceptions, despite lacking technical exploitation. Mitigation requires enhanced public awareness, verification protocols, and law enforcement collaboration. Countries with high social media penetration and affluent populations are more vulnerable. This threat underscores the evolving nature of cybercrime blending digital manipulation with psychological tactics.
Chrome’s new agentic browsing protections include user alignment critic, expanded origin-isolation capabilities, and user confirmations. The post Google Fortifies Chrome Agentic AI Against Indirect Prompt Injection Attacks appeared first on SecurityWeek .
The article '10 (Not So) Hidden Dangers of Age Verification' highlights significant privacy and security risks associated with age verification systems. These systems, often mandated to restrict access to age-restricted content, can inadvertently expose sensitive personal data, increase surveillance risks, and create new attack surfaces. The dangers include data breaches, identity theft, and misuse of biometric or government-issued ID data. European organizations implementing such systems must carefully consider data protection regulations like GDPR and the potential reputational damage from mishandling sensitive information. Mitigation requires adopting privacy-preserving verification methods, minimizing data collection, and ensuring robust encryption and secure storage. Countries with high digital service adoption and strict age verification laws, such as Germany, France, and the UK, are particularly at risk. Given the medium severity, the threat primarily impacts confidentiality and privacy, with moderate ease of exploitation due to reliance on third-party verification services. Defenders should prioritize privacy-centric designs and compliance with European data protection standards.
The SmartApeSG campaign, also known as ZPHP or HANEYMANEY, has evolved from using fake browser update pages to employing ClickFix-style fake CAPTCHA pages. This campaign distributes malicious NetSupport RAT packages as its initial infection vector. The attack chain begins with an injected script on compromised websites, which, under certain conditions, displays a fake CAPTCHA page. When users interact with this page, malicious content is injected into the Windows clipboard, prompting users to paste and execute it. This leads to the download and installation of NetSupport RAT, which maintains persistence through a Start Menu shortcut. The campaign frequently changes domains, packages, and C2 servers to evade detection.
A malicious campaign is targeting indie game platforms Itch.io and Patreon by posting fake update links in comments, which lead to downloads of LummaStealer malware. This malware uses advanced anti-analysis techniques to evade detection, including checks for virtual machines, specific usernames, and malware analysis processes. The payload is delivered via a nexe-compiled JavaScript file that drops and loads a DLL variant of LummaStealer. Despite efforts to remove malicious accounts, attackers continuously create new ones, indicating an ongoing and persistent threat. The campaign primarily targets users seeking game updates, exploiting trust in indie game communities. No known exploits in the wild have been reported yet, but the malware’s stealth and persistence pose a medium-level risk. European organizations involved in gaming, digital content creation, or using these platforms could be impacted, especially those with less mature security controls. Mitigation requires targeted detection of fake update links, monitoring of platform comments, and enhanced endpoint defenses against DLL injection and obfuscated JavaScript. Countries with active indie game development and strong Patreon/Itch.
GhostPenguin is a newly discovered, undocumented Linux backdoor malware identified through AI-driven threat hunting. It is a multi-threaded C++ program that establishes remote shell access and file system manipulation capabilities over an encrypted UDP channel using RC5 encryption. The malware employs a structured handshake and thread synchronization for registration, heartbeat, and command delivery, making it stealthy and evasive. Although still in development with debug artifacts present, GhostPenguin's capabilities include remote shell, file and directory operations, and encrypted communications. No known exploits are currently in the wild, and it was found in zero-detection samples on VirusTotal. The malware targets Linux systems, which are widely used in European enterprises and infrastructure. Detection was enabled by custom YARA rules and AI profiling, highlighting the importance of advanced threat hunting techniques. The threat poses a medium severity risk due to its stealth, remote control features, and potential for lateral movement within networks.
China-linked threat actors rapidly weaponized the React2Shell vulnerability shortly after its public disclosure, indicating a swift exploitation attempt in the wild. React2Shell is a critical remote code execution vulnerability affecting systems that use the React framework or related components. Although no confirmed exploits in the wild have been reported yet, the speed of weaponization suggests imminent risk. European organizations using vulnerable React-based applications or AWS services could face unauthorized code execution, leading to data breaches, service disruption, or lateral movement within networks. Mitigation requires immediate patching, monitoring for suspicious activity, and restricting access to vulnerable services. Countries with significant cloud adoption and software development sectors, such as Germany, the UK, France, and the Netherlands, are at higher risk. Given the ease of exploitation and potential impact on confidentiality, integrity, and availability, this threat is assessed as high severity. Defenders should prioritize rapid vulnerability management and threat hunting to prevent compromise.
For the latest discoveries in cyber research for the week of 8th December, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES The University of Pennsylvania and the University of Phoenix were hit by data breaches after attackers exploited zero-day vulnerabilities in Oracle E-Business Suite servers. At least 1,488 people at UPenn and numerous […] The post 8th December – Threat Intelligence Report appeared first on Check Point Research .
Tri-Century Eye Care was targeted recently by the Pear ransomware group, which claimed to have stolen over 3 Tb of data. The post Tri-Century Eye Care Data Breach Impacts 200,000 Individuals appeared first on SecurityWeek .
Ransomware payments reached the highest level in 2023, at $1.1 billion paid in 1,512 reported incidents. The post Ransomware Payments Surpassed $4.5 Billion: US Treasury appeared first on SecurityWeek .
A months-long phishing campaign has been identified targeting US universities, utilizing over 70 malicious domains to deceive recipients. The attackers aim to impersonate legitimate university communications to harvest credentials or deliver malware. Although primarily focused on US academic institutions, the tactics and infrastructure used could pose risks to European universities and research organizations due to similarities in communication channels and potential cross-border collaborations. The campaign's scale and persistence indicate a well-resourced adversary employing domain infrastructure to evade detection. No known exploits or malware payload specifics are reported, but the medium severity reflects the potential for credential compromise and subsequent unauthorized access. Defenders should prioritize domain monitoring, user awareness training, and email filtering enhancements to mitigate risk. European organizations with international ties to US universities or similar email ecosystems should be particularly vigilant. Countries with large academic sectors and strong research collaborations with the US, such as the UK, Germany, and the Netherlands, are more likely to be affected. The threat is assessed as medium severity due to the phishing nature, requiring user interaction but with significant impact potential if successful.
A recent analysis reveals that malicious Visual Studio Code (VS Code) extensions can bypass the official VS Code Marketplace's security analysis, exploiting weaknesses in both the Marketplace and the OpenVSX alternative. Attackers can publish extensions that appear legitimate but contain harmful code, potentially compromising developer environments. This threat highlights the insecurity of OpenVSX, an open-source VS Code extension registry, which lacks rigorous vetting processes. European organizations relying on VS Code and OpenVSX for development tools face risks of code injection, data leakage, and supply chain attacks. Mitigations include strict extension source verification, enhanced monitoring of extension behavior, and restricting extension installation to trusted repositories. Countries with strong software development sectors and high VS Code adoption, such as Germany, France, and the UK, are particularly at risk. Given the ease of exploitation without authentication and the potential impact on confidentiality and integrity, this threat is assessed as high severity. Defenders should prioritize vetting extensions, educating developers, and employing endpoint protection to mitigate risks.
A side-channel tracking technique leveraging WhatsApp and Signal allows an attacker to infer a target phone's device activity state (screen on/off, offline) by sending silent probe reactions to invalid message IDs and measuring delivery receipt round-trip times. This method does not generate visible notifications or messages on the victim's device, making it stealthy. Over time, attackers can profile user behavior such as when they are home, sleeping, or mobile. The attack requires the ability to send messages to the target number, which can be mitigated by restricting unknown contacts in privacy settings. Although no direct data breach occurs, this privacy-invasive tracking poses significant risks. The threat is relevant to European users given WhatsApp and Signal's widespread adoption. No known exploits in the wild exist yet, but the proof-of-concept is publicly available.
A security news report highlights the patching of firmware vulnerabilities in pulse oximeters, medical devices used to monitor blood oxygen levels. While no specific vulnerabilities or exploits are detailed, the discussion emphasizes the importance of firmware updates to address potential security risks. There are no known exploits in the wild, and the threat currently has minimal public discussion. The medium severity rating suggests moderate risk, likely due to the critical nature of medical devices and potential impacts on device integrity and patient safety. European healthcare providers using affected pulse oximeters should prioritize firmware updates once available. The threat is more relevant to countries with advanced healthcare infrastructure and significant use of such medical devices. Given the lack of detailed technical data and exploit evidence, the overall risk is assessed as medium. Defenders should monitor for official patches and verify device firmware integrity to mitigate potential risks.
CVE-2025-59287 is a critical remote code execution vulnerability in Microsoft Windows Server Update Services (WSUS) affecting versions from Windows Server 2012 through 2025 with the WSUS role enabled. It allows unauthenticated attackers to execute code with system privileges by targeting WSUS instances exposed on ports 8530 and 8531. Initial patches released on October 14, 2025, were incomplete, requiring an emergency update on October 23. Exploitation has been observed shortly after patch release, with attackers using malicious PowerShell commands for reconnaissance and data exfiltration. Approximately 5,500 WSUS instances are exposed globally, posing a significant risk, especially to European organizations. The vulnerability facilitates initial access and lateral movement within networks. Immediate patching and reducing network exposure are critical to mitigate this threat.
Stillepost is a technique that enables threat actors to proxy their command-and-control (C2) HTTP traffic through the Chromium browser, effectively leveraging a legitimate browser process to obfuscate malicious communications. This method complicates network detection and analysis by blending C2 traffic with normal browser activity, making it harder for defenders to distinguish malicious traffic from benign. Although no specific affected software versions or exploits in the wild are currently reported, the approach represents a medium-severity threat due to its potential to bypass traditional network security controls. European organizations, especially those with high Chromium browser usage, may face challenges detecting such covert C2 channels. Mitigation requires advanced monitoring of browser processes, behavioral analytics, and strict application control policies. Countries with significant tech sectors and high Chromium adoption, such as Germany, France, and the UK, are more likely to be targeted. Given the stealthy nature and potential impact on confidentiality and integrity, this threat is assessed as medium severity. Defenders should prioritize visibility into browser network activity and implement anomaly detection to counter this emerging evasion technique.
