Threats affecting Sweden

How an attacker can find out the topic of your chats with an AI assistant without hacking your computer, and what you can do to guard against this threat

BreachGermanyFrance+9

A malicious Visual Studio Code extension named 'prettier-vscode-plus' was discovered on the official VSCode Marketplace, impersonating the legitimate Prettier formatter. This extension served as the entry point for a multi-stage malware chain, starting with the Anivia loader, which decrypted and executed further payloads in memory. The final stage, OctoRAT, is a comprehensive remote access toolkit providing over 70 commands for surveillance, file theft, remote desktop control, persistence, privilege escalation, and harassment. The attack chain employs sophisticated techniques like AES encryption, process hollowing, and UAC bypass. The threat actor's GitHub repository showed active payload rotation to evade detection. This supply-chain attack highlights the evolving threats targeting developers and the abuse of trusted tools in their ecosystem.

Malware#extension#remote-access-toolkitGermany+6

Kohler's smart toilet camera, marketed as having end-to-end encryption, has been found not to provide true end-to-end encryption, potentially exposing sensitive video data to interception or unauthorized access. This vulnerability undermines user privacy and could lead to significant confidentiality breaches. Although no known exploits are currently in the wild, the high sensitivity of the data involved elevates the risk. European organizations and consumers using these devices may face privacy violations and reputational damage. Mitigation requires verifying actual encryption implementations, demanding transparency from the vendor, and applying network-level protections. Countries with higher adoption of smart home and IoT devices, such as Germany, the UK, and the Nordics, are more likely to be affected. Given the nature of the data and ease of exploitation through network interception, the severity is assessed as high. Defenders should prioritize verifying device security claims and monitoring network traffic for unauthorized access attempts.

News#infosecnews#redditGermany+7

[This is a Guest Diary by Jackie Nguyen, an ISC intern as part of the SANS.edu BACS program]

CampaignGermanyFrance+8

The ShadyPanda threat actor has conducted a sophisticated seven-year malware campaign infecting 4.3 million Chrome and Edge browsers via malicious extensions that were verified and featured by Google, enabling widespread trust and distribution. The campaign operates two main components: a 300,000-user remote code execution (RCE) backdoor and a 4-million-user spyware operation that harvests extensive user data such as browsing history, search queries, and mouse clicks, sending it to servers in China. This malware exploits vulnerabilities in browser extension marketplaces and trusted update mechanisms to maintain persistence and evade detection. The campaign highlights significant risks to user privacy and organizational security, especially for entities relying heavily on Chrome and Edge browsers. European organizations face risks of data exfiltration, espionage, and potential lateral movement within networks. Mitigation requires proactive extension management, network monitoring for suspicious domains, and enhanced user awareness. Countries with high Chrome/Edge usage and strategic geopolitical interest in China-related cyber espionage are most at risk. The threat severity is assessed as high due to the scale, stealth, and potential impact on confidentiality and integrity without requiring user interaction post-installation.

Malware#browser extension#malware campaignGermany+9

Albiriox is a newly discovered Android RAT malware offered as Malware-as-a-Service, primarily targeting financial and cryptocurrency applications globally. It uses a sophisticated two-stage deployment involving dropper apps and packing to evade detection. The malware enables remote control of infected devices via VNC-based access and overlay attacks, allowing real-time interaction and unauthorized operations such as screen manipulation and device takeover. It targets over 400 financial and crypto wallet apps, facilitating on-device fraud while remaining stealthy. The MaaS model and ongoing development indicate potential rapid spread among cybercriminals. Although no known exploits in the wild are reported yet, its advanced capabilities pose a significant threat to mobile users, especially in finance sectors. The malware is linked to Russian-speaking threat actors and uses multiple fake domains for distribution. European organizations with mobile banking and crypto wallet users are at risk, particularly in countries with high Android usage and financial sector prominence. Mitigation requires targeted detection of dropper apps, user education on app sources, and enhanced mobile endpoint protection. Given its impact on confidentiality, integrity, and availability with ease of exploitation and no user interaction needed post-installation, the threat severity is assessed as high.

Malware#android#vncGermany+9

Albiriox is a newly identified Android banking malware family that enables cybercriminals to remotely control infected devices and conduct financial fraud. It operates as Malware-as-a-Service (MaaS), featuring modular components such as loaders, command modules, and control panels designed specifically for targeting banking, fintech, payment, and cryptocurrency applications. Distributed via fake apps and social engineering, it mimics legitimate brands and app stores to deceive users. The malware abuses Android accessibility features and employs black-screen masking to hide malicious activity. Notably, it can bypass multi-factor authentication and device fingerprinting, increasing its effectiveness. Although currently rated medium severity, its capabilities pose significant risks to user confidentiality and financial integrity. European organizations with mobile banking users are at risk, especially in countries with high Android adoption and fintech usage. Mitigation requires verifying app sources, maintaining updated devices, deploying advanced anti-malware solutions, and educating users about social engineering tactics.

Malware#android#albirioxAustria+9

A vulnerability in legacy Python packages arises from bootstrap scripts that fetch and execute installation code from the domain python-distribute.org, which is no longer controlled by the original maintainers and is available for takeover. This can lead to arbitrary code execution if an attacker acquires the domain and serves malicious scripts. Affected packages include tornado, pypiserver, and others. The issue is due to the use of hardcoded domains in bootstrap scripts for the obsolete 'distribute' package. No exploits have been observed in the wild, but the risk is significant given the trust in PyPI packages and the potential for supply chain compromise.

EPSS 1.7%Vulnerability#python packaging#supply chainGermany+4

A critical vulnerability in the WordPress King Addons plugin is actively exploited in the wild, allowing attackers to create unauthorized administrator accounts. This flaw enables privilege escalation without requiring prior authentication or user interaction, posing a significant risk to affected WordPress sites. Exploitation can lead to full site compromise, data theft, and potential use of the site for further malicious activities. The vulnerability is currently under active attack, emphasizing the urgency for site administrators to take immediate protective measures. No official patches or CVEs have been published yet, increasing the risk window. European organizations using this plugin are at heightened risk, especially those with high-value web assets. Mitigation requires immediate plugin updates once available, restricting access to WordPress admin areas, and monitoring for suspicious account creations. Countries with large WordPress user bases and significant e-commerce or media sectors are most likely to be targeted. Given the ease of exploitation and impact, the threat severity is assessed as critical. Defenders must prioritize detection and response to prevent full administrative takeover of their WordPress environments.

Campaign#infosecnews#redditGermany+7

Microsoft has silently patched a long-standing vulnerability in the Windows LNK file handling mechanism after years of active exploitation. The flaw allowed attackers to execute arbitrary code by tricking users into opening or previewing specially crafted shortcut (. LNK) files, a technique historically used in targeted attacks and malware campaigns. Although Microsoft did not publicly announce the patch initially, the fix addresses a high-severity issue that impacts Windows systems globally. European organizations using Windows are at risk due to the widespread use of the OS and the potential for this exploit to be used in spear-phishing or supply chain attacks. The vulnerability affects the confidentiality, integrity, and availability of affected systems by enabling remote code execution without user authentication, often requiring minimal user interaction. Mitigation involves applying the latest Windows updates immediately, disabling the parsing of LNK files in untrusted locations, and enhancing endpoint detection capabilities for suspicious LNK file activity. Countries with high Windows market penetration and significant critical infrastructure, such as Germany, France, the UK, and the Netherlands, are most likely to be targeted. Given the ease of exploitation, the scope of affected systems, and the impact on core security properties, this threat is assessed as high severity. Defenders should prioritize patching and monitoring for related attack indicators to reduce exposure to this stealthy but dangerous vulnerability.

News#infosecnews#redditGermany+9

Currently, in order to provide basic DDoS protection and filter aggressive bots, some form of Content Delivery Network (CDN) is usually the simplest and most cost-effective way to protect a web application. In a typical setup, DNS is used to point clients to the CDN, and the CDN will then forward the request to the actual web server. There are a number of companies offering services like this, and cloud providers will usually have solutions like this as well.

News#web#dosGermany+6

This threat describes a novel approach to detecting and mitigating Layer 7 (L7) Distributed Denial of Service (DDoS) attacks and bot traffic using ClickHouse analytics combined with Tempesta FW, an open-source HTTP reverse proxy and firewall. Traditional L7 mitigation techniques relying on challenges or static rules are increasingly ineffective against modern botnets using impersonation libraries and proxy networks. The solution collects access logs in real time from Tempesta FW and uses WebShield, a Python daemon, to analyze traffic spikes, classify clients, and automatically block malicious actors based on IP, TLS, or HTTP fingerprints. This method enables near real-time detection and mitigation of sophisticated multi-thousand-IP botnets without relying on user challenges. The approach is particularly relevant for organizations facing advanced botnet threats and requiring scalable, automated L7 defense mechanisms.

Botnet#netsec#redditGermany+7

A recent analysis reveals that 68% of phishing websites utilize Cloudflare's services to protect their infrastructure. This trend complicates detection and takedown efforts because Cloudflare acts as a reverse proxy, masking the true hosting location and providing DDoS protection. While not a vulnerability in Cloudflare itself, this widespread abuse of its platform enables phishing actors to evade traditional security controls. European organizations face increased risks as phishing remains a primary vector for credential theft and malware delivery. Mitigation requires enhanced email filtering, user awareness, and collaboration with Cloudflare for rapid takedown. Countries with high Cloudflare adoption and significant financial or governmental targets are most at risk. The threat is assessed as medium severity due to the indirect nature of the risk and the reliance on social engineering. Defenders should prioritize detection of phishing URLs behind Cloudflare and strengthen incident response capabilities.

Phishing#netsec#redditGermany+6

The threat actor leveraged Evilginx (likely version 3.0), an open source, advanced phishing adversary-in-the-middle (AITM, aka MITM) framework designed to steal login credentials and session cookies. Evilginx is widely used by cybercriminals to undermine multi-factor authentication (MFA) security, and this actor has used it to target at least 18 universities and educational institutions across the United States since April 2025. The campaigns were delivered through email and the phishing domains used subdomains that mimicked the legitimate SSO sites.

Campaign#evilginx#aitmUnited Kingdom+6

A phishing campaign leveraging a fake ChatGPT-branded browser called 'Atlas' is being used in the ClickFix attack to steal user passwords. The attack involves tricking users into downloading and using a counterfeit browser that mimics legitimate ChatGPT functionality but is designed to harvest credentials. Although no known exploits are currently reported in the wild, the campaign poses a medium-level threat due to its social engineering nature and potential to compromise user accounts. European organizations with employees or users interested in AI tools and ChatGPT-related products are at risk. The attack requires user interaction to download and use the fake browser, and it targets confidentiality by stealing passwords. Mitigation involves user awareness training, blocking downloads from untrusted sources, and monitoring for suspicious browser installations. Countries with high AI adoption and digital service usage, such as Germany, France, and the UK, are more likely to be affected. The threat is assessed as medium severity given the reliance on phishing and user interaction but with significant impact on credential confidentiality.

Phishing#infosecnews#redditGermany+4

DragonForce ransomware is a high-severity malware threat linked to the Scattered Spider threat group, known for targeted ransomware attacks. It employs advanced tactics to gain remote code execution (RCE) capabilities, enabling attackers to infiltrate and encrypt critical systems. Although no known exploits are currently active in the wild, the malware's connection to a sophisticated threat actor increases its risk profile. European organizations, especially those in critical infrastructure and high-value sectors, face significant risks due to potential data loss, operational disruption, and financial extortion. Mitigation requires proactive threat hunting, network segmentation, and enhanced monitoring for indicators of compromise related to Scattered Spider activity. Countries with strong digital economies and critical infrastructure, such as Germany, France, the UK, and the Netherlands, are particularly at risk. Given the ransomware's impact on confidentiality, integrity, and availability, ease of exploitation through RCE, and the broad scope of potential targets, the threat severity is assessed as high. Defenders should prioritize detection of lateral movement and privilege escalation attempts associated with this ransomware family.

Malware#infosecnews#redditGermany+7

Researchers have observed Lazarus Group actors operating as remote IT workers, indicating a sophisticated approach to cyber espionage and intrusion. This activity suggests the group is leveraging legitimate remote work frameworks to infiltrate target organizations. While no specific vulnerabilities or exploits have been identified, the tactic increases the risk of insider threats and supply chain compromises. European organizations, especially those with remote work policies and critical infrastructure, may be targeted due to the group's known geopolitical motivations. Mitigations require enhanced monitoring of remote access, strict verification of IT personnel, and robust anomaly detection. Countries with significant financial, governmental, and technological sectors are at higher risk. The threat is assessed as medium severity due to the indirect nature of the compromise and lack of known exploits but remains concerning due to the potential for stealthy, persistent access. Defenders should prioritize visibility into remote worker activities and strengthen identity and access management controls.

News#infosecnews#redditGermany+7

The University of Phoenix disclosed a data breach resulting from a hack of Oracle systems. The breach stems from a compromise of Oracle infrastructure, which impacted the university's data security. While specific technical details about the attack vector or exploited vulnerabilities are not provided, the incident highlights risks associated with third-party cloud or software providers. The breach is classified as high severity due to the potential exposure of sensitive personal and academic information. No known exploits are currently active in the wild, and the discussion level in public forums remains minimal. European organizations relying on Oracle cloud services or similar third-party providers should be alert to similar risks. Mitigation requires enhanced monitoring of third-party integrations, rigorous access controls, and incident response preparedness. Countries with significant Oracle customer bases and higher education institutions are more likely to be affected. Given the potential impact on confidentiality and the indirect attack vector, the suggested severity is high.

Breach#infosecnews#redditGermany+6

The Aisuru botnet has been identified as the source of a new record-breaking distributed denial-of-service (DDoS) attack reaching 29.7 Tbps. This attack represents one of the largest volumetric DDoS attacks ever recorded, leveraging a massive network of compromised devices to overwhelm targeted infrastructure. Such an attack can severely disrupt online services, degrade network performance, and cause significant operational downtime. European organizations, especially those with critical online services or digital infrastructure, are at risk of service outages and reputational damage. Mitigation requires advanced DDoS protection strategies, including traffic filtering, rate limiting, and collaboration with upstream providers and ISPs. Countries with high internet penetration, significant digital economies, and strategic infrastructure are more likely to be targeted. Given the scale and potential impact, this threat is assessed as high severity. Defenders should prioritize monitoring for unusual traffic spikes and ensure robust incident response plans are in place.

Campaign#infosecnews#redditGermany+7

A recently disclosed security issue involves vulnerabilities in the Picklescan mechanism used to scan PyTorch machine learning models. These bugs allow maliciously crafted PyTorch models to evade detection by security scanners and execute arbitrary code on the host system. This poses a significant risk as PyTorch is widely used in AI and machine learning workflows, including in European organizations. The threat does not currently have known exploits in the wild but is rated as high severity due to the potential for remote code execution without user interaction. Organizations relying on PyTorch models for AI development or deployment should urgently review their security posture. Mitigations include restricting model sources, isolating model execution environments, and monitoring for anomalous behavior. Countries with strong AI and tech sectors, such as Germany, France, and the UK, are likely to be most affected. Given the ease of exploitation and impact on confidentiality and integrity, the suggested severity is high.

News#infosecnews#redditGermany+6