Threats affecting Sweden

Arizona is the latest state to sue Temu and its parent company PDD Holdings over allegations that the Chinese online retailer is stealing customers’ data. The post Arizona Attorney General Sues Chinese Online Retailer Temu Over Data Theft Claims appeared first on SecurityWeek .

NewsGermanyFrance+5

The University of Pennsylvania and the University of Phoenix confirm that they are victims of the recent Oracle EBS hacking campaign. The post Penn and Phoenix Universities Disclose Data Breach After Oracle Hack appeared first on SecurityWeek .

BreachGermanyFrance+5

The ShadyPanda campaign is a long-running espionage operation that targeted approximately 4.3 million users of Chrome and Edge browsers over a seven-year period. It involved persistent spying activities, likely through malicious extensions or other browser-based mechanisms, to collect sensitive user data. Although no specific affected versions or technical exploit details are provided, the campaign's longevity and scale indicate a sophisticated threat actor with sustained access. The medium severity rating reflects the significant privacy and confidentiality risks, though exploitation complexity and exact attack vectors remain unclear. European organizations using Chrome and Edge browsers are at risk, particularly those in countries with high adoption of these browsers and strategic geopolitical relevance. Mitigation requires enhanced browser security hygiene, monitoring for suspicious extensions, and user awareness. Countries such as Germany, France, the UK, Italy, and the Netherlands are likely most affected due to their large user bases and critical infrastructure. Given the lack of detailed exploit information, the suggested severity is medium, balancing the impact on confidentiality against the unknown ease of exploitation and scope. Defenders should prioritize detection of unusual browser activity and ensure timely updates and audits of browser extensions.

Campaign#infosecnews#redditGermany+7

South Korean authorities have arrested suspects involved in hacking IP cameras to steal and sell intimate videos. The threat involves unauthorized access to vulnerable IP cameras, compromising user privacy and potentially exposing sensitive personal footage. This breach highlights risks associated with insecure IoT devices, particularly IP cameras lacking proper security controls. European organizations and individuals using similar devices may face privacy violations and reputational damage if targeted. The threat is high severity due to the privacy impact and ease of exploitation of poorly secured devices. Mitigation requires securing IP cameras with strong authentication, regular firmware updates, network segmentation, and monitoring for unusual access patterns. Countries with high IoT adoption and significant consumer use of IP cameras, such as Germany, France, and the UK, are most likely to be affected. Given the direct privacy impact, ease of exploitation, and broad scope of vulnerable devices, the suggested severity is high.

Breach#infosecnews#redditGermany+6

Let’s Encrypt, a widely used certificate authority, plans to reduce the validity period of its SSL/TLS certificates from 90 days to 45 days. This change aims to improve security by limiting the window of exposure if a certificate is compromised. While this is not a vulnerability or exploit, it impacts certificate management processes and automation for organizations relying on Let’s Encrypt certificates. European organizations using Let’s Encrypt will need to adjust their renewal workflows to accommodate the shorter validity period. Failure to do so could lead to service disruptions due to expired certificates. The change does not introduce new attack vectors but increases operational demands on IT teams. Countries with high adoption of Let’s Encrypt certificates and strong digital infrastructure are more likely to be affected. This update underscores the importance of robust automation and monitoring in certificate lifecycle management. Overall, this is a security policy change rather than a direct threat or vulnerability.

News#infosecnews#redditGermany+9

A sophisticated social engineering campaign exploits Microsoft Teams' 'Chat with Anyone' feature to impersonate IT support and trick users into initiating Quick Assist sessions. This multi-stage attack involves phishing, malware deployment (notably an infostealer named 'updater.exe'), and reconnaissance to steal credentials and potentially exfiltrate data. The threat actors leverage legitimate collaboration tools to bypass traditional security controls. Organizations are advised to disable the vulnerable Teams feature, enforce multi-factor authentication, and adopt Zero Trust principles to mitigate risks. No CVSS score is assigned, but the attack poses a medium severity risk due to its credential theft focus and social engineering complexity.

Campaign#reconnaissance#infostealerGermany+6

Shai-Hulud V2 is an advanced malware campaign targeting the npm software supply chain, compromising over 700 npm packages and creating more than 27,000 malicious GitHub repositories. It introduces sophisticated techniques including pre-install phase execution, persistent backdoors via self-hosted GitHub Actions runners, credential harvesting and recycling across victims, and a destructive failsafe mechanism. The malware exfiltrates data through GitHub and propagates within the npm ecosystem, also exploiting Azure DevOps build agents. This supply chain attack enables persistent remote code execution and widespread credential theft without requiring user interaction. European organizations relying on npm packages and GitHub Actions for CI/CD pipelines face significant risks of data breaches, system compromise, and operational disruption. Mitigation requires enhanced supply chain security practices, strict GitHub Actions runner controls, credential hygiene, and proactive monitoring for anomalous activity. Countries with strong software development sectors and high npm usage, such as Germany, France, the UK, and the Netherlands, are particularly vulnerable. Given its broad impact and advanced persistence mechanisms, the threat severity is assessed as high.

Malware#exfiltration#githubGermany+6

Critical vulnerabilities have been identified in an ICS 5G modem, specifically the RUT22GW industrial LTE cellular router. These newly allocated CVEs highlight significant security weaknesses that could be exploited to compromise industrial control systems relying on this hardware. Although no known exploits are currently active in the wild, the critical severity rating indicates a high risk of impact if exploited. The vulnerabilities could affect confidentiality, integrity, and availability of industrial networks using these modems. European organizations using these routers in critical infrastructure or industrial environments are at risk. Mitigation requires immediate attention to firmware updates once available, network segmentation, and enhanced monitoring of affected devices. Countries with significant industrial sectors and high adoption of such ICS modems, including Germany, France, Italy, and the UK, are most likely to be impacted. Given the critical nature and potential for remote exploitation without user interaction, the suggested severity is critical. Defenders must prioritize patch management and network security controls to reduce exposure.

News#netsec#redditGermany+6

The Meatmeet BBQ Probe is a Bluetooth Low Energy (BLE) enabled smart BBQ thermometer device that has been demonstrated to be vulnerable to hacking, enabling the creation of a BLE-based botnet. This botnet leverages compromised BBQ probes to form a network of devices that can be remotely controlled or manipulated. The threat was recently discussed on Reddit's NetSec community and detailed on softwaresecured.com, highlighting the potential for IoT devices with BLE connectivity to be co-opted into botnets. While no known exploits are currently active in the wild, the medium severity rating reflects the risk posed by the widespread use of such consumer IoT devices and the potential for abuse in distributed denial-of-service (DDoS) attacks or other malicious activities. European organizations using or connected to these devices could face risks related to network congestion, data integrity, and unauthorized device control. Mitigation requires securing BLE communications, firmware updates, and network segmentation to prevent lateral movement. Countries with high consumer adoption of smart home and IoT devices, such as Germany, the UK, France, and the Netherlands, are more likely to be affected due to market penetration and historical targeting of IoT botnets in these regions. Given the ease of exploitation via BLE and the potential for widespread impact, the suggested severity is medium.

Botnet#netsec#redditGermany+5

The Shai-Hulud 2.0 malware campaign targeted the NPM ecosystem, exposing up to 400,000 developer secrets. This attack involved malicious packages distributed via NPM, which is widely used for JavaScript development. The malware harvested sensitive credentials such as API keys, tokens, and other secrets embedded in developer environments. Although no known exploits are currently active in the wild, the potential for credential theft poses a significant risk to software supply chains and downstream applications. European organizations relying on NPM packages for development and deployment are at risk of indirect compromise through exposed secrets. Mitigation requires proactive secret scanning, strict access controls, and monitoring of package dependencies. Countries with large software development sectors and high NPM usage, such as Germany, the UK, France, and the Netherlands, are most likely to be affected. Given the scale and sensitivity of exposed data, the threat severity is assessed as high. Defenders should prioritize secret management hygiene and supply chain security to reduce exposure.

Malware#infosecnews#redditGermany+5

An AI system has autonomously discovered seven new vulnerabilities in FFmpeg, a widely used multimedia framework. These vulnerabilities have been publicly reported but currently lack detailed technical disclosures, patches, or evidence of exploitation in the wild. The threat is assessed as medium severity due to the potential impact on confidentiality, integrity, and availability of systems processing multimedia content. European organizations relying on FFmpeg for media processing, streaming, or content delivery could be at risk if these vulnerabilities are exploited. Mitigation should focus on monitoring for official patches, applying updates promptly, and employing network-level protections to limit exposure. Countries with significant media, broadcasting, and technology sectors, such as Germany, France, and the UK, are more likely to be affected. Given the absence of CVSS scores and exploit details, the threat is rated medium severity based on potential impact and ease of exploitation. Defenders should prioritize vulnerability management and threat intelligence monitoring related to FFmpeg to reduce risk.

News#netsec#redditGermany+5

A phishing campaign uses fake Calendly invites spoofing top brands to trick recipients into hijacking their ad manager accounts. Attackers impersonate trusted companies to lure victims into clicking malicious links or providing credentials. This threat targets users managing digital advertising platforms, potentially leading to unauthorized access and misuse of ad accounts. The campaign leverages social engineering and brand impersonation to increase success rates. No known exploits are currently active in the wild, but the high severity rating reflects the potential damage. European organizations with significant digital marketing operations are at risk, especially those using platforms integrated with Calendly or similar scheduling tools. Attackers could manipulate ad spend, steal sensitive marketing data, or damage brand reputation. Mitigation requires user awareness, verification of invite authenticity, and strict access controls on ad manager accounts. Countries with large digital economies and marketing sectors, such as the UK, Germany, and France, are particularly vulnerable. The threat is assessed as high severity due to the ease of exploitation, potential confidentiality and integrity impacts, and the broad scope of affected users.

Phishing#infosecnews#redditGermany+6

The Lazarus APT group has been observed employing a novel remote-worker scheme, captured live on camera by researchers. This campaign highlights the evolving tactics of Lazarus, focusing on exploiting remote work environments to infiltrate targets. While no specific software vulnerabilities or exploits are detailed, the campaign represents a high-severity threat due to the advanced persistent nature of Lazarus and their history of impactful cyber espionage and sabotage. European organizations, especially those with remote workforce infrastructures, are at risk of targeted intrusion attempts leveraging social engineering and remote access exploitation. Mitigation requires tailored defenses around remote access security, employee training, and enhanced monitoring for suspicious remote activity. Countries with significant technology, finance, and critical infrastructure sectors, such as Germany, France, and the UK, are particularly vulnerable given their strategic importance and market penetration of remote work technologies. The threat is assessed as high severity due to the potential for significant confidentiality and integrity breaches, ease of exploitation through social engineering, and the broad scope of affected remote work environments without requiring user interaction beyond initial compromise. Defenders should prioritize detection of anomalous remote access patterns and reinforce endpoint security in remote setups.

Campaign#infosecnews#redditGermany+6

We explain how vulnerabilities in DeckMate 2 shuffling machines allowed criminals to gain insights into opponents’ hands and win massive sums at poker.

AnalysisGermanyFrance+9

North Korean (NK) hackers have distributed approximately 200 malicious npm packages containing the OtterCookie malware. These packages were uploaded to the npm repository, a popular package manager for JavaScript, potentially targeting developers and organizations relying on npm dependencies. OtterCookie malware is designed to stealthily compromise systems, potentially enabling data exfiltration or further malicious activity. Although no known exploits in the wild have been reported yet, the scale and nature of the campaign pose a significant risk. European organizations using npm packages in their software supply chain could be exposed to this threat, especially if they do not have strict dependency vetting processes. Mitigation requires enhanced supply chain security measures, including automated scanning of dependencies, restricting use of unverified packages, and continuous monitoring for anomalous behavior. Countries with strong software development sectors and high npm usage, such as Germany, the UK, France, and the Netherlands, are particularly at risk. Given the malware’s potential for confidentiality breaches and the ease of exploitation via package installation, the threat severity is assessed as high. Defenders should prioritize verifying package integrity and implementing zero-trust principles in software supply chains to mitigate this threat.

Malware#infosecnews#redditGermany+6

The University of Pennsylvania has confirmed a new data breach resulting from a prior hack of Oracle E-Business Suite (EBS) systems. This breach involves unauthorized access and data theft linked to vulnerabilities exploited in Oracle's software environment. While specific technical details and exploited vulnerabilities have not been disclosed, the incident highlights risks associated with third-party software compromises impacting academic institutions. European organizations using Oracle EBS or similar enterprise resource planning (ERP) systems should be alert to potential exposure. The breach underscores the importance of timely patching, monitoring, and incident response to prevent data theft. No known exploits are currently reported in the wild, but the breach's high severity rating indicates significant impact potential. Mitigation requires focused security controls around Oracle environments, including enhanced access management and network segmentation. Countries with high Oracle EBS adoption and critical academic or research institutions are most at risk. Given the breach's scope and ease of exploitation through third-party software, the suggested severity is high. Defenders must prioritize detection and containment to mitigate data loss and reputational damage.

Breach#infosecnews#redditGermany+7

Law enforcement agencies are reportedly using Flock Safety's Automated License Plate Recognition (ALPR) network to surveil protesters and activists. This practice raises significant privacy and civil liberties concerns, as the ALPR system collects and stores vehicle location data extensively. While not a traditional cybersecurity vulnerability, the use of this surveillance technology can lead to unauthorized tracking and profiling of individuals exercising their rights to protest. The threat lies in potential misuse of collected data, lack of transparency, and insufficient controls over data access. European organizations and civil rights groups should be aware of similar surveillance technologies and advocate for strict data protection and oversight. The severity of this threat is medium, given the impact on privacy and potential chilling effects on free expression, though it does not involve direct exploitation of software vulnerabilities. Countries with active protest movements and strong civil rights advocacy, such as Germany, France, and the UK, may be most concerned about such surveillance practices. Mitigation involves policy advocacy, legal challenges, and technical controls on data collection and sharing rather than traditional cybersecurity measures.

News#infosecnews#redditGermany+5

The extensions were seen profiling users, reading cookie data to create unique identifiers, and executing payloads with browser API access. The post Chrome, Edge Extensions Caught Tracking Users, Creating Backdoors appeared first on SecurityWeek .

MalwareGermanyFrance+5

Google has released patches addressing 107 vulnerabilities in the Android operating system, including two critical framework bugs that have been actively exploited in the wild. These flaws affect multiple components of Android, potentially allowing attackers to execute arbitrary code, escalate privileges, or cause denial of service. The vulnerabilities are considered high severity due to their exploitation status and broad impact on Android devices globally. European organizations relying on Android devices face risks including data breaches, device compromise, and operational disruption. Immediate patching is essential to mitigate these threats. Countries with high Android adoption and significant mobile-dependent infrastructure are most at risk. The threat requires no user interaction for exploitation in some cases, increasing its danger. Defenders should prioritize deploying official Google security updates and monitor for indicators of compromise related to these framework bugs. Enhanced mobile device management and network-level protections can further reduce exposure.

Tool#infosecnews#redditGermany+7

The Glassworm malware has resurfaced in a third wave, distributed via malicious Visual Studio Code (VS Code) packages. This malware campaign targets developers by leveraging the popularity of VS Code extensions to infiltrate systems. Once installed, Glassworm can execute malicious payloads, potentially compromising confidentiality, integrity, and availability of affected systems. Although no known exploits in the wild have been reported yet, the high severity rating reflects the risk posed by supply chain attacks through trusted development tools. European organizations relying on VS Code for software development are at risk, especially those in technology, finance, and critical infrastructure sectors. Mitigation requires strict controls on extension sourcing, enhanced monitoring for anomalous behaviors, and developer awareness training. Countries with strong software development industries and high VS Code adoption, such as Germany, the UK, France, and the Netherlands, are most likely to be affected. Given the ease of exploitation via user installation and the broad impact potential, the suggested severity is high.

Malware#infosecnews#redditGermany+5