The Shai-Hulud v2 campaign is a high-severity supply chain attack spreading from the npm ecosystem to Maven repositories, targeting software development dependencies. It involves malicious packages designed to exfiltrate thousands of secrets, such as API keys and credentials, embedded in developer environments. This campaign exploits the trust in widely used package managers, increasing the risk of widespread compromise. European organizations relying on npm and Maven for software development are at risk of data leakage and potential downstream attacks. The campaign's expansion to Maven indicates a broader targeting of Java-based projects, which are prevalent in Europe. Mitigation requires proactive dependency auditing, secret scanning, and restricting automated credential access. Countries with strong software development sectors and high adoption of Java and JavaScript ecosystems, such as Germany, France, and the UK, are most likely affected. Given the ease of exploitation through popular package managers and the significant impact on confidentiality, the threat severity is assessed as high. Defenders should prioritize monitoring for suspicious package activity and implement strict supply chain security controls.
The information provided discusses 'Rey,' the admin of the cybercriminal group ‘Scattered Lapsus$ Hunters,’ as reported by KrebsOnSecurity and shared on Reddit's InfoSecNews. While the report is newsworthy and highlights the existence of this threat actor, it lacks technical details about specific vulnerabilities, exploits, or attack methods. There are no affected software versions, no known exploits in the wild, and no concrete indicators of compromise provided. The threat is categorized as high severity based on the source's assessment, but the absence of technical specifics limits actionable defensive measures. European organizations should remain vigilant about groups like Lapsus$ due to their history of targeting high-profile entities globally. However, this particular report serves more as an intelligence update on threat actor activity rather than a direct technical threat or vulnerability. Organizations should continue monitoring for further detailed disclosures and maintain robust security postures against ransomware and extortion groups. Given the lack of exploit details, the suggested severity is medium, reflecting the potential risk from the group but the absence of immediate technical exploitation information.
A medium-severity vulnerability in Microsoft Teams guest chat functionality has been reported, potentially allowing attackers to deliver malware to users. The flaw enables malicious actors to exploit guest chat interactions to distribute malware payloads. Although no known exploits are currently active in the wild, the issue poses a risk to organizations relying on Teams for collaboration, especially those with frequent guest user interactions. The lack of detailed technical information and absence of patches increases uncertainty, but the threat is credible given Teams' widespread use. European organizations using Microsoft Teams extensively for internal and external communications could face confidentiality and integrity risks if exploited. Mitigation should focus on restricting guest access, enhancing user awareness, and monitoring for suspicious activity. Countries with high Microsoft Teams adoption and significant international collaboration, such as Germany, France, and the UK, are likely to be most affected. Given the potential impact and ease of exploitation through social engineering, the suggested severity is medium. Defenders should prioritize awareness and access controls while awaiting official patches or detailed advisories.
Cybercriminals impersonating financial institutions have targeted individuals, businesses, and organizations of different sizes. The post Account Takeover Fraud Caused $262 Million in Losses in 2025: FBI appeared first on SecurityWeek .
A malicious Chrome extension has been identified injecting hidden Solana blockchain transfer fees into Raydium decentralized exchange swaps. This covert manipulation results in users unknowingly paying extra fees during token swaps on Raydium, a popular Solana-based DeFi platform. The threat exploits users who interact with the Raydium interface via the compromised extension, altering transaction parameters without their consent. Although no known exploits in the wild have been reported yet, the high severity rating reflects the potential financial impact and trust erosion in DeFi tools. European organizations and individuals involved in cryptocurrency trading or DeFi activities on Solana are at risk of financial losses. Defenders should audit installed browser extensions, especially those related to cryptocurrency, and verify transaction details on-chain before approval. Countries with significant cryptocurrency adoption and active DeFi communities, such as Germany, the Netherlands, and the UK, are more likely to be affected. The threat is assessed as high severity due to direct financial impact, ease of exploitation through browser extension compromise, and lack of user awareness. Immediate mitigation involves removing suspicious extensions, using hardware wallets, and monitoring blockchain transactions for anomalies.
A cyberattack targeted OnSolve CodeRED, a critical emergency alert system, causing emergency alerts to go dark. This disruption poses a severe risk to public safety by preventing timely dissemination of urgent warnings. The attack highlights vulnerabilities in emergency communication infrastructure. No specific technical details or exploited vulnerabilities have been disclosed yet. There are no known exploits in the wild at this time. The incident underscores the importance of securing alerting platforms to maintain public trust and safety. European organizations relying on similar alerting systems could face analogous risks. Immediate mitigation and resilience planning are essential to prevent similar outages. The attack's critical severity stems from its impact on availability and potential to endanger lives. Defenders should prioritize securing emergency communication systems and establishing robust incident response protocols.
ASUS has disclosed a critical authentication bypass vulnerability affecting its AiCloud routers. This flaw allows attackers to circumvent authentication mechanisms, potentially granting unauthorized access to router management interfaces. Exploitation could lead to full control over the device, enabling attackers to manipulate network traffic, steal sensitive data, or deploy further attacks within the network. No known exploits are currently reported in the wild, but the severity and nature of the flaw demand immediate attention. European organizations using ASUS AiCloud routers are at risk, especially those in sectors relying heavily on secure network infrastructure. Mitigation requires prompt firmware updates once available, network segmentation, and enhanced monitoring of router access logs. Countries with high ASUS router market penetration and critical infrastructure reliance on such devices are more likely to be impacted. Given the critical impact on confidentiality, integrity, and availability, ease of exploitation without authentication, and broad potential scope, this vulnerability is assessed as critical severity. Defenders should prioritize patching and implement compensating controls to reduce exposure until updates are deployed.
This report discusses concerns about Huawei and Chinese surveillance activities as highlighted by Bruce Schneier, a well-known security expert. It is a security news article rather than a direct vulnerability or exploit. The content focuses on geopolitical and supply chain risks related to Huawei's telecommunications equipment and potential surveillance implications. There are no specific technical vulnerabilities, exploits, or affected software versions detailed. The threat is medium severity due to the potential impact on confidentiality and national security, but lacks direct exploitability information. European organizations using Huawei infrastructure may face risks of unauthorized data access or espionage. Mitigation involves careful supply chain risk management, network segmentation, and enhanced monitoring of Huawei equipment. Countries with significant Huawei infrastructure deployment and geopolitical tensions with China, such as Germany, France, and the UK, are most likely affected. The threat is indirect, stemming from surveillance concerns rather than technical exploits, requiring strategic and policy-level responses.
JSONFormatter and CodeBeautify users exposed credentials, authentication keys, configuration information, private keys, and other secrets. The post Thousands of Secrets Leaked on Code Formatting Platforms appeared first on SecurityWeek .
The OnSolve CodeRED platform has been targeted by the Inc Ransom ransomware group, resulting in disruptions and a data breach. The post Ransomware Attack Disrupts Local Emergency Alert System Across US appeared first on SecurityWeek .
Fake Battlefield 6 game downloads are being distributed to spread malware and steal player data. These malicious downloads impersonate the highly anticipated game to lure victims into installing harmful software. The malware aims to compromise user confidentiality by harvesting sensitive information from infected systems. While no known exploits or vulnerabilities in Battlefield 6 itself are involved, the threat leverages social engineering and fake distribution channels. European gamers and organizations with gaming communities may be targeted, especially where Battlefield 6 has significant popularity. The threat requires user interaction to download and execute the fake installer, limiting automated spread but increasing risk through deception. Mitigation involves educating users on verifying legitimate sources, employing endpoint protection with malware detection, and monitoring network traffic for suspicious activity. Countries with large gaming populations and strong Battlefield fanbases, such as the UK, Germany, France, and the Nordics, are more likely to be affected. Given the medium severity rating and the nature of the attack, defenders should prioritize awareness and technical controls to prevent infection and data theft.
This analysis details a sophisticated DPRK-linked operation called Contagious Interview, which uses a fake job platform to target U.S. AI talent. The campaign mimics legitimate recruitment processes, offering job listings from well-known tech companies to lure victims. The platform, hosted at lenvny[.]com, is designed to appear as a legitimate AI-powered interview tool. It employs various techniques to establish credibility, including professional design, fake testimonials, and comparisons with real companies. The attack culminates in a malware delivery through a clipboard hijacking technique, triggered when victims attempt to record a video introduction. This operation specifically targets high-value professionals in AI and cryptocurrency sectors, aiming to gain access to strategic information and financial assets.
Dartmouth College has disclosed a data breach after cybercriminals leaked over 226 Gb of files stolen from the university. The post Dartmouth College Confirms Data Theft in Oracle Hack appeared first on SecurityWeek .
FlexibleFerret is a sophisticated macOS malware campaign leveraging fake job assessment scams and social engineering to infect victims. It uses multi-stage attacks starting with JavaScript files on fraudulent recruitment websites that trick users into executing shell commands. These commands download and run a Golang backdoor that establishes persistence, enabling data theft and remote control. The malware can collect system info, steal Chrome credentials, upload/download files, and execute arbitrary commands. Attackers exfiltrate stolen data via Dropbox, complicating detection. The campaign is attributed to DPRK-aligned threat actors and targets macOS users globally. No CVSS score exists, but the threat is medium severity due to social engineering reliance and macOS focus. European organizations with macOS endpoints, especially in tech and government sectors, face risks. Mitigations include user education on phishing, restricting script execution, monitoring unusual Dropbox traffic, and deploying endpoint detection tuned for macOS threats.
Sha1-Hulud is a newly identified cyber threat involving supply chain compromise and covert command and control (C2) communications using application layer protocols. Attackers exploit link-local IP addresses such as 169.254.169.254 and 169.254.170.2, commonly associated with cloud metadata services, to bypass perimeter defenses and blend malicious traffic with legitimate communications. A JavaScript component named bun_environment.js has been identified as part of the attack chain.
CISA has described the techniques used by attackers and pointed out that the focus is on high-value individuals. The post CISA Warns of Spyware Targeting Messaging App Users appeared first on SecurityWeek .
ToddyCat, a threat actor, has developed new hacking tools designed to steal Outlook emails and Microsoft 365 access tokens. These tools enable attackers to gain unauthorized access to sensitive email communications and cloud resources by compromising authentication tokens. The threat is considered high severity due to the potential for extensive data exposure and lateral movement within compromised environments. Although no known exploits in the wild have been reported yet, the tools represent a significant risk to organizations relying on Microsoft 365 services. European organizations using Outlook and Microsoft 365 are particularly at risk, especially those in countries with high adoption of these platforms. Mitigation requires targeted detection of token theft, enhanced monitoring of Microsoft 365 account activities, and strict access controls. Countries such as the United Kingdom, Germany, France, and the Netherlands are likely to be most affected due to their widespread use of Microsoft cloud services and strategic importance. The threat is assessed as high severity given the impact on confidentiality and integrity, ease of exploitation once initial access is gained, and the broad scope of affected systems without requiring user interaction. Defenders should prioritize monitoring for unusual token usage patterns and implement conditional access policies to reduce risk.
A recently reported security issue involves code beautifiers—tools used to format source code—accidentally exposing sensitive credentials from banks, government agencies, and technology organizations. These tools, when processing code, can inadvertently reveal secrets such as API keys, passwords, and tokens embedded in the code or configuration files. Although no known exploits are currently active in the wild, the exposure risk is high due to the sensitive nature of the leaked information. The threat primarily arises from the improper handling or display of code snippets by beautifiers, which may not sanitize or mask confidential data. European organizations using such tools in their development or code review processes could face significant confidentiality breaches. Mitigation requires careful auditing of code before formatting, implementing automated secret detection, and restricting access to formatted code outputs. Countries with large financial sectors, government digital services, and advanced tech industries are more likely to be impacted. Given the ease of exploitation and the criticality of exposed data, the threat severity is assessed as high. Defenders should prioritize securing development pipelines and educating developers about secret management best practices.
