Threats affecting Sweden

Researchers submitted 107 bug reports during the bugSWAT hacking event at the ESCAL8 conference in New Mexico. The post Google Paid Out $458,000 at Live Hacking Event appeared first on SecurityWeek .

NewsGermanyFrance+5

A global phishing campaign is exploiting the use of @facebookmail.com email invites to target Facebook Business users. Attackers send seemingly legitimate invitations appearing to come from Facebook's official domain to deceive recipients into divulging sensitive credentials or business information. This medium-severity threat leverages social engineering and brand trust to bypass user suspicion. No specific affected software versions or patches are identified, and no known exploits in the wild have been confirmed beyond the phishing campaign. The campaign's global nature and targeting of business users pose risks to confidentiality and potentially business operations. European organizations using Facebook Business services are at risk, especially those with significant social media marketing or customer engagement through Facebook. Mitigation requires heightened user awareness, email filtering tuned to detect spoofed or suspicious invites, and verification procedures for unexpected communications. Countries with high Facebook Business adoption and active digital marketing sectors, such as the UK, Germany, France, and the Netherlands, are most likely to be affected. Given the ease of exploitation through phishing and the potential for credential compromise, the threat is assessed as medium severity.

Phishing#infosecnews#redditGermany+6

A high-profile phishing scam known as the “Bitcoin Queen” case resulted in an 11-year prison sentence for the perpetrator responsible for a $7.3 billion Bitcoin fraud. The scam involved deceptive tactics to defraud victims of significant cryptocurrency assets. Although no specific technical exploit details or affected software versions are provided, the case highlights the ongoing risk of large-scale phishing attacks targeting cryptocurrency holders. There are no known exploits in the wild related to this incident, and the discussion level on technical forums is minimal. European organizations and individuals involved in cryptocurrency trading or investment are at risk from similar phishing schemes. Mitigation requires heightened user awareness, robust email filtering, and multi-factor authentication for crypto-related accounts. Countries with high cryptocurrency adoption and financial hubs are more likely to be impacted. The severity is assessed as high due to the massive financial impact and the sophisticated social engineering involved.

Phishing#infosecnews#redditGermany+6

SAP addressed a maximum severity vulnerability in its SQL Anywhere Monitor product. The flaw, described as having maximum severity, could potentially allow attackers to compromise affected systems. Although specific technical details and affected versions were not disclosed, the vulnerability is significant enough to warrant urgent attention. No known exploits are currently reported in the wild. The medium severity rating provided may underestimate the risk given the 'maximum severity' description in the title. European organizations using SAP SQL Anywhere Monitor should prioritize patching once updates are available. The threat primarily impacts database monitoring environments, which are critical for operational continuity. Countries with a strong SAP user base and critical infrastructure relying on SAP products are at higher risk. Mitigation involves applying SAP patches promptly, restricting access to monitoring tools, and enhancing network segmentation. Given the potential impact on confidentiality, integrity, and availability, and the lack of detailed exploitation requirements, the suggested severity is high.

News#infosecnews#redditGermany+7

Synology recently addressed multiple zero-day vulnerabilities in its BeeStation product that were publicly demonstrated at the Pwn2Own Ireland security competition. These zero-days represent critical security flaws that could allow attackers to compromise affected systems. Although no known exploits are currently active in the wild, the public disclosure increases the urgency for organizations to apply patches promptly. The vulnerabilities could impact confidentiality, integrity, and availability of data managed by BeeStation, a platform often used for storage and collaboration. European organizations using Synology BeeStation should prioritize remediation to mitigate potential exploitation risks. The threat is rated high severity due to the nature of zero-day exploits and the potential for significant operational disruption. Countries with high adoption of Synology products and strategic data infrastructure are at greater risk. Immediate mitigation involves applying vendor patches once available, restricting network access to BeeStation services, and monitoring for suspicious activity. This threat highlights the importance of proactive vulnerability management and rapid response to zero-day disclosures.

News#infosecnews#redditGermany+7

A newly reported macOS infection vector leverages AppleScripts to bypass Apple's Gatekeeper security mechanism. Gatekeeper is designed to prevent untrusted or malicious software from executing, but attackers can exploit AppleScript capabilities to circumvent these protections. This technique does not rely on known vulnerabilities but abuses legitimate scripting functionality to execute malicious code. Although no active exploits have been observed in the wild yet, the method poses a medium-level threat due to its potential to evade standard macOS defenses. European organizations using macOS devices, especially in sectors with high reliance on Apple hardware, could be targeted. Mitigation requires enhanced monitoring of AppleScript execution, restricting script permissions, and user education about suspicious script behaviors. Countries with significant macOS adoption and strong tech sectors, such as Germany, the UK, France, and the Nordics, are more likely to be affected. The threat is assessed as medium severity given the moderate impact and the need for some user interaction or social engineering to trigger the script. Defenders should prioritize detection of unusual AppleScript activity and consider application whitelisting policies to reduce risk.

News#netsec#redditGermany+9

ThreatFox IOCs for 2025-11-12

Indicator#type:osint#tlp:whiteGermany+9

The Cl0p ransomware group has reportedly listed the UK's National Health Service (NHS) as a victim shortly after a breach involving the Washington Post. Cl0p is a known ransomware threat actor that targets large organizations to extort ransom payments by encrypting data and threatening to leak stolen information. While specific technical details and exploit vectors are not provided, the incident highlights ongoing targeting of critical infrastructure and media entities. The ransomware attack on NHS could severely disrupt healthcare services, risking patient safety and data confidentiality. European organizations, especially in healthcare, should be vigilant due to the high-profile nature of this attack. Mitigation requires proactive network segmentation, enhanced monitoring for ransomware indicators, and robust incident response planning. Countries with large NHS-like healthcare systems and high digital healthcare adoption are most at risk. Given the absence of detailed exploit information but the high impact potential and no authentication requirement implied, the threat severity is assessed as high. Defenders must prioritize detection and containment strategies to prevent similar breaches and ransomware encryptions.

Malware#infosecnews#redditGermany+6

A Russian-speaking threat actor is conducting a large-scale phishing campaign targeting travelers by registering over 4,300 fake hotel and travel-related domains impersonating brands like Airbnb and Booking.com. The campaign uses sophisticated phishing sites with customized pages, fake CAPTCHA, and multilingual support to appear legitimate. Malicious emails redirect victims through multiple sites before landing on phishing pages designed to steal payment card data. The attacker continuously registers new domains with travel-related naming conventions, focusing on specific registrars. The phishing kit collects data in real-time and contains Russian language elements. This campaign poses a medium severity risk due to its scale, sophistication, and potential financial impact on victims. European organizations in the travel, hospitality, and financial sectors should be vigilant. Countries with high tourism and travel service usage, such as the UK, Germany, France, Spain, and Italy, are most likely to be affected. Mitigation requires targeted detection of phishing domains, enhanced email filtering, user awareness training focused on travel scams, and collaboration with domain registrars to disrupt domain registrations.

Campaign#phishing#domain registrationGermany+9

A recent ransomware attack attributed to the RansomHub group was uncovered following an unusual CPU spike detected in a system. The attack involves ransomware that encrypts data and demands payment for decryption keys, posing a significant threat to affected organizations. Although no specific affected software versions or exploits in the wild have been reported, the high severity rating indicates a serious risk. European organizations, especially those with critical infrastructure or high-value data, could face operational disruption and financial losses. Mitigation requires proactive monitoring of system performance anomalies, robust endpoint protection, network segmentation, and incident response readiness. Countries with high adoption of vulnerable systems and strategic importance in sectors like finance, manufacturing, and healthcare are more likely to be targeted. Given the ransomware's impact on confidentiality, integrity, and availability, ease of exploitation through typical ransomware infection vectors, and no need for user interaction beyond initial compromise, the threat severity is assessed as high. Defenders should prioritize detection of abnormal resource usage patterns and maintain updated backups to mitigate potential damage.

Malware#infosecnews#redditGermany+9

SAP has addressed a high-severity security flaw involving hardcoded credentials in its SQL Anywhere Monitor product. This vulnerability could allow attackers to gain unauthorized access to monitoring systems, potentially leading to data exposure or system manipulation. Although no known exploits are currently reported in the wild, the presence of hardcoded credentials represents a significant risk, especially in enterprise environments where SQL Anywhere Monitor is deployed. European organizations using this SAP product should prioritize patching to prevent exploitation. The flaw impacts confidentiality and integrity, as attackers could bypass authentication controls. Mitigation involves applying SAP's security updates promptly and auditing affected systems for unauthorized access. Countries with substantial SAP enterprise deployments, such as Germany, the UK, and France, are most likely to be affected. Given the ease of exploitation and potential impact, the severity is assessed as high. Defenders should focus on rapid patch management and monitoring for suspicious activity related to SQL Anywhere Monitor.

News#infosecnews#redditGermany+6

Mozilla has implemented fresh fingerprinting protections to prevent hidden trackers from identifying Firefox users. The post New Firefox Protections Halve the Number of Trackable Users appeared first on SecurityWeek .

NewsGermanyFrance+5

Prompt injection vulnerabilities in AI browsers allow attackers to manipulate AI-driven browser interfaces by injecting malicious prompts that alter the AI's behavior. This threat can lead to unauthorized actions, data leakage, or misinformation within AI-assisted browsing sessions. Although no known exploits are currently active in the wild, the medium severity rating reflects the potential risks if exploited. European organizations using AI browsers for sensitive tasks could face confidentiality and integrity risks. Mitigation requires strict input validation, sandboxing AI prompt processing, and monitoring AI outputs for anomalies. Countries with high adoption of AI technologies and digital services, such as Germany, France, and the UK, are more likely to be affected. The threat is medium severity due to the moderate impact on confidentiality and integrity, ease of exploitation through crafted inputs, and no requirement for authentication or user interaction. Defenders should prioritize securing AI browser environments and educating users on potential prompt manipulation tactics.

News#infosecnews#redditGermany+5

Have I Been Pwned (HIBP) has added 1.96 billion accounts from the Synthient credential data breach to its database, significantly expanding the volume of exposed credentials available for threat actors. This large-scale credential exposure increases the risk of credential stuffing, account takeover, and phishing attacks targeting users whose data is included. Although no direct exploit or vulnerability is reported, the aggregation of such a vast dataset poses a substantial threat to organizations relying on password-based authentication. European organizations face heightened risks due to the potential for compromised credentials to be used against their employees and customers. Mitigation requires proactive credential hygiene, including enforcing multi-factor authentication, monitoring for credential reuse, and leveraging threat intelligence feeds like HIBP to identify affected accounts. Countries with high digital adoption and large enterprise sectors, such as Germany, the UK, France, and the Netherlands, are likely to be most impacted. Given the scale and potential for widespread abuse without requiring user interaction or system vulnerabilities, the severity is assessed as high. Defenders should prioritize rapid detection and response to credential-based attacks stemming from this data exposure.

News#infosecnews#redditGermany+6

Attackers intercepting network traffic can determine the conversation topic with a chatbot despite end-to-end encrypted communication. The post ‘Whisper Leak’ LLM Side-Channel Attack Infers User Prompt Topics appeared first on SecurityWeek .

Breach#rceGermany+5

A fake NPM package with over 206,000 downloads was discovered targeting GitHub credentials through phishing techniques. The malicious package masqueraded as a legitimate module to trick developers into installing it, thereby exposing their GitHub authentication tokens or credentials. Although no known exploits in the wild have been reported yet, the scale of downloads indicates significant exposure risk. This threat primarily affects developers and organizations relying on NPM packages for software development, potentially leading to unauthorized access to source code repositories. European organizations using NPM and GitHub for development are at risk, especially those with large developer communities. Mitigation requires strict verification of package authenticity, use of scoped packages, and implementation of least privilege principles for tokens. Countries with strong software development sectors and high adoption of open-source tooling, such as Germany, the UK, France, and the Netherlands, are more likely to be impacted. Given the potential for credential compromise and unauthorized access, the threat severity is assessed as high. Defenders should prioritize supply chain security hygiene and continuous monitoring for suspicious package activity.

Phishing#infosecnews#redditGermany+5

Quantum Route Redirect PhaaS is a high-severity phishing-as-a-service campaign targeting Microsoft 365 users globally. It leverages route redirection techniques to intercept and manipulate user traffic, aiming to harvest credentials or deliver malicious payloads. The threat exploits the widespread adoption of Microsoft 365, making it a significant risk for organizations relying on this platform. No known exploits in the wild have been confirmed yet, but the potential for credential theft and unauthorized access is substantial. European organizations using Microsoft 365 are at risk, especially those in countries with high Microsoft 365 market penetration and strategic importance. Mitigation requires advanced monitoring of network traffic, strict email filtering, and user awareness training focused on phishing and route manipulation tactics. Countries like Germany, the United Kingdom, France, and the Netherlands are likely to be most affected due to their extensive Microsoft 365 usage and critical infrastructure reliance. Given the ease of exploitation via phishing and the broad impact on confidentiality and integrity, the threat severity is assessed as high. Defenders should prioritize detection of anomalous routing behaviors and implement multi-factor authentication to reduce risk.

News#infosecnews#redditGermany+6

A critical vulnerability in Triofox has been exploited to execute malicious payloads by manipulating antivirus (AV) configurations. This flaw allows attackers to leverage AV settings to run arbitrary code, potentially leading to full system compromise. Although no known exploits in the wild have been reported yet, the severity is critical due to the nature of the attack vector and the potential impact. European organizations using Triofox, especially those integrating it with AV solutions, are at risk. The exploit requires no user interaction and can affect confidentiality, integrity, and availability of systems. Immediate mitigation steps include reviewing AV configurations, applying any available patches, and monitoring for suspicious activity. Countries with significant Triofox adoption and critical infrastructure relying on AV-integrated file sharing solutions are most vulnerable. Given the ease of exploitation and critical impact, this threat demands urgent attention from defenders in Europe.

News#infosecnews#redditGermany+7

A critical vulnerability in Gladinet's Triofox file-sharing platform, CVE-2025-12480, allowed unauthenticated access to configuration pages, enabling arbitrary payload execution. Threat actor UNC6485 exploited this flaw as early as August 24, 2025, bypassing authentication and chaining it with anti-virus feature abuse for code execution. The vulnerability affected Triofox version 16.4.10317.56372 and was patched in version 16.7.10368.56560. Attackers created admin accounts, deployed remote access tools, conducted reconnaissance, and attempted privilege escalation. They used Zoho UEMS, Zoho Assist, and Anydesk for remote access, and set up encrypted tunnels for C2 communication. The exploit chain involved HTTP host header manipulation and abuse of the built-in anti-virus feature to execute malicious scripts.

KEVEPSS 95%Report on CVE-2025-12480CampaignGladinetCWE-284#anti-virus abuseGermany+7

Recent reports highlight new attack techniques targeting secure enclave technologies, which are designed to protect sensitive data and code execution even from privileged system software. These attacks potentially undermine the confidentiality and integrity guarantees of secure enclaves by exploiting novel side-channel or implementation weaknesses. Although no known exploits are currently active in the wild, the medium severity rating reflects the potential risk if these vulnerabilities are weaponized. European organizations relying on secure enclave technologies for critical data protection, especially in finance, healthcare, and government sectors, could face increased exposure. Mitigation requires a combination of applying vendor patches when available, enhancing enclave usage policies, and adopting layered security controls to detect anomalous enclave behavior. Countries with high adoption of enclave-enabled hardware and strong digital infrastructure, such as Germany, France, and the UK, are more likely to be affected. Given the complexity of exploitation and the critical role of enclaves, the suggested severity is medium. Defenders should prioritize monitoring developments, validating enclave integrity, and preparing incident response plans tailored to enclave compromise scenarios.

News#infosecnews#redditGermany+5