A security issue exists in Android Enterprise BYOD devices managed via Microsoft Intune, allowing users to install arbitrary applications within the Work Profile. This vulnerability was discovered in late 2023 and remains unpatched as of late 2025. Despite the potential risk, Android has classified this behavior as not a security risk. The flaw could enable users to bypass intended app restrictions, potentially leading to data leakage or introduction of malicious apps in a corporate environment. No known exploits are currently active in the wild. The issue specifically affects Android Enterprise BYOD setups using Microsoft Intune management. Organizations relying on this configuration should be aware of the risk and consider additional controls. The severity is assessed as medium due to the potential impact on corporate data integrity and confidentiality, balanced against the need for user interaction and existing management controls. European organizations with widespread Intune-managed Android BYOD deployments should evaluate their exposure and mitigation strategies accordingly.
Cisco firewall vulnerabilities are currently being actively exploited to conduct Denial of Service (DoS) attacks. These flaws allow attackers to disrupt network availability by overwhelming or crashing affected firewall devices. Although no specific affected versions or CVEs are detailed, the threat is rated high severity due to active exploitation and potential widespread impact. European organizations relying on Cisco firewalls for perimeter defense face risks of service outages and operational disruption. Mitigation requires immediate attention to Cisco advisories, network segmentation, and enhanced monitoring for anomalous traffic patterns. Countries with significant Cisco firewall deployments and critical infrastructure reliance are at greater risk. The threat is assessed as high severity given the ease of exploitation, impact on availability, and lack of authentication requirements. Defenders should prioritize patching once available, implement DoS protection mechanisms, and conduct incident response preparedness. This threat underscores the importance of proactive firewall security management in Europe’s cybersecurity landscape.
Chinese state-sponsored hackers are leveraging legacy vulnerabilities, such as those in Log4j and Microsoft IIS, to conduct global espionage campaigns. These attacks exploit well-known, often unpatched bugs in widely deployed software to gain unauthorized access and maintain persistence. The threat actors focus on legacy systems that remain in use due to operational constraints, turning them into espionage tools. European organizations running outdated or unpatched versions of these technologies are at significant risk. The attacks can compromise confidentiality and integrity of sensitive data, with potential impacts on national security and critical infrastructure. Mitigation requires targeted patch management, legacy system audits, and enhanced monitoring for exploitation attempts. Countries with high adoption of affected technologies and strategic geopolitical relevance are more likely targets. The threat is assessed as high severity due to the potential for widespread impact and the sophistication of the adversaries. Defenders must prioritize legacy vulnerability remediation and threat intelligence sharing to reduce exposure.
Malicious NuGet packages have been discovered that contain disruptive 'time bombs' designed to activate after a delay, causing harm to affected systems. These packages are distributed through the NuGet repository, a popular package manager for . NET developers, making them a significant threat to software supply chains. The time bombs are intended to evade immediate detection by triggering their payloads only after a certain period or condition is met. Although no known exploits are currently active in the wild, the potential for widespread disruption is high due to the trust developers place in NuGet packages. European organizations relying on . NET development environments and continuous integration pipelines are at risk, especially those with automated package updates. Mitigation requires strict package vetting, monitoring for unusual package behavior, and restricting automated package installations in production environments. Countries with strong software development sectors and high adoption of Microsoft technologies, such as Germany, the UK, France, and the Netherlands, are particularly vulnerable. Given the potential for significant disruption and the ease of exploitation via trusted supply chains, this threat is assessed as high severity.
A sophisticated malware campaign is increasingly targeting WordPress websites to inject online casino spam content. This malware uses multiple redundancy and reinfection techniques, storing payloads in databases and non-standard file extensions to evade detection and maintain persistence. The campaign exploits the popularity of online gambling and leverages the decline of other spam sources, such as essay writing services, to focus on lucrative casino spam. Although primarily noted in Indonesia due to strict gambling laws, the campaign has international reach. The malware's complexity and persistence mechanisms pose risks to website integrity, SEO rankings, and user trust. European organizations running WordPress sites could be targeted, especially those with lax security or outdated plugins. Mitigation requires advanced detection, continuous monitoring, and tailored cleanup strategies. The threat is assessed as medium severity due to its impact on website integrity and SEO rather than direct data breach or system compromise.
Threat actors exploited CVE-2025-21042 to deliver malware via specially crafted images to users in the Middle East. The post Landfall Android Spyware Targeted Samsung Phones via Zero-Day appeared first on SecurityWeek .
ClickFix prompts typically contain instructions for Windows users, but now they are tailored for macOS and they are getting increasingly convincing. The post ClickFix Attacks Against macOS Users Evolving appeared first on SecurityWeek .
Cisco has identified a new attack variant targeting its Secure Firewall ASA and FTD devices. Although detailed technical specifics and affected versions are not disclosed, the threat is categorized as a campaign with medium severity. No known exploits are currently observed in the wild, and discussion around this attack is minimal, limiting public technical insights. The attack potentially targets firewall devices critical for network security, which could impact confidentiality, integrity, and availability if exploited. European organizations relying on Cisco Secure Firewall ASA and FTD devices are at risk, especially in countries with high Cisco market penetration and strategic infrastructure. Mitigation should focus on close monitoring of Cisco advisories, network segmentation, and enhanced logging to detect anomalous activity. Countries like Germany, France, the UK, Italy, and the Netherlands are likely most affected due to their extensive use of Cisco security products and critical infrastructure. Given the limited public information but the critical role of the targeted devices, the suggested severity is medium. Defenders should prioritize awareness and readiness for potential updates or patches from Cisco.
The U. S. Congressional Budget Office (CBO) was reportedly targeted by a suspected foreign cyberattack. While specific technical details and attack vectors have not been disclosed, the incident is considered high priority due to the sensitive nature of the CBO's role in U. S.government budgetary and economic analysis. There is no current evidence of known exploits in the wild or detailed indicators of compromise. The attack highlights the ongoing risk of state-sponsored or foreign cyber espionage against government institutions. European organizations with similar governmental or budgetary functions should be alert to potential spillover or similar targeting. Mitigation should focus on enhanced monitoring, threat intelligence sharing, and hardening of critical government systems.
A malicious Visual Studio Code (VS Code) extension named 'Vibe-Coded' has been discovered containing built-in ransomware capabilities. This threat involves a seemingly legitimate extension that, once installed, can encrypt user files and demand ransom, leveraging the widespread use of VS Code among developers. Although no known exploits in the wild have been reported yet, the presence of ransomware functionality within a popular development tool extension poses a significant risk. European organizations using VS Code, especially those in software development and IT sectors, could face data loss and operational disruption. The threat is rated as high severity due to the potential impact on confidentiality, integrity, and availability of data, combined with the ease of exploitation through user installation. Mitigation requires strict extension vetting policies, use of trusted sources only, and enhanced endpoint protection with behavioral detection. Countries with large tech industries and high VS Code adoption, such as Germany, France, the UK, and the Netherlands, are most likely to be affected. Immediate awareness and proactive defense measures are critical to prevent compromise from this emerging ransomware threat.
Between 2016 and 2021, the suspects defrauded 4.3 million cardholders in 193 countries of €300 million (~$346 million). The post 18 Arrested in Crackdown on Credit Card Fraud Rings appeared first on SecurityWeek .
EndClient RAT is a newly identified Remote Access Trojan attributed to the North Korean Kimsuky group, targeting human rights defenders. Delivered via a signed Microsoft Installer package disguised as 'StressClear.msi', it uses AutoIT scripts for execution and establishes persistence through scheduled tasks and startup folder entries. The malware communicates with its command and control server using a custom protocol with JSON markers, enabling remote shell access, file upload/download, and system reconnaissance. It employs in-memory modules for binary search, Base64 encoding/decoding, and LZMA decompression to evade detection. Detection rates are currently low, increasing the risk of undetected compromise. While primarily targeting North Korean human rights defenders, the malware's capabilities pose risks to any organization with similar exposure or interest. No known exploits in the wild have been reported yet, but the threat is medium severity due to its stealth and persistence mechanisms.
Seven new vulnerabilities have been reported affecting ChatGPT, potentially allowing attackers to steal data and hijack memory. These vulnerabilities were disclosed via a Reddit InfoSec news post linking to an external article. While detailed technical specifics and affected versions are not provided, the vulnerabilities reportedly enable unauthorized data access and memory manipulation. No known exploits are currently active in the wild, and discussion around these issues remains minimal. The severity is assessed as medium based on available information. European organizations using ChatGPT or related OpenAI services could face risks of data leakage or service disruption if these vulnerabilities are exploited. Mitigation should focus on monitoring official OpenAI advisories for patches, restricting sensitive data input into ChatGPT, and employing network-level controls to limit exposure. Countries with high adoption of AI tools and significant digital service sectors, such as Germany, France, and the UK, may be more impacted. Given the lack of detailed technical data and exploit availability, the suggested severity is medium. Defenders should prioritize awareness and readiness to apply updates once official patches are released.
The Cavalry Werewolf hacking group has deployed a new backdoor malware named ShellNET targeting a Russian government organization. This backdoor enables persistent unauthorized access and remote control over compromised systems. Although currently reported with minimal discussion and no known exploits in the wild, the malware represents a medium-severity threat due to its potential for espionage and disruption. European organizations should be aware of this threat given geopolitical tensions and possible targeting of allied or related infrastructure. Mitigation requires enhanced network monitoring for unusual outbound connections, strict access controls, and threat hunting focused on backdoor indicators. Countries with strong intelligence, government, and critical infrastructure sectors, especially those with close ties or adversarial relations involving Russia, are more likely to be affected. The threat is assessed as medium severity due to the targeted nature, lack of widespread exploitation, and moderate impact potential. Defenders must prioritize detection and containment to prevent lateral movement and data exfiltration.
A recent technique has been demonstrated to evade Elastic EDR's call stack signature detections by using call gadgets, which manipulate the call stack to bypass behavioral detection mechanisms. This evasion method complicates detection by altering the expected call stack patterns that Elastic EDR relies on. Although no known exploits are currently in the wild, the technique highlights a potential gap in Elastic EDR's detection capabilities. European organizations using Elastic EDR could face increased risk of stealthy attacks if adversaries adopt this method. Mitigation requires advanced behavioral analysis enhancements and customized detection rules to identify anomalous call stack manipulations. Countries with significant Elastic EDR deployments and critical infrastructure are more likely to be targeted. The threat is assessed as medium severity due to its impact on detection efficacy and the technical skill required for exploitation. Defenders should prioritize monitoring for unusual call stack behaviors and collaborate with Elastic to improve signature robustness.
Agentic AI systems, which autonomously perform tasks, introduce risks related to opacity, misalignment with intended goals, and potential misuse. Effective management requires pragmatic interventions such as defining clear operational goals, enforcing least privilege access, ensuring auditability, conducting red-teaming exercises, and maintaining human oversight. Although no specific vulnerabilities or exploits are identified, the inherent risks of agentic AI necessitate careful governance to prevent security incidents. The threat is currently assessed as low severity due to the absence of known exploits and the general nature of the concerns. European organizations adopting agentic AI should focus on robust control frameworks to mitigate risks associated with autonomous decision-making. Countries with advanced AI adoption and critical infrastructure integration are more likely to be impacted. Proactive measures can reduce the likelihood of misalignment and misuse, preserving confidentiality, integrity, and availability of systems leveraging agentic AI.
A ransomware attack targeting the state of Nevada was discovered in August but had been active since May, initiated by a state employee inadvertently downloading malicious software. The prolonged undetected presence allowed the attackers to establish persistence and potentially exfiltrate data or disrupt operations. This incident highlights the risks of social engineering and the importance of timely detection and response. Although no specific ransomware variant or exploit details are provided, the attack underscores vulnerabilities in endpoint security and user awareness. European organizations face similar risks from ransomware that can remain dormant and undetected for months. Mitigation requires enhanced user training, robust endpoint protection, network segmentation, and continuous monitoring. Countries with significant public sector digital infrastructure and those historically targeted by ransomware campaigns are at higher risk. Given the medium severity rating and lack of known exploits, the threat is serious but not critical. Immediate detection and containment are crucial to minimize impact.
This content discusses best practices for reducing ecommerce payment fraud, highlighting the significant financial losses in the sector. It is a general informational piece rather than a description of a specific security vulnerability or active threat. The source is a blog post linked from a Reddit InfoSec news thread, focusing on fraud prevention strategies rather than a technical exploit. There are no affected software versions, no known exploits, and no direct technical details about a vulnerability or attack vector. Therefore, this is not a direct security threat but rather educational content aimed at improving ecommerce security posture.
