The hackers stole names, addresses, dates of birth, Social Security numbers, and health and insurance information. The post 10 Million Impacted by Conduent Data Breach appeared first on SecurityWeek .
The packages deployed malicious code harvesting system information, credentials, tokens, API keys, and other sensitive information. The post 136 NPM Packages Delivering Infostealers Downloaded 100,000 Times appeared first on SecurityWeek .
Hacktivists have reportedly breached critical infrastructure in Canada, as warned by a Canadian cyber agency. The breach is considered critical, indicating significant potential impact on essential services. Details are limited, with minimal discussion and no known exploits currently in the wild. The attack highlights the growing threat posed by hacktivist groups targeting national infrastructure. European organizations should be aware of similar risks, especially those with interconnected infrastructure or shared supply chains. Mitigation requires enhanced monitoring, incident response readiness, and collaboration with national cybersecurity agencies. Countries with close economic and security ties to Canada, or with similar critical infrastructure profiles, are more likely to be affected. The severity is assessed as critical due to the breach of critical infrastructure, potential for widespread disruption, and the difficulty in defending such targets. Defenders must prioritize threat intelligence sharing and proactive defense measures to mitigate similar threats.
A new malware threat leveraging NFC relay attacks targets Android tap-to-pay transactions, enabling attackers to clone payment credentials by intercepting and relaying NFC signals. This malware can effectively bypass typical proximity requirements of NFC payments, allowing fraudulent transactions without physical card or device possession. Although no known exploits are currently active in the wild, the technique poses a medium-level risk due to its potential to compromise payment confidentiality and integrity. European organizations with high adoption of Android tap-to-pay services, especially in retail and financial sectors, are at risk. Mitigation requires enhanced transaction authentication, user awareness, and device security hardening. Countries with widespread NFC payment adoption and significant mobile payment infrastructure, such as the UK, Germany, France, and the Nordics, are most likely affected. The threat is medium severity given the complexity of exploitation and limited current exploitation evidence. Defenders should prioritize monitoring for unusual NFC activity and enforce multi-factor authentication for payment approvals.
In October 2025, a wave of sophisticated cyber attacks targeted corporate environments, leveraging phishing campaigns exploiting trusted platforms like Google Careers and ClickUp, abusing Figma for credential theft, and deploying the LockBit 5.0 ransomware variant against ESXi and Linux systems. Attackers used legitimate cloud services and multi-stage redirection to evade detection, while a new phishing kit named TyKit emerged. These campaigns threaten corporate credentials, infrastructure integrity, and data confidentiality across multiple sectors. The attacks do not require known exploits in the wild but rely heavily on social engineering and abuse of trusted platforms. Security operations centers (SOCs) must enhance detection capabilities, harden access controls, and employ advanced threat intelligence to mitigate these evolving threats. The overall severity is medium, reflecting the complexity and multi-vector nature of the attacks but without widespread exploitation of zero-day vulnerabilities. European organizations, especially those using affected platforms and cloud services, face significant risks from credential theft and ransomware infection.
Hackers have compromised corporate XWiki servers to deploy unauthorized cryptocurrency mining operations. This threat involves attackers gaining access to XWiki instances, leveraging them to mine cryptocurrencies without the organizations' consent. The exploitation does not currently have known public exploits or patches, and detailed technical specifics are limited. The attack primarily impacts server availability and resource utilization, potentially degrading performance and increasing operational costs. European organizations using XWiki for internal collaboration or documentation are at risk, especially those with exposed or poorly secured instances. Mitigation requires immediate hardening of XWiki deployments, including access controls, monitoring for unusual resource usage, and applying security best practices. Countries with significant enterprise adoption of XWiki and higher cloud infrastructure usage are more likely to be targeted. Given the medium severity, the threat poses moderate risk but can escalate if attackers gain deeper access or persist longer. Defenders should prioritize detection and containment to prevent resource abuse and potential lateral movement.
Ten malicious npm packages have been discovered stealing developer credentials across Windows, macOS, and Linux platforms. These packages, once installed, exfiltrate sensitive authentication data, potentially compromising developer accounts and access to critical code repositories. The threat affects developers using npm, a widely adopted package manager in the JavaScript ecosystem, making it a significant risk for software supply chain security. Although no known exploits are currently active in the wild, the high severity rating underscores the potential damage if these packages are used in development environments. European organizations relying on npm for software development are at risk, especially those with large developer teams and open-source dependencies. Immediate mitigation involves auditing dependencies, removing suspicious packages, and enhancing credential security practices. Countries with strong technology sectors and high npm usage, such as Germany, the UK, France, and the Netherlands, are most likely to be impacted. The threat is assessed as high severity due to the sensitive nature of stolen credentials, ease of exploitation via package installation, and broad platform coverage without requiring user interaction beyond installing the package.
Let’s compare TikTok, Twitch, YouTube, Reddit, Pinterest, Facebook, Instagram, and other social media based on the amount of data they collect and their privacy settings.
The company has built a plug-and-play photonic layer transmission system that encrypts data in transit to prevent interception. The post CyberRidge Emerges From Stealth With $26 Million for Photonic Encryption Solution appeared first on SecurityWeek .
GhostGrab is a sophisticated Android malware that combines cryptocurrency mining with extensive data theft, targeting sensitive financial information such as banking credentials, debit card details, and OTPs. It exploits device resources for mining while maintaining persistence through advanced hiding techniques and resisting removal. The malware abuses permissions to access SMS, calls, and storage, enabling comprehensive data exfiltration. It uses Firebase for command-and-control and data exfiltration, masking malicious activity within legitimate cloud traffic. Its modular design includes WebView-based phishing pages aimed at financial fraud and identity theft. The malware infrastructure involves recently registered domains and obfuscation services, indicating a professional operation. GhostGrab exemplifies the convergence of financial cybercrime and resource exploitation in mobile malware, posing a significant threat to Android users. European organizations with mobile banking users are at risk, especially where Android market share is high. Mitigation requires enhanced mobile security controls, user awareness, and network monitoring for suspicious Firebase traffic.
Team46, formerly known as TaxOff, is an advanced persistent threat (APT) group that uses sophisticated malware and attack techniques to maintain long-term access to targeted systems. Their toolkit includes zero-day exploits, advanced multi-layer encrypted backdoors like Trinper, and reconnaissance tools. They employ phishing, DLL hijacking, PowerShell commands, and Cobalt Strike beacons to infiltrate and control victim networks. The group’s infrastructure mimics legitimate services to evade detection. While no widespread exploits are currently observed in the wild, European critical infrastructure and government sectors are particularly at risk. Mitigation involves targeted detection of indicators of compromise, strict PowerShell logging, and enhanced email security measures.
Japan’s Dentsu has disclosed a Merkle data breach impacting clients, suppliers, and employees. The post Ad and PR Giant Dentsu Says Hackers Stole Merkle Data appeared first on SecurityWeek .
The TEE. Fail side-channel attack targets secure enclaves implemented on Intel and AMD processors using DDR5 memory, enabling attackers to extract sensitive secrets. This attack exploits vulnerabilities in the Trusted Execution Environment (TEE) design, leveraging side-channel techniques to bypass hardware protections. Although no known exploits are currently observed in the wild, the attack poses a high risk due to the critical nature of enclave security. European organizations relying on Intel and AMD CPUs with DDR5 memory for confidential computing or secure data processing are at risk of data leakage and compromise of cryptographic keys. Mitigation requires microcode and firmware updates from CPU vendors, enhanced enclave design, and strict memory access controls. Countries with significant technology sectors and extensive use of Intel/AMD hardware, such as Germany, France, and the UK, are most likely to be affected. Given the high impact on confidentiality and the complexity of exploitation, the threat severity is assessed as high. Defenders should prioritize patching, monitoring enclave behavior, and restricting access to sensitive enclave workloads.
The Aisuru botnet, previously known for conducting distributed denial-of-service (DDoS) attacks, has shifted its operational focus towards leveraging residential proxies. This evolution allows attackers to route malicious traffic through compromised residential IP addresses, enhancing stealth and evasion capabilities. The botnet's new use of residential proxies poses significant risks to network security, privacy, and the integrity of online services. European organizations could face increased challenges in detecting and mitigating attacks originating from legitimate residential IP ranges. The threat is assessed as high severity due to the botnet's potential to facilitate various malicious activities beyond DDoS, including credential stuffing, web scraping, and anonymized command and control communications. Mitigation requires enhanced network monitoring, anomaly detection focused on proxy traffic, and collaboration with ISPs to identify and remediate infected devices. Countries with high broadband penetration and significant residential internet usage, such as Germany, France, the UK, and the Netherlands, are likely to be most affected. The threat's shift to residential proxies complicates traditional defense mechanisms, necessitating adaptive and proactive security strategies.
Herodotus is an Android malware strain that uses sophisticated techniques to mimic human typing behavior, thereby evading traditional detection mechanisms that rely on identifying automated inputs. This stealthy approach allows the malware to operate covertly on infected devices, potentially enabling unauthorized data access or control. Although currently there are no known exploits in the wild, the malware's evasion tactics pose a medium-level threat. European organizations using Android devices, especially in sectors with high mobile usage, could face risks related to data confidentiality and device integrity. Mitigation requires deploying advanced behavioral detection tools, restricting app permissions, and educating users on the risks of installing untrusted applications. Countries with high Android market penetration and significant mobile workforce, such as Germany, France, Italy, Spain, and the UK, are more likely to be affected. Given the malware’s stealth and potential impact, the suggested severity is medium. Defenders should prioritize monitoring for anomalous input patterns and enforce strict mobile security policies to reduce exposure.
Starting October 2026, the browser will ask users if they want to access public websites that do not use secure connections. The post Chrome to Turn HTTPS on by Default for Public Sites appeared first on SecurityWeek .
Intel and AMD have published advisories after academics disclosed details of the new TEE.fail attack method. The post New Attack Targets DDR5 Memory to Steal Keys From Intel and AMD TEEs appeared first on SecurityWeek .
A recent campaign has been identified targeting the Visual Studio Code (VSCode) extension marketplace, where attackers have uploaded a dozen malicious extensions aimed at developers. These extensions pose a supply chain attack risk by potentially compromising developer environments and injecting malicious code into software development workflows. Although no known exploits are currently active in the wild, the presence of malicious plugins in a widely used IDE marketplace elevates the risk profile. The threat is assessed as medium severity due to the potential impact on confidentiality and integrity, combined with the ease of exploitation through trusted extension installation. European organizations relying heavily on VSCode for software development could face risks of intellectual property theft, code integrity compromise, and downstream supply chain contamination. Mitigation requires proactive extension vetting, restricting extension installation policies, and monitoring for unusual IDE behaviors. Countries with strong software development sectors and high VSCode adoption, such as Germany, the UK, France, and the Netherlands, are more likely to be affected. Given the medium severity and the supply chain nature of the attack, defenders should prioritize awareness and controls around IDE plugin management.
This threat involves attackers using memory-only filesystems (tmpfs) on Linux systems, such as /dev/shm, to hide malicious tools or stage data exfiltration. Traditional forensic imaging tools cannot capture these volatile filesystems because they lack block device backing. The analyst describes a method to collect both metadata and file contents from these tmpfs mounts by first extracting inode metadata using stat commands and then archiving file contents with tar, preserving forensic integrity. This technique has been tested successfully on numerous Linux and Unix-like systems. The threat highlights the challenge of detecting and collecting evidence from in-memory filesystems that attackers exploit to evade detection. The severity is medium due to the difficulty in forensic collection and potential for attackers to hide artifacts in tmpfs, but exploitation requires system access. European organizations running Linux servers with tmpfs mounts are at risk of stealthy attacks leveraging this technique.
