Threats affecting Sweden

The malicious Smishing Triad domains were used to collect sensitive information, including Social Security numbers. The post Massive China-Linked Smishing Campaign Leveraged 194,000 Domains appeared first on SecurityWeek .

PhishingGermanyFrance+8

HyperRat is a newly identified Android malware marketed as a ready-made spying tool, enabling attackers to covertly monitor infected devices. Although it is currently not known to be exploited in the wild, its availability as an off-the-shelf spyware increases the risk of widespread misuse. The malware targets Android devices, potentially compromising user confidentiality by accessing sensitive data and communications. European organizations with employees using Android devices are at risk of espionage and data leakage. Mitigation requires proactive mobile security measures, including app vetting, endpoint protection, and user awareness to detect and prevent installation of such spyware. Countries with high Android adoption and significant digital infrastructure, such as Germany, France, Italy, Spain, and the UK, are most likely to be affected. Given the malware’s spying capabilities, ease of distribution, and potential impact on confidentiality, the threat severity is assessed as high. Defenders should prioritize monitoring for suspicious app behavior and enforce strict mobile device management policies to reduce exposure.

Malware#infosecnews#redditGermany+7

All new extensions will be required to declare their data collection practices in their manifest file using a specific key. The post New Firefox Extensions Required to Disclose Data Collection Practices appeared first on SecurityWeek .

NewsGermanyFrance+5

For the latest discoveries in cyber research for the week of 27th October, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES Toys “R” Us Canada has suffered a data breach that resulted in stolen customer records being leaked on the dark web. The compromised data affects an undisclosed number of individuals and includes […] The post 27th October – Threat Intelligence Report appeared first on Check Point Research .

Analysis#webSweden+9

A new high-severity threat involves hackers using a RedTiger-based infostealer malware to steal Discord accounts. This malware targets users by harvesting credentials and sensitive information stored on infected systems, enabling attackers to hijack Discord accounts. The infostealer operates stealthily, often delivered via phishing or malicious downloads, and can compromise user privacy and security. Although no known exploits in the wild have been reported yet, the threat is considered high due to the potential impact on account integrity and the widespread use of Discord in both personal and professional contexts. European organizations using Discord for communication and collaboration are at risk of account takeover, which could lead to data leaks, impersonation, and further lateral attacks. Mitigation requires targeted user education, endpoint protection tuned to detect infostealer behaviors, and multi-factor authentication enforcement on Discord accounts. Countries with high Discord adoption and active infosec communities, such as the UK, Germany, France, and the Netherlands, are likely to be most affected. Given the malware’s capability to compromise confidentiality and integrity without requiring user interaction beyond initial infection, the suggested severity is high.

News#infosecnews#redditGermany+4

Wordfence has blocked approximately 8.7 million attacks exploiting vulnerabilities in the outdated GutenKit and Hunk Companion WordPress plugins. These flaws, although old, continue to be targeted by attackers attempting to compromise WordPress sites. The attacks are widespread but do not currently have known active exploits in the wild beyond these blocked attempts. The vulnerabilities allow attackers to potentially execute unauthorized actions on affected sites, risking data confidentiality and site integrity. European organizations using these plugins remain at risk if they have not removed or patched these components. Mitigation involves removing these outdated plugins, applying any available patches, and employing robust web application firewalls like Wordfence. Countries with high WordPress usage and significant e-commerce or media sectors are more likely to be targeted. Given the scale of attacks and potential impact, the threat severity is assessed as high. Defenders should prioritize identifying and remediating these vulnerable plugins to prevent compromise.

News#infosecnews#redditGermany+7

The 'Bytes over DNS' report from the SANS Internet Storm Center highlights a technique where data is covertly transmitted using DNS queries and responses. This method can be exploited for data exfiltration or command and control communication, bypassing traditional network security controls. Although no specific vulnerabilities or exploits are detailed, the technique poses a medium-level threat due to its stealth and potential misuse. European organizations, especially those with sensitive data and strict regulatory requirements, could face confidentiality risks if attackers leverage this method. Mitigation requires enhanced DNS monitoring, anomaly detection, and strict egress filtering to detect and block suspicious DNS traffic. Countries with advanced digital infrastructure and high adoption of DNS-based services, such as Germany, France, and the UK, are more likely to be targeted. Given the lack of direct exploits and the complexity of exploitation, the suggested severity is medium. Defenders should focus on improving DNS traffic visibility and implementing DNS security best practices to mitigate this covert channel threat.

News#infosecnews#redditGermany+5

Coveware has attributed the drop to large enterprises increasingly refusing to pay up and smaller amounts paid by mid-market firms. The post Ransomware Payments Dropped in Q3 2025: Analysis appeared first on SecurityWeek .

AnalysisGermanyFrance+8

The threat actor behind Operation ForumTroll used the same toolset typically employed in Dante spyware attacks. The post Chrome Zero-Day Exploitation Linked to Hacking Team Spyware appeared first on SecurityWeek .

MalwareGermanyFrance+8

I was intrigued when Johannes talked about malware that uses BASE64 over DNS to communicate. Take a DNS request like this: label1.label2.tld. Labels in a request like this can only be composed with letters (not case-sensitive), digits and a hyphen character (-). While BASE64 is encoded with letters (uppercase and lowercase), digits and special characters + and /. And also a special padding character: =.

NewsGermanyFrance+6

A Local File Inclusion (LFI) vulnerability exists in Traccar versions 5.8 through 6.8.1 on Windows systems due to Jetty's addPath method. This vulnerability allows unauthenticated attackers to read arbitrary files on the server by exploiting the way Jetty handles path additions. Although no known exploits are currently in the wild, the flaw can lead to sensitive information disclosure, potentially aiding further attacks. The vulnerability is specific to Windows environments and does not require authentication or user interaction, increasing its risk. European organizations using affected Traccar versions on Windows should prioritize mitigation. The threat is assessed as medium severity due to its impact on confidentiality and ease of exploitation. Countries with significant Traccar deployments and critical infrastructure monitoring are at higher risk.

News#netsec#redditGermany+7

Reports have emerged suggesting that Tesla's Full Self-Driving (FSD) AI system may be degrading in performance over time, raising concerns about the reliability and safety of autonomous driving technology. Although this observation is based on limited discussion and lacks detailed technical evidence, it highlights potential risks in AI model maintenance and continuous learning in safety-critical systems. There are no known exploits or direct cybersecurity vulnerabilities reported at this time. European organizations relying on Tesla vehicles or similar autonomous systems should monitor developments closely, as degradation in AI performance could impact operational safety and liability. Mitigation involves rigorous validation, continuous monitoring of AI behavior, and ensuring fallback safety mechanisms are in place. Countries with higher Tesla adoption and advanced autonomous vehicle testing, such as Germany, the UK, and the Netherlands, may be more affected. Given the medium severity and lack of direct exploitability, the threat primarily concerns safety and operational integrity rather than traditional cybersecurity compromise.

News#infosecnews#redditGermany+5

EDR-Redir is a technique that abuses Windows kernel components—specifically a Bind Filter driver (bindflt.sys) and the Windows Cloud Filter API (cldflt.sys)—to redirect or corrupt the working folder of Endpoint Detection and Response (EDR) software. By doing so, attackers can disrupt or disable the EDR's process services, effectively bypassing detection and response capabilities. This method does not require known exploits or published patches yet and has minimal public discussion, indicating it may be a novel or emerging technique. The attack targets the integrity and availability of EDR systems, potentially allowing attackers to operate undetected. While no active exploits are reported in the wild, the medium severity rating reflects the significant impact on security monitoring if successfully implemented. European organizations relying on Windows-based EDR solutions are at risk, especially those with critical infrastructure or sensitive data. Mitigation requires advanced monitoring of kernel filter drivers, integrity checks on EDR folders, and restricting unauthorized driver installations. Countries with high adoption of Windows enterprise environments and advanced threat landscapes, such as Germany, France, the UK, and the Netherlands, are most likely to be affected.

News#netsec#redditGermany+7

A recent high-severity security news report reveals the discovery of a coordinated campaign involving multiple malicious browser extensions. The investigation began with one malicious extension and uncovered a broader network of extensions designed to evade detection while potentially compromising user data and browser security. Although no known exploits are currently active in the wild, the threat highlights the risks posed by malicious extensions that can operate stealthily within browsers. European organizations relying heavily on browser-based workflows and extensions could face confidentiality and integrity risks if targeted. The threat requires vigilance in extension management and enhanced monitoring to detect suspicious behaviors. Mitigation involves strict extension vetting, use of enterprise policies to control extension installation, and continuous user education. Countries with high adoption of affected browsers and significant digital infrastructure, such as Germany, France, and the UK, are more likely to be impacted. Given the stealthy nature and potential for data compromise without user interaction, the suggested severity is high. Defenders should prioritize detection and prevention strategies to mitigate this evolving threat landscape.

News#infosecnews#redditGermany+6

ThreatFox IOCs for 2025-10-26

Indicator#type:osint#tlp:whiteGermany+4

A new phishing campaign named CoPhish targets users of Copilot Studio agents to steal OAuth tokens, enabling attackers to hijack user sessions and access sensitive resources. This attack leverages social engineering to trick users into authorizing malicious OAuth applications or interacting with compromised Copilot Studio agents. The stolen tokens can grant attackers unauthorized access to cloud services and enterprise applications without needing user credentials. The campaign is recent and considered high severity due to the potential for widespread token theft and session hijacking. No known exploits in the wild have been reported yet, but the threat is credible given the trusted source and recent discovery. European organizations using Copilot Studio or similar OAuth-based integrations are at risk, especially those heavily reliant on cloud services. Mitigation requires targeted user awareness, strict OAuth app permission reviews, and enhanced monitoring of token usage. Countries with significant cloud adoption and technology sectors, such as Germany, the UK, France, and the Netherlands, are likely more exposed. The attack does not require system vulnerabilities but exploits user trust and OAuth token handling, making it relatively easy to execute. The suggested severity is high due to the impact on confidentiality and integrity without requiring credential theft or complex exploits.

Campaign#infosecnews#redditGermany+5

Researchers have discovered that a prompt can be disguised as an url, and accepted by Atlas as an url in the omnibox. The post OpenAI Atlas Omnibox Is Vulnerable to Jailbreaks appeared first on SecurityWeek .

NewsGermanyFrance+5

Next.js server actions use hashed identifiers in POST requests, obscuring their purpose and complicating penetration testing. When productionBrowserSourceMaps is enabled, these hashes can be mapped back to function names using the NextjsServerActionAnalyzer Burp extension, improving visibility into server actions. This tool automates extraction of mappings from JavaScript bundles, enabling testers to identify and test unused or hidden server actions effectively. The presence of productionBrowserSourceMaps in production environments can inadvertently leak debugging information, increasing attack surface. European organizations using Next.js with this configuration risk exposure of sensitive backend functionality. Mitigation involves disabling productionBrowserSourceMaps in production, monitoring server action usage, and employing tools like this extension for thorough security assessments. Countries with strong web development sectors and high adoption of Next.js, such as the UK, Germany, and France, are most likely affected.

Tool#netsec#redditGermany+4

A global phishing campaign known as the 'Smishing Triad' has been linked to the creation and use of approximately 194,000 malicious domains. This operation leverages smishing (SMS phishing) techniques to deceive victims into divulging sensitive information or installing malware. The campaign is widespread and targets users globally, posing a significant threat to organizations and individuals alike. European organizations are at risk due to the high volume of malicious domains and the common use of mobile communications in business and personal contexts. The threat is categorized as high severity due to its scale, potential impact on confidentiality and integrity, and the ease of exploitation without requiring user authentication. Defenders should focus on enhancing mobile security awareness, deploying advanced domain filtering, and monitoring for suspicious SMS activity. Countries with high mobile penetration and significant digital infrastructure, such as Germany, the UK, France, and the Netherlands, are particularly vulnerable. Immediate mitigation steps include user education, domain reputation services, and collaboration with telecom providers to detect and block smishing attempts.

Phishing#infosecnews#redditGermany+6

Hackers are conducting mass attacks targeting outdated WordPress plugins, exploiting known vulnerabilities to compromise websites. These attacks leverage unpatched security flaws in widely used plugins, enabling attackers to potentially execute arbitrary code, inject malicious content, or gain unauthorized access. European organizations running WordPress sites with outdated plugins face increased risks of data breaches, website defacement, or service disruption. The threat is high severity due to the widespread use of WordPress across Europe and the ease of exploitation without requiring authentication. Mitigation requires immediate plugin updates, continuous vulnerability monitoring, and enhanced web application firewall rules tailored to WordPress plugin exploits. Countries with large digital economies and high WordPress adoption, such as Germany, the UK, France, and the Netherlands, are most likely to be targeted. Given the potential impact on confidentiality, integrity, and availability, and the ease of exploitation, the suggested severity is high. Defenders should prioritize patch management and proactive monitoring to reduce exposure to these mass exploitation attempts.

News#infosecnews#redditGermany+7