Mozilla has announced a new policy requiring all new Firefox extensions to disclose their data collection practices. This move aims to increase transparency and protect user privacy by informing users about what data extensions collect before installation. While this is a positive step for security and privacy, it is not a direct vulnerability or exploit but rather a policy change to mitigate potential risks from malicious or overly intrusive extensions. There are no known exploits or active attacks related to this announcement. European organizations using Firefox should be aware of this change as it impacts extension vetting and user trust. The policy may reduce risks associated with data leakage through extensions but does not eliminate the need for ongoing vigilance. This announcement is informational and does not represent an immediate threat or vulnerability. Given the nature of the information, the suggested severity is low. Key defenders should focus on monitoring extension permissions and educating users about safe extension usage.
A recent phishing campaign exploits fake death claims related to LastPass to trick users into divulging credentials and breaching password vaults. Attackers impersonate LastPass or related entities, leveraging emotional manipulation to increase success rates. This social engineering tactic targets users of LastPass password managers, aiming to gain unauthorized access to their stored credentials. The campaign is high severity due to the sensitive nature of compromised data and potential for widespread credential theft. No known exploits in the wild have been reported yet, but the threat is credible given the trusted brand impersonation and phishing vector. European organizations using LastPass are at risk, particularly those with employees susceptible to social engineering. Mitigation requires targeted user awareness training, multi-factor authentication enforcement, and vigilant email filtering. Countries with high LastPass adoption and significant digital infrastructure, such as Germany, the UK, France, and the Netherlands, are most likely to be affected. The threat is assessed as high severity due to the potential impact on confidentiality and ease of exploitation via phishing without technical vulnerabilities. Defenders should prioritize detection of phishing attempts referencing LastPass death claims and reinforce secure password management practices.
Shortly after the browser was launched, numerous fraudulent domains and fake applications were discovered. The post Hackers Target Perplexity Comet Browser Users appeared first on SecurityWeek .
A large-scale malware campaign has been identified involving approximately 3,000 YouTube videos used as malware traps within a ghost network operation. These videos are likely designed to lure users into downloading malicious payloads or visiting compromised sites. The threat leverages the popularity and trust of YouTube to propagate malware, potentially impacting user confidentiality and system integrity. There is no evidence of known exploits in the wild yet, but the scale and method of delivery pose significant risks. European organizations could be targeted through employee interactions with these videos, leading to potential data breaches or system compromises. Mitigation requires enhanced user awareness, network monitoring for suspicious traffic, and strict controls on executable downloads. Countries with high internet usage and significant YouTube penetration, such as Germany, the UK, and France, are at greater risk. Given the ease of exploitation via social engineering and the broad scope of affected users, the threat severity is assessed as high. Defenders should prioritize detection and prevention strategies tailored to multimedia-based malware delivery vectors.
At the Pwn2Own Ireland event, hackers earned over $1 million by discovering and exploiting 73 zero-day vulnerabilities across various software and hardware targets. These zero-days represent previously unknown security flaws that could be leveraged for unauthorized access, data theft, or system compromise. Although no known exploits are currently active in the wild, the sheer volume and diversity of vulnerabilities highlight significant security risks. European organizations using affected products should be vigilant, as attackers could weaponize these zero-days before patches are widely deployed. Mitigation requires timely patching once updates are released, enhanced monitoring for unusual activity, and applying defense-in-depth strategies. Countries with high technology adoption and critical infrastructure reliant on the targeted systems are at greater risk. Given the high impact potential and ease of exploitation demonstrated in controlled environments, the threat severity is assessed as high. Defenders must prioritize awareness and readiness to respond to emerging exploits stemming from these zero-days.
A large-scale smishing campaign, attributed to the China-based Smishing Triad, is targeting global users with fraudulent SMS messages impersonating toll violations and package delivery issues. The campaign has expanded internationally, targeting critical sectors such as banking, healthcare, and law enforcement by using realistic phishing pages to harvest sensitive data. It operates via a decentralized infrastructure with over 194,000 malicious domains registered since early 2024, primarily through a Hong Kong-based registrar. This phishing-as-a-service operation leverages sophisticated social engineering to maximize victim engagement. The campaign poses a significant threat to individuals and organizations worldwide, including European entities, due to the broad targeting and sector diversity. No known exploits in the wild have been reported, but the scale and complexity indicate a persistent and evolving threat. Defenders should focus on advanced SMS filtering, user awareness, and domain monitoring to mitigate risks. The threat is assessed as medium severity given its impact on confidentiality and ease of exploitation without requiring authentication but does not directly affect system availability.
The Baohuo Android backdoor is a newly identified malware that targets Telegram users by masquerading as a fake Telegram X app. It hijacks Telegram accounts by exploiting user trust in the fake app, potentially allowing attackers to access private communications and perform unauthorized actions. This malware is distributed through deceptive channels and does not require known exploits or vulnerabilities in Telegram itself. The threat is currently assessed as medium severity due to its impact on confidentiality and account integrity, combined with the need for user interaction to install the fake app. European organizations with employees or users relying on Telegram for communication could face risks of data leakage and account compromise. Mitigation involves user education on app authenticity, restricting app installations from untrusted sources, and monitoring for suspicious account activity. Countries with high Telegram usage and significant digital communication infrastructure, such as Germany, France, and the UK, are more likely to be affected. Given the malware’s backdoor capabilities and account hijacking potential, vigilance is essential to prevent unauthorized access and data breaches.
In files downloaded from the internet, HTML tags referencing external paths could be used to leak NTLM hashes during file previews. The post Microsoft Disables Downloaded File Previews to Block NTLM Hash Leaks appeared first on SecurityWeek .
A Chinese APT group named Jewelbug has expanded its operations to target organizations in South America, South Asia, Taiwan, and Russia. The group's recent intrusion into a Russian IT service provider lasted for five months in 2025, potentially aiming for a supply chain attack. Jewelbug has deployed new backdoors, including one leveraging Microsoft Graph API and OneDrive for command and control. The group's tactics include using legitimate tools, DLL sideloading, and the bring-your-own-vulnerable-driver technique. Notably, Jewelbug's targeting of Russian organizations marks a shift in Chinese cyber operations, previously considered to be allied with Russia.
Questions have been raised over the technical viability of the purported WhatsApp exploit, but the researcher says he wants to keep his identity private. The post Pwn2Own WhatsApp Hacker Says Exploit Privately Disclosed to Meta appeared first on SecurityWeek .
LockBit ransomware is resurfacing with a new variant named "ChuongDong" that targets multiple platforms including Windows, Linux, and VMware ESXi hypervisors. This variant represents an evolution of the LockBit family, known for its sophisticated ransomware-as-a-service operations. Although currently assessed as medium severity, the multi-platform targeting and potential impact on critical infrastructure elevate its risk profile. European organizations using virtualized environments or mixed OS infrastructures are particularly at risk. The ransomware's ability to encrypt ESXi hosts could disrupt virtualized data centers and cloud services. Mitigation requires tailored defenses such as strict network segmentation, hardened ESXi configurations, and proactive monitoring for ransomware behaviors. Countries with high adoption of VMware and diverse IT environments, such as Germany, France, and the UK, are more likely to be targeted. Given the lack of public exploits and minimal discussion, the threat is emerging but demands immediate attention to prevent widespread impact. Defenders should prioritize incident response readiness and ensure robust backup and recovery strategies are in place.
A financially motivated Vietnamese threat actor group UNC6229 is conducting a campaign using fake job postings on legitimate platforms to target remote workers in digital advertising and marketing. They create credible fake company profiles and lure victims with attractive remote job offers. Upon victim engagement, they deliver malware attachments or phishing links, often leveraging legitimate business and CRM platforms to increase trust. The goal is to steal credentials and compromise high-value corporate and digital advertising accounts. The campaign relies heavily on social engineering and victim-initiated contact. Indicators include malware hashes and a suspicious domain (staffvirtual.website). This medium-severity threat poses risks to confidentiality and integrity of corporate accounts, especially in organizations with remote digital advertising staff.
An individual reported their AWS account was compromised, sharing their experience on a public blog linked from a Reddit NetSec post. The incident highlights risks associated with cloud account security, though specific technical details on the attack vector or exploited vulnerabilities are not provided. No known exploits or automated attacks are currently linked to this breach. The severity is assessed as medium due to potential exposure of sensitive cloud resources, but the lack of detailed indicators limits broader impact assessment. European organizations using AWS should be aware of the risks of credential compromise and ensure robust identity and access management. Countries with high AWS adoption and significant cloud infrastructure usage are more likely to be affected. Mitigation should focus on enforcing multi-factor authentication, monitoring account activity, and securing credentials beyond generic advice. Given the limited technical detail, the threat is rated medium severity based on potential impact and ease of exploitation through credential theft or phishing. Defenders should prioritize cloud account security hygiene and incident response readiness.
The Shadow Escape 0-Click attack targets AI assistants, enabling exploitation without user interaction and potentially exposing trillions of records. This novel attack vector leverages vulnerabilities in AI assistant platforms to bypass security controls silently. Although no known exploits are currently active in the wild, the threat poses a medium severity risk due to its potential scale and stealth. European organizations relying on AI assistants for sensitive data processing could face confidentiality breaches and operational disruptions. Mitigations require proactive security assessments of AI assistant integrations, strict access controls, and anomaly detection tailored to AI interaction patterns. Countries with high AI adoption in enterprise and government sectors, such as Germany, France, and the UK, are most likely to be affected. Given the attack's zero-click nature and broad impact potential, the suggested severity is high. Defenders should prioritize monitoring AI assistant platforms for unusual behavior and apply rigorous security hygiene to minimize attack surfaces.
A recently disclosed privilege escalation technique targets laptops using BitLocker with TPM and PIN protection. The method leverages weaknesses in the interaction between BitLocker, TPM, and PIN authentication to escalate privileges on the device. Although no known exploits are currently in the wild, the technique poses a medium-level risk due to its potential to bypass security controls protecting encrypted drives. European organizations using BitLocker with TPM and PIN on laptops could face confidentiality and integrity risks if attackers gain physical or remote access. Mitigation requires careful management of BitLocker configurations, firmware updates, and restricting physical access. Countries with high adoption of Windows enterprise laptops and strong use of BitLocker encryption, such as Germany, France, and the UK, are more likely to be affected. Given the complexity and requirement for some level of access, the threat severity is assessed as medium. Defenders should prioritize monitoring for unusual privilege escalations and ensure endpoint security policies are robust to prevent exploitation.
The relationship between the Russian government and cybercriminal groups has evolved from passive tolerance. The post Russian Government Now Actively Managing Cybercrime Groups: Security Firm appeared first on SecurityWeek .
The threat involves the use of Frida, a dynamic instrumentation toolkit, to modify (mod) and redistribute mobile applications. Attackers or malicious actors can leverage Frida to bypass security controls, alter app behavior, or inject malicious code into mobile apps, potentially leading to unauthorized access or data leakage. Although no specific vulnerabilities or exploits are detailed, the technique poses risks to app integrity and confidentiality. This threat is particularly relevant for organizations relying on mobile apps for sensitive operations. European organizations with mobile app deployments should be aware of this risk and implement robust app protection and runtime detection mechanisms. The threat does not require a known exploit in the wild but highlights a method that could be leveraged for malicious purposes. Mitigation involves advanced app hardening, runtime protection, and monitoring for instrumentation frameworks like Frida. Countries with high mobile app usage and significant digital services sectors, such as Germany, France, and the UK, are more likely to be impacted. The suggested severity is medium due to the potential impact on confidentiality and integrity, moderate ease of exploitation, and the absence of direct exploits or vulnerabilities. Defenders should focus on detecting and preventing unauthorized app instrumentation and distribution.
