Threats affecting Sweden

The security paradox of local large language models (LLMs) highlights the conflicting security implications of running LLMs locally versus relying on cloud-based services. While local LLMs reduce data exposure to external servers, they introduce new risks such as local system compromise, unauthorized model manipulation, and data leakage through insecure storage or execution environments. This paradox creates a complex security landscape where organizations must balance confidentiality, integrity, and availability concerns. European organizations adopting local LLMs may face risks related to sensitive data processing on endpoint devices, increasing the attack surface. Mitigations include enforcing strict access controls, securing local environments, monitoring for anomalous model behavior, and applying cryptographic protections to stored data and models. Countries with strong AI adoption and digital transformation initiatives, such as Germany, France, and the UK, are more likely to be affected due to higher local LLM usage. Given the medium severity and absence of known exploits, the threat requires proactive but measured attention to prevent exploitation of local deployment weaknesses.

News#netsec#redditGermany+5

Yesterday, Chinese security services published a story alleging a multi-year attack against the systems operating the Chinese standard time (CST), sometimes called Beijing Standard Time. China uses only one time zone across the country, and has not used daylight saving time since 1991. Most operating systems use UTC internally and display local time zones for user convenience. Modern operating systems use NTP to synchronize time. Popular implementations are ntpd and chrony. The client will poll several servers, disregard outliers, and usually sync with the "best" time server based on latency and jitter detected.

News#localGermany+7

Star Blizzard started using the NoRobot (BaitSwitch) and MaybeRobot (SimpleFix) malware after public reporting on the LostKeys malware. The post Russian APT Switches to New Backdoor After Malware Exposed by Researchers appeared first on SecurityWeek .

MalwareGermanyFrance+8

The Jingle Thief campaign, conducted by financially motivated threat actors from Morocco, targets global enterprises in retail and consumer services sectors to execute gift card fraud. Using phishing and smishing tactics, the attackers gain access to Microsoft 365 environments, exploiting cloud services for reconnaissance, lateral movement, and persistence. They focus on compromising gift card issuance systems, leveraging internal documentation and communication channels. The campaign demonstrates sophisticated techniques, including tailored phishing, internal email manipulation, and device registration abuse. The attackers maintain long-term access, sometimes over a year, making detection challenging. Their activities often align with holiday periods to maximize impact.

Campaign#microsoft 365#phishingUnited Kingdom+7

Cursor and Windsurf integrated development environments (IDEs) have been found to contain over 94 unpatched (n-day) vulnerabilities originating from their embedded Chromium components. These vulnerabilities span a wide range of security issues inherent to Chromium, potentially exposing users to risks such as remote code execution, privilege escalation, and data leakage. Although no known exploits are currently active in the wild, the sheer volume and severity of these vulnerabilities pose a significant threat, especially given the widespread use of these IDEs in software development. European organizations using these IDEs may face increased risk of compromise, intellectual property theft, or disruption of development workflows. Immediate attention to patching or mitigating these vulnerabilities is critical. The threat is assessed as high severity due to the potential impact on confidentiality, integrity, and availability, combined with the ease of exploitation of Chromium vulnerabilities. Countries with strong software development sectors and high adoption of these IDEs, such as Germany, France, and the UK, are likely to be most affected. Defenders should prioritize updating Chromium components, applying vendor patches when available, and implementing network-level protections to reduce exposure. Continuous monitoring for suspicious activity related to these IDEs is also recommended.

News#infosecnews#redditGermany+6

Vidar Stealer 2.0 is a malware variant that enhances its data theft capabilities by implementing multi-threaded operations and improved evasion techniques. It targets sensitive user information by stealing data more efficiently and stealthily than previous versions. Although no known exploits in the wild have been reported yet, its high-priority classification and recent emergence warrant immediate attention. The malware’s multi-threaded design allows it to exfiltrate data faster, increasing the risk of significant data loss. European organizations, especially those handling large volumes of personal or financial data, are at risk due to the potential for rapid and covert data compromise. Mitigation requires advanced endpoint detection, behavioral analysis, and network monitoring tailored to detect multi-threaded suspicious activities. Countries with high adoption of Windows-based systems and significant financial or industrial sectors are more likely to be targeted. Given the high impact on confidentiality and ease of exploitation without user interaction, the threat severity is assessed as high.

Malware#infosecnews#redditGermany+9

Participants exploited 34 previously unknown vulnerabilities to hack printers, NAS devices, and smart home products. The post Hackers Earn Over $520,000 on First Day of Pwn2Own Ireland 2025 appeared first on SecurityWeek .

NewsGermanyFrance+5

Mirai, a notorious botnet targeting IoT devices, has evolved since its 2016 debut. Initially known for massive DDoS attacks, newer variants employ sophisticated techniques like UPX packing and common network utilities for evasion and adaptability. Modern Mirai samples extend beyond DDoS, focusing on data exfiltration and long-term persistence. The analysis compares a June 2025 variant with the original, highlighting differences in execution, network behavior, and file characteristics. The new variant demonstrates increased stealth, modularity, and versatility, making it a more significant threat in the interconnected device landscape. Prevention strategies include updated antivirus software, avoiding suspicious links, and regular system and network monitoring.

Malware#botnet#iotGermany+6

Tykit is a newly identified phishing kit targeting Microsoft 365 accounts, active since May 2025. It uses SVG files as delivery vectors and a multi-stage attack chain to mimic Microsoft login pages and steal credentials. The kit employs evasion techniques including Cloudflare Turnstile anti-bot protection and basic anti-debugging measures. It primarily targets industries such as finance, construction, IT, professional services, government, and telecom, with victims globally including the EMEA region. Stolen credentials are exfiltrated via API calls to attacker-controlled servers. The campaign requires user interaction through phishing but does not require prior authentication. This threat poses a medium severity risk due to its potential impact on confidentiality and the widespread use of Microsoft 365 in Europe.

Malware#svg#microsoft 365Germany+7

The PolarEdge botnet campaign targets routers from Cisco, ASUS, QNAP, and Synology to expand its network of compromised devices. This campaign leverages vulnerabilities or weak configurations in these widely used routers to enlist them into a botnet, potentially enabling large-scale distributed denial-of-service (DDoS) attacks, data interception, or further lateral movement. Although no known exploits are currently reported in the wild, the campaign is considered high priority due to the critical role these devices play in network infrastructure. European organizations using these brands are at risk, especially those with less stringent router security practices. The campaign's expansion highlights the ongoing threat posed by botnets exploiting IoT and network edge devices. Defenders should focus on hardening router configurations, applying firmware updates, and monitoring network traffic for anomalies. Countries with high adoption of these router brands and significant digital infrastructure are more likely to be targeted. Immediate mitigation steps can reduce the risk of compromise and limit the botnet's growth.

Campaign#infosecnews#redditGermany+9

Real-time audio deepfakes have emerged as a new security threat, enabling attackers to impersonate voices convincingly during live interactions. This technology can be exploited in vishing (voice phishing) attacks to deceive individuals or organizations into divulging sensitive information or authorizing fraudulent transactions. Although no known exploits are currently reported in the wild, the medium severity rating reflects the potential risks associated with this capability. European organizations, especially those relying heavily on voice-based authentication or customer service, face increased risks of social engineering attacks. Mitigation requires a combination of technical controls, employee training, and verification protocols to detect and prevent deepfake audio misuse. Countries with advanced financial sectors and high adoption of voice technologies, such as the UK, Germany, and France, are more likely to be targeted. Given the ease of generating convincing audio deepfakes and the broad scope of potential victims, this threat is assessed as high severity. Defenders should prioritize awareness, multi-factor authentication, and anomaly detection to reduce exposure.

News#infosecnews#redditGermany+5

Russian threat actors have evolved a malware campaign that leverages fake "I am not a robot" CAPTCHA prompts to deliver malicious payloads. This technique abuses user trust in CAPTCHA interfaces to trick victims into executing malware, potentially leading to system compromise. The malware is associated with advanced persistent threat (APT) groups and represents a high-severity risk due to its social engineering vector and stealthy delivery. Although no known exploits are currently active in the wild, the campaign's sophistication and targeting suggest a significant threat to organizations, especially those with high user interaction and web-facing services. European organizations are at risk given the widespread use of CAPTCHA mechanisms and the geopolitical focus on this region. Mitigation requires enhanced user awareness, web filtering, and endpoint detection tuned to identify unusual CAPTCHA-related behaviors. Countries with large digital economies and critical infrastructure in Europe are most likely targets. The threat is assessed as high severity due to the potential for confidentiality breaches, ease of exploitation via social engineering, and the broad scope of affected systems without requiring prior authentication or complex user interaction beyond clicking a fake CAPTCHA.

Malware#infosecnews#redditGermany+9

We explain how to configure privacy settings in DeepSeek, how to use the chatbot securely, and how to deploy it locally.

Analysis#localGermany+6

GlassWorm is a groundbreaking self-propagating worm targeting VS Code extensions on OpenVSX marketplace. It employs invisible Unicode characters to conceal malicious code and utilizes a blockchain-based command and control infrastructure on Solana. The worm compromised seven OpenVSX extensions with 35,800 downloads, harvesting NPM, GitHub, and Git credentials, targeting cryptocurrency wallets, deploying SOCKS proxy servers, and installing hidden VNC servers. It spreads exponentially through the developer ecosystem using stolen credentials. The worm employs a triple-layer C2 setup involving Solana blockchain, direct IP connection, and Google Calendar. A new infected extension was also detected in Microsoft's VSCode marketplace. The campaign remains active, necessitating immediate security measures and audits of installed extensions.

Malware#self-propagating#vscodeFrance+7

A new tech support scam campaign exploits Microsoft's trusted brand to deceive users. It starts with phishing emails promising payments, leading victims to fake CAPTCHA challenges. After completion, users are redirected to a browser-locked landing page mimicking ransomware, with multiple pop-ups resembling Microsoft security alerts. These pop-ups urge victims to call a fraudulent support number, enabling phone-based social engineering. The scam combines browser manipulation, phishing, and social engineering to potentially gain system access. No direct malware or exploits are involved, but the psychological manipulation can lead to financial loss or unauthorized access. The campaign underscores the risks of trusting familiar branding without verification and highlights the need for user awareness and layered defenses. Indicators include multiple malicious URLs and domains used in the campaign. The threat is medium severity due to its social engineering nature and potential impact on confidentiality and integrity.

Campaign#microsoft impersonation#browser manipulationGermany+9

Attackers are leveraging TikTok videos to distribute malware by masquerading as free software activations. The campaign uses social engineering to convince users to run malicious PowerShell scripts that download additional payloads, including the AuroStealer information stealer. Persistence is established via scheduled tasks, and one payload uses a self-compiling technique to inject shellcode directly into memory, evading detection. Multiple TikTok videos target various software products, employing the ClickFix technique to increase user trust. This threat exploits user interaction and social engineering on a popular platform, posing a medium risk due to its potential to compromise confidentiality and integrity. European organizations with users active on TikTok and those using targeted software products are at risk. Mitigations include user education, PowerShell execution restrictions, monitoring scheduled tasks, and blocking malicious domains. Countries with high TikTok usage and significant software user bases, such as Germany, France, and the UK, are more likely to be affected.

Malware#scheduled tasks#self-compilingGermany+7

The PassiveNeuron campaign is a sophisticated cyberespionage operation targeting Windows Server machines primarily in government, financial, and industrial sectors across Asia, Africa, and Latin America. Attackers gain initial access by exploiting SQL servers and deploy custom implants such as Neursite and NeuralExecutor. These implants employ advanced persistence, evasion, and command execution techniques, using a multi-stage loading process and diverse communication protocols for command and control (C2). Although attribution is uncertain, indicators suggest possible links to Chinese-speaking threat actors. The campaign highlights the critical need for robust server security and continuous monitoring to detect complex multi-stage intrusions. No known exploits are currently in the wild, and the campaign is rated medium severity. The focus on Windows Server environments and SQL exploitation techniques underscores the risk to organizations relying on these technologies.

Malware#cyberespionage#multi-stage loadingGermany+9

A threat actor has been infecting servers of high-profile entities with backdoors to exfiltrate information and deploy additional payloads. The post Government, Industrial Servers Targeted in China-Linked ‘PassiveNeuron’ Campaign appeared first on SecurityWeek .

MalwareGermanyFrance+8

A medium-severity vulnerability was identified in Microsoft 365 Copilot involving arbitrary data exfiltration via Mermaid diagrams. Attackers could exploit the way Mermaid diagrams are processed to extract sensitive data without authorization. This issue was publicly disclosed on Reddit and detailed on a security blog, but no known exploits are currently active in the wild. The vulnerability does not require authentication or user interaction, increasing its risk profile. European organizations using Microsoft 365 Copilot, especially in sectors handling sensitive or regulated data, are at risk. Mitigation requires applying any patches from Microsoft once available and restricting Mermaid diagram usage or sanitizing inputs in the interim. Countries with high Microsoft 365 adoption and significant enterprise cloud usage, such as Germany, France, and the UK, are most likely to be affected. Given the potential for confidentiality breaches and the ease of exploitation, the suggested severity is high. Defenders should monitor official Microsoft advisories and implement strict content controls on Mermaid diagrams within their environments.

News#netsec#redditGermany+6

Windows 11 23H2 is approaching its end of life (EOL), meaning Microsoft will cease providing security updates and patches for this version after the designated date. Organizations continuing to use this version post-EOL will be exposed to unpatched vulnerabilities, increasing their risk of compromise. Although no specific exploits are currently known in the wild targeting this EOL, the lack of security updates inherently raises the threat level. European organizations relying on Windows 11 23H2 should plan timely upgrades to supported versions to maintain security posture. Failure to upgrade may lead to increased exposure to malware, ransomware, and other cyberattacks exploiting unpatched vulnerabilities. The impact is particularly significant for sectors with strict compliance requirements and critical infrastructure. Countries with high Windows 11 adoption and strong digital economies are at greater risk. Proactive asset management and patching strategies are essential to mitigate risks associated with this EOL. This threat is assessed as medium severity due to the indirect nature of the risk and absence of active exploits.

News#infosecnews#redditGermany+9