MacSync is a sophisticated macOS infostealer that targets cryptocurrency users. It is delivered through a phishing lure disguised as a cloud storage installer, tricking users into executing a malicious Terminal command. The malware employs a multi-stage infection process, using a script-based approach to harvest browser credentials, cryptocurrency wallet data, and sensitive files. A key feature of MacSync is its ability to trojanize popular Electron-based cryptocurrency applications like Ledger and Trezor, enabling long-term phishing and data exfiltration. The malware's infrastructure includes multiple rotating C2 domains and clone sites, indicating an ongoing and evolving campaign. MacSync's focus on cryptocurrency-related data and its stealthy, script-based execution make it particularly dangerous for macOS users in the crypto community.
The incident impacted the personal information of CIRO member firms and their registered employees. The post 750,000 Impacted by Data Breach at Canadian Investment Watchdog appeared first on SecurityWeek .
isVerified provides Android and iOS mobile applications designed to protect enterprise communications. The post isVerified Emerges From Stealth With Voice Deepfake Detection Apps appeared first on SecurityWeek .
Hackers stole the personal and reservation information of people with a Eurail pass and those who made a seat reservation with the company. The post Traveler Information Stolen in Eurail Data Breach appeared first on SecurityWeek .
The botnet’s propagation is fueled by the AI-generated server deployments that use weak credentials, and legacy web stacks. The post GoBruteforcer Botnet Targeting Crypto, Blockchain Projects appeared first on SecurityWeek .
The law firm Fried Frank seems to be informing high-profile clients about a recent data security incident. The post After Goldman, JPMorgan Discloses Law Firm Data Breach appeared first on SecurityWeek .
According to the World Economic Forum's Global Cybersecurity Outlook 2026 report, cyber fraud has surpassed ransomware as the top concern for CEOs, while ransomware remains the primary worry for CISOs. This shift highlights evolving threat landscapes where financial deception and fraud schemes increasingly threaten organizational leadership. Although no specific vulnerability or exploit details are provided, the medium severity rating reflects the significant but indirect risk posed by cyber fraud activities. European organizations face heightened risks due to their economic stature and digital integration, necessitating tailored fraud detection and prevention strategies. Mitigation requires advanced fraud analytics, employee training focused on social engineering, and enhanced transactional monitoring beyond traditional ransomware defenses. Countries with large financial sectors and digital economies, such as the UK, Germany, France, and the Netherlands, are particularly susceptible. Given the broad impact potential and the complexity of fraud schemes, the suggested severity is medium. Defenders should prioritize adaptive fraud risk management alongside ransomware preparedness to address this emerging CEO-level concern effectively.
Threat actors exploited Cloudflare's free-tier infrastructure and Python environments to deploy AsyncRAT, demonstrating advanced evasion techniques. The attack begins with phishing emails containing Dropbox links to malicious files. It uses legitimate Python downloads and sophisticated code injection targeting explorer.exe. The campaign ensures persistence through multiple vectors, including startup folder scripts and WebDAV mounting. It abuses trusted infrastructure like Cloudflare to mask activities and evade detection. The attackers employ social engineering tactics, such as displaying legitimate PDF documents, to reduce suspicion. This campaign highlights the trend of abusing cloud services for malware delivery and execution, emphasizing the need for multi-layered security approaches.
The PHALT#BLYX campaign targets the hospitality sector using sophisticated social engineering and advanced techniques. It begins with a phishing email mimicking a Booking.com reservation cancellation, leading victims to a fake website. Users are tricked into executing malicious PowerShell commands through a fake BSOD and click-fix social engineering tactic. The malware leverages MSBuild.exe to bypass defenses and deploys a customized DCRat payload. It establishes persistence, disables Windows Defender, and uses process hollowing to inject into legitimate processes. The campaign shows evolution from earlier, simpler methods and demonstrates a deep understanding of modern endpoint protection. Attribution points to Russian-speaking threat actors, given the presence of Cyrillic debug strings and the use of DCRat, a popular tool in Russian underground forums.
Three malicious npm packages were discovered in November 2025, designed to deliver and install a new RAT malware family named NodeCordRAT. The packages, bitcoin-main-lib, bitcoin-lib-js, and bip40, mimicked legitimate Bitcoin-related libraries to deceive developers. NodeCordRAT uses Discord for command-and-control communication, targets Chrome credentials, sensitive secrets, and MetaMask data. It performs host fingerprinting, executes shell commands, captures screenshots, and exfiltrates data. The malware exploits software supply chain vulnerabilities, highlighting the importance of vigilance in package management. Although removed from npm, the incident serves as a reminder of ongoing threats in the software development ecosystem.
Hackers exploited a multisignature (multisig) wallet vulnerability in the Unleash Protocol, resulting in the theft of approximately $3.9 million. The attack involved hijacking control over the multisig wallet, which is designed to require multiple approvals for transactions, thereby bypassing its intended security. This incident highlights risks associated with multisig wallet management and governance in decentralized finance (DeFi) platforms. Although no specific CVEs or patches are currently available, the breach demonstrates a high-severity threat due to the large financial loss and potential for similar attacks on other DeFi protocols. European organizations involved in blockchain, cryptocurrency, or DeFi services could face significant financial and reputational damage if targeted. Mitigation requires robust multisig wallet security practices, including strict key management, enhanced access controls, and continuous monitoring for suspicious activity. Countries with active blockchain ecosystems and financial hubs, such as Germany, the Netherlands, Switzerland, and the UK, are most likely to be affected. Given the attack's impact on confidentiality, integrity, and availability of funds, ease of exploitation through governance compromise, and lack of user interaction, the suggested severity is high. Defenders should prioritize securing multisig wallets and governance processes to prevent similar hijacks.
The worm exposed Trust Wallet’s Developer GitHub secrets, allowing attackers to publish a backdoor extension and steal funds from 2,520 wallets. The post Shai-Hulud Supply Chain Attack Led to $8.5 Million Trust Wallet Heist appeared first on SecurityWeek .
A cyber campaign has been identified involving the abuse of Remote Monitoring and Management (RMM) tools to distribute malicious crypto wallet software. Attackers leverage RMM platforms to deploy malware under the guise of legitimate crypto wallet applications, aiming to compromise users' cryptocurrency assets. Although no known exploits are currently active in the wild, the campaign represents a medium-severity threat due to the potential financial impact and the stealthy use of trusted management tools. European organizations involved in cryptocurrency services or using RMM solutions are at risk, especially those with high adoption of remote management platforms. Mitigation requires strict control and monitoring of RMM tool usage, validation of crypto wallet software sources, and enhanced user awareness. Countries with significant crypto markets and advanced IT infrastructure, such as Germany, the UK, and the Netherlands, are more likely targets. The threat's medium severity is based on the moderate impact on confidentiality and integrity, the complexity of exploitation requiring some user interaction, and the limited scope of affected systems. Defenders should focus on securing RMM environments and verifying software authenticity to prevent compromise.
A former Coinbase support agent was arrested for assisting hackers in compromising user accounts. This insider threat highlights risks associated with privileged access abuse within cryptocurrency platforms. Although no specific technical exploit details or affected software versions are provided, the incident underscores the potential for social engineering and insider collusion to facilitate unauthorized access. European organizations involved in cryptocurrency trading or custodial services could face similar insider risks. Mitigation requires stringent internal controls, enhanced monitoring of privileged users, and robust verification processes for support interactions. Countries with significant cryptocurrency adoption and financial sectors, such as Germany, the UK, and the Netherlands, are most likely to be impacted. The threat severity is assessed as high due to the potential for significant financial loss and reputational damage, ease of exploitation via insider access, and the broad impact on user trust. Defenders should prioritize insider threat programs and continuous behavioral analytics to detect anomalous support agent activities.
A recent high-severity crypto theft campaign targeted Trust Wallet users, resulting in the draining of 2,596 wallets and a loss of approximately $7 million. The attack exploited vulnerabilities or weaknesses related to Trust Wallet, a widely used cryptocurrency wallet application. While specific technical details of the exploit are not disclosed, the campaign demonstrates significant financial impact and risk to users' digital assets. European organizations and individuals using Trust Wallet or related services are at risk of financial loss and reputational damage. The attack does not require user interaction beyond wallet usage, and the compromised wallets indicate a breach of confidentiality and integrity of user assets. Mitigation requires immediate wallet security hygiene, including private key management, use of hardware wallets, and vigilance against phishing or malicious apps. Countries with higher cryptocurrency adoption and Trust Wallet user bases, such as Germany, the UK, France, and the Netherlands, are more likely to be affected. Given the financial impact, ease of exploitation, and scope, the threat severity is assessed as high. Defenders should prioritize securing wallet credentials, monitoring for suspicious transactions, and educating users on safe crypto practices.
Stolen LastPass backups reportedly enable ongoing cryptocurrency theft through 2025 by exposing sensitive credential data. The breach involves unauthorized access to backup data, potentially containing encrypted vault information that attackers can exploit to steal crypto assets. Although no known exploits are currently active in the wild, the threat persists due to the long-term validity of the stolen data. European organizations using LastPass for password management and crypto wallet credentials face risks of confidentiality breaches and financial losses. The threat severity is medium given the complexity of exploiting encrypted backups and the requirement for further decryption efforts. Mitigation requires immediate credential resets, enhanced multi-factor authentication, and monitoring of crypto transactions. Countries with high LastPass adoption and significant crypto markets, such as Germany, the UK, and the Netherlands, are most at risk. Defenders should prioritize securing password vaults, auditing access logs, and educating users on phishing risks related to credential theft. This threat underscores the importance of robust backup security and crypto asset protection strategies.
A phishing campaign is distributing fake GrubHub emails that promise recipients a tenfold return on any cryptocurrency they send. These emails attempt to lure victims into sending cryptocurrency with the false promise of high returns, a classic advance-fee scam tactic. The campaign leverages the GrubHub brand to increase credibility and target users who may be familiar with the service. There are no known exploits or vulnerabilities involved, but the threat relies on social engineering to deceive users. This type of phishing can lead to direct financial loss and potential exposure of personal information. European organizations and individuals using GrubHub or similar services may be targeted, especially those with cryptocurrency holdings. The ease of exploitation is high since it only requires user interaction and trust in the brand. Mitigation requires user awareness, email filtering, and verification of unsolicited offers. Countries with higher cryptocurrency adoption and GrubHub usage are more likely to be affected. The severity is assessed as high due to the financial impact and widespread phishing nature.
The Trust Wallet Chrome extension was compromised, leading to thefts amounting to millions of dollars. This attack involved malicious actors exploiting the browser extension to steal cryptocurrency assets from users. The incident highlights significant risks associated with browser-based crypto wallets, especially when extensions are targeted. European organizations and users relying on Trust Wallet or similar extensions face potential financial losses and reputational damage. The attack underscores the need for stringent security controls around browser extensions and crypto asset management. Mitigation requires immediate removal of compromised extensions, use of hardware wallets, and enhanced monitoring of wallet activities. Countries with high cryptocurrency adoption and significant Trust Wallet user bases are most at risk. Given the high financial impact and ease of exploitation through a widely used extension, the severity is assessed as high. Defenders must prioritize awareness, patching, and alternative secure wallet solutions to prevent further losses.
