Law enforcement agencies dismantled a large-scale cryptocurrency scam valued at approximately EUR 700 million that leveraged deepfake technology to deceive victims. The scam involved the use of sophisticated deepfake videos or audio to impersonate trusted individuals or entities, facilitating phishing attacks that tricked victims into transferring cryptocurrency. Although no specific software vulnerabilities or affected product versions were identified, the threat highlights the growing use of AI-generated media in social engineering attacks. The scam's scale and use of advanced deception techniques pose significant risks to financial assets and organizational trust. European organizations, especially those involved in cryptocurrency trading, investment, or financial services, face increased exposure to such scams. Mitigation requires enhanced verification processes, employee training on deepfake recognition, and multi-factor authentication for transactions. Countries with high cryptocurrency adoption and financial hubs are more likely to be targeted. Given the complexity and financial impact, the threat severity is assessed as high despite the absence of direct software exploits.
The SimpleX Chat official X (formerly Twitter) account was compromised, leading to the promotion of a fake website designed to scam users by impersonating a crypto wallet service. This phishing campaign aims to deceive users into submitting sensitive information or cryptocurrency to attackers. Although no direct exploits or vulnerabilities in SimpleX Chat software are reported, the account hijacking facilitates social engineering attacks. European organizations and users involved in cryptocurrency or blockchain communities are at risk of financial loss and reputational damage. Mitigation requires vigilance against phishing, verification of official communication channels, and enhanced account security measures. Countries with significant crypto adoption and active social media usage are more likely to be targeted. Given the medium severity, the threat impacts confidentiality and financial integrity primarily, with moderate ease of exploitation due to account compromise. Defenders should prioritize monitoring social media accounts, educating users on phishing risks, and implementing multi-factor authentication (MFA) for social media management.
This report details an investigation into a North Korean infiltration operation by the Lazarus Group's Famous Chollima division. The operation aims to deploy remote IT workers in American financial and crypto/Web3 companies for corporate espionage and funding. Researchers posed as potential recruits and used sandboxed environments to monitor the operators' activities in real-time. The investigation revealed the group's tactics, including identity theft, social engineering, and the use of AI tools. The operators displayed poor operational security, sharing infrastructure and making repeated mistakes. The report provides insights into the group's recruitment methods, toolset, and communication patterns, offering a rare inside view of their operations.
We break down a new infostealer attack that combines the ClickFix technique with a shared chat containing malicious user guides on the official ChatGPT website.
The SmartApeSG campaign, also known as ZPHP or HANEYMANEY, has evolved from using fake browser update pages to employing ClickFix-style fake CAPTCHA pages. This campaign distributes malicious NetSupport RAT packages as its initial infection vector. The attack chain begins with an injected script on compromised websites, which, under certain conditions, displays a fake CAPTCHA page. When users interact with this page, malicious content is injected into the Windows clipboard, prompting users to paste and execute it. This leads to the download and installation of NetSupport RAT, which maintains persistence through a Start Menu shortcut. The campaign frequently changes domains, packages, and C2 servers to evade detection.
A security news report highlights the patching of firmware vulnerabilities in pulse oximeters, medical devices used to monitor blood oxygen levels. While no specific vulnerabilities or exploits are detailed, the discussion emphasizes the importance of firmware updates to address potential security risks. There are no known exploits in the wild, and the threat currently has minimal public discussion. The medium severity rating suggests moderate risk, likely due to the critical nature of medical devices and potential impacts on device integrity and patient safety. European healthcare providers using affected pulse oximeters should prioritize firmware updates once available. The threat is more relevant to countries with advanced healthcare infrastructure and significant use of such medical devices. Given the lack of detailed technical data and exploit evidence, the overall risk is assessed as medium. Defenders should monitor for official patches and verify device firmware integrity to mitigate potential risks.
Pharmaceutical company Inotiv has disclosed a data breach following a ransomware attack that compromised its systems. The attack involved malware that encrypted or otherwise disrupted access to critical data, leading to unauthorized data exposure. Although specific technical details and exploited vulnerabilities are not provided, the incident highlights the ongoing threat ransomware poses to sensitive sectors such as pharmaceuticals. The breach could impact confidentiality of proprietary research, patient data, and operational integrity. European organizations in the pharmaceutical and biotech sectors should be vigilant, as similar attacks could target them due to the high value of their data. Mitigation requires tailored ransomware defenses including network segmentation, robust backup strategies, and incident response readiness. Countries with significant pharmaceutical industries and research hubs, such as Germany, Switzerland, and the UK, are particularly at risk. Given the high impact on confidentiality and availability, ease of exploitation typical of ransomware, and no requirement for user interaction once inside, the severity is assessed as high. Defenders must prioritize detection, prevention, and rapid response to ransomware threats to protect critical healthcare and research infrastructure.
A North Korean state-sponsored hacker's device was found infected with the LummaC2 infostealer malware, linking it to the massive $1.4 billion breach of the ByBit cryptocurrency exchange. LummaC2 is an advanced infostealer capable of harvesting sensitive data such as credentials and cryptographic keys, facilitating large-scale cyber theft. This incident highlights the use of sophisticated malware by nation-state actors targeting cryptocurrency platforms. The breach underscores significant risks to financial institutions and digital asset custodians, especially those with exposure to cryptocurrency markets. European organizations involved in cryptocurrency trading, blockchain technology, or financial services could be targeted or impacted by similar tactics. Mitigation requires enhanced endpoint detection, network monitoring for C2 communications, and strict credential management. Countries with strong cryptocurrency markets and financial hubs, such as the UK, Germany, and the Netherlands, are most likely to be affected. Given the high financial impact, ease of exploitation via malware infection, and the involvement of a state actor, the threat severity is assessed as high. Defenders should prioritize detection of LummaC2 indicators and strengthen defenses around cryptocurrency-related infrastructure.
Hackers stole the names, addresses, Social Security numbers, and financial and medical information of 9,542 people. The post Inotiv Says Personal Information Stolen in Ransomware Attack appeared first on SecurityWeek .
The Marquis data breach has compromised sensitive information from over 74 US banks and credit unions, representing a significant security incident in the financial sector. Although the breach primarily affects US institutions, European organizations connected to these banks or using related services could face indirect risks such as fraud or phishing attacks leveraging stolen data. The breach's high severity is due to the potential exposure of confidential financial and personal data, which could lead to identity theft, financial fraud, and reputational damage. No known exploits are currently active in the wild, but the breach's scale and sensitivity warrant immediate attention. European financial institutions should review their exposure to affected US entities and enhance monitoring for suspicious activities. Mitigation should focus on strengthening inter-organizational data sharing security, improving anomaly detection, and educating customers about potential phishing attempts. Countries with strong financial ties to the US and significant banking sectors, such as the United Kingdom, Germany, France, and the Netherlands, are most likely to be impacted. Given the breach's scope, ease of exploitation (via data theft), and high impact on confidentiality and integrity, the suggested severity is high. Defenders must prioritize incident response, cross-border collaboration, and customer communication to mitigate downstream effects.
Albiriox is a newly discovered Android RAT malware offered as Malware-as-a-Service, primarily targeting financial and cryptocurrency applications globally. It uses a sophisticated two-stage deployment involving dropper apps and packing to evade detection. The malware enables remote control of infected devices via VNC-based access and overlay attacks, allowing real-time interaction and unauthorized operations such as screen manipulation and device takeover. It targets over 400 financial and crypto wallet apps, facilitating on-device fraud while remaining stealthy. The MaaS model and ongoing development indicate potential rapid spread among cybercriminals. Although no known exploits in the wild are reported yet, its advanced capabilities pose a significant threat to mobile users, especially in finance sectors. The malware is linked to Russian-speaking threat actors and uses multiple fake domains for distribution. European organizations with mobile banking and crypto wallet users are at risk, particularly in countries with high Android usage and financial sector prominence. Mitigation requires targeted detection of dropper apps, user education on app sources, and enhanced mobile endpoint protection. Given its impact on confidentiality, integrity, and availability with ease of exploitation and no user interaction needed post-installation, the threat severity is assessed as high.
We explain how vulnerabilities in DeckMate 2 shuffling machines allowed criminals to gain insights into opponents’ hands and win massive sums at poker.
By: Dikla Barda, Roman Zaikin, and Oded Vanunu On November 30, 2025, Check Point Research detected a critical exploit targeting Yearn Finance’s yETH pool on Ethereum. Within hours, approximately $9 million was stolen from the protocol. The attacker achieved this by minting an astronomical number of tokens—235 septillion yETH (a 41-digit number)—while depositing only 16 […] The post The $9M yETH Exploit: How 16 Wei Became Infinite Tokens appeared first on Check Point Research .
Cryptomixer was targeted by law enforcement in Operation Olympia for facilitating cybercrime and money laundering. The post $29 Million Worth of Bitcoin Seized in Cryptomixer Takedown appeared first on SecurityWeek .
An attacker employed an 'Evil Twin' Wi-Fi hotspot to intercept and steal data from passengers during a flight, resulting in a 7-year jail sentence. The attack involved setting up a rogue Wi-Fi access point mimicking the legitimate in-flight network to trick users into connecting. This type of attack can compromise confidentiality by capturing sensitive information transmitted over the network. Although no specific technical details or exploits are provided, the incident highlights the risks of unsecured or poorly secured public Wi-Fi environments, especially in constrained settings like airplanes. European organizations with employees who travel frequently or rely on public Wi-Fi should be aware of such threats. Mitigation requires strong user awareness, use of VPNs, and network authentication improvements. Countries with high volumes of international air travel and business connectivity are more likely to be affected. The threat is assessed as medium severity due to the need for user interaction and limited scope but significant confidentiality impact.
A malicious Chrome extension has been identified injecting hidden Solana blockchain transfer fees into Raydium decentralized exchange swaps. This covert manipulation results in users unknowingly paying extra fees during token swaps on Raydium, a popular Solana-based DeFi platform. The threat exploits users who interact with the Raydium interface via the compromised extension, altering transaction parameters without their consent. Although no known exploits in the wild have been reported yet, the high severity rating reflects the potential financial impact and trust erosion in DeFi tools. European organizations and individuals involved in cryptocurrency trading or DeFi activities on Solana are at risk of financial losses. Defenders should audit installed browser extensions, especially those related to cryptocurrency, and verify transaction details on-chain before approval. Countries with significant cryptocurrency adoption and active DeFi communities, such as Germany, the Netherlands, and the UK, are more likely to be affected. The threat is assessed as high severity due to direct financial impact, ease of exploitation through browser extension compromise, and lack of user awareness. Immediate mitigation involves removing suspicious extensions, using hardware wallets, and monitoring blockchain transactions for anomalies.
The founders of Samourai Wallet, a cryptocurrency wallet service, have been jailed in connection with a $237 million crypto laundering case. This incident highlights the risks associated with cryptocurrency platforms being exploited for illicit financial activities. While the case involves criminal prosecution rather than a direct technical vulnerability or exploit, it underscores the importance of regulatory compliance and monitoring in crypto services. European organizations involved in cryptocurrency transactions or wallet services could face increased scrutiny and regulatory pressure. The threat primarily affects the integrity and trustworthiness of crypto wallet providers rather than their technical security. Mitigation involves enhanced due diligence, compliance with anti-money laundering (AML) regulations, and monitoring for suspicious transactions. Countries with significant cryptocurrency adoption and regulatory frameworks, such as Germany, the UK, and the Netherlands, are more likely to be impacted. Given the nature of this threat as a criminal case rather than a technical exploit, the severity is assessed as medium. Defenders should focus on compliance, transaction monitoring, and risk management related to cryptocurrency services.
Hackers stole corporate data such as accounting records and legal agreements, but did not deploy file-encrypting ransomware. The post Major US Banks Impacted by SitusAMC Hack appeared first on SecurityWeek .
