PurpleBravo, a North Korean state-sponsored threat group, targets software developers through fake recruitment efforts, particularly in cryptocurrency and software development sectors. Their toolkit includes BeaverTail, PyLangGhost, and GolangGhost, designed for stealing browser credentials and cryptocurrency information. The group has affected 3,136 IP addresses, mainly in South Asia and North America, compromising 20 organizations across various industries. PurpleBravo's tactics include using fictitious personas, malicious GitHub repositories, and sophisticated malware to infiltrate IT services companies, posing a significant supply-chain risk. The group shows overlap with PurpleDelta, another North Korean threat actor, sharing infrastructure and operational patterns. PurpleBravo's focus on the IT sector in South Asia presents an overlooked threat to organizations outsourcing IT services.
MacSync is a sophisticated macOS infostealer that targets cryptocurrency users. It is delivered through a phishing lure disguised as a cloud storage installer, tricking users into executing a malicious Terminal command. The malware employs a multi-stage infection process, using a script-based approach to harvest browser credentials, cryptocurrency wallet data, and sensitive files. A key feature of MacSync is its ability to trojanize popular Electron-based cryptocurrency applications like Ledger and Trezor, enabling long-term phishing and data exfiltration. The malware's infrastructure includes multiple rotating C2 domains and clone sites, indicating an ongoing and evolving campaign. MacSync's focus on cryptocurrency-related data and its stealthy, script-based execution make it particularly dangerous for macOS users in the crypto community.
Threat actors may have wanted to take advantage of the holiday weekend in the United States to increase their chances of success. The post LastPass Users Targeted With Backup-Themed Phishing Emails appeared first on SecurityWeek .
The hackers trick victims into accessing GitHub or GitLab repositories that are opened using Visual Studio Code. The post North Korean Hackers Target macOS Developers via Malicious VS Code Projects appeared first on SecurityWeek .
North Korean threat actors have evolved their techniques in the Contagious Interview campaign, now abusing Microsoft Visual Studio Code task configuration files. The infection chain begins when a victim opens a malicious Git repository, often disguised as part of a recruitment process. If trust is granted, arbitrary commands are executed on the system. The malware uses JavaScript payloads hosted on vercel.app to implement backdoor logic, including remote code execution, system fingerprinting, and persistent command-and-control communication. The backdoor collects host information and beacons to a C2 server every five seconds. Recent observations show further execution of similar payloads, indicating ongoing development of these tactics.
By integrating identity threat detection with MFA, organizations can protect sensitive data, maintain operational continuity, and reduce risk exposure. The post Why Identity Security Must Move Beyond MFA appeared first on SecurityWeek .
API cybersecurity will be a ping pong ball, battered between the rackets of AI-assisted attackers and AI-assisted defenders. The post Cyber Insights 2026: API Security – Harder to Secure, Impossible to Ignore appeared first on SecurityWeek .
LockBit, originating as ABCD ransomware in 2019, has evolved to version 5.0 in September 2025. After a period of inactivity, it resumed operations in December 2025 with a reduced affiliate sign-up fee. LockBit 5.0, nicknamed ChoungDong, consists of a Loader and Ransomware component. The Loader decrypts and executes the payload in memory, while the Ransomware uses ChaCha20 and Curve25519 for encryption. This update significantly enhances evasion techniques and attack efficiency, introducing features like Mutex, Execution Delay, and Wiper. The group's history includes affiliation with the Maze cartel, independent operations, and continuous upgrades. Mitigation strategies involve monitoring process behavior, applying security patches, and preparing for swift responses using provided IoCs and MITRE ATT&CK techniques.
Visual Studio Code is a popular open-source code editor[1]. But it's much more than a simple editor, it's a complete development platform that supports many languages and it is available on multiple platforms. Used by developers worldwide, it's a juicy target for threat actors because it can be extended with extensions.
A 2025 study analyzing 6 billion stolen passwords reveals that user password behavior remains stagnant, with common weak passwords like '123456', 'admin', and 'password' dominating. This widespread use of easily guessable passwords continues to expose organizations to credential-based attacks. Although no specific software vulnerability is identified, the persistence of weak passwords significantly increases risks of unauthorized access and data breaches. European organizations remain vulnerable due to reliance on password authentication and insufficient enforcement of strong password policies. Mitigation requires enforcing multi-factor authentication, implementing password blacklists, and user education to reduce weak password usage. Countries with large digital economies and high internet penetration, such as Germany, the UK, France, and the Netherlands, are particularly at risk. Given the ease of exploitation and potential for broad impact, the threat severity is assessed as high. Defenders must prioritize strengthening authentication controls and monitoring for credential abuse to mitigate this ongoing risk.
CVE-2026-21926 is a high-severity vulnerability in Oracle Siebel CRM Deployment versions 17.0 through 25.2. It allows an unauthenticated attacker with network access via TLS to cause a denial of service (DoS) by triggering a hang or repeated crash of the Siebel CRM server infrastructure. The vulnerability does not impact confidentiality or integrity but severely affects availability. Exploitation requires no privileges or user interaction and can be performed remotely, making it easily exploitable. There are no known exploits in the wild yet, but the potential for disruption in business-critical CRM environments is significant. European organizations relying on Siebel CRM for customer management and operations could face service outages and operational disruptions. Mitigation should focus on applying vendor patches promptly once available, restricting network access to Siebel CRM servers, and monitoring for unusual traffic patterns. Countries with high adoption of Oracle Siebel CRM, such as the UK, Germany, France, and the Netherlands, are most at risk.
CVE-2026-21663 is a reflected Cross-Site Scripting (XSS) vulnerability in the banner-acl.php script of Revive Adserver version 6. An attacker can craft a malicious URL containing an HTML payload that executes when a logged-in administrator visits it, potentially compromising session integrity and enabling unauthorized actions. The vulnerability requires user interaction (administrator clicking the link) but does not require prior authentication to trigger the malicious payload. The CVSS score is 6.1 (medium severity), reflecting the moderate impact on confidentiality and integrity without affecting availability. No known exploits are currently reported in the wild. European organizations using Revive Adserver version 6 should prioritize patching or mitigating this vulnerability to prevent targeted attacks. Countries with high digital advertising activity and significant use of Revive Adserver, such as Germany, the UK, and France, are more likely to be affected. Mitigation includes restricting administrator access to trusted networks, implementing web application firewalls with XSS protections, and educating administrators about phishing risks.
A sophisticated multi-stage malware campaign targeting Windows users in Russia has been identified. The attack chain begins with social engineering lures and progresses to a full system compromise, including security bypass, surveillance, and ransomware delivery. It abuses Defendnot to disable Microsoft Defender and uses modular hosting across cloud services. The attack employs various techniques such as PowerShell scripts, obfuscated VBScript, and COM object manipulation. It deploys Amnesia RAT for data theft and surveillance, Hakuna Matata ransomware for file encryption, and a WinLocker component for system lockout. The campaign demonstrates how full system compromise can be achieved without exploiting software vulnerabilities, instead relying on social engineering and abuse of legitimate Windows features.
CVE-2025-33233 is a high-severity code injection vulnerability in NVIDIA Merlin Transformers4Rec affecting all versions prior to commit 27ddd49. It allows an attacker with local privileges and low complexity to execute arbitrary code without user interaction, potentially leading to privilege escalation, information disclosure, and data tampering. The vulnerability arises from improper control over code generation (CWE-94). Although no known exploits are currently in the wild, the impact on confidentiality, integrity, and availability is high. European organizations using Merlin Transformers4Rec in AI/ML recommendation systems should prioritize patching or mitigating this flaw. Countries with significant AI technology adoption and NVIDIA product usage, such as Germany, France, and the UK, are most at risk. Mitigation involves applying the fixed commit, restricting local access, and auditing code inputs. Given the CVSS 7.8 score, the threat is classified as high severity.
CVE-2025-54778 is a reflected cross-site scripting (XSS) vulnerability found in MedDream PACS Premium version 7.3.6.870, specifically in the existingUser functionality. This flaw allows an attacker to craft a malicious URL that, when visited by a user, executes arbitrary JavaScript code in the victim's browser. The vulnerability requires user interaction (clicking the malicious link) but does not require authentication, and it can lead to partial compromise of confidentiality and integrity of user sessions. Although no known exploits are currently reported in the wild, the medium severity CVSS score of 6.1 reflects the potential risk. European healthcare organizations using this PACS software should prioritize patching or applying mitigations to prevent exploitation. Countries with significant healthcare infrastructure and MedDream PACS deployments, such as Germany, France, and the UK, are likely to be most affected.
Providing cyberespionage and remote code execution capabilities, the malware is executed via DLL sideloading. The post APT-Grade PDFSider Malware Used by Ransomware Groups appeared first on SecurityWeek .
A simple payload allowed attackers to create a new event leaking summaries of the victim’s private meetings. The post Weaponized Invite Enabled Calendar Data Theft via Google Gemini appeared first on SecurityWeek .
