IDNs or “International Domain Names” have been with us for a while now (see RFC3490[1]). They are (ab)used in many attack scenarios because.. it works! Who can immediately spot the difference between:
VoidLink is an advanced AI-generated malware framework exhibiting high maturity, modularity, and sophisticated techniques such as eBPF and LKM rootkits. It targets cloud and container environments with dedicated modules for enumeration and post-exploitation, indicating a focus on modern infrastructure. Although no known exploits in the wild have been reported yet, its architecture suggests a significant threat potential. European organizations relying on cloud-native and containerized deployments are at heightened risk due to the malware's capabilities. Mitigation requires advanced detection mechanisms tailored to eBPF and kernel-level rootkits, alongside strict cloud environment monitoring and segmentation. Countries with strong cloud adoption and critical infrastructure sectors, such as Germany, the UK, France, and the Netherlands, are likely to be most affected. Given its high impact on confidentiality, integrity, and availability, combined with ease of exploitation via AI-generated code, the suggested severity is high. Defenders should prioritize proactive threat hunting and behavioral analytics to detect this evolving threat.
A sophisticated spear-phishing campaign targeting Argentina's judicial sector has been uncovered. The operation uses a multi-stage infection chain to deploy a stealthy Remote Access Trojan (RAT). Attackers exploit trust in court communications by using authentic-looking judicial decoy documents. The campaign employs a weaponized LNK file, a BAT-based loader script, and a covert Rust-based RAT to establish persistent access within judicial environments. The malware performs extensive anti-VM and anti-debug checks, collects system information, and establishes resilient C2 connections. It supports various malicious activities including persistence, file transfer, data harvesting, encryption, and privilege escalation. The campaign demonstrates high operational sophistication and aims to gain long-term access to sensitive legal and institutional data.
The Evelyn Stealer campaign targets software developers through weaponized Visual Studio Code extensions, employing a multistage delivery of information-stealing malware. The attack chain involves a downloader disguised as a legitimate Lightshot DLL, an injector that uses process hollowing to inject the final payload, and the Evelyn Stealer itself. The malware implements sophisticated anti-analysis techniques, collects sensitive information including browser credentials and cryptocurrency data, and exfiltrates the stolen data via FTP. This campaign highlights the increasing threat to developer communities and the need for enhanced security measures in development environments.
CVE-2025-66803 is a medium-severity race condition vulnerability in the turbo-frame element handler of Hotwired Turbo before version 8.0.x. This flaw causes logout operations to fail because delayed frame responses can reapply session cookies after a user logs out, potentially allowing session persistence. Remote attackers can exploit this by inducing selective network delays, while physically proximate attackers may exploit naturally occurring race conditions on shared computers. The vulnerability impacts confidentiality and integrity by enabling unauthorized session continuation but does not affect availability. No known exploits are currently reported in the wild. European organizations using Hotwired Turbo in web applications should prioritize patching and implement network controls to mitigate exploitation risks. Countries with significant web development sectors and high adoption of Hotwired Turbo, such as Germany, the UK, and France, are more likely to be affected.
CVE-2025-56353 is a high-severity vulnerability in tinyMQTT broker software caused by improper handling of malformed UTF-8 strings in topic filters. An attacker can exploit this by sending repeated subscription requests with invalid or oversized topic filters, causing the broker to allocate memory without freeing it, resulting in a memory leak. This unbounded heap growth can lead to denial of service (DoS) conditions under sustained attack. The vulnerability requires no authentication or user interaction and can be exploited remotely over the network. There are no known exploits in the wild yet, and no patches have been published at this time. The CVSS score of 7.5 reflects the high impact on availability with no impact on confidentiality or integrity. European organizations using tinyMQTT brokers in IoT or messaging infrastructures are at risk, especially those with exposed MQTT brokers. Mitigations include implementing input validation and rate limiting at the network perimeter, monitoring broker memory usage, and isolating MQTT services. Countries with significant IoT deployments and industrial automation sectors, such as Germany, France, and the UK, are most likely to be affected.
Operating as an access broker, the defendant sold unauthorized access to compromised networks to an undercover agent. The post Jordanian Admits in US Court to Selling Access to 50 Enterprise Networks appeared first on SecurityWeek .
The information stealer abuses legitimate APIs and libraries to exfiltrate data to Discord webhooks. The post ‘SolyxImmortal’ Information Stealer Emerges appeared first on SecurityWeek .
US officials told The New York Times that cyberattacks were used to turn off the lights in Caracas and disrupt air defense radars. The post New Reports Reinforce Cyberattack’s Role in Maduro Capture Blackout appeared first on SecurityWeek .
Posing as an ad blocker, the malicious extension crashes the browser to lure victims into installing malware. The post Malicious Chrome Extension Crashes Browser in ClickFix Variant ‘CrashFix’ appeared first on SecurityWeek .
The compromised personal information includes names, dates of birth, Social Security numbers, and employment-related data. The post 42,000 Impacted by Ingram Micro Ransomware Attack appeared first on SecurityWeek .
The Sysdig Threat Research Team analyzed VoidLink, a sophisticated Linux malware framework targeting cloud environments. Key findings include the first documented Serverside Rootkit Compilation, Chinese development with AI assistance, adaptive detection evasion, and use of the Zig programming language. VoidLink employs a multi-stage loader architecture, fileless execution techniques, and kernel-level stealth mechanisms. It features three control channels, including a covert ICMP channel, and specialized functionality for cloud and container environments. Despite its sophistication, VoidLink can be detected using runtime monitoring tools. The malware shows indicators of Chinese-speaking developers with significant kernel expertise, likely using AI-assisted development methods.
The KRVTZ IDS alerts from January 19, 2026, report low-severity reconnaissance and scanning activities targeting AjaxPro Remote Code Execution vulnerability (CVE-2021-23758) and IIS 8.3 web servers. These include brute force attempts, suspicious user-agent strings linked to InfoBot malware, and directory brute forcing. No active exploits or patches are currently associated with these alerts, but early-stage probing could lead to more serious attacks. European countries such as Germany, France, the UK, Netherlands, Italy, Spain, and Poland are highlighted as likely affected due to market presence. The overall threat severity is medium given the potential impact if exploitation occurs.
PDFSIDER is a newly identified malware variant that utilizes DLL side-loading to deploy a covert backdoor with encrypted command-and-control capabilities. It exploits vulnerabilities in legitimate software like PDF24 Creator to bypass endpoint detection mechanisms. The malware operates primarily in memory, minimizing disk artifacts, and employs advanced anti-VM technology to evade sandboxes and analysis labs. PDFSIDER features a robust cryptographic implementation using the Botan library for secure communications. It gathers system information and provides attackers with an interactive, hidden command shell for remote execution. The malware's characteristics align with APT tradecraft, suggesting its use in cyber-espionage operations. Distribution occurs through spear-phishing emails containing ZIP archives with legitimate-looking executables.
Operation Poseidon is a sophisticated spear-phishing campaign attributed to the Konni APT group. The attackers exploit Google Ads redirection mechanisms to bypass security filters and user awareness. They compromise poorly secured WordPress sites for malware distribution and C2 infrastructure. The campaign uses social engineering tactics, impersonating North Korean human rights organizations and financial institutions. Malware is delivered through LNK files disguised as PDF documents, executing AutoIt scripts that load EndRAT variants. The attackers employ advanced evasion techniques, including email content padding and abuse of legitimate advertising URLs. The campaign demonstrates evolving tactics and infrastructure reuse consistent with previous Konni activities.
