CVE-2025-14505 is a medium-severity vulnerability in the Elliptic package's ECDSA implementation, where an incorrect computation of the byte-length of the ephemeral value 'k' leads to truncation when 'k' has leading zeros. This flaw causes faulty digital signatures and breaks legitimate transactions or communications. More critically, attackers who obtain both a faulty signature and a correct signature for the same input under certain conditions may derive the secret private key, compromising cryptographic confidentiality. The vulnerability affects all Elliptic versions up to and including 6.6.1. Exploitation requires network access but no privileges or user interaction, and no known exploits are currently in the wild. European organizations relying on Elliptic for cryptographic operations, especially in financial or blockchain applications, face risks of transaction failures and potential key compromise. Mitigation involves updating to a patched Elliptic version once available, auditing signature generation for anomalies, and implementing additional cryptographic safeguards. Countries with significant blockchain, fintech, and cryptography-dependent sectors such as Germany, the UK, France, and the Netherlands are most likely to be impacted.
ASEC discovered Guloader malware being distributed through phishing emails masquerading as employee performance reports. The emails, claiming to be about October 2025 performance, contain a RAR file with an NSIS executable named 'staff record pdf.exe'. This file is actually Guloader malware, which downloads and executes shellcode from a Google Drive URL. The final payload is Remcos RAT, enabling threat actors to perform various malicious remote control activities, including keylogging, screenshot capture, webcam and microphone control, and browser data extraction. The attackers are increasingly using legitimate platforms as C2 servers, making detection more challenging. Users are advised to exercise caution when opening emails from unknown sources and to change passwords regularly to prevent secondary damage.
The Boto Cor-de-Rosa campaign reveals Astaroth's new strategy of exploiting WhatsApp Web for propagation. This Brazilian banking malware now uses a Python-based worm module to retrieve victims' WhatsApp contact lists and automatically send malicious messages, expanding its infection reach. The attack begins with a malicious ZIP file sent via WhatsApp, containing a Visual Basic script that downloads additional components. The malware then operates two parallel modules: a propagation module for spreading through WhatsApp contacts, and a banking module for credential stealing. This campaign demonstrates Astaroth's evolution, combining traditional malware techniques with sophisticated social engineering and multi-platform propagation, primarily targeting Brazilian users.
MuddyWater APT group has launched a spearphishing campaign targeting various sectors in the Middle East, including diplomatic, maritime, financial, and telecom entities. The campaign employs icon spoofing and malicious Word documents to deliver a Rust-based implant dubbed 'RustyWater'. This new tool represents a significant upgrade from their traditional PowerShell and VBS loaders, offering capabilities such as asynchronous C2, anti-analysis features, registry persistence, and modular post-compromise expansion. The attack chain involves a malicious email with an attached document that triggers a multi-stage process, ultimately leading to the deployment of the RustyWater implant. This evolution in MuddyWater's toolkit demonstrates their adaptation to more sophisticated, structured, and stealthy attack methods.
This analysis examines a sophisticated malware delivery chain that begins with a phishing email impersonating DocuSign. The attack employs multiple evasion techniques, including an access-code gate, time-based checks, and packing. The initial payload is a single-file .NET bundle with a valid code signing certificate. Static analysis revealed a second-stage native binary with additional obfuscation. The final payload is identified as Vidar malware. The investigation showcases the effectiveness of combining static and dynamic analysis tools to overcome advanced evasion tactics and reconstruct the full attack chain, from the initial phishing email to the final payload.
When software can think and act on its own, security strategies must shift from static policy enforcement to real-time behavioral governance. The post Rethinking Security for Agentic AI appeared first on SecurityWeek .
CISA advisory warns that unauthenticated Bluetooth access in WHILL devices allows for unauthorized movement. The post Researchers Expose WHILL Wheelchair Safety Risks via Remote Hacking appeared first on SecurityWeek .
Three malicious npm packages were discovered in November 2025, designed to deliver and install a new RAT malware family named NodeCordRAT. The packages, bitcoin-main-lib, bitcoin-lib-js, and bip40, mimicked legitimate Bitcoin-related libraries to deceive developers. NodeCordRAT uses Discord for command-and-control communication, targets Chrome credentials, sensitive secrets, and MetaMask data. It performs host fingerprinting, executes shell commands, captures screenshots, and exfiltrates data. The malware exploits software supply chain vulnerabilities, highlighting the importance of vigilance in package management. Although removed from npm, the incident serves as a reminder of ongoing threats in the software development ecosystem.
Between February and September 2025, BlueDelta, a Russian state-sponsored threat group linked to the GRU, conducted multiple credential-harvesting campaigns. The group targeted individuals associated with energy research, defense cooperation, and government communication networks in Turkey, Europe, North Macedonia, and Uzbekistan. BlueDelta impersonated legitimate webmail and VPN services, using free hosting and tunneling services to host phishing content and capture user data. The campaigns incorporated PDF lures and customized JavaScript to increase authenticity and operational efficiency. This activity demonstrates BlueDelta's continued focus on low-cost, high-yield methods for collecting information supporting Russian intelligence objectives.
A malicious WordPress plugin named 'Modern Recent Posts' has been discovered, targeting administrators with fake browser update pop-ups. The plugin injects malicious JavaScript from an external domain, only affecting logged-in administrators on Windows machines. The campaign uses social engineering tactics to trick users into downloading potential malware. The plugin includes persistence mechanisms and can self-update. This sophisticated attack demonstrates a focused approach on high-value targets, leveraging trust in security updates to compromise local machines. The malware's stealthy nature and targeted delivery system make it particularly dangerous for WordPress site owners.
I&#;x26;#;39;m always looking for new ways of manipulating the data captured by my DShield sensor [1]. This time I used Gephi [2] and Graphiz [3] a popular and powerful tool for visualizing and exploring relationships between nodes, to examine the relationship between the source IP, filename and which sensor got a copy of the file. I queried the past 30 days of data stored in my ELK [4] database in Kibana using ES|QL [5][6] to query and export the data and import the result into Gephi. 
CVE-2025-61546 is a critical vulnerability in edu Business Solutions Print Shop Pro WebDesk version 18.34 that allows remote attackers to manipulate financial transactions by submitting negative quantities when purchasing items. This flaw exists because the application relies solely on client-side input validation, which can be bypassed, enabling attackers to create financial discrepancies. The vulnerability is exploitable without authentication or user interaction, with a CVSS score of 9.1 indicating high impact on confidentiality and integrity. It was fixed in version 19.69. European organizations using affected versions risk financial fraud and data integrity issues. Mitigation requires upgrading to the patched version and implementing robust server-side input validation. Countries with significant adoption of edu Business Solutions products and strong print service sectors, such as Germany, France, and the UK, are most likely to be impacted.
CVE-2026-0669 is a high-severity path traversal vulnerability in the CSS extension of Wikimedia Foundation's MediaWiki versions 1.39, 1.43, and 1.44. This flaw allows an unauthenticated remote attacker to read arbitrary files on the server by manipulating file path inputs, bypassing directory restrictions. The vulnerability impacts confidentiality but does not affect integrity or availability. No user interaction or privileges are required for exploitation, and no known exploits are currently reported in the wild. European organizations using affected MediaWiki versions, especially those hosting sensitive or proprietary information, face significant data exposure risks. Mitigation requires promptly updating to patched versions once available or applying strict input validation and access controls on the CSS extension. Countries with high MediaWiki adoption in government, education, and public sectors—such as Germany, France, the UK, and the Netherlands—are most at risk.
CVE-2026-0668 is a medium-severity vulnerability in the Wikimedia Foundation's MediaWiki VisualData Extension version 1.45. It involves inefficient regular expression complexity, leading to a potential Regular Expression Denial of Service (ReDoS) attack. This vulnerability can be exploited remotely without authentication or user interaction, causing service disruption by exhausting server resources. No known exploits are currently reported in the wild. The impact is limited to availability, with no confidentiality or integrity compromise. European organizations running affected MediaWiki versions with the VisualData extension are at risk of service degradation or downtime. Mitigation requires patching or applying workarounds to limit or optimize regex processing. Countries with significant Wikimedia usage and MediaWiki deployments, such as Germany, France, and the UK, are most likely affected. The vulnerability's CVSS score is 5.
Impersonating a legitimate extension from AITOPIA, the two malicious extensions were also exfiltrating users’ browser activity. The post Chrome Extensions With 900,000 Downloads Caught Stealing AI Chats appeared first on SecurityWeek .
Key takeaways Introduction GoBruteforcer is a botnet that turns compromised Linux servers into scanning and password brute-force nodes. It targets internet-exposed services such as phpMyAdmin web panels, MySQL and PostgreSQL databases, and FTP servers. Infected hosts are incorporated into the botnet and accept remote operator commands.  Newly discovered weak credentials are used to steal data, […] The post Inside GoBruteforcer: AI-Generated Server Defaults, Weak Passwords, and Crypto-Focused Campaigns appeared first on Check Point Research .
The critical-severity vulnerability allows unauthenticated, remote attackers to execute arbitrary shell commands. The post Hackers Exploit Zero-Day in Discontinued D-Link Devices appeared first on SecurityWeek .
Threat actors are leveraging complex routing scenarios and misconfigured spoof protections to send phishing emails that appear to be internal communications. These attacks, which have increased since May 2025, use various lures like voicemails, shared documents, and password resets to conduct credential phishing and financial scams. The campaigns, often using PhaaS platforms like Tycoon2FA, are opportunistic and target multiple industries. While Microsoft detects most attempts, organizations can further mitigate risks by properly configuring spoof protections and third-party connectors. The attacks do not affect customers whose Microsoft Exchange MX records point to Office 365, as they are protected by built-in spoofing detections.
Threat actors spoof legitimate domains to make their phishing emails appear to have been sent internally. The post Complex Routing, Misconfigurations Exploited for Domain Spoofing in Phishing Attacks appeared first on SecurityWeek .
