There is a critical surge in AI-powered phishing campaigns, with a 300% year-over-year increase and a significant rise in attack sophistication. These campaigns leverage machine learning to analyze organizational communication patterns and employee behavior, generating highly personalized and contextually relevant phishing emails in real time. Traditional signature-based detection methods are largely ineffective against these dynamic, unique attack vectors. The FBI reports over 200 US organizations compromised within 30 days, and NIST predicts that by 2025, 90% of successful breaches will stem from AI-driven phishing. Although primarily targeting US infrastructure, European organizations are at risk due to the global nature of phishing and interconnected business relationships. Defenders must adopt advanced behavioral analytics, AI-driven detection, and comprehensive employee training to mitigate these threats effectively. Countries with significant digital infrastructure and high adoption of targeted sectors are most vulnerable. This threat is critical due to its high impact on confidentiality, integrity, and availability, ease of exploitation without user authentication, and broad attack surface.
This entry describes a security analysis of a medical device, focusing on the methods and findings of the assessment. The information is sourced from a Reddit NetSec post linking to an external site, cc-sw.com, which hosts the detailed analysis. No specific vulnerabilities, exploits, or affected device versions are detailed in the provided data. The severity is marked as medium, but no CVSS score is available. There are no known exploits in the wild, and the discussion level on Reddit is minimal. The content appears to be an informational security analysis rather than a direct report of an active threat or vulnerability. European organizations using similar medical devices could benefit from reviewing such analyses to understand potential risks. However, without concrete vulnerability details or exploit data, the immediate threat level remains uncertain. Mitigation would involve following best practices for medical device security and monitoring for updates from device manufacturers.
An Australian law firm detected anomalous behavior involving two employees accessing numerous sensitive files, which triggered alerts via User and Entity Behavior Analytics (UEBA). Investigation revealed signs of lateral movement and privilege escalation attempts, indicative of a potential ransomware attack. The firm successfully contained the threat before any encryption or data exfiltration occurred, demonstrating the effectiveness of behavioral analytics and least privilege enforcement. This case highlights the importance of monitoring deviations from normal access patterns to detect early stages of ransomware and insider threats. No actual breach or payload delivery took place. The threat underscores risks related to privilege escalation and lateral movement within hybrid environments. It serves as a practical example of proactive defense mechanisms preventing ransomware disasters. European organizations with similar environments and sensitive data face comparable risks. Early detection and strict access controls are critical to mitigating such threats.
Active Directory (AD) domain join accounts, commonly used during system build processes, are frequently exposed and inherit over-privileged access control lists (ACLs). These excessive permissions enable attackers to exploit Local Administrator Password Solution (LAPS) disclosures, Resource-Based Constrained Delegation (RBCD), and other high-impact attacks. Even with Microsoft's recommended mitigations, residual risks remain due to replication lag and Active Directory Certificate Services (AD CS) interactions that can allow recovery of pre-reset machine secrets. Hardening requires layered controls including restricting machine account creation to privileged users, ensuring Domain Admins own computer objects, and applying deny Access Control Entries (ACEs) for sensitive attributes like ms-Mcs-AdmPwd and msDS-AllowedToActOnBehalfOfOtherIdentity. The threat is high severity due to the potential for privilege escalation and lateral movement within AD environments. Detection and mitigation require careful monitoring and tailored ACL configurations. European organizations relying heavily on AD infrastructure are at risk, especially those with complex domain join automation and build pipelines. Countries with large enterprise sectors and advanced IT infrastructure such as Germany, France, the UK, and the Netherlands are likely most affected. The threat is rated high severity due to the broad impact on confidentiality, integrity, and availability, ease of exploitation via exposed accounts, and the critical role of AD in enterprise security.
A phishing campaign leverages Zoom's document sharing feature to establish initial trust with victims. The attack directs users through a fake bot protection page before presenting a Gmail-like login interface to harvest credentials. Entered credentials are transmitted to the attacker via WebSocket and validated on the backend. This technique exploits user trust in Zoom and mimics legitimate Gmail login to increase success rates. The campaign is currently observed with minimal discussion and no known widespread exploitation. It poses a medium risk due to credential compromise potential without requiring advanced exploitation or vulnerabilities. European organizations using Gmail and Zoom are at risk, especially those with remote workforces relying on these platforms. Attackers can gain unauthorized access to email accounts, leading to data breaches and further attacks. Mitigation requires user awareness, multi-factor authentication enforcement, and monitoring for suspicious login attempts. Countries with high Zoom and Gmail usage and significant remote work adoption are most likely affected.
A recently reported security threat involves the potential for attackers to take remote control over industrial generators. While detailed technical specifics are limited, the threat highlights vulnerabilities in the control systems of industrial generators that could be exploited remotely. This could allow adversaries to manipulate generator operations, potentially causing disruptions in power supply or damaging critical infrastructure. The threat is currently assessed as medium severity, with no known exploits in the wild and minimal public discussion. European organizations relying on industrial generators for critical power backup or infrastructure support could face operational risks if targeted. Mitigation requires focused security measures on industrial control systems, including network segmentation, strict access controls, and continuous monitoring for anomalous activity. Countries with significant industrial sectors and critical infrastructure dependent on such generators are more likely to be affected. Given the potential impact on availability and integrity of power systems, and the ease of remote exploitation, this threat is assessed as medium severity. Defenders should prioritize securing generator control interfaces and enhancing incident response capabilities.
The Salesloft-Drift breach is a high-severity security incident involving unauthorized access to data from two prominent SaaS providers. Although detailed technical specifics are limited, the breach is considered one of the largest SaaS breaches reported in 2025, highlighting significant risks to customer data and service integrity. The breach was initially discussed on Reddit's NetSec community with minimal details but has been flagged as highly newsworthy. No known exploits are currently active in the wild, and no patches or affected software versions have been disclosed. European organizations using Salesloft or Drift services may face data confidentiality and operational risks. Mitigation requires enhanced monitoring of SaaS integrations, strict access controls, and verification of data integrity. Countries with high SaaS adoption and strategic reliance on these platforms, such as the UK, Germany, France, and the Netherlands, are most likely to be impacted. Given the breach's scale and potential data exposure without requiring user interaction or authentication bypass, the severity is assessed as high. Defenders should prioritize incident response readiness and vendor communication to manage potential fallout.
CVE-2025-59489 is a medium-severity arbitrary code execution vulnerability found in the Unity Runtime environment. It allows attackers to execute arbitrary code, potentially compromising affected systems. The vulnerability was publicly disclosed on Reddit's NetSec community with minimal discussion and no known exploits in the wild. No specific affected Unity versions or patches have been identified yet. European organizations using Unity-based applications or development environments could face risks related to confidentiality, integrity, and availability if exploited. Mitigation should focus on monitoring official Unity advisories, restricting runtime permissions, and employing runtime application self-protection. Countries with strong gaming, simulation, and software development sectors, such as Germany, France, and the UK, are more likely to be impacted. Given the potential for arbitrary code execution without known exploitation or detailed technical data, the suggested severity is medium. Defenders should prioritize awareness, restrict exposure, and prepare for patch deployment once available.
AMI BMC vulns are on the CISA Known Exploited Vulnerabilities catalog now. I think this is the first BMC vuln to hit the KEV. Here are some Nuclei templates to detect this vuln in your BMCs.
Software Secured | Hacking Furbo 2: Mobile App and P2P Exploits | USA
Source: https://www.softwaresecured.com/post/hacking-furbo-a-hardware-research-project-part-2-mobile-and-p2p-exploits
When Audits Fail: Four Critical Pre-Auth Vulnerabilities in TRUfusion Enterprise
Source: https://www.rcesecurity.com/2025/09/when-audits-fail-four-critical-pre-auth-vulnerabilities-in-trufusion-enterprise/
Klopatra: exposing a new Android banking trojan operation with roots in Turkey | Cleafy LABS
Source: https://www.cleafy.com/cleafy-labs/klopatra-exposing-a-new-android-banking-trojan-operation-with-roots-in-turkey
FullHunt 💜 Open-Source: 39,408 Exploits from 0day.today is Back Online
Source: https://fullhunt.io/blog/2025/09/28/fullhunt-releases-0day-today-archive.html
So I was out bucket hunting looking for stupid stuff again and found this innocently (ghe-ghe) named bucket from the UK "National Chicken Squeezing Community" with a cat picture, a badly drawn paint pic and... This Oscar worthy masterful production.
Enjoy.
The Phantom Extension: Backdooring chrome through uncharted pathways
Source: https://www.synacktiv.com/en/publications/the-phantom-extension-backdooring-chrome-through-uncharted-pathways
