Threats tagged 'infosecnews'

A security flaw in Comet Browser allows a hidden API to execute commands on users' devices without their knowledge. This vulnerability could enable attackers to run arbitrary commands remotely, potentially compromising device confidentiality, integrity, and availability. Although no known exploits are currently in the wild, the flaw poses a medium-level risk due to its ability to bypass user interaction and authentication. European organizations using Comet Browser or related software may be at risk, especially if the browser has significant market penetration in their sectors. Mitigation requires immediate vendor patching once available, disabling or restricting the hidden API, and monitoring for unusual command execution behavior. Countries with higher usage of Comet Browser and strategic digital infrastructure are more likely to be targeted. Given the medium severity, organizations should prioritize detection and containment measures while awaiting official fixes.

News#infosecnews#redditGermany+6

Eternidade Stealer is a banking Trojan distributed via WhatsApp hijacking and social engineering. It uses a Python-based WhatsApp worm to propagate malicious attachments and an MSI installer that deploys a Delphi-based banking Trojan. The campaign aims to steal banking credentials and conduct fraud. Exploitation does not require prior authentication but relies on user interaction to open malicious attachments. The malware targets Windows systems through MSI installers. The medium severity rating reflects moderate impact and exploitation complexity. European organizations with significant WhatsApp usage and Windows environments are at risk, especially financial institutions. Mitigations include user awareness training, restricting MSI execution, and monitoring WhatsApp traffic for suspicious activity. Countries with high WhatsApp penetration and financial sector importance, such as Germany, France, Italy, Spain, and the UK, are most likely affected. The threat poses a medium risk due to its reliance on social engineering and targeted banking fraud objectives.

Malware#infosecnews#redditGermany+6

TamperedChef is a malware campaign spreading globally through fake software installers. The malware masquerades as legitimate software to trick users into installation, enabling attackers to compromise systems. Although no specific affected software versions are identified, the campaign is ongoing and considered high severity. There are no known exploits in the wild beyond the fake installers. The malware poses significant risks to confidentiality, integrity, and availability by potentially allowing unauthorized access and control over infected systems. European organizations are at risk, especially those with high software usage and less stringent software verification processes. Mitigation requires strict software installation policies, user education on verifying software sources, and enhanced endpoint detection capabilities. Countries with large IT sectors and high software adoption, such as Germany, France, and the UK, are more likely to be targeted. Given the ease of exploitation through social engineering and the broad impact scope, the threat severity is assessed as high. Defenders should prioritize detection of suspicious installers and enforce application whitelisting to reduce infection risk.

Malware#infosecnews#redditGermany+5

Iran-linked hackers conducted reconnaissance by mapping ship Automatic Identification System (AIS) data days before an attempted missile strike, indicating coordinated cyber-physical threat activity. This mapping effort likely aimed to identify maritime targets and optimize attack timing and precision. The threat highlights the use of cyber intelligence gathering to support kinetic military operations, increasing risks to maritime assets. European organizations involved in shipping, port operations, and maritime security could face elevated risks due to potential targeting or collateral damage. The threat requires enhanced monitoring of AIS data integrity and maritime situational awareness. Mitigation should include anomaly detection on AIS feeds, collaboration with maritime authorities, and hardened cyber defenses for critical maritime infrastructure. Countries with significant maritime trade and naval presence, such as the UK, Netherlands, Germany, and Italy, are particularly at risk. Given the high impact on availability and integrity of maritime operations and the ease of exploitation through publicly accessible AIS data, this threat is assessed as high severity. Defenders must prioritize integrating cyber and physical security intelligence to anticipate and respond to such hybrid threats.

News#infosecnews#redditNetherlands+7

The Sneaky2FA phishing-as-a-service (PhaaS) kit has integrated the Browser-in-the-Browser (BitB) attack technique, enhancing its ability to bypass two-factor authentication protections by mimicking legitimate browser pop-ups. This attack creates convincing fake login dialogs within a browser window, deceiving users into entering credentials and 2FA codes. The campaign is considered high severity due to its potential to compromise multi-factor authentication, a critical security layer. European organizations relying on 2FA for sensitive systems are at increased risk, especially those in finance, government, and critical infrastructure sectors. Mitigations include user training to recognize BitB attacks, deploying advanced anti-phishing tools that detect UI spoofing, and adopting hardware-based or phishing-resistant authentication methods. Countries with high adoption of 2FA and significant financial or governmental digital infrastructure, such as Germany, France, the UK, and the Netherlands, are most likely to be targeted. The threat does not require software vulnerabilities but exploits user trust and UI deception, making it relatively easy to execute. Defenders must prioritize awareness and technical controls to mitigate this evolving phishing technique.

Campaign#infosecnews#redditGermany+7

The UK government has exposed a bulletproof hosting operator that is linked to major ransomware groups including BlackBasta, Evil Corp, and LockBit. Bulletproof hosting providers offer cybercriminals resilient infrastructure to host malicious operations with minimal risk of takedown. This exposure highlights the ongoing support infrastructure enabling ransomware campaigns that target organizations globally. While no direct exploit or vulnerability is reported, the takedown or exposure of such hosting services can disrupt ransomware operations. European organizations remain at risk due to the widespread targeting by these ransomware groups. The threat is medium severity given the indirect nature of the exposure and absence of direct exploitation details. Defenders should monitor for ransomware activity linked to these groups and collaborate with law enforcement to mitigate infrastructure abuse. Countries with high ransomware targeting history and significant digital infrastructure are most likely affected.

Malware#infosecnews#redditGermany+7

A Python-based worm propagates through WhatsApp, spreading the Eternidade stealer malware primarily targeting Brazilian devices. This malware harvests sensitive information from infected systems, leveraging social engineering via WhatsApp to self-replicate and infect new victims. Although currently focused on Brazil, the worm's propagation method and malware payload pose risks to any WhatsApp users, including European organizations with employees or contacts linked to Brazil. The worm does not require complex exploits but relies on user interaction to propagate. There is no known CVSS score, but the threat is assessed as high severity due to its potential impact on confidentiality and ease of spread. Defenders should focus on user awareness, endpoint detection, and network monitoring to mitigate infection risks. Countries with strong economic or cultural ties to Brazil and high WhatsApp usage are more likely to be affected in Europe.

Malware#infosecnews#redditPortugal+6

A high-severity remote code execution (RCE) vulnerability identified as CVE-2025-11001 affects 7-Zip, leveraging symbolic link (symlink) handling flaws. Attackers can exploit this vulnerability to execute arbitrary code on affected systems by crafting malicious archives that abuse symlink processing during extraction. Although no known exploits are currently observed in the wild, active exploitation attempts have been reported, indicating an urgent threat. The vulnerability impacts users of 7-Zip, a widely used open-source file archiver, particularly on Windows platforms. European organizations relying on 7-Zip for file compression and decompression are at risk of compromise, potentially leading to data breaches, system takeover, and lateral movement within networks. Mitigation requires immediate patching once updates are available, restricting archive extraction privileges, and monitoring for suspicious archive handling activities. Countries with high adoption of 7-Zip in enterprise environments and critical infrastructure sectors, such as Germany, France, and the UK, are most likely to be targeted. Given the ease of exploitation without authentication and the potential for full system compromise, this vulnerability is assessed as critical. Defenders must prioritize awareness, implement compensating controls, and prepare for incident response related to this threat.

EPSS 27%Vulnerability#infosecnews#redditGermany+2

A significant vulnerability in WhatsApp has been reported that potentially exposes the phone numbers of over 3.5 billion users worldwide. This flaw allows unauthorized parties to access user phone numbers, risking privacy breaches and enabling further targeted attacks such as phishing or social engineering. Although no known exploits are currently active in the wild, the scale of affected users and the sensitivity of the leaked data make this a high-priority concern. The vulnerability does not specify affected versions or available patches yet, indicating the need for urgent investigation and mitigation. European organizations relying on WhatsApp for communication could face increased risks of data leakage and targeted attacks. Countries with high WhatsApp penetration and critical infrastructure communications are particularly vulnerable. Immediate mitigation should include monitoring for suspicious activity, limiting WhatsApp data exposure, and preparing for rapid patch deployment once available. The threat is assessed as high severity due to the vast scope, ease of exploitation, and impact on confidentiality without requiring user interaction or authentication.

A hacker is reportedly selling healthcare data allegedly stolen from Samsung Medison via a third-party breach. The breach involves sensitive healthcare information, raising significant confidentiality concerns. The data theft originates not from Samsung Medison directly but through a compromised third-party vendor, complicating attribution and response. No specific affected software versions or exploits are identified, and there is minimal public discussion or technical detail available. The breach is considered high severity due to the sensitivity of healthcare data and potential privacy violations. European healthcare organizations could face indirect risks if they use Samsung Medison products or share data with affected third parties. Mitigation requires enhanced third-party risk management, monitoring for data leaks, and incident response readiness. Countries with strong healthcare sectors and significant Samsung Medison market presence, such as Germany, France, and the UK, are most likely to be impacted. Given the nature of the breach, the severity is assessed as high due to the impact on confidentiality and potential regulatory consequences. Defenders should prioritize verifying third-party security, monitoring dark web marketplaces, and preparing for potential regulatory inquiries.

Breach#infosecnews#redditGermany+6

A California man has admitted to laundering cryptocurrency stolen in a $230 million heist. The incident involves the movement and concealment of illegally obtained crypto assets, highlighting ongoing risks related to cryptocurrency theft and money laundering. While the event is significant, it does not describe a new technical vulnerability or exploit but rather a criminal activity involving cybercrime. European organizations may face indirect impacts due to the global nature of cryptocurrency markets and potential regulatory scrutiny. The threat underscores the importance of robust anti-money laundering (AML) controls and monitoring of crypto transactions. No specific technical exploit or vulnerability is detailed, and no direct attack vector against European systems is indicated. The severity is assessed as high due to the large financial scale and implications for financial crime. Countries with significant cryptocurrency adoption and financial sectors, such as Germany, the UK, and the Netherlands, may be more affected by related regulatory and enforcement actions. Practical mitigation includes enhanced transaction monitoring, cooperation with law enforcement, and improved compliance with AML regulations. This event serves as a reminder of the evolving threat landscape around cryptocurrency crime rather than a direct technical threat to IT infrastructure.

News#infosecnews#redditGermany+4

Fortinet has addressed two critical zero-day vulnerabilities in its FortiWeb product, a web application firewall widely used to protect web applications from attacks. These vulnerabilities are classified as critical due to their potential to allow attackers to compromise the confidentiality, integrity, and availability of affected systems. Although no known exploits are currently observed in the wild, the zero-day nature and critical severity indicate a high risk if left unpatched. European organizations using FortiWeb should prioritize applying patches and reviewing their web application firewall configurations to mitigate potential exploitation. The threat is particularly relevant for countries with significant Fortinet customer bases and critical infrastructure relying on FortiWeb for web security. Given the critical severity and zero-day status, immediate attention and proactive defense measures are essential to reduce exposure. The lack of detailed technical information limits deeper analysis, but the urgency is underscored by Fortinet's prompt patch release. Organizations should also monitor threat intelligence sources for emerging exploit activity and update incident response plans accordingly.

The Cline Bot AI Agent, a coding assistant tool, has been identified with vulnerabilities that could lead to unauthorized data theft and remote code execution. These flaws potentially allow attackers to access sensitive information processed by the bot and execute arbitrary code within the environment where the bot operates. Although no known exploits are currently active in the wild, the medium severity rating indicates a tangible risk that requires attention. The threat primarily concerns organizations using this AI coding assistant, especially those handling confidential or proprietary code. Mitigation involves restricting the bot's access to sensitive data, applying strict input validation, and monitoring for unusual activity. European organizations relying on AI coding tools should prioritize evaluating their exposure to this vulnerability. Countries with significant tech sectors and AI adoption, such as Germany, France, and the UK, are more likely to be impacted. Given the potential for data compromise and code execution without requiring user interaction, the threat severity is assessed as high. Immediate security reviews and hardening of AI agent deployments are recommended to prevent exploitation.

Vulnerability#infosecnews#redditGermany+2

Eurofiber, a European telecommunications infrastructure provider, confirmed a cyberattack on November 13 involving unauthorized access, data theft, and an extortion attempt. The breach was publicly disclosed via a security news source and Reddit InfoSec community, highlighting the incident's recent and newsworthy nature. Although specific technical details about the attack vector or exploited vulnerabilities are not provided, the incident involves data exfiltration and extortion, indicating a ransomware or data leak scenario. No known exploits or patches are currently reported. The attack poses significant risks to confidentiality and potentially availability of Eurofiber's services. European organizations relying on Eurofiber's infrastructure could face service disruptions or data exposure. Mitigation requires enhanced monitoring, incident response readiness, and verification of supply chain security. Countries with high Eurofiber market presence and critical infrastructure dependency, such as the Netherlands, Belgium, and Germany, are most at risk. Given the high impact on confidentiality and extortion elements, the threat severity is assessed as high. Defenders should prioritize containment, forensic analysis, and communication strategies to mitigate reputational and operational damage.

Breach#infosecnews#redditNetherlands+4

EdgeStepper is a sophisticated malware implant that manipulates DNS queries to hijack software update mechanisms, enabling the deployment of malicious payloads. By rerouting DNS requests, it intercepts and redirects legitimate update traffic to attacker-controlled servers, facilitating stealthy malware distribution. This technique undermines software supply chain integrity and can lead to widespread compromise of affected systems. The threat is classified as high severity due to its potential to impact confidentiality, integrity, and availability without requiring user interaction or authentication. European organizations relying on vulnerable software update infrastructures are at risk, especially those in critical sectors. Mitigation requires enhanced DNS monitoring, validation of update sources, and network segmentation to detect and block anomalous DNS behavior. Countries with significant technology sectors and critical infrastructure, such as Germany, France, and the UK, are likely to be most affected. Given the complexity and stealth of the attack vector, this threat demands urgent attention and tailored defensive measures.

Malware#infosecnews#redditGermany+6

The PlushDaemon threat group has been reported to hijack software updates as part of supply-chain attacks, compromising the integrity of software distribution mechanisms. This attack vector allows adversaries to inject malicious code into legitimate software updates, potentially affecting a wide range of organizations relying on the targeted software. While specific affected software versions and exploits in the wild have not been detailed, the high severity rating indicates significant risk. European organizations could face data breaches, operational disruptions, and reputational damage if targeted. Mitigation requires rigorous supply-chain security practices, including verifying update authenticity and monitoring for anomalous update behavior. Countries with strong software development sectors and critical infrastructure relying on third-party software are at higher risk. Given the attack complexity and potential widespread impact, the threat is assessed as high severity. Defenders should prioritize supply-chain security controls and incident readiness to mitigate this evolving threat.

News#infosecnews#redditGermany+7

The China-linked cyber operation named “WrtHug” has been identified hijacking thousands of ASUS routers globally. This campaign involves compromising vulnerable ASUS routers to gain unauthorized control, potentially enabling data interception, network manipulation, and further lateral attacks. The threat is considered high severity due to the scale of affected devices and the critical role routers play in network infrastructure. European organizations using ASUS routers are at risk of exposure to espionage, data breaches, and service disruption. Mitigation requires immediate firmware updates, network segmentation, and enhanced monitoring for unusual router behavior. Countries with high ASUS router market penetration and strategic geopolitical interest in China are more likely to be targeted. Given the lack of a CVSS score, the threat is assessed as high severity due to the broad impact on confidentiality, integrity, and availability, ease of exploitation, and no requirement for user interaction. Defenders should prioritize identifying vulnerable routers, applying patches, and implementing network defenses to mitigate this campaign’s impact.

Campaign#infosecnews#redditGermany+9

ShadowRay attacks target Ray clusters by compromising them to deploy unauthorized cryptocurrency mining operations. These attacks exploit vulnerabilities or misconfigurations in Ray cluster environments, converting legitimate compute resources into crypto miners, which leads to resource exhaustion and degraded performance. The threat is recent and has been reported by credible sources but currently lacks known exploits in the wild. European organizations using Ray clusters for distributed computing or AI workloads are at risk of operational disruption and increased costs due to unauthorized resource usage. Mitigation requires securing cluster access, monitoring for anomalous mining activity, and applying strict resource usage policies. Countries with significant cloud and AI infrastructure adoption, such as Germany, France, and the UK, are more likely to be impacted. Given the high impact on availability and resource integrity, ease of exploitation through misconfiguration, and no need for user interaction, the threat severity is assessed as high. Defenders should prioritize immediate cluster security audits and implement continuous monitoring to detect and prevent such crypto-mining compromises.

News#infosecnews#redditGermany+4

The Akira ransomware attack exploited a fake CAPTCHA to maintain a 42-day compromise within a victim's environment. This social engineering tactic led to prolonged unauthorized access, enabling the attackers to deploy ransomware and potentially exfiltrate data. The attack highlights the use of deceptive user interaction elements to bypass defenses and gain persistence. Although no known exploits or patches are currently associated, the threat demonstrates a medium severity due to its extended dwell time and ransomware impact. European organizations, especially those with high reliance on user-facing web services, are at risk of similar social engineering-based ransomware attacks. Mitigation requires enhanced user awareness, robust endpoint detection, and network segmentation to limit lateral movement. Countries with significant digital infrastructure and critical industries, such as Germany, France, and the UK, are more likely to be targeted. Given the attack's complexity and impact, the suggested severity is medium. Defenders should focus on detecting social engineering attempts, monitoring unusual user activity, and implementing multi-layered security controls to reduce exposure.

Malware#infosecnews#redditGermany+5

The Tuoni Command and Control (C2) infrastructure was involved in a high-priority attempted cyber intrusion targeting the real-estate sector in 2025. While detailed technical indicators and affected software versions are not disclosed, the threat is characterized as a botnet operation with a high severity rating. The attack appears to be focused on leveraging Tuoni C2 to orchestrate malicious activities within real-estate organizations, potentially aiming at data exfiltration, disruption, or espionage. No known exploits in the wild have been reported yet, and the discussion around this threat remains minimal. European real-estate firms, especially in countries with significant property markets and digital infrastructure, could be at risk. Mitigation requires enhanced network monitoring for botnet-related traffic, strict segmentation of critical systems, and proactive threat hunting for Tuoni C2 indicators. Countries like the UK, Germany, France, and the Netherlands are likely to be most affected due to their large real-estate markets and historical targeting patterns. Given the high potential impact on confidentiality and availability, ease of botnet deployment, and lack of authentication barriers, the threat severity is assessed as high.

Botnet#infosecnews#redditGermany+5