Operation PCPcat is a large-scale credential theft campaign that compromised approximately 59,000 Next.js servers within 48 hours by exploiting two remote code execution vulnerabilities (CVE-2025-29927 and CVE-2025-66478). Attackers extracted sensitive files such as . env files, SSH keys, and cloud credentials, installed persistent backdoors, and operated a publicly exposed command and control infrastructure. The campaign involves exploitation, data exfiltration, and backdoor installation. Organizations running Next.js in production are advised to patch vulnerable systems immediately and rotate all potentially compromised credentials. The threat is assessed as medium severity with potentially widespread impact due to the scale and sensitivity of data targeted. European organizations using Next.js may be particularly at risk.
Offline Decryption Messaging is a proposed security model designed to protect communications even when online devices are compromised by spyware. It uses two devices per user: an online device for transmitting encrypted messages and an air-gapped offline device for writing, encrypting, decrypting, and displaying messages. This separation ensures that spyware on the online device cannot access plaintext messages or cryptographic keys, while spyware on the offline device cannot exfiltrate data due to lack of network connectivity. The concept aims to address the limitations of traditional end-to-end encrypted messengers like Signal, which become ineffective if the device itself is compromised. The project, called HelioSphere, is in early prototype stages and seeks community feedback on security, usability, and cryptographic improvements. While promising for high-risk users such as activists, the approach introduces operational complexity and usability challenges. No known exploits exist yet, and the threat is currently a conceptual proposal rather than an active attack vector. The suggested severity is medium due to the potential to mitigate spyware risks but also the practical challenges in deployment.
JS#SMUGGLER is a threat actor or campaign leveraging compromised legitimate websites to deliver the NetSupport Remote Access Trojan (RAT). The attack involves injecting malicious JavaScript payloads into trusted sites, which then silently deploy NetSupport RAT onto victims' systems. This RAT enables attackers to gain persistent remote access, potentially leading to data theft, espionage, or further network compromise. The threat is considered high severity due to the use of trusted sites for delivery, the capabilities of NetSupport RAT, and the stealthy infection vector. European organizations relying on web traffic from compromised sites are at risk, especially those with remote workforce or critical infrastructure. Mitigation requires proactive monitoring of web assets, enhanced endpoint detection, and network segmentation to limit RAT impact. Countries with high internet usage, significant remote workforces, and strategic industries are more likely targets. Given the ease of exploitation via compromised sites and the high impact on confidentiality and integrity, the threat is assessed as high severity. Defenders should prioritize detection of unusual RAT activity and patch any web application vulnerabilities that could lead to site compromise.
A recent security incident dubbed 'Shai1-Hulud, The Second Coming' involves the compromise of hundreds of NPM packages, as reported on Reddit's NetSec community and linked to an external source. This breach potentially allows attackers to distribute malicious code through widely used JavaScript packages, impacting software supply chains. Although no known exploits are currently active in the wild, the compromise poses significant risks to confidentiality, integrity, and availability of systems relying on these packages. European organizations using affected NPM packages in their development or production environments could face supply chain attacks, data breaches, or service disruptions. Mitigation requires immediate auditing of dependencies, implementation of strict package integrity verification, and enhanced monitoring of software supply chains. Countries with strong software development sectors and high adoption of JavaScript technologies, such as Germany, the United Kingdom, France, and the Netherlands, are most likely to be affected. Given the broad impact and ease of exploitation through dependency management, the suggested severity is high. Defenders should prioritize verifying package authenticity, updating dependencies from trusted sources, and employing runtime protections to detect anomalous behavior from compromised packages.
RondoDox v2 is a significantly evolved botnet variant that has expanded its exploit capabilities by 650%, now leveraging over 75 CVEs across 16 different architectures. Originally targeting DVRs and routers, it has broadened its scope to include enterprise systems, indicating a shift towards more valuable targets. The botnet employs new command and control (C&C) infrastructure hosted on compromised residential IP addresses, complicating detection and takedown efforts. Although no known exploits are currently observed in the wild, the botnet's increased sophistication and scale pose a high risk. The threat actor is identifiable by an open signature email, and detailed technical analysis including dropper behavior, binary decoding, and detection rules are available. European organizations face heightened risk due to the targeting of enterprise systems and the widespread use of vulnerable devices. Mitigation requires targeted patch management, network segmentation, deployment of YARA and IDS/IPS rules, and enhanced monitoring of residential IP traffic. Countries with large enterprise sectors and significant IoT device usage, such as Germany, France, Italy, and the UK, are most likely to be affected. Given the high impact on confidentiality, integrity, and availability, ease of exploitation, and broad scope, this threat is assessed as high severity.
RondoDox v2 is an advanced IoT botnet that has significantly expanded its attack surface, now supporting over 15 exploitation vectors and targeting enterprise environments beyond consumer devices. It supports 16 different CPU architectures and uses XOR obfuscation to evade detection. Command and control infrastructure is hosted on compromised residential IPs and multiple AWS EC2 instances, indicating a sophisticated and distributed setup. This evolution from a simple DDoS botnet to an enterprise-ready threat raises concerns about its potential impact on critical infrastructure and business networks. Detection rules and IOCs are available, including YARA and Snort/Suricata signatures. Although no known exploits in the wild have been reported yet, the high number of exploit vectors and expanded target scope make it a high-severity threat. European organizations, especially those with extensive IoT deployments and cloud infrastructure, should be vigilant. Countries with large enterprise sectors and significant AWS usage are particularly at risk. Immediate mitigation steps include deploying updated detection signatures, network segmentation, and enhanced monitoring of IoT devices and cloud assets.
SocGholish is a malware campaign that leverages compromised websites to deliver ransomware through fake software update prompts. Users visiting these compromised sites are tricked into installing malicious payloads disguised as legitimate updates, leading to ransomware infection. This attack vector exploits social engineering and website vulnerabilities to bypass traditional security controls. The malware's medium severity reflects its potential to disrupt operations but requires user interaction for execution. European organizations with significant web presence or reliance on third-party software updates are at risk. Mitigation involves securing web assets, monitoring for unauthorized changes, and educating users on update verification. Countries with high internet usage, advanced digital infrastructure, and targeted ransomware history, such as Germany, France, and the UK, are more likely to be affected. The threat does not require advanced exploitation techniques but depends on compromised sites and user deception, warranting a medium severity rating. Defenders should prioritize detection of fake update prompts and strengthen web application security to reduce exposure.
MCP Snitch highlights a critical security issue with Modern Code Platforms (MCPs) that run with overprivileged tokens, such as GitHub PATs or AWS credentials, without runtime boundaries, enabling potential data exfiltration via prompt injection. Current authentication models lack granular, temporal scoping, forcing broad access tokens that expose entire repositories or cloud resources. MCP Snitch is an open-source proxy tool designed to mediate and restrict MCP operations through whitelist-based access control, runtime permission requests, API key detection, and comprehensive logging. However, it does not address supply chain attacks, persistence mechanisms, or out-of-band operations. This vulnerability underscores the urgent need for sandboxing and protocol-level security primitives in MCPs, akin to the evolution of browser security models. European organizations using MCPs with broad access tokens are at risk of unauthorized data exposure, especially in software development and cloud environments. Mitigations include deploying proxy-based mediation layers like MCP Snitch, enforcing least privilege token scopes where possible, and monitoring MCP activity closely. Countries with significant software development sectors and cloud adoption, such as Germany, France, the UK, and the Netherlands, are most likely affected. The threat severity is assessed as high due to the potential for widespread data compromise, ease of exploitation via prompt injection, and lack of existing granular access controls.
There is a critical surge in AI-powered phishing campaigns, with a 300% year-over-year increase and a significant rise in attack sophistication. These campaigns leverage machine learning to analyze organizational communication patterns and employee behavior, generating highly personalized and contextually relevant phishing emails in real time. Traditional signature-based detection methods are largely ineffective against these dynamic, unique attack vectors. The FBI reports over 200 US organizations compromised within 30 days, and NIST predicts that by 2025, 90% of successful breaches will stem from AI-driven phishing. Although primarily targeting US infrastructure, European organizations are at risk due to the global nature of phishing and interconnected business relationships. Defenders must adopt advanced behavioral analytics, AI-driven detection, and comprehensive employee training to mitigate these threats effectively. Countries with significant digital infrastructure and high adoption of targeted sectors are most vulnerable. This threat is critical due to its high impact on confidentiality, integrity, and availability, ease of exploitation without user authentication, and broad attack surface.
A Chinese cybercrime group is operating a global SEO fraud campaign by compromising Microsoft IIS web servers. The attackers leverage these compromised servers to manipulate search engine rankings, likely redirecting traffic or injecting fraudulent content to benefit their SEO schemes. This campaign is high priority due to its global scale and the widespread use of IIS servers. Although no specific exploited vulnerabilities or CVEs are identified, the threat involves unauthorized access and control over web infrastructure, impacting confidentiality and integrity. European organizations running IIS servers are at risk of having their web assets abused for fraudulent purposes, potentially damaging reputation and causing indirect financial losses. Mitigation requires proactive server hardening, continuous monitoring for unauthorized changes, and rapid incident response. Countries with significant IIS deployment and high-value web infrastructure, such as Germany, the UK, France, and the Netherlands, are most likely to be affected. Given the ease of exploitation implied by compromised servers and the broad impact on availability and integrity, the suggested severity is high. Defenders should prioritize detection of unusual web server activity and ensure robust patching and access controls to prevent compromise.
40 npm Packages Compromised in Supply Chain Attack Using bundle.js to Steal Credentials
Source: https://thehackernews.com/2025/09/40-npm-packages-compromised-in-supply.html
An interesting approach to malware by checking for Claude Code CLI and Gemini CLI in compromised \`nx\` package to explore local filesystem and steal credentials, api keys, wallets, etc.
DaVita confirms ransomware attack compromised data of 2.7M people
Source: https://securityaffairs.com/181458/data-breach/kidney-dialysis-firm-davita-confirms-ransomware-attack-compromised-data-of-2-7m-people.html
Weak Passwords and Compromised Accounts: Key Findings from the Blue Report 2025
Source: https://thehackernews.com/2025/08/weak-passwords-and-compromised-accounts.html
Scammers Compromised by Own Malware, Expose $4.67M Operation and Identities
Source: https://hackread.com/scammers-compromised-by-malware-expose-operation/
# Summer cybersecurity news catch up
Paris Natural History Museum and hosting provider Francelink paralyzed, Google victim of an attack documented by their own services, urgent CISA directive for Exchange and 5 new KEV vulnerabilities, Microsoft Patch Tuesday with 111 vulnerabilities patched, Alltricks and Manpower compromised, Dell laptops hacked with vegetables 🤯, etc.
There are also some cool articles and cool tools.
Content in french but most of the articles are in english.
