Campaign threats

A new Magecart network has been uncovered, targeting major payment networks including American Express, Diners Club, Discover, and Mastercard. The campaign, active since January 2022, uses web-skimming techniques to steal credit card information from online shoppers. The attackers inject malicious JavaScript code into compromised e-commerce websites, creating fake payment forms that capture and exfiltrate sensitive data. The skimmer employs sophisticated obfuscation techniques and mimics legitimate payment processes to avoid detection. Victims are unaware of the theft, as the malware allows the real transaction to proceed after capturing the data. The campaign demonstrates advanced knowledge of e-commerce platforms and continues to pose a significant threat to online retailers and consumers worldwide.

Campaign#e-commerce#credit-card-theftUnited Kingdom+6

In 2025, AI did not revolutionize cyber attacks as predicted. Instead, adversaries used AI to accelerate traditional tradecraft, focusing on speed and accessibility rather than new offensive capabilities. The article examines several case studies showcasing AI-generated scripts for credential theft and browser exploitation. These attacks, while faster and more accessible to less-skilled operators, still rely on familiar techniques detectable by basic security measures. The outlook for 2026 suggests continued AI-driven commoditization of tradecraft, with more templated attacks and improved phishing attempts. However, fundamental security practices remain effective against these evolving threats.

Campaign#chrome extension#tradecraft accelerationGermany+7

CNCERT and Microstep Online jointly detected a cyberattack campaign launched by the "Black Cat" criminal gang. This gang uses search engine SEO (Search Engine Optimization) techniques to push meticulously crafted phishing websites to the top of search engine keyword results. After visiting these high-ranking phishing pages, users are lured by carefully designed download pages, attempting to download software installation packages bundled with malicious programs. Once installed, the program implants a backdoor Trojan without the user's knowledge, leading to the theft of sensitive data from their host computer by attackers.

Campaign#notepad#seoGermany+6

Between February and September 2025, BlueDelta, a Russian state-sponsored threat group linked to the GRU, conducted multiple credential-harvesting campaigns. The group targeted individuals associated with energy research, defense cooperation, and government communication networks in Turkey, Europe, North Macedonia, and Uzbekistan. BlueDelta impersonated legitimate webmail and VPN services, using free hosting and tunneling services to host phishing content and capture user data. The campaigns incorporated PDF lures and customized JavaScript to increase authenticity and operational efficiency. This activity demonstrates BlueDelta's continued focus on low-cost, high-yield methods for collecting information supporting Russian intelligence objectives.

Campaign#tunneling services#credential harvestingUnited Kingdom+8

Key takeaways Introduction GoBruteforcer is a botnet that turns compromised Linux servers into scanning and password brute-force nodes. It targets internet-exposed services such as phpMyAdmin web panels, MySQL and PostgreSQL databases, and FTP servers. Infected hosts are incorporated into the botnet and accept remote operator commands.  Newly discovered weak credentials are used to steal data, […] The post Inside GoBruteforcer: AI-Generated Server Defaults, Weak Passwords, and Crypto-Focused Campaigns appeared first on Check Point Research .

Campaign#linux#remoteGermany+6

The VVS Discord Stealer is a Python-based malware designed to exfiltrate sensitive Discord user data including credentials and tokens. It uses Pyarmor with BCC mode and AES-128-CTR encryption to heavily obfuscate its code, evading detection by static and dynamic analysis tools. The malware decrypts encrypted Discord tokens, queries Discord APIs for user information, injects malicious JavaScript into the Discord client to intercept active sessions, and extracts data from multiple web browsers. It achieves persistence by configuring itself to run at system startup and deceives victims by displaying a fake error message. While no known exploits or CVEs are reported, its capabilities pose a medium severity threat. The stealer primarily targets Windows environments where Discord and browsers are installed and relies on user interaction, likely via social engineering. European organizations with significant Discord usage, especially in technology, gaming, media, and education sectors, face risks of credential theft, unauthorized access, data leakage, and operational disruption. Detection requires behavioral and heuristic analysis due to strong obfuscation techniques.

Campaign#browser data theft#pythonGermany+4

GreyNoise has observed thousands of requests targeting a dozen vulnerabilities in Adobe ColdFusion during the Christmas 2025 holiday. The post Adobe ColdFusion Servers Targeted in Coordinated Campaign appeared first on SecurityWeek .

CampaignGermanyFrance+4

A new automated red-team tool has been developed to identify critical vulnerabilities in AI applications that integrate large language models (LLMs) such as GPT-4. The tool focuses on discovering prompt injection or jailbreak attacks, system prompt leaks, and potential leakage of personally identifiable information (PII) from the model's context or training data. Early tests on AI startups revealed prompt leaks within minutes, highlighting the immature state of LLM security. This threat exposes significant risks including unauthorized command execution, data exposure, and compromise of AI system integrity. European organizations adopting AI solutions without robust security controls may face data breaches and operational disruptions. Mitigation requires specialized security assessments tailored to LLM-based applications, including prompt sanitization, strict access controls, and continuous monitoring. Countries with high AI adoption and technology sectors, such as Germany, France, and the UK, are particularly at risk. Given the critical impact on confidentiality, integrity, and availability and ease of exploitation without authentication, the severity is assessed as critical. Defenders must prioritize securing AI integrations to prevent exploitation of these novel attack surfaces.

Campaign#netsec#redditGermany+6

A cyber campaign has been identified involving the abuse of Remote Monitoring and Management (RMM) tools to distribute malicious crypto wallet software. Attackers leverage RMM platforms to deploy malware under the guise of legitimate crypto wallet applications, aiming to compromise users' cryptocurrency assets. Although no known exploits are currently active in the wild, the campaign represents a medium-severity threat due to the potential financial impact and the stealthy use of trusted management tools. European organizations involved in cryptocurrency services or using RMM solutions are at risk, especially those with high adoption of remote management platforms. Mitigation requires strict control and monitoring of RMM tool usage, validation of crypto wallet software sources, and enhanced user awareness. Countries with significant crypto markets and advanced IT infrastructure, such as Germany, the UK, and the Netherlands, are more likely targets. The threat's medium severity is based on the moderate impact on confidentiality and integrity, the complexity of exploitation requiring some user interaction, and the limited scope of affected systems. Defenders should focus on securing RMM environments and verifying software authenticity to prevent compromise.

Campaign#netsec#redditGermany+4

Between December 19-22, 2025, EmEditor's official website suffered a security breach, causing the main download button to serve malicious software. The fake installer, signed by WALSHAM INVESTMENTS LIMITED, contained infostealer malware targeting login credentials, browser history, and VPN settings. It specifically targeted technical staff and government offices, stealing files and installing a fraudulent browser extension for remote control and cryptocurrency address swapping. Users who downloaded during this period are advised to check the digital signature, delete suspicious files, and change stored passwords. Emurasoft is investigating the incident and has apologized for the inconvenience.

Campaign#infostealer#data theftGermany+7

A recent high-severity crypto theft campaign targeted Trust Wallet users, resulting in the draining of 2,596 wallets and a loss of approximately $7 million. The attack exploited vulnerabilities or weaknesses related to Trust Wallet, a widely used cryptocurrency wallet application. While specific technical details of the exploit are not disclosed, the campaign demonstrates significant financial impact and risk to users' digital assets. European organizations and individuals using Trust Wallet or related services are at risk of financial loss and reputational damage. The attack does not require user interaction beyond wallet usage, and the compromised wallets indicate a breach of confidentiality and integrity of user assets. Mitigation requires immediate wallet security hygiene, including private key management, use of hardware wallets, and vigilance against phishing or malicious apps. Countries with higher cryptocurrency adoption and Trust Wallet user bases, such as Germany, the UK, France, and the Netherlands, are more likely to be affected. Given the financial impact, ease of exploitation, and scope, the threat severity is assessed as high. Defenders should prioritize securing wallet credentials, monitoring for suspicious transactions, and educating users on safe crypto practices.

Campaign#infosecnews#redditGermany+5

A persistent nine-month RondoDoX botnet campaign has been targeting IoT devices and web applications. The threat actors have recently shifted to weaponizing a critical Next.js vulnerability, deploying malicious payloads like 'React2Shell' and cryptominers. The campaign, spanning from March to December 2025, shows quick adaptation to latest attack trends. The activity is divided into three phases: initial reconnaissance, web application exploitation, and IoT botnet deployment. The attackers have been using multiple command and control servers and deploying various malware variants. The campaign has intensified in December 2025 with a focus on Next.js exploitation. The impact includes widespread IoT device compromise, Next.js application risks, credential harvesting, and persistent multi-architecture threats.

Campaign#rondodox#command and controlGermany+7

The pro-Russian hacktivist group Noname057 has claimed responsibility for a cyberattack targeting La Poste services in France. The attack was reported via Reddit and linked to a news article but lacks detailed technical information or confirmed impact assessments. No specific vulnerabilities, exploited methods, or affected system versions have been disclosed, and there are no known exploits in the wild associated with this campaign. The severity is assessed as medium based on the nature of the target and the potential disruption to postal services. European organizations, especially those in France, could face operational disruptions and data confidentiality risks if the attack is substantiated. Mitigation should focus on enhancing monitoring of La Poste’s digital infrastructure, incident response readiness, and communication security. Countries with significant reliance on La Poste or similar postal services and with geopolitical tensions involving Russia are more likely to be affected. Given the limited technical details and lack of confirmed exploitation, the suggested severity remains medium. Defenders should prioritize vigilance and verification of La Poste’s security posture while preparing for potential escalation or follow-up attacks.

Campaign#infosecnews#redditFrance+4

The Evasive Panda APT group conducted highly-targeted campaigns from November 2022 to November 2024, employing adversary-in-the-middle attacks and DNS poisoning techniques. They developed a new loader that evades detection and uses hybrid encryption for victim-specific implants. The group utilized fake updaters for popular applications to deliver malware, including a multi-stage shellcode execution process. A secondary loader, disguised as a legitimate Windows library, was used to achieve stealthier loading. The attackers employed a custom hybrid encryption method combining DPAPI and RC5 to secure payloads. Victims were detected in Türkiye, China, and India, with some systems compromised for over a year. The campaign showcases the group's advanced capabilities and continuous improvement of tactics.

Campaign#aitm attacks#dns poisoningTurkey+5

A novel cryptanalysis approach called the Kaoru Method proposes linearizing SHA-256's modular addition by modeling it as fractional modular arithmetic, enabling the reconstruction of a Universal Carry Map that removes modular barriers. This method simplifies differential cryptanalysis by making carry behavior predictable rather than noisy, potentially undermining SHA-256's assumed non-linearity. While no direct exploits or collisions have been demonstrated yet, this theoretical framework could pave the way for future attacks on SHA-256's compression function. The research is recent and experimental, with code and theory publicly released for validation. European organizations relying on SHA-256 for integrity, authentication, or digital signatures should monitor developments closely. Immediate practical exploitation is not confirmed, but the cryptographic assumptions underlying many security protocols could be challenged if this method matures. Mitigations include diversifying cryptographic algorithms, preparing for post-quantum or alternative hash adoption, and engaging with cryptographic research communities. Countries with strong tech sectors and critical infrastructure relying heavily on SHA-256, such as Germany, France, and the UK, are most likely to be affected. The threat severity is assessed as medium given the theoretical nature, no known exploits, and the foundational importance of SHA-256.

Campaign#netsec#redditGermany+7

During the holiday season, threat actors exploit overloaded inboxes and financial stress through two main patterns: Docusign-themed phishing for corporate credential harvesting and loan offer spam for personal data theft. The Docusign campaign uses spoofed emails with authentic-looking branding, redirecting through disposable hosting platforms to a credential harvesting page. The loan scams range from obvious 'Xmas loan' offers to sophisticated marketing-style emails, ultimately leading victims to a detailed identity theft questionnaire on christmasscheercash.com. Both scams utilize seasonal themes and mimic normal end-of-year workflows to increase effectiveness. Defensive measures include verifying sender domains, validating link destinations, and treating unsolicited loan offers as high risk.

Campaign#identity theft#phishingUnited Kingdom+5

A pirate group known as Anna’s Archive has reportedly scraped and copied 256 million songs from Spotify, creating a massive unauthorized dataset of copyrighted music. This data scrape does not appear to exploit a technical vulnerability in Spotify’s systems but rather involves large-scale data extraction, likely through automated means. While no direct compromise of Spotify’s infrastructure or user data is indicated, the incident raises concerns about intellectual property theft and potential redistribution of copyrighted content. European organizations in the music, media, and digital rights management sectors could face increased challenges related to piracy and copyright enforcement. The threat does not involve malware or direct system compromise but represents a significant data theft campaign impacting content owners. Mitigation focuses on enhanced monitoring for unauthorized data scraping, legal enforcement actions, and collaboration with platform providers to detect and block abusive behaviors. Countries with large music markets and strong digital content industries, such as the UK, Germany, and France, are most likely to be affected. Given the nature of the threat, the suggested severity is medium, reflecting the impact on intellectual property rather than direct cybersecurity risks to infrastructure or user data.

Campaign#infosecnews#redditGermany+6

This report highlights multiple security concerns including a North Korean infiltrator discovered within Amazon's IT department, a significant €140 million fine imposed by the EU on an unspecified entity, and Cisco customers targeted by a China-linked advanced persistent threat (APT). The information is sourced from a Reddit post linking to a cybersecurity news newsletter. While the details are sparse and discussion minimal, the mention of nation-state actors and high-profile targets suggests ongoing espionage and cyberattack campaigns. The threat involves insider risk, regulatory penalties, and sophisticated cyber intrusions affecting major technology providers. European organizations may face indirect impacts through supply chain risks and regulatory enforcement. The lack of detailed technical data and exploit information limits precise risk assessment. Given the involvement of APT groups and insider threats, the overall severity is assessed as medium. Defenders should prioritize insider threat detection, supply chain security, and monitoring for APT activity. Countries with significant Amazon and Cisco presence and strategic importance in cyber espionage are most likely affected.

Campaign#infosecnews#redditGermany+5

Threat actors are increasingly abusing legitimate Remote Monitoring and Management (RMM) tools such as PDQ and GoTo Resolve to deploy secondary RMM tools like ScreenConnect or SimpleHelp, enabling persistent and stealthy access. Attacks often start with phishing emails or malicious downloads, targeting diverse sectors including real estate, investment firms, and car dealerships. Social engineering lures include holiday-themed messages and fake bid transcripts to trick users into executing malicious payloads. The abuse of multiple RMM tools complicates detection and remediation efforts. Detection and mitigation require a managed Security Operations Center (SOC) with visibility into RMM tool usage and network behavior. The threat is medium severity due to the potential for persistence and lateral movement, but exploitation requires initial user interaction. European organizations using these RMM tools are at risk, especially those in Germany and countries with high adoption of these management platforms. Practical mitigations include strict RMM access controls, multi-factor authentication, monitoring for unusual RMM deployments, and user training against phishing. No known exploits in the wild have been reported yet, but the trend indicates growing attacker interest in RMM abuse for persistence and lateral movement.

Campaign#rmm abuse#phishingGermany+4

A China-linked advanced persistent threat (APT) group known as UAT-9686 is actively targeting Cisco Secure Email Gateway and Secure Email and Web Manager products. This campaign aims to exploit vulnerabilities or misconfigurations in these email and web security appliances to gain unauthorized access or persist within victim networks. Although no known exploits are currently in the wild and no specific affected versions or CVEs have been disclosed, the targeting of critical email and web security infrastructure poses a significant risk to organizations relying on these Cisco products. The threat is assessed as medium severity due to the potential impact on confidentiality and integrity, combined with the complexity of exploitation and lack of public exploit code. European organizations using Cisco Secure Email Gateway or Secure Email and Web Manager should be vigilant, as these products are widely deployed in enterprise environments. Mitigation should focus on monitoring for unusual activity, applying Cisco security advisories promptly, and enhancing network segmentation around these appliances. Countries with large Cisco enterprise deployments and strategic geopolitical interest to China, such as Germany, France, the UK, and the Netherlands, are likely to be most affected. Given the nature of the threat and its targeting of critical security infrastructure, the suggested severity is medium.

Campaign#infosecnews#redditGermany+5