A high-priority cyber espionage campaign has been reported involving Chinese threat actors leveraging Anthropic's AI technology to automate their operations. This campaign represents an evolution in threat actor capabilities by integrating advanced AI to enhance attack automation and sophistication. Although no specific vulnerabilities or exploits are detailed, the use of AI suggests increased speed, scale, and adaptability in targeting. European organizations, especially those in critical infrastructure, government, and technology sectors, face heightened risks due to potential espionage and data exfiltration. Mitigation requires tailored defenses including AI threat detection, enhanced monitoring for automated attack patterns, and strict access controls. Countries with significant technological and industrial assets, such as Germany, France, and the UK, are likely primary targets. Given the campaign nature, lack of authentication requirements, and potential broad impact, the threat severity is assessed as high. Defenders should prioritize intelligence sharing and proactive AI-driven security measures to counter this emerging threat.
A global phishing campaign is exploiting the use of @facebookmail.com email invites to target Facebook Business users. Attackers send seemingly legitimate invitations appearing to come from Facebook's official domain to deceive recipients into divulging sensitive credentials or business information. This medium-severity threat leverages social engineering and brand trust to bypass user suspicion. No specific affected software versions or patches are identified, and no known exploits in the wild have been confirmed beyond the phishing campaign. The campaign's global nature and targeting of business users pose risks to confidentiality and potentially business operations. European organizations using Facebook Business services are at risk, especially those with significant social media marketing or customer engagement through Facebook. Mitigation requires heightened user awareness, email filtering tuned to detect spoofed or suspicious invites, and verification procedures for unexpected communications. Countries with high Facebook Business adoption and active digital marketing sectors, such as the UK, Germany, France, and the Netherlands, are most likely to be affected. Given the ease of exploitation through phishing and the potential for credential compromise, the threat is assessed as medium severity.
The China-aligned threat actor UTA0388 is conducting global phishing campaigns leveraging AI tools to enhance the sophistication and effectiveness of their attacks. These campaigns aim to deceive targets by generating more convincing phishing content, increasing the likelihood of credential theft or malware deployment. While no specific affected software versions or exploits are noted, the use of AI indicates an evolution in phishing tactics that can bypass traditional detection methods. European organizations, especially those in sectors with strategic geopolitical importance, are at risk due to the global scope of these campaigns. Mitigation requires targeted user awareness training focused on AI-enhanced phishing, deployment of advanced email filtering solutions, and continuous monitoring for suspicious activity. Countries with significant digital infrastructure and geopolitical relevance to China are more likely targets. Given the high potential impact on confidentiality and integrity, ease of exploitation without authentication, and broad scope, this threat is assessed as high severity. Defenders should prioritize enhancing phishing defenses and incident response capabilities to counter this emerging AI-driven threat vector.
A China-linked hacking group has been conducting a long-term espionage campaign targeting a U. S.non-profit organization. The campaign involves persistent cyber intrusions aimed at gathering sensitive information over an extended period. While specific technical details and exploited vulnerabilities are not disclosed, the threat reflects ongoing state-sponsored cyber espionage activities. The campaign is assessed as medium severity due to its targeted nature and potential impact on confidentiality. European organizations with ties to U. S.non-profits or similar sectors should be vigilant. Mitigation requires enhanced monitoring, threat intelligence sharing, and strict access controls.
A China-linked hacking group is conducting a global campaign targeting Cisco AKA firewalls. The campaign appears to be recent and is reported via a Reddit InfoSec news post referencing an external source. While specific technical details, affected versions, or exploits in the wild are not provided, the targeting of Cisco AKA firewalls suggests an attempt to compromise network perimeter defenses. The campaign is assessed as medium severity due to limited public technical details and no confirmed exploits. European organizations using Cisco AKA firewalls could be at risk, especially those with critical infrastructure or government networks. Mitigation should focus on enhanced monitoring, network segmentation, and applying Cisco security advisories promptly. Countries with high Cisco market penetration and strategic geopolitical interest in China-related cyber activities are more likely to be affected. Given the lack of detailed exploit information, the threat severity is assessed as medium, balancing potential impact and limited exploitation evidence.
CoPHish is a novel phishing technique that leverages Microsoft Copilot Studio chatbots to craft highly convincing OAuth-based credential theft campaigns. Attackers abuse the chatbot’s capabilities to generate realistic phishing content that tricks users into granting OAuth permissions, thereby compromising their accounts. This technique does not require exploiting software vulnerabilities but relies on social engineering and the abuse of legitimate OAuth flows. The threat is categorized as medium severity due to its potential impact on user credentials and organizational security, though it requires user interaction and targeted phishing attempts. European organizations using Microsoft 365 and related cloud services are at risk, especially those with extensive OAuth integrations. Mitigation involves user education on OAuth consent phishing, strict monitoring of OAuth app permissions, and enhanced email filtering. Countries with high Microsoft cloud adoption and significant digital infrastructure, such as Germany, the UK, France, and the Netherlands, are most likely to be affected. Given the ease of exploitation through social engineering and the broad scope of affected users, the suggested severity is medium.
APT36, a known advanced persistent threat group, has launched a targeted malware campaign against the Indian government using a Golang-based remote access trojan named DeskRAT. This malware enables attackers to gain persistent remote control over infected systems, facilitating espionage and data exfiltration. The campaign leverages Golang to enhance cross-platform capabilities and evade detection. Although primarily targeting Indian government entities, the malware's capabilities and attack methods pose risks to organizations in Europe with ties to India or similar infrastructure. The threat is considered high severity due to its potential impact on confidentiality and integrity, ease of exploitation without known patches, and no requirement for user interaction once initial access is gained. European organizations should implement targeted detection and response strategies, including monitoring for Golang-based malware behaviors and network anomalies. Countries with strong diplomatic, economic, or technological links to India, such as the UK, Germany, and France, are more likely to be affected. Proactive threat intelligence sharing and tailored endpoint defenses are critical to mitigating this threat.
The Iran-linked threat actor group MuddyWater has launched a global espionage campaign targeting over 100 organizations worldwide. This campaign focuses on intelligence gathering and is characterized by high-priority targeting of entities likely involved in sensitive sectors. Although specific technical details and exploited vulnerabilities are not disclosed, MuddyWater is known for using sophisticated tactics including spear-phishing and custom malware. The campaign poses significant risks to confidentiality and integrity of targeted organizations’ data. European organizations, especially those in critical infrastructure, government, and defense sectors, are at heightened risk due to their strategic value. Mitigation requires enhanced threat hunting, network monitoring for MuddyWater TTPs, and strict access controls. Countries with strong geopolitical ties or adversarial relations with Iran, and those with high adoption of targeted technologies, are more likely to be affected. Given the espionage nature, ease of exploitation is moderate but impact on confidentiality is high, warranting a high severity rating. Defenders should prioritize detection of MuddyWater indicators and implement proactive cyber threat intelligence sharing.
The PolarEdge botnet campaign targets routers from Cisco, ASUS, QNAP, and Synology to expand its network of compromised devices. This campaign leverages vulnerabilities or weak configurations in these widely used routers to enlist them into a botnet, potentially enabling large-scale distributed denial-of-service (DDoS) attacks, data interception, or further lateral movement. Although no known exploits are currently reported in the wild, the campaign is considered high priority due to the critical role these devices play in network infrastructure. European organizations using these brands are at risk, especially those with less stringent router security practices. The campaign's expansion highlights the ongoing threat posed by botnets exploiting IoT and network edge devices. Defenders should focus on hardening router configurations, applying firmware updates, and monitoring network traffic for anomalies. Countries with high adoption of these router brands and significant digital infrastructure are more likely to be targeted. Immediate mitigation steps can reduce the risk of compromise and limit the botnet's growth.
A spear-phishing campaign targeting the Russian Automobile-Commerce industry using a malicious.NET implant has been uncovered by Seqrite Labs Research Team and is now being investigated by the FBI.
Microsoft has revoked 200 fraudulent digital certificates that were used in the Rhysida ransomware campaign. These certificates were exploited by attackers to sign malicious payloads, helping them evade detection and appear legitimate. The revocation disrupts the attackers' ability to use these certificates for code signing, thereby mitigating part of the threat. The Rhysida ransomware campaign remains a high-severity threat due to its use of trusted certificates to facilitate malware distribution. European organizations, especially those with high reliance on Microsoft ecosystems and critical infrastructure, could be targeted. The campaign highlights the ongoing risk of certificate-based trust abuse in ransomware operations. Defenders should prioritize monitoring for suspicious signed binaries and ensure robust certificate validation processes. Countries with significant Microsoft product usage and critical infrastructure sectors are at elevated risk. Immediate mitigation includes updating certificate revocation lists and enhancing endpoint detection capabilities to identify signed malware. The threat is assessed as high severity given the impact on confidentiality, integrity, and availability, combined with the ease of exploitation through trusted certificates and no need for user interaction once infection vectors are triggered.
There is a critical surge in AI-powered phishing campaigns, with a 300% year-over-year increase and a significant rise in attack sophistication. These campaigns leverage machine learning to analyze organizational communication patterns and employee behavior, generating highly personalized and contextually relevant phishing emails in real time. Traditional signature-based detection methods are largely ineffective against these dynamic, unique attack vectors. The FBI reports over 200 US organizations compromised within 30 days, and NIST predicts that by 2025, 90% of successful breaches will stem from AI-driven phishing. Although primarily targeting US infrastructure, European organizations are at risk due to the global nature of phishing and interconnected business relationships. Defenders must adopt advanced behavioral analytics, AI-driven detection, and comprehensive employee training to mitigate these threats effectively. Countries with significant digital infrastructure and high adoption of targeted sectors are most vulnerable. This threat is critical due to its high impact on confidentiality, integrity, and availability, ease of exploitation without user authentication, and broad attack surface.
A phishing campaign leverages Zoom's document sharing feature to establish initial trust with victims. The attack directs users through a fake bot protection page before presenting a Gmail-like login interface to harvest credentials. Entered credentials are transmitted to the attacker via WebSocket and validated on the backend. This technique exploits user trust in Zoom and mimics legitimate Gmail login to increase success rates. The campaign is currently observed with minimal discussion and no known widespread exploitation. It poses a medium risk due to credential compromise potential without requiring advanced exploitation or vulnerabilities. European organizations using Gmail and Zoom are at risk, especially those with remote workforces relying on these platforms. Attackers can gain unauthorized access to email accounts, leading to data breaches and further attacks. Mitigation requires user awareness, multi-factor authentication enforcement, and monitoring for suspicious login attempts. Countries with high Zoom and Gmail usage and significant remote work adoption are most likely affected.
Moonlock Lab researchers have spotted a new macOS malware campaign that leverages **malvertising + fake social media profiles** to distribute malicious apps. Once installed, the malware exfiltrates sensitive data and can be updated remotely with new modules. This trend shows that macOS is no longer “low priority” for attackers – they’re actively adapting Windows-style tactics for Apple’s ecosystem.
New Infostealer Campaign Targeting Mac Users via GitHub Pages Claiming to Offer LastPass Premium
Source: https://blog.lastpass.com/posts/attack-targeting-macs-via-github-pages
From MostereRAT to ClickFix: New Malware Campaigns Highlight Rising AI and Phishing Risks
Source: https://thehackernews.com/2025/09/from-mostererat-to-clickfix-new-malware.html
