Threats tagged 'infosecnews'

Malicious advertisements promoting the Perplexity Comet Browser have been observed on Google Search results, leading users to download a password-stealing malware. These ads impersonate legitimate software downloads but instead deliver a credential-stealing payload. The attack leverages search engine advertising to target users actively seeking the browser, increasing the likelihood of infection. The malware focuses on harvesting stored passwords, potentially compromising user accounts and sensitive data. There is no evidence of widespread exploitation yet, but the threat poses a medium risk due to the nature of credential theft and the attack vector. European organizations with employees or users searching for this browser are at risk, especially those with lax ad filtering or endpoint protections. Mitigation requires enhanced ad-blocking, user awareness, and endpoint detection capabilities. Countries with high internet usage and significant Google Search market share are more likely to be affected. The threat is assessed as medium severity given the impact on confidentiality, moderate ease of exploitation, and lack of authentication or user interaction beyond downloading the malware.

Malware#infosecnews#redditGermany+6

A hacker involved in compromising PowerSchool systems was sentenced to four years in prison. The incident highlights the risks associated with attacks on educational software platforms that manage sensitive student and staff data. While no specific technical details or exploited vulnerabilities are provided, the case underscores the importance of securing such critical infrastructure. The threat does not describe an ongoing or new vulnerability but rather reports on a legal outcome following a cyberattack. European organizations using PowerSchool or similar educational management systems should remain vigilant. The severity of the threat is assessed as medium due to the potential impact on confidentiality and integrity of educational data, though exploitation details are lacking. No active exploits or patches are mentioned, limiting immediate technical mitigation steps. Countries with significant educational technology adoption and digital infrastructure in schools may be more concerned. Overall, this is a security incident report rather than a new technical threat or vulnerability disclosure.

News#infosecnews#redditGermany+6

A high-severity vulnerability has been discovered in WatchGuard VPN products that could allow attackers to take control of affected devices. Although specific affected versions and technical details are not disclosed, the flaw potentially enables remote code execution or privilege escalation. No known exploits are currently observed in the wild, but the risk remains significant due to the critical nature of VPN infrastructure. European organizations relying on WatchGuard VPN solutions for secure remote access could face confidentiality, integrity, and availability risks if exploited. Mitigation requires close monitoring for official patches from WatchGuard and immediate application once available, alongside network segmentation and enhanced monitoring of VPN traffic. Countries with high adoption of WatchGuard VPN, such as Germany, the UK, France, and the Netherlands, are likely to be most impacted. Given the potential for device takeover without user interaction, the suggested severity is critical. Defenders should prioritize vulnerability assessment, restrict VPN access to trusted endpoints, and prepare incident response plans for potential exploitation scenarios.

News#infosecnews#redditGermany+5

A nation-state threat actor has stolen source code and undisclosed vulnerabilities from F5 Networks, a major provider of application delivery controllers and security solutions. This breach potentially exposes zero-day vulnerabilities that could be weaponized for remote code execution (RCE) attacks. Although no known exploits are currently observed in the wild, the theft increases the risk of targeted attacks against organizations using F5 products. European organizations relying on F5 infrastructure could face confidentiality, integrity, and availability risks if these vulnerabilities are exploited. The threat is assessed as medium severity due to the lack of active exploitation but significant potential impact. Mitigation requires enhanced monitoring, rapid patching once updates are available, and restricting access to F5 management interfaces. Countries with high adoption of F5 technologies and strategic digital infrastructure, such as Germany, France, and the UK, are most likely to be affected. Defenders should prioritize threat intelligence sharing and incident response readiness to mitigate emerging risks from this breach.

News#infosecnews#redditGermany+5

Sotheby’s, a major auction house, suffered a data breach that exposed customer financial information. The breach was publicly disclosed in October 2025 and reported by credible sources including BleepingComputer and Reddit InfoSec News. Although detailed technical specifics of the breach are not provided, the exposure of financial data indicates a significant compromise of sensitive customer information. No known exploits are currently active in the wild, and the discussion level in public forums remains minimal. The breach poses a high risk to affected individuals and organizations due to potential financial fraud, identity theft, and reputational damage. European organizations connected to Sotheby’s or using similar systems may face indirect impacts, especially those involved in luxury goods, auctions, or financial services. Mitigation should focus on enhanced monitoring, customer notification, and strengthening data protection controls. Countries with strong luxury markets and high Sotheby’s client presence, such as the UK, France, Germany, Italy, and Switzerland, are likely to be most affected. Given the sensitivity of the data and the breach context, the severity is assessed as high.

Breach#infosecnews#redditFrance+6

Microsoft has revoked 200 fraudulent digital certificates that were used in the Rhysida ransomware campaign. These certificates were exploited by attackers to sign malicious payloads, helping them evade detection and appear legitimate. The revocation disrupts the attackers' ability to use these certificates for code signing, thereby mitigating part of the threat. The Rhysida ransomware campaign remains a high-severity threat due to its use of trusted certificates to facilitate malware distribution. European organizations, especially those with high reliance on Microsoft ecosystems and critical infrastructure, could be targeted. The campaign highlights the ongoing risk of certificate-based trust abuse in ransomware operations. Defenders should prioritize monitoring for suspicious signed binaries and ensure robust certificate validation processes. Countries with significant Microsoft product usage and critical infrastructure sectors are at elevated risk. Immediate mitigation includes updating certificate revocation lists and enhancing endpoint detection capabilities to identify signed malware. The threat is assessed as high severity given the impact on confidentiality, integrity, and availability, combined with the ease of exploitation through trusted certificates and no need for user interaction once infection vectors are triggered.

Malware#infosecnews#redditGermany+9

A high-severity vulnerability in Cisco switches' SNMP implementation has been exploited by hackers to deploy a rootkit, enabling persistent unauthorized control over network switches. Although no specific affected versions or patches have been disclosed, the exploitation allows attackers to compromise the integrity and availability of critical network infrastructure. This threat poses significant risks to European organizations relying on Cisco networking equipment, potentially disrupting operations and enabling further lateral attacks. Mitigation requires immediate network monitoring for anomalous SNMP activity, restricting SNMP access to trusted hosts, and applying any forthcoming Cisco security updates promptly. Countries with high Cisco market penetration and critical infrastructure reliance, such as Germany, France, and the UK, are most at risk. Given the rootkit deployment and ease of exploitation without user interaction, the threat severity is assessed as high. Defenders must prioritize detection and containment to prevent persistent compromise of network devices.

Vulnerability#infosecnews#redditGermany+2

A misconfigured NetcoreCloud server exposed approximately 40 billion records totaling 13.4TB of data, leading to a significant data breach. The exposure was due to improper server configuration, allowing unauthorized access to a massive volume of sensitive information. Although no known exploits are currently active in the wild, the sheer scale of exposed data presents a substantial risk to affected organizations and individuals. This breach primarily impacts confidentiality, with potential secondary impacts on integrity and availability if attackers leverage the data for further attacks. European organizations using NetcoreCloud services or handling data processed by this platform are at risk, especially those in sectors with high data sensitivity. Mitigation requires immediate configuration audits, restricting public access, and implementing strict access controls. Countries with high adoption of cloud services and digital marketing platforms, such as the UK, Germany, and France, are more likely to be affected. Given the ease of exploitation through misconfiguration and the vast scope of data exposed, the severity is assessed as high. Defenders should prioritize verifying their cloud configurations and monitoring for any suspicious activity related to this breach.

Breach#infosecnews#redditGermany+6

The China-linked advanced persistent threat (APT) group known as Jewelbug has conducted a rare cross-nation cyberattack targeting a Russian IT provider. This campaign represents an unusual geopolitical targeting pattern, as it involves a Chinese APT focusing on a Russian entity. The attack is characterized by medium severity, with no known exploits in the wild or publicly disclosed technical details. The campaign was reported recently and is considered newsworthy due to its geopolitical implications and the involvement of a sophisticated threat actor. There are no specific affected software versions or vulnerabilities disclosed, and the attack details remain limited. European organizations should be aware of potential indirect impacts, especially those with ties to Russian IT infrastructure or supply chains. Mitigation should focus on enhanced monitoring for APT tactics, supply chain security, and cross-border intelligence sharing. Countries with significant IT service dependencies on Russian providers or geopolitical interest in Sino-Russian relations are more likely to be affected. Given the medium severity and limited technical details, the threat requires vigilance but does not currently indicate an immediate critical risk to European entities.

Campaign#infosecnews#redditGermany+6

LinkPro is a newly discovered Linux rootkit that leverages eBPF (extended Berkeley Packet Filter) technology to stealthily hide its presence on infected systems. It activates upon receiving specially crafted 'magic' TCP packets, allowing attackers to control compromised hosts covertly. This rootkit's use of eBPF, a legitimate kernel feature, makes detection challenging as it operates at a low level within the Linux kernel. Although no known exploits are currently reported in the wild, the rootkit's capabilities pose a significant risk to Linux-based infrastructure. European organizations relying on Linux servers, especially those exposed to external networks, could be targeted. The rootkit threatens system confidentiality, integrity, and availability by enabling persistent unauthorized access and potential data exfiltration or sabotage. Mitigation requires advanced monitoring of eBPF programs, network traffic analysis for anomalous TCP packets, and strict kernel security policies. Countries with high Linux adoption in critical sectors and strategic geopolitical relevance are more likely to be affected. Given its stealth, activation method, and potential impact, this threat is assessed as high severity. Defenders should prioritize detection and containment strategies tailored to eBPF misuse and network-based triggers.

News#infosecnews#redditGermany+9

A maximum-severity vulnerability in Adobe software has been confirmed by CISA to be actively exploited in the wild. Although specific affected versions and technical details are not provided, the flaw is rated high severity and is now leveraged by attackers. This exploitation poses significant risks to confidentiality, integrity, and availability of affected systems. European organizations using Adobe products are at risk, especially those with critical infrastructure or sensitive data. Mitigation requires immediate patching once updates are available, enhanced monitoring for exploitation attempts, and restricting Adobe software usage where possible. Countries with high Adobe market penetration and strategic digital infrastructure, such as Germany, France, and the UK, are likely most impacted. Given the active exploitation and high severity, the threat is assessed as critical. Defenders should prioritize vulnerability management and incident detection related to Adobe products to reduce exposure.

News#infosecnews#redditGermany+7

Hackers are leveraging blockchain smart contracts as a novel vector to distribute malware through compromised WordPress websites. This attack involves embedding malicious payloads or commands within blockchain smart contracts, which are then referenced or executed via infected WordPress sites, enabling malware propagation. The technique exploits the decentralized and immutable nature of blockchain to evade traditional detection and takedown methods. European organizations using WordPress for their web presence are at risk, especially those with limited security controls or outdated plugins. The attack can compromise confidentiality, integrity, and availability of affected systems, potentially leading to data breaches or service disruptions. Mitigation requires advanced monitoring of blockchain interactions, securing WordPress installations, and implementing strict content validation. Countries with high WordPress adoption and significant blockchain development or usage are more likely to be targeted. Given the complexity and stealth of this attack vector, the threat is assessed as high severity. Defenders should prioritize detection of anomalous blockchain-related activities and ensure robust WordPress security hygiene.

Malware#infosecnews#redditGermany+7

A credential weakness has been identified in the Model Context Protocol (MCP) server, raising security concerns. The weakness relates to how credentials are managed or validated within the MCP, potentially allowing unauthorized access if exploited. While no known exploits are currently in the wild, the issue is rated as medium severity due to potential risks to confidentiality and integrity. The threat was recently reported by ReversingLabs and discussed minimally on Reddit's InfoSecNews community. European organizations using MCP or related systems should be aware of this vulnerability and assess their exposure. Mitigation involves reviewing credential management practices, enforcing strong authentication, and monitoring for unusual access patterns. Countries with significant industrial, governmental, or technological deployments of MCP-related infrastructure are more likely to be affected. Given the lack of detailed technical data and no public exploits, the threat is assessed as medium severity. Defenders should prioritize credential security audits and prepare for potential future exploit attempts.

News#infosecnews#redditGermany+5

The Zero Day Initiative (ZDI) announced the return of its Pwn2Own Automotive hacking competition in Tokyo, featuring expanded targets including automotive chargers and other vehicle-related technologies. This event focuses on identifying zero-day vulnerabilities in automotive systems by incentivizing security researchers to discover and responsibly disclose critical flaws. While no specific vulnerabilities or exploits have been disclosed yet, the competition highlights the increasing cybersecurity risks in connected vehicles and their infrastructure. European automotive manufacturers and suppliers, heavily invested in connected and electric vehicle technologies, could be indirectly impacted by vulnerabilities discovered through this initiative. The event underscores the importance of proactive vulnerability management and collaboration between researchers and industry to mitigate emerging threats. Organizations should monitor disclosures resulting from Pwn2Own and prepare to apply patches promptly. Given the critical nature of automotive system security and the potential for remote exploitation, the suggested severity is high. Defenders should prioritize threat intelligence integration and strengthen security controls around vehicle communication interfaces and charging infrastructure.

News#infosecnews#redditGermany+6

A critical zero-day vulnerability in Gladinet file-sharing software was recently fixed after being actively exploited. The flaw allowed attackers to compromise affected systems, posing significant risks to confidentiality, integrity, and availability. Although specific technical details and affected versions are not disclosed, the exploit was urgent enough to warrant immediate patching. European organizations using Gladinet software for file sharing are at risk of data breaches and operational disruptions. Mitigation requires prompt patch application and enhanced monitoring of file-sharing activities. Countries with higher adoption of Gladinet or strategic industries relying on secure file sharing are more likely to be targeted. Given the active exploitation and critical severity, organizations must prioritize remediation to prevent potential damage. No CVSS score is available, but the threat is assessed as critical due to its impact and exploitation status.

North Korea's Chollima hacker group is deploying BeaverTail and OtterCookie malware as part of a job scam campaign. These malware families are used to compromise victims who respond to fraudulent job offers, enabling espionage and data theft. The campaign leverages social engineering to trick targets into executing malicious payloads. While no known exploits are currently active in the wild, the threat poses a medium severity risk due to its potential impact on confidentiality and organizational security. European organizations, especially those with remote hiring processes or in strategic sectors, could be targeted. Mitigation requires enhanced email filtering, user awareness training focused on job scams, and endpoint detection tuned for these malware signatures. Countries with significant exposure to North Korean cyber activities and large multinational corporations are at higher risk. The threat is medium severity given the moderate impact and social engineering exploitation vector without direct zero-day exploits or widespread automation.

Malware#infosecnews#redditGermany+7

PostgreSQL 13 reached its end of life (EOL) status, meaning it will no longer receive security updates or patches from the maintainers. Organizations continuing to use PostgreSQL 13 beyond its EOL date risk exposure to unpatched vulnerabilities that could compromise data confidentiality, integrity, and availability. This situation is particularly relevant for European organizations relying on PostgreSQL 13 in critical applications. Without updates, attackers may exploit known or newly discovered vulnerabilities, increasing the risk of data breaches or service disruptions. Mitigation requires timely upgrading to supported PostgreSQL versions and implementing compensating controls such as enhanced monitoring and network segmentation. Countries with significant PostgreSQL adoption and critical infrastructure relying on this database are at higher risk. Given the lack of direct exploits currently in the wild but the potential for future exploitation, the threat severity is assessed as medium. Defenders should prioritize migration planning and risk assessment to avoid exposure after PostgreSQL 13's EOL.

News#infosecnews#redditGermany+7

A new tech support scam is leveraging the Microsoft logo to create a fake browser lock screen, tricking users into believing their system is compromised. This phishing attack aims to steal sensitive data by convincing victims to contact fraudulent support services. The scam does not exploit software vulnerabilities but relies on social engineering and visual deception. It has been recently reported on Reddit and covered by hackread.com, indicating emerging awareness but minimal current discussion or exploitation. European organizations and users are at risk due to the widespread use of Microsoft products and browsers. The scam's impact includes potential data theft, financial loss, and reputational damage. Mitigation requires user education, browser security enhancements, and blocking known scam domains. Countries with high Microsoft product adoption and significant digital infrastructure are most likely to be targeted. Given the ease of exploitation and potential data compromise without technical exploitation, the threat severity is assessed as medium.

Phishing#infosecnews#redditGermany+8

F5 has released high-priority security patches for its BIG-IP product line to address vulnerabilities that were disclosed following the theft of security details. Although no known exploits are currently active in the wild, the vulnerabilities are considered serious and could potentially allow attackers to compromise affected systems. The patches are critical for organizations using BIG-IP devices, which are widely deployed for application delivery and network security. European organizations relying on F5 BIG-IP infrastructure should prioritize patching to prevent potential exploitation. The threat primarily impacts confidentiality and integrity, with possible availability concerns if exploited. No specific affected versions or technical details were provided, limiting precise risk assessment. The threat severity is assessed as high due to the nature of the vulnerabilities and the critical role of BIG-IP in network environments. Countries with significant F5 BIG-IP deployments and critical infrastructure are at greater risk. Immediate mitigation involves applying the official patches and monitoring for suspicious activity related to BIG-IP devices.

News#infosecnews#redditGermany+7

F5 Networks has confirmed a nation-state sponsored breach resulting in the theft of source code and vulnerability data. The breach potentially exposes critical information about F5's products, including details that could facilitate remote code execution (RCE) attacks. Although no known exploits are currently active in the wild, the stolen data significantly raises the risk of future targeted attacks. European organizations using F5 products, especially those relying on F5 BIG-IP and related security appliances, face increased risk of compromise. The breach highlights the need for immediate review of F5 deployments and enhanced monitoring for suspicious activity. Mitigation requires not only patching once updates are available but also implementing strict network segmentation and anomaly detection. Countries with high adoption of F5 technology and strategic infrastructure are most vulnerable. The threat is assessed as high severity due to the sensitivity of stolen data, potential for exploitation without authentication, and broad impact scope. Defenders must prioritize threat intelligence sharing and proactive defenses to mitigate emerging risks from this breach.