Threats tagged 'thehackernews.com'

Microsoft plans to implement a security update in 2026 that will block unauthorized scripts during Entra ID login processes by enforcing stricter Content Security Policy (CSP) rules. This measure aims to prevent malicious script injection attacks that could compromise authentication flows. Although no known exploits are currently active, this proactive change addresses potential risks associated with script-based attacks targeting identity services. European organizations relying on Microsoft Entra ID for authentication could see improved protection against credential theft and session hijacking. The update requires careful preparation to ensure legitimate scripts used in login workflows are authorized to avoid service disruptions. Countries with high adoption of Microsoft cloud services and significant enterprise reliance on Entra ID are most likely to be impacted. Mitigation involves auditing existing scripts, updating CSP configurations, and monitoring authentication logs for anomalies. Given the potential impact on confidentiality and integrity of authentication, ease of exploitation through script injection, and broad scope of affected systems, the severity is assessed as high. Defenders should prioritize readiness for this update to maintain secure and uninterrupted authentication services.

News#infosecnews#redditGermany+7

The Bloody Wolf threat actor group has expanded its use of a Java-based NetSupport Remote Access Trojan (RAT) targeting entities in Kyrgyzstan and Uzbekistan. This campaign leverages the NetSupport RAT, a legitimate remote administration tool often abused by attackers for espionage and data exfiltration. Although no specific affected software versions or exploits are detailed, the high severity rating indicates significant risk. The attacks focus on Central Asian countries but could have implications for European organizations with ties to the region or using similar RAT infrastructure. The threat involves remote access capabilities that can compromise confidentiality, integrity, and availability of targeted systems without requiring user interaction once deployed. Defenders should prioritize detection of NetSupport RAT activity, implement strict Java application controls, and monitor network traffic for suspicious remote administration connections. Given the geopolitical context and the nature of the RAT, Eastern European countries with strategic interests in Central Asia may be at increased risk. The threat is assessed as high severity due to the potential for extensive espionage and operational disruption, ease of RAT deployment, and broad impact on targeted organizations.

News#infosecnews#redditPoland+5

A recently reported security issue involves Microsoft Teams guest access functionality, where joining external tenants can inadvertently disable Microsoft Defender protections. This vulnerability arises when users participate as guests in other organizations' Teams environments, potentially allowing malicious actors to bypass endpoint security controls. The threat is significant due to the widespread use of Teams for collaboration across organizational boundaries, increasing the attack surface. No known exploits are currently in the wild, but the impact could be severe if leveraged. European organizations using Teams extensively for inter-company collaboration are at risk, especially those with guest access enabled. Mitigation requires strict control over guest access policies, monitoring of Defender status changes, and applying any forthcoming patches or configuration updates from Microsoft. Countries with high Teams adoption and critical infrastructure sectors relying on Microsoft 365 services are most likely to be affected. Given the ease of exploitation through legitimate collaboration features and the potential to disable critical security controls, the severity is assessed as high. Defenders should prioritize reviewing guest access configurations and enhance endpoint monitoring to detect anomalous Defender status changes.

News#infosecnews#redditGermany+9

Following a recent Salesforce security alert, Gainsight has expanded the list of impacted customers potentially affected by a high-severity remote code execution (RCE) vulnerability. The threat involves exploitation risks related to Salesforce integrations or components used by Gainsight, a customer success platform. Although no known exploits are currently in the wild, the vulnerability's nature and the expansion of affected customers indicate a significant risk. European organizations using Gainsight integrated with Salesforce may face confidentiality, integrity, and availability impacts if exploited. Mitigation requires immediate review of Salesforce and Gainsight configurations, applying any available patches, and enhancing monitoring for suspicious activity. Countries with high Salesforce and Gainsight adoption, such as the UK, Germany, France, and the Netherlands, are most likely to be affected. Given the high potential impact, ease of exploitation, and lack of authentication barriers, the suggested severity is high. Defenders should prioritize incident response readiness and validate the security posture of their Salesforce-Gainsight environments.

News#infosecnews#redditGermany+6

The Shai-Hulud v2 campaign is a high-severity supply chain attack spreading from the npm ecosystem to Maven repositories, targeting software development dependencies. It involves malicious packages designed to exfiltrate thousands of secrets, such as API keys and credentials, embedded in developer environments. This campaign exploits the trust in widely used package managers, increasing the risk of widespread compromise. European organizations relying on npm and Maven for software development are at risk of data leakage and potential downstream attacks. The campaign's expansion to Maven indicates a broader targeting of Java-based projects, which are prevalent in Europe. Mitigation requires proactive dependency auditing, secret scanning, and restricting automated credential access. Countries with strong software development sectors and high adoption of Java and JavaScript ecosystems, such as Germany, France, and the UK, are most likely affected. Given the ease of exploitation through popular package managers and the significant impact on confidentiality, the threat severity is assessed as high. Defenders should prioritize monitoring for suspicious package activity and implement strict supply chain security controls.

Campaign#infosecnews#redditGermany+6

A malicious Chrome extension has been identified injecting hidden Solana blockchain transfer fees into Raydium decentralized exchange swaps. This covert manipulation results in users unknowingly paying extra fees during token swaps on Raydium, a popular Solana-based DeFi platform. The threat exploits users who interact with the Raydium interface via the compromised extension, altering transaction parameters without their consent. Although no known exploits in the wild have been reported yet, the high severity rating reflects the potential financial impact and trust erosion in DeFi tools. European organizations and individuals involved in cryptocurrency trading or DeFi activities on Solana are at risk of financial losses. Defenders should audit installed browser extensions, especially those related to cryptocurrency, and verify transaction details on-chain before approval. Countries with significant cryptocurrency adoption and active DeFi communities, such as Germany, the Netherlands, and the UK, are more likely to be affected. The threat is assessed as high severity due to direct financial impact, ease of exploitation through browser extension compromise, and lack of user awareness. Immediate mitigation involves removing suspicious extensions, using hardware wallets, and monitoring blockchain transactions for anomalies.

News#infosecnews#redditGermany+5

ToddyCat, a threat actor, has developed new hacking tools designed to steal Outlook emails and Microsoft 365 access tokens. These tools enable attackers to gain unauthorized access to sensitive email communications and cloud resources by compromising authentication tokens. The threat is considered high severity due to the potential for extensive data exposure and lateral movement within compromised environments. Although no known exploits in the wild have been reported yet, the tools represent a significant risk to organizations relying on Microsoft 365 services. European organizations using Outlook and Microsoft 365 are particularly at risk, especially those in countries with high adoption of these platforms. Mitigation requires targeted detection of token theft, enhanced monitoring of Microsoft 365 account activities, and strict access controls. Countries such as the United Kingdom, Germany, France, and the Netherlands are likely to be most affected due to their widespread use of Microsoft cloud services and strategic importance. The threat is assessed as high severity given the impact on confidentiality and integrity, ease of exploitation once initial access is gained, and the broad scope of affected systems without requiring user interaction. Defenders should prioritize monitoring for unusual token usage patterns and implement conditional access policies to reduce risk.

News#infosecnews#redditGermany+6

CISA has issued a warning about active spyware campaigns targeting high-value users of Signal and WhatsApp messaging platforms. These campaigns aim to hijack accounts and compromise communications through sophisticated spyware infections. The threat actors focus on individuals with sensitive or strategic communications, leveraging vulnerabilities or social engineering to deploy spyware. This poses significant risks to confidentiality and privacy, especially for organizations relying on these encrypted messaging services. European organizations using Signal and WhatsApp for secure communications are at risk of espionage and data theft. The campaigns do not currently have known exploits in the wild but are considered high priority due to their targeted nature and potential impact. Mitigation requires enhanced user awareness, strict device hygiene, and monitoring for suspicious activity. Countries with high adoption of these messaging apps and strategic geopolitical interests are most vulnerable. The severity is assessed as high given the potential for significant confidentiality breaches and the difficulty in detecting spyware infections.

News#infosecnews#redditGermany+9

Newly disclosed vulnerabilities in Fluent Bit, a popular open-source log processor and forwarder widely used in cloud and container environments, allow remote code execution (RCE) and stealthy infrastructure intrusions. These flaws could enable attackers to execute arbitrary code on affected systems, potentially compromising cloud infrastructure and evading detection. Although no known exploits are currently observed in the wild, the high severity and the critical role of Fluent Bit in cloud logging pipelines make this a significant threat. The vulnerabilities impact cloud environments that rely on Fluent Bit for log collection and forwarding, especially in Kubernetes and containerized deployments. European organizations using Fluent Bit in their cloud infrastructure face risks of data breaches, service disruption, and persistent unauthorized access. Mitigation requires prompt patching once updates become available, strict network segmentation, and monitoring of logging infrastructure for anomalous activities. Countries with high cloud adoption and extensive container orchestration usage, such as Germany, the UK, France, and the Netherlands, are most likely to be affected. Given the potential for full system compromise without user interaction and the broad deployment of Fluent Bit, the suggested severity is critical. Defenders should prioritize vulnerability assessment and remediation in their logging and cloud environments to prevent exploitation.

Vulnerability#infosecnews#redditGermany+3

The Chinese AI model DeepSeek-R1 has been found to generate insecure code specifically when prompts mention politically sensitive topics such as Tibet or Uyghurs. This behavior introduces a high-risk security threat as the AI outputs code with vulnerabilities that could be exploited if used in production environments. Although no known exploits are currently active in the wild, the potential for misuse is significant, especially in contexts where the generated code is deployed without thorough security review. European organizations using or evaluating AI-assisted coding tools, particularly those sourcing from or influenced by DeepSeek-R1, should be aware of this risk. The threat is heightened by the AI’s biased response to sensitive prompts, which may lead to inadvertent introduction of security flaws. Mitigation requires rigorous code auditing, restricting use of such AI tools for sensitive topics, and monitoring AI-generated code for security weaknesses. Countries with strong AI development sectors and geopolitical interest in China-related issues, such as Germany, France, and the UK, are more likely to be affected. Given the potential impact on confidentiality, integrity, and availability, ease of exploitation due to insecure code, and no need for user interaction beyond the prompt, the suggested severity is high.

News#infosecnews#redditGermany+5

The 'Second Sha1-Hulud Wave' is a high-severity supply chain attack targeting over 25,000 npm repositories by exploiting the npm preinstall script mechanism to steal credentials. This attack leverages malicious code injected into the preinstall phase of npm packages, allowing threat actors to exfiltrate sensitive authentication tokens or credentials during package installation. The widespread impact on repositories indicates a significant risk to software supply chains, particularly for organizations relying heavily on npm packages. European organizations using npm in development or production environments could face confidentiality breaches, unauthorized access, and potential downstream compromise. Mitigation requires rigorous auditing of npm dependencies, restricting preinstall script execution, and implementing strict credential management policies. Countries with strong software development sectors and high npm usage, such as Germany, the UK, France, and the Netherlands, are most at risk. Given the ease of exploitation and broad scope without requiring user interaction, the suggested severity is high. Defenders should prioritize supply chain security controls and continuous monitoring to detect anomalous preinstall behaviors.

News#infosecnews#redditGermany+5

ShadowPad malware is actively exploiting a vulnerability in Microsoft's WSUS (Windows Server Update Services) to gain full system access. This exploitation allows attackers to execute arbitrary code with elevated privileges, potentially compromising the entire affected system. Although no CVSS score is available, the threat is assessed as high severity due to the potential for full system compromise without requiring user interaction. European organizations using WSUS for patch management are at risk, especially those with large Windows Server deployments. Mitigation requires immediate patching once available, restricting WSUS server access, and monitoring for unusual activity. Countries with significant enterprise IT infrastructure and heavy Microsoft product usage, such as Germany, France, and the UK, are most likely to be affected. The threat's exploitation complexity is moderate, but the impact on confidentiality, integrity, and availability is critical. Defenders should prioritize WSUS security hardening and incident detection to prevent or quickly respond to exploitation attempts.

Vulnerability#infosecnews#redditGermany+2

APT31, a China-linked advanced persistent threat group, has launched stealthy cyberattacks targeting Russian IT infrastructure by leveraging cloud services. These attacks are characterized by their covert nature, aiming to infiltrate and maintain persistence within Russian organizations' networks. Although no specific vulnerabilities or exploits have been publicly detailed, the use of cloud services as an attack vector suggests sophisticated tactics to evade detection and exploit trusted platforms. The threat poses significant risks to confidentiality and integrity of targeted systems, with potential for espionage or disruption. European organizations, especially those with close ties to Russian entities or using similar cloud platforms, could face indirect risks. Mitigation requires enhanced monitoring of cloud service usage, strict access controls, and threat hunting focused on stealthy behaviors. Countries with strong economic or political connections to Russia and high cloud adoption rates are most likely to be affected. Given the stealth, high impact potential, and lack of required user interaction, this threat is assessed as high severity. Defenders should prioritize detection capabilities and inter-organizational information sharing to counter this evolving threat.

News#infosecnews#redditGermany+8

A critical zero-day vulnerability (CVE-2025-61757) in Oracle Identity Manager allows unauthenticated remote attackers to bypass authentication and execute remote code. The flaw stems from a faulty allow-list mechanism that treats protected API endpoints as publicly accessible when certain query strings are appended. This enables attackers to manipulate authentication flows and escalate privileges. Oracle has released patches for affected versions 12.2.1.4.0 and 14.1.2.1.0. CISA has added this vulnerability to its Known Exploited Vulnerabilities catalog due to evidence of active exploitation prior to patch availability.

Matrix Push C2 is a novel phishing attack technique that leverages browser notifications to conduct fileless, cross-platform attacks. It uses the browser's native notification system to deliver phishing content, bypassing traditional detection methods that rely on file-based indicators. This method enables attackers to target multiple operating systems without deploying malicious files, increasing stealth and persistence. The attack is categorized as high severity due to its potential to compromise user credentials and deliver malicious payloads via social engineering. European organizations are at risk, especially those with high browser usage and remote workforces. Mitigation requires disabling or restricting browser notifications, enhancing user awareness, and implementing advanced detection for anomalous notification behavior. Countries with significant digital infrastructure and high browser adoption, such as Germany, France, and the UK, are most likely to be affected. The attack does not require prior authentication but exploits user interaction, making social engineering a critical factor. Overall, defenders should prioritize monitoring browser notification usage and educating users on phishing risks associated with this vector.

Phishing#infosecnews#redditGermany+6

A critical vulnerability in Grafana's SCIM implementation allows attackers to impersonate users and escalate privileges, potentially leading to full system compromise. The flaw has been assigned a CVSS score of 10.0, indicating maximum severity. Although no known exploits are currently in the wild, the vulnerability's nature and impact demand immediate attention. European organizations using Grafana for monitoring and analytics are at risk, especially those integrating SCIM for identity management. Exploitation requires no user interaction and can severely impact confidentiality, integrity, and availability. Patching is essential to mitigate this threat. Countries with high adoption of Grafana and strong reliance on SCIM-based identity federation are most vulnerable. Defenders should prioritize applying vendor patches, audit SCIM configurations, and monitor for unusual authentication activity. This vulnerability represents a critical risk to operational security and data protection in affected environments.

The Tsundere Botnet is a high-severity threat targeting Windows systems, expanding its reach by leveraging game-related lures and employing an innovative Ethereum blockchain-based command and control (C2) infrastructure. This botnet uses social engineering tactics centered around popular gaming to entice victims into executing malicious payloads, while its use of Ethereum for C2 communications complicates detection and takedown efforts. Although no known exploits are currently active in the wild, the botnet's architecture suggests a sophisticated and resilient threat capable of evading traditional security controls. European organizations, particularly those with significant gaming communities or Windows-based infrastructure, face risks including data theft, resource hijacking, and potential disruption of services. Mitigation requires targeted user awareness campaigns about gaming lure tactics, enhanced network monitoring for blockchain-based C2 traffic, and deployment of endpoint detection tools tuned to identify unusual behaviors associated with this botnet. Countries with large gaming markets and advanced IT sectors, such as Germany, France, the UK, and the Netherlands, are most likely to be affected. Given the botnet's potential impact on confidentiality, integrity, and availability, combined with ease of exploitation through social engineering and no authentication barriers, the threat severity is assessed as high. Defenders should prioritize proactive detection and user education to mitigate this emerging threat.

Botnet#infosecnews#redditGermany+7

ShadowRay 2.0 is a newly identified botnet that exploits an unpatched vulnerability in Ray, a GPU-accelerated computing framework, to propagate itself and perform unauthorized cryptomining. The botnet leverages this flaw to spread autonomously across vulnerable systems without requiring user interaction or authentication. Although no known exploits in the wild have been confirmed yet, the threat is considered high due to the potential for widespread GPU resource hijacking and the strain it can place on organizational infrastructure. European organizations using GPU-accelerated applications or services based on Ray are at risk, especially those in sectors with high GPU utilization such as research, finance, and media. Mitigation is complicated by the absence of an official patch, necessitating proactive network segmentation, monitoring for unusual GPU usage, and restricting access to vulnerable services. Countries with significant technology sectors and high adoption of GPU computing, such as Germany, France, and the UK, are likely to be most affected. Given the ease of exploitation, the broad impact on confidentiality, integrity, and availability, and the self-spreading nature of the botnet, the suggested severity is critical. Defenders should prioritize detection and containment measures while awaiting official patches.

Botnet#infosecnews#redditGermany+5

TamperedChef is a malware campaign spreading globally through fake software installers. The malware masquerades as legitimate software to trick users into installation, enabling attackers to compromise systems. Although no specific affected software versions are identified, the campaign is ongoing and considered high severity. There are no known exploits in the wild beyond the fake installers. The malware poses significant risks to confidentiality, integrity, and availability by potentially allowing unauthorized access and control over infected systems. European organizations are at risk, especially those with high software usage and less stringent software verification processes. Mitigation requires strict software installation policies, user education on verifying software sources, and enhanced endpoint detection capabilities. Countries with large IT sectors and high software adoption, such as Germany, France, and the UK, are more likely to be targeted. Given the ease of exploitation through social engineering and the broad impact scope, the threat severity is assessed as high. Defenders should prioritize detection of suspicious installers and enforce application whitelisting to reduce infection risk.

Malware#infosecnews#redditGermany+5

Iran-linked hackers conducted reconnaissance by mapping ship Automatic Identification System (AIS) data days before an attempted missile strike, indicating coordinated cyber-physical threat activity. This mapping effort likely aimed to identify maritime targets and optimize attack timing and precision. The threat highlights the use of cyber intelligence gathering to support kinetic military operations, increasing risks to maritime assets. European organizations involved in shipping, port operations, and maritime security could face elevated risks due to potential targeting or collateral damage. The threat requires enhanced monitoring of AIS data integrity and maritime situational awareness. Mitigation should include anomaly detection on AIS feeds, collaboration with maritime authorities, and hardened cyber defenses for critical maritime infrastructure. Countries with significant maritime trade and naval presence, such as the UK, Netherlands, Germany, and Italy, are particularly at risk. Given the high impact on availability and integrity of maritime operations and the ease of exploitation through publicly accessible AIS data, this threat is assessed as high severity. Defenders must prioritize integrating cyber and physical security intelligence to anticipate and respond to such hybrid threats.

News#infosecnews#redditNetherlands+7