Threats tagged 'thehackernews.com'

The 'Whisper Leak' attack, uncovered by Microsoft, is a novel side-channel threat that can infer AI chat topics from encrypted traffic. This attack does not decrypt the content but uses traffic analysis techniques to identify the subject matter of AI conversations despite encryption. It poses a high risk to confidentiality, especially for organizations relying on AI chat services for sensitive communications. While no known exploits are currently active in the wild, the potential for privacy breaches is significant. European organizations using AI chat platforms could face exposure of confidential discussion topics, impacting competitive advantage and regulatory compliance. Mitigation requires advanced traffic obfuscation and network monitoring tailored to detect such side-channel leaks. Countries with high AI adoption and strict data privacy regulations are most vulnerable. The attack is rated high severity due to its impact on confidentiality, ease of exploitation via passive network observation, and broad scope affecting encrypted AI chat traffic without requiring user interaction or authentication.

Campaign#infosecnews#redditGermany+7

Chinese state-sponsored hackers are leveraging legacy vulnerabilities, such as those in Log4j and Microsoft IIS, to conduct global espionage campaigns. These attacks exploit well-known, often unpatched bugs in widely deployed software to gain unauthorized access and maintain persistence. The threat actors focus on legacy systems that remain in use due to operational constraints, turning them into espionage tools. European organizations running outdated or unpatched versions of these technologies are at significant risk. The attacks can compromise confidentiality and integrity of sensitive data, with potential impacts on national security and critical infrastructure. Mitigation requires targeted patch management, legacy system audits, and enhanced monitoring for exploitation attempts. Countries with high adoption of affected technologies and strategic geopolitical relevance are more likely targets. The threat is assessed as high severity due to the potential for widespread impact and the sophistication of the adversaries. Defenders must prioritize legacy vulnerability remediation and threat intelligence sharing to reduce exposure.

News#infosecnews#redditGermany+9

A malicious Visual Studio Code (VS Code) extension named 'Vibe-Coded' has been discovered containing built-in ransomware capabilities. This threat involves a seemingly legitimate extension that, once installed, can encrypt user files and demand ransom, leveraging the widespread use of VS Code among developers. Although no known exploits in the wild have been reported yet, the presence of ransomware functionality within a popular development tool extension poses a significant risk. European organizations using VS Code, especially those in software development and IT sectors, could face data loss and operational disruption. The threat is rated as high severity due to the potential impact on confidentiality, integrity, and availability of data, combined with the ease of exploitation through user installation. Mitigation requires strict extension vetting policies, use of trusted sources only, and enhanced endpoint protection with behavioral detection. Countries with large tech industries and high VS Code adoption, such as Germany, France, the UK, and the Netherlands, are most likely to be affected. Immediate awareness and proactive defense measures are critical to prevent compromise from this emerging ransomware threat.

Malware#infosecnews#redditGermany+5

Threat actors have begun leveraging Windows Hyper-V virtualization technology to stealthily run hidden Linux virtual machines (VMs) on compromised Windows hosts. This technique enables attackers to evade Endpoint Detection and Response (EDR) tools by isolating malicious activities within a concealed Linux VM, making detection and forensic analysis significantly more difficult. The threat does not currently have known exploits in the wild but is considered high priority due to its potential to bypass common security controls. European organizations using Windows systems with Hyper-V enabled are at risk, especially those in sectors with high virtualization adoption. Attackers exploiting this method can maintain persistence and conduct lateral movement or data exfiltration under the radar. Mitigation requires enhanced monitoring of Hyper-V activity, restricting Hyper-V usage to trusted administrators, and deploying advanced behavioral analytics capable of detecting anomalous VM creation and network traffic. Countries with high Windows and Hyper-V market penetration and strategic importance in critical infrastructure are most likely to be targeted. Given the stealthy nature and potential impact on confidentiality and integrity, this threat is assessed as high severity. Defenders should prioritize visibility into virtualization layers and integrate Hyper-V telemetry into their security monitoring frameworks.

News#infosecnews#redditGermany+7

PROMPTFLUX is a newly uncovered malware that leverages Gemini AI technology to autonomously rewrite its own code on an hourly basis, significantly complicating detection and analysis efforts. Discovered by Google and reported in November 2025, this malware represents an evolution in AI-driven threats, using continuous code mutation to evade traditional signature-based defenses. Although no known exploits are currently active in the wild, the high adaptability of PROMPTFLUX poses a substantial risk to targeted systems. European organizations, especially those in critical infrastructure and technology sectors, could face challenges in timely detection and response due to the malware's dynamic nature. Mitigation requires advanced behavioral analytics, AI-enhanced detection tools, and strict network segmentation to limit spread. Countries with high adoption of AI technologies and extensive digital infrastructure, such as Germany, France, and the UK, are likely to be most affected. Given the malware's potential impact on confidentiality, integrity, and availability, combined with its ease of autonomous code rewriting without user interaction, the threat severity is assessed as high. Defenders should prioritize monitoring for anomalous AI-driven behaviors and prepare incident response plans tailored to adaptive malware threats.

Malware#infosecnews#redditGermany+5

The U. S.government has imposed sanctions on 10 North Korean entities involved in laundering approximately $12.7 million through cryptocurrency and IT fraud schemes. These entities are part of North Korea's broader cybercrime operations aimed at evading sanctions and generating revenue. The laundering activities leverage cryptocurrency's pseudonymous nature and IT fraud tactics to obscure illicit financial flows. While no specific vulnerabilities or exploits are detailed, the threat highlights ongoing risks from state-sponsored cybercrime groups targeting global financial systems. European organizations may face indirect impacts through increased cybercrime activity, potential targeting of financial institutions, and regulatory compliance challenges. Mitigation requires enhanced monitoring of cryptocurrency transactions, collaboration with law enforcement, and strengthening of anti-money laundering (AML) controls. Countries with significant cryptocurrency markets and financial hubs, such as the UK, Germany, and the Netherlands, are more likely to be affected.

News#infosecnews#redditGermany+4

The 'SmudgedSerpent' hacking group has been reported targeting U. S.policy experts amid heightened Iran–Israel tensions. While specific technical details and indicators of compromise are not disclosed, the activity is considered high priority due to its geopolitical context and potential espionage motives. There is no evidence of known exploits in the wild or affected software versions. The threat appears focused on information gathering rather than disruptive attacks. European organizations, especially those engaged in policy, diplomatic, or intelligence sectors related to Middle Eastern affairs, could face indirect risks. Mitigation should emphasize enhanced monitoring of targeted personnel, threat intelligence sharing, and strict access controls. Countries with strong diplomatic ties or intelligence cooperation with the U. S.

News#infosecnews#redditGermany+6

A critical vulnerability has been discovered in the React Native CLI tool, potentially exposing millions of developers to remote attacks. This flaw could allow attackers to execute arbitrary code or compromise developer environments remotely. Although no known exploits are currently active in the wild, the severity is rated critical due to the widespread use of React Native in mobile app development. The vulnerability affects the CLI tool used during development, which could lead to supply chain risks if exploited. European organizations relying on React Native for app development could face significant risks including intellectual property theft, codebase compromise, and disruption of development workflows. Immediate mitigation involves monitoring official React Native channels for patches and restricting CLI tool usage to trusted networks and environments. Countries with large software development sectors and high adoption of React Native, such as Germany, the UK, France, and the Netherlands, are most likely to be impacted. Given the potential for remote exploitation without user interaction and the critical role of the CLI in development, the suggested severity is critical. Defenders should prioritize patching once available and implement strict access controls around development tools.

Breach#infosecnews#redditGermany+5

Operation SkyCloak is a recently identified cyber threat involving a Tor-enabled OpenSSH backdoor targeting defense sector organizations. The backdoor leverages Tor to anonymize command and control communications, complicating detection and attribution. Although no known exploits are currently active in the wild, the malware's design suggests a focus on stealthy, persistent access to sensitive defense infrastructure. The threat is considered high severity due to its potential impact on confidentiality and integrity within critical defense environments. European defense organizations are at risk, especially those with extensive OpenSSH deployments and strategic defense roles. Mitigation requires advanced network monitoring for Tor traffic, strict SSH access controls, and enhanced endpoint detection capabilities. Countries with significant defense industries and NATO membership are likely primary targets. Given the complexity and stealth of this backdoor, the suggested severity is high. Defenders should prioritize detection of anomalous Tor usage and review SSH configurations to prevent unauthorized backdoor implantation.

Malware#infosecnews#redditFrance+9

Google's AI tool 'Big Sleep' has identified five new high-severity vulnerabilities in Apple's Safari WebKit engine. These vulnerabilities affect the core rendering engine used by Safari and other applications on Apple platforms. Although no known exploits are currently active in the wild, the discovery highlights potential risks to confidentiality, integrity, and availability for users of Safari. The vulnerabilities have not yet been assigned CVEs or patches, and technical details remain limited. European organizations relying on Safari for web access could face targeted attacks exploiting these flaws, especially in sectors with high-value data. Mitigation requires close monitoring of Apple security advisories and rapid deployment of patches once available. Countries with significant Apple user bases and strategic technology sectors are at higher risk. The threat is assessed as high severity due to the critical nature of WebKit in web browsing, the potential for remote code execution, and the lack of current mitigations. Defenders should prioritize vulnerability management and consider temporary mitigations such as limiting Safari use or sandboxing until patches are released.

News#infosecnews#redditGermany+9

SleepyDuck is a malicious Visual Studio Code extension (VSX) that leverages the Ethereum blockchain to maintain the availability of its command and control (C2) server, making takedown efforts more difficult. This malware uses decentralized infrastructure to evade traditional detection and disruption methods. Although no known exploits are currently active in the wild, the technique represents an innovative persistence mechanism. The threat targets developers using VS Code extensions, potentially compromising development environments and sensitive code. European organizations relying heavily on VS Code in software development are at risk, especially those in critical infrastructure and technology sectors. Mitigation requires strict extension vetting, network monitoring for unusual blockchain-related traffic, and restricting extension installation policies. Countries with strong software development industries and high VS Code adoption, such as Germany, France, and the UK, are more likely to be affected. Given the medium severity, the threat impacts confidentiality and integrity with moderate exploitation complexity and no user interaction required once installed. Defenders should prioritize detection of unusual extension behavior and blockchain communication patterns to prevent persistent C2 connections.

News#infosecnews#redditGermany+5

The HttpTroy backdoor is a newly identified malware posing as a VPN invoice, used in targeted cyberattacks primarily against South Korean entities. This backdoor enables attackers to maintain persistent unauthorized access, potentially exfiltrating sensitive data or facilitating further network compromise. Although currently observed mainly in South Korea, the malware’s disguise as legitimate VPN-related communication could allow it to spread to other regions, including Europe, especially where VPN usage is prevalent. The threat is considered high severity due to its stealthy nature, targeted approach, and potential impact on confidentiality and integrity. There are no known public exploits or patches yet, complicating immediate defense. European organizations should be vigilant, particularly those with business ties to South Korea or heavy VPN usage. Mitigation requires enhanced email filtering, user awareness training focused on phishing and invoice fraud, network monitoring for unusual outbound connections, and endpoint detection capabilities tuned to detect backdoor behaviors. Countries with strong economic or technological links to South Korea and high VPN adoption rates are at greater risk. Given the malware’s ability to bypass typical defenses by masquerading as legitimate traffic and the lack of authentication barriers, the threat severity is assessed as high.

Malware#infosecnews#redditGermany+6

Researchers have uncovered two Android trojans, BankBot-YNRK and DeliveryRAT, which are designed to steal financial data from infected devices. These trojans target Android users by masquerading as legitimate applications to gain access to sensitive banking credentials and personal information. Although no known exploits are currently active in the wild, the malware poses a high risk due to its capability to compromise confidentiality and financial integrity. European organizations and individuals using Android devices for financial transactions are particularly at risk. The trojans do not require user interaction beyond installation, and they operate stealthily to avoid detection. Mitigation requires enhanced mobile security hygiene, including restricting app installations to trusted sources, employing mobile threat defense solutions, and educating users about phishing and malicious apps. Countries with high Android adoption and significant financial sectors, such as Germany, France, and the UK, are most likely to be affected. Given the potential impact on confidentiality and the ease of exploitation once installed, the threat severity is assessed as high. Defenders should prioritize monitoring for suspicious app behavior and promptly update mobile security policies to counter these trojans.

News#infosecnews#redditGermany+7

The Australian Signals Directorate (ASD) has issued a warning about ongoing attacks named BADCANDY that exploit a vulnerability in Cisco IOS XE software. These attacks target network devices running Cisco IOS XE, potentially allowing attackers to compromise device integrity and network security. Although no specific affected versions or patches have been disclosed yet, the threat is considered high severity due to the critical role of Cisco IOS XE in enterprise and service provider networks. There are currently no known exploits in the wild, but the warning indicates active exploitation attempts. European organizations relying on Cisco IOS XE infrastructure could face risks including unauthorized access, data interception, or network disruption. Mitigation requires close monitoring of Cisco advisories, network segmentation, and enhanced logging to detect suspicious activity. Countries with significant Cisco deployments and critical infrastructure, such as Germany, France, and the UK, are most likely to be impacted. Given the potential impact on confidentiality, integrity, and availability, ease of exploitation, and criticality of affected systems, the suggested severity is high. Defenders should prioritize vulnerability assessment and incident response readiness to mitigate this emerging threat.

Vulnerability#infosecnews#redditGermany+2

A critical zero-day vulnerability in VMware products is actively exploited by China-linked threat actors, as flagged by CISA. The vulnerability allows attackers to compromise affected VMware systems, potentially leading to unauthorized access and control over virtualized environments. Although specific affected versions and technical details are not disclosed, the threat is considered high priority due to active exploitation and the strategic targeting by state-affiliated hackers. European organizations using VMware virtualization infrastructure face risks of data breaches, service disruption, and espionage. Mitigation requires immediate monitoring for unusual activity, strict network segmentation of VMware management interfaces, and rapid application of vendor patches once available. Countries with high VMware adoption and strategic geopolitical interest in cyber espionage, such as Germany, France, the UK, and the Netherlands, are most likely to be targeted. The severity is assessed as critical given the potential for widespread impact, ease of exploitation without authentication, and the involvement of advanced persistent threat actors. Defenders must prioritize threat hunting and incident response readiness to mitigate this evolving threat.

Vulnerability#infosecnews#redditGermany+3

The Eclipse Foundation revoked leaked Open VSX tokens after their exposure was discovered by Wiz. These tokens could have allowed unauthorized access to Open VSX services, potentially enabling malicious actors to manipulate or disrupt the open-source extension registry. Although no known exploits are currently active in the wild, the incident highlights risks related to leaked credentials in software supply chains. European organizations relying on Open VSX for development or distribution of extensions should be aware of the potential for unauthorized access and take immediate steps to verify token security. The threat is considered high severity due to the sensitive nature of the tokens and the potential impact on software integrity and availability. Mitigation involves auditing token usage, rotating credentials, and enhancing monitoring for suspicious activity. Countries with strong open-source ecosystems and significant software development sectors, such as Germany, France, and the Netherlands, are likely to be most affected. Vigilance is required to prevent exploitation and maintain trust in open-source infrastructure.

News#infosecnews#redditGermany+5

Ten malicious npm packages have been discovered stealing developer credentials across Windows, macOS, and Linux platforms. These packages, once installed, exfiltrate sensitive authentication data, potentially compromising developer accounts and access to critical code repositories. The threat affects developers using npm, a widely adopted package manager in the JavaScript ecosystem, making it a significant risk for software supply chain security. Although no known exploits are currently active in the wild, the high severity rating underscores the potential damage if these packages are used in development environments. European organizations relying on npm for software development are at risk, especially those with large developer teams and open-source dependencies. Immediate mitigation involves auditing dependencies, removing suspicious packages, and enhancing credential security practices. Countries with strong technology sectors and high npm usage, such as Germany, the UK, France, and the Netherlands, are most likely to be impacted. The threat is assessed as high severity due to the sensitive nature of stolen credentials, ease of exploitation via package installation, and broad platform coverage without requiring user interaction beyond installing the package.

News#infosecnews#redditGermany+6

Russian threat actors are conducting targeted cyberattacks against Ukrainian organizations using stealthy living-off-the-land (LotL) techniques. These tactics leverage legitimate system tools and processes to evade detection and maintain persistence without deploying traditional malware. The attacks focus on covert operations to infiltrate networks, gather intelligence, and potentially disrupt critical infrastructure. While no specific vulnerabilities or exploits have been disclosed, the use of LotL methods complicates detection and response efforts. European organizations, especially those with close ties to Ukraine or involved in regional security and infrastructure, face elevated risks of spillover or collateral targeting. Mitigation requires enhanced monitoring of native system tools, strict access controls, and threat hunting focused on anomalous legitimate tool usage. Countries with significant geopolitical interest in the conflict and strong digital infrastructure connections to Ukraine are most likely to be affected. Given the high impact potential on confidentiality, integrity, and availability combined with stealthy exploitation and no need for user interaction, this threat is assessed as high severity. Defenders must prioritize visibility into living-off-the-land activities and strengthen cross-border intelligence sharing to counter these sophisticated attacks.

News#infosecnews#redditPoland+7

The TEE. Fail side-channel attack targets secure enclaves implemented on Intel and AMD processors using DDR5 memory, enabling attackers to extract sensitive secrets. This attack exploits vulnerabilities in the Trusted Execution Environment (TEE) design, leveraging side-channel techniques to bypass hardware protections. Although no known exploits are currently observed in the wild, the attack poses a high risk due to the critical nature of enclave security. European organizations relying on Intel and AMD CPUs with DDR5 memory for confidential computing or secure data processing are at risk of data leakage and compromise of cryptographic keys. Mitigation requires microcode and firmware updates from CPU vendors, enhanced enclave design, and strict memory access controls. Countries with significant technology sectors and extensive use of Intel/AMD hardware, such as Germany, France, and the UK, are most likely to be affected. Given the high impact on confidentiality and the complexity of exploitation, the threat severity is assessed as high. Defenders should prioritize patching, monitoring enclave behavior, and restricting access to sensitive enclave workloads.

Campaign#infosecnews#redditGermany+5

The SideWinder threat actor group has adopted a new attack chain leveraging Microsoft's ClickOnce deployment technology to target South Asian diplomats. This campaign uses ClickOnce to deliver malicious payloads, exploiting trust in legitimate Microsoft frameworks to bypass security controls. The attacks are highly targeted, focusing on diplomatic personnel, which suggests espionage motives. Although no known exploits are currently reported in the wild, the campaign's sophistication and targeting elevate its risk. European organizations with diplomatic ties or South Asian connections could face indirect risks, especially if involved in related geopolitical activities. Mitigation requires strict control over ClickOnce application execution, enhanced email filtering, and user awareness training focused on this attack vector. Countries with significant diplomatic engagement with South Asia or hosting South Asian diplomatic missions are more likely to be affected. Given the high impact on confidentiality and the ease of exploitation via social engineering, the suggested severity is high.

Campaign#infosecnews#redditGermany+7