A sophisticated social engineering campaign exploits Microsoft Teams' 'Chat with Anyone' feature to impersonate IT support and trick users into initiating Quick Assist sessions. This multi-stage attack involves phishing, malware deployment (notably an infostealer named 'updater.exe'), and reconnaissance to steal credentials and potentially exfiltrate data. The threat actors leverage legitimate collaboration tools to bypass traditional security controls. Organizations are advised to disable the vulnerable Teams feature, enforce multi-factor authentication, and adopt Zero Trust principles to mitigate risks. No CVSS score is assigned, but the attack poses a medium severity risk due to its credential theft focus and social engineering complexity.
Shai-Hulud V2 is an advanced malware campaign targeting the npm software supply chain, compromising over 700 npm packages and creating more than 27,000 malicious GitHub repositories. It introduces sophisticated techniques including pre-install phase execution, persistent backdoors via self-hosted GitHub Actions runners, credential harvesting and recycling across victims, and a destructive failsafe mechanism. The malware exfiltrates data through GitHub and propagates within the npm ecosystem, also exploiting Azure DevOps build agents. This supply chain attack enables persistent remote code execution and widespread credential theft without requiring user interaction. European organizations relying on npm packages and GitHub Actions for CI/CD pipelines face significant risks of data breaches, system compromise, and operational disruption. Mitigation requires enhanced supply chain security practices, strict GitHub Actions runner controls, credential hygiene, and proactive monitoring for anomalous activity. Countries with strong software development sectors and high npm usage, such as Germany, France, the UK, and the Netherlands, are particularly vulnerable. Given its broad impact and advanced persistence mechanisms, the threat severity is assessed as high.
The Lumma infostealer is a sophisticated malware distributed as Malware-as-a-Service, targeting Windows systems. It primarily steals sensitive data such as browser credentials, cryptocurrency wallets, and VPN/RDP accounts. Lumma is often used in the initial stages of multi-vector attacks, including ransomware and network breaches. The malware is distributed through phishing sites, disguised as pirated software, and uses complex techniques like NSIS packaging, AutoIt scripts, and process hollowing to evade detection. To combat this threat, organizations should implement behavior-based detection systems and integrate threat intelligence into their security strategies.
The Shai-hulud 2.0 campaign is an advanced malware operation targeting cloud platforms (AWS, GCP, Azure) and developer ecosystems by stealing credentials and secrets. It automates backdooring of NPM packages maintained by victims, enabling rapid supply chain propagation. The malware abuses GitHub Actions workflows for command-and-control and secret exfiltration, leveraging cloud secret management services and destructive failsafes to maintain stealth and persistence. This campaign threatens the confidentiality and integrity of cloud and developer environments, potentially impacting thousands of downstream users. It requires no known exploits in the wild but uses sophisticated tactics to evade detection. European organizations relying heavily on cloud services and open-source development are at risk, especially those with significant use of NPM packages and GitHub repositories. The threat severity is assessed as high due to the broad impact on supply chains and credential theft without requiring user interaction. Immediate mitigation includes securing cloud credentials, auditing GitHub workflows, and monitoring supply chain dependencies for unauthorized changes.
FlexibleFerret is a sophisticated macOS malware campaign leveraging fake job assessment scams and social engineering to infect victims. It uses multi-stage attacks starting with JavaScript files on fraudulent recruitment websites that trick users into executing shell commands. These commands download and run a Golang backdoor that establishes persistence, enabling data theft and remote control. The malware can collect system info, steal Chrome credentials, upload/download files, and execute arbitrary commands. Attackers exfiltrate stolen data via Dropbox, complicating detection. The campaign is attributed to DPRK-aligned threat actors and targets macOS users globally. No CVSS score exists, but the threat is medium severity due to social engineering reliance and macOS focus. European organizations with macOS endpoints, especially in tech and government sectors, face risks. Mitigations include user education on phishing, restricting script execution, monitoring unusual Dropbox traffic, and deploying endpoint detection tuned for macOS threats.
This analysis examines the latest attack flow of the KimJongRAT variant, attributed to the North Korean threat actor Kimsuky. The malware has evolved to include both PE-based and PowerShell-based attack chains, which have been merged into a single workflow. The attackers use phishing emails for initial access, leveraging GitHub and Google Drive for malware distribution. The malware exfiltrates sensitive data including browser credentials, system information, and keystrokes. Additional activities by the same actor include credential theft through phishing sites and spear-phishing campaigns targeting South Korean users. The analysis provides evidence supporting the attribution to Kimsuky and highlights the ongoing development of variants and infrastructure, indicating successful attacks.
A malware campaign targeting WhatsApp users primarily in Brazil uses WhatsApp's 'View Once' message feature to deliver malicious ZIP archives containing VBS or HTA files. These files execute PowerShell scripts to download additional payloads, including scripts that steal WhatsApp user data and an MSI installer deploying the Astaroth banking trojan. The campaign evolved from IMAP-based to HTTP-based command and control communication and leverages Selenium Chrome WebDriver and the WPPConnect JavaScript library to hijack WhatsApp Web sessions, steal session tokens and contacts, and distribute spam. Over 250 victims have been identified, with 95% located in Brazil and some impact noted in Austria. The attack enables credential theft, session hijacking, persistence, and financial fraud through banking trojan deployment. No CVE or known exploits in the wild are reported, and the campaign is rated medium severity. Defenders should focus on user awareness, endpoint detection of PowerShell and script execution, and monitoring for suspicious WhatsApp Web activity.
In October 2025, a wave of sophisticated cyber attacks targeted corporate environments, leveraging phishing campaigns exploiting trusted platforms like Google Careers and ClickUp, abusing Figma for credential theft, and deploying the LockBit 5.0 ransomware variant against ESXi and Linux systems. Attackers used legitimate cloud services and multi-stage redirection to evade detection, while a new phishing kit named TyKit emerged. These campaigns threaten corporate credentials, infrastructure integrity, and data confidentiality across multiple sectors. The attacks do not require known exploits in the wild but rely heavily on social engineering and abuse of trusted platforms. Security operations centers (SOCs) must enhance detection capabilities, harden access controls, and employ advanced threat intelligence to mitigate these evolving threats. The overall severity is medium, reflecting the complexity and multi-vector nature of the attacks but without widespread exploitation of zero-day vulnerabilities. European organizations, especially those using affected platforms and cloud services, face significant risks from credential theft and ransomware infection.
Herodotus is a newly discovered Android malware designed to perform device takeover by mimicking human behavior to evade biometric and automated detection. It is distributed via side-loading and targets financial organizations and cryptocurrency wallets, with active campaigns observed in Italy and Brazil and potential for global spread. The malware is offered as Malware-as-a-Service and is linked to the Brokewell malware family. It steals credentials and remotely controls infected devices, using randomized delays between inputs to simulate human interaction. This behavior mimicry complicates detection by security solutions relying on behavioral analysis. The malware’s focus on financial targets and crypto wallets poses significant risks to confidentiality and financial integrity. European organizations, especially in Italy and Poland, are currently targeted and should prepare for potential expansion. Mitigation requires advanced layered security, including strict app installation policies, behavioral anomaly detection tuned for such mimicry, and user education on side-loading risks.
A financially motivated Vietnamese threat actor group UNC6229 is conducting a campaign using fake job postings on legitimate platforms to target remote workers in digital advertising and marketing. They create credible fake company profiles and lure victims with attractive remote job offers. Upon victim engagement, they deliver malware attachments or phishing links, often leveraging legitimate business and CRM platforms to increase trust. The goal is to steal credentials and compromise high-value corporate and digital advertising accounts. The campaign relies heavily on social engineering and victim-initiated contact. Indicators include malware hashes and a suspicious domain (staffvirtual.website). This medium-severity threat poses risks to confidentiality and integrity of corporate accounts, especially in organizations with remote digital advertising staff.
Tykit is a newly identified phishing kit targeting Microsoft 365 accounts, active since May 2025. It uses SVG files as delivery vectors and a multi-stage attack chain to mimic Microsoft login pages and steal credentials. The kit employs evasion techniques including Cloudflare Turnstile anti-bot protection and basic anti-debugging measures. It primarily targets industries such as finance, construction, IT, professional services, government, and telecom, with victims globally including the EMEA region. Stolen credentials are exfiltrated via API calls to attacker-controlled servers. The campaign requires user interaction through phishing but does not require prior authentication. This threat poses a medium severity risk due to its potential impact on confidentiality and the widespread use of Microsoft 365 in Europe.
A unique phishing campaign has been identified, urging users to install a Chrome extension through an attached file. The threat actor entices victims with the promise of a $50,000 prize and privacy protection. The malicious extension, disguised as a MAC spoofer, actually captures user credentials when logging into various services. The campaign uses social engineering techniques and a seemingly legitimate domain to appear trustworthy. The extension is manually installed, bypassing the Chrome Web Store. Analysis of the extension's files revealed its true purpose of sending captured information to the attacker's server. This case highlights the importance of human analysis in detecting threats that bypass automated security solutions.
This threat report highlights ransomware attacks disproportionately impacting small businesses, emphasizing both financial and psychological damage. It details a new malware campaign by the North Korean group Famous Chollima, which targets job seekers with trojanized applications to steal credentials and cryptocurrency. The campaign employs multiple tactics including credential dumping, phishing, and malware execution techniques. The report stresses the importance of empathetic leadership and comprehensive incident response plans that address technical and human factors. Indicators include multiple malware hashes linked to this campaign. The threat is medium severity due to its targeted nature, impact on confidentiality and availability, and the exploitation complexity. European small businesses, especially those with limited cybersecurity resources, are at heightened risk. Mitigation requires tailored incident response, user awareness focused on job seeker scams, and credential protection strategies. Countries with significant small business sectors and exposure to North Korean threat activity are most likely affected.
A phishing campaign is impersonating LastPass by sending scam emails with alarming subjects like 'We Have Been Hacked' to trick users into clicking malicious links. These links lead to fake websites hosted on domains such as lastpassdesktop.com, designed to steal credentials and secret keys, potentially compromising users' password vaults. LastPass has confirmed it has not been breached and is actively working with partners like Cloudflare to take down these fraudulent domains and warn users. Similar phishing attacks have targeted other password managers, increasing the risk to users relying on these services. The campaign leverages social engineering tactics to create urgency and exploit trust in the LastPass brand. No direct system vulnerabilities are exploited, but the threat targets user credentials through deception. European organizations using LastPass or similar password managers are at risk of credential theft if users fall for these scams. Mitigation requires user education, domain blocking, and enhanced email filtering to detect and prevent phishing attempts.
Maverick is a banking Trojan targeting Brazilian users via a large-scale WhatsApp distribution campaign. It starts with a malicious LNK file sent through WhatsApp, leading to a fileless infection chain. The malware uses the WPPConnect project to automate spreading through hijacked WhatsApp accounts. It monitors multiple Brazilian banks, cryptocurrency exchanges, and a payment platform to steal banking credentials. Maverick employs advanced evasion techniques including AI-assisted code development and shares traits with the Coyote banking Trojan. The campaign is notable for its worm-like propagation and exploitation of a widely used messaging platform.
A recent malware campaign uses SEO poisoning on Bing to distribute a trojanized Ivanti Pulse Secure VPN client via lookalike domains. Users are tricked into downloading a malicious MSI installer that steals VPN credentials from the connectionstore.dat file. Stolen credentials are exfiltrated to a command and control server hosted on Azure infrastructure. The attack employs signed executables and referrer-based conditional content delivery to evade detection. This credential theft technique has been linked to subsequent Akira ransomware deployments. Organizations are advised to implement multi-factor authentication, conduct user awareness training, and monitor for suspicious network and endpoint activity. No CVE or known exploits in the wild are reported yet. The threat poses a medium severity risk due to credential compromise and potential ransomware follow-on attacks. European organizations using Ivanti Pulse Secure VPN are at risk, especially in countries with high adoption of this VPN solution and critical infrastructure sectors.
A financially motivated cybercrime operation has been identified, targeting users with over 80 spoofed domain names and lure websites. The campaign, which began in September 2024, focuses on government tax sites, consumer banking, age 18+ social media content, and Windows assistant applications. The actors use these domains to deliver Android and Windows trojans, likely for credential theft. The operation employs common techniques such as spoofed domains and lure websites, prioritizing scale and conversion rates over technical sophistication. The most common lures exploit curiosity and desire, making victims less likely to report infections. Users are advised to be cautious when encountering unfamiliar links or download prompts.
Two malicious files were discovered on a compromised WordPress website, designed to manipulate administrator accounts and maintain unauthorized access. The first file, disguised as a plugin called 'DebugMaster Pro', created a secret admin user and communicated with a command and control server. The second file, 'wp-user.php', ensured a specific admin user with a known password was always present. Both files worked together to create a robust system for persistent access, allowing attackers to control the site, inject spam, redirect visitors, or steal information. The malware also injected malicious scripts for visitors and tracked admin IPs. Cleaning requires removing the files, auditing accounts, resetting credentials, and hardening the site against reinfection.
A threat actor exploited a SonicWall VPN vulnerability to gain initial access to an organization's network. The attacker discovered plaintext Huntress recovery codes on a user's desktop, allowing them to bypass MFA and access the Huntress portal. They then proceeded to close active incident reports and uninstall Huntress agents from compromised systems. This incident highlights the critical importance of securely storing credentials and recovery codes. The attacker also exported certificates from the domain controller, potentially for further privilege escalation or persistence. The compromise was detected by Huntress' Security Operations Center, which initiated a mass isolation response to contain the threat. This case emphasizes the need for proper credential management and the risks associated with storing sensitive information in easily accessible plaintext files.
A new malware campaign called EvilAI is spreading globally by disguising itself as legitimate AI-enhanced productivity tools. The malware uses AI-generated code and professional interfaces to evade detection, targeting organizations across sectors like manufacturing, government, and healthcare. It exploits Node.js to execute malicious JavaScript, establishes persistence through scheduled tasks and registry modifications, and communicates with command-and-control servers using encrypted channels. EvilAI enumerates installed software, terminates browser processes, and duplicates credential data. It employs sophisticated obfuscation and anti-analysis techniques to hinder reverse engineering. The malware acts as an initial access vector, potentially deploying additional payloads. This campaign highlights how AI is being weaponized to create increasingly stealthy and adaptive malware threats.
