Eurail on DanSec Daily

Cybersecurity Brief – 2026-04-10

Fri, 10 Apr 2026 00:00:00 +0000

Major Incidents or Breaches

Eurail Data Breach: Eurail B.V. confirmed a December 2025 breach affecting over 300,000 individuals. Attackers accessed names, passport numbers, and other personal information from the European travel operator’s systems.
ChipSoft Ransomware Attack: Dutch healthcare IT provider ChipSoft suffered a ransomware attack, leading to the shutdown of its website and digital services used by patients and healthcare providers.
Smart Slider 3 Pro Supply Chain Attack: Unknown threat actors compromised Nextend’s update servers to distribute a backdoored version of the Smart Slider 3 Pro plugin for WordPress and Joomla, impacting users who downloaded updates during the attack window.
MyLovely.AI Data Leak: The NSFW app MyLovely.AI exposed over 70,000 user prompts and explicit images, affecting more than 100,000 users and increasing risks of sextortion and doxxing.
Meta Employee Data Misuse: A Meta employee allegedly downloaded 30,000 private Facebook images using a custom script designed to evade internal detection, raising concerns about insider threats.

Newly Discovered Vulnerabilities

Adobe Reader Zero-Day: A zero-day vulnerability in Adobe Reader has been actively exploited via malicious PDF documents since at least December 2025. The flaw remains unpatched and is being leveraged in the wild.
EngageLab SDK Flaw (Android): A now-patched vulnerability in the EngageLab SDK, used by over 50 million Android users (including 30 million crypto wallet app installs), exposed users to potential data theft. The flaw was reported by Microsoft and has since been addressed.
‘BlueHammer’ Windows Zero-Day: A researcher under the alias ‘Chaotic Eclipse’ released a proof-of-concept exploit for a Windows zero-day (dubbed ‘BlueHammer’) that enables local privilege escalation and system takeover. The researcher cited dissatisfaction with Microsoft’s bug disclosure handling.
Palo Alto Networks and SonicWall Vulnerabilities: Both vendors patched high-severity vulnerabilities that could allow attackers to modify protected resources or escalate privileges to administrator level.
Google API Key Exposure in Android Apps: Researchers found that dozens of Android apps exposed hardcoded Google API keys, allowing unauthorised access to Gemini endpoints.

Notable Threat Actor Activity

ClipBanker Malware Campaign: Threat actors are distributing a trojanised version of Proxifier software, initiating a multi-stage infection chain leading to ClipBanker malware deployment. ClipBanker replaces copied cryptocurrency wallet addresses to steal funds.
VENOM Phishing-as-a-Service Platform: A newly identified PhaaS platform, VENOM, is being used to target C-suite executives across industries, aiming to steal Microsoft credentials via sophisticated phishing campaigns.
Palo Alto Networks Recruitment Phishing: Attackers are impersonating Palo Alto Networks recruiters in spear-phishing campaigns targeting senior job seekers, as reported by the company’s Unit 42 team.
UAT-10362 and LucidRook Malware: A previously undocumented threat cluster, UAT-10362, has been attributed to spear-phishing campaigns against Taiwanese NGOs and universities, deploying a new Lua-based malware named LucidRook.
Bitter-Linked Hack-for-Hire Campaign: A hack-for-hire group with suspected links to India targeted journalists, activists, and government officials across the Middle East and North Africa.
Google Warns of BPO-Targeted Campaigns: Google has identified campaigns by threat actor UNC6783 (linked to “Mr. Raccoon”) targeting business process outsourcing (BPO) firms to steal corporate data.
Fancy Bear (APT28) Ongoing Activity: Russia-linked APT28 (Fancy Bear) continues global operations, targeting organisations with a focus on exploiting unpatched systems.
Fake Windows Support Site: Attackers are using convincing Microsoft lookalike websites to deliver password-stealing malware to unsuspecting users.
Amazon Support Scams: A new wave of phishing campaigns is impersonating Amazon support to steal user account credentials via email and SMS.

Trends, Tools, or Tactics of Interest

AI-Driven Phishing: Attackers are leveraging AI to automate and personalise phishing campaigns, increasing their scale and effectiveness.
Shadow AI Risks in Enterprises: The unsanctioned adoption of AI tools by employees without IT oversight is introducing new security risks, including data leakage and unauthorised access.
Session Cookie Theft Mitigations: Google Chrome 146 for Windows introduces Device Bound Session Credentials (DBSC), cryptographically binding session cookies to devices to prevent infostealer malware from reusing stolen cookies.
MFA Bypass Techniques: Attackers are increasingly targeting authentication systems by leveraging stolen credentials and session tokens, highlighting limitations of traditional MFA and the need for session-aware authentication.
Obfuscated JavaScript in Phishing: Recent campaigns have used highly obfuscated JavaScript payloads delivered via phishing emails and compressed archives to evade detection.
Supply Chain Attacks on Plugin Updates: The Smart Slider 3 Pro incident underscores ongoing risks to software supply chains, particularly through compromised update mechanisms.

Regulatory or Policy Developments Affecting the Security Industry

Increased Political Campaign Security Spend: Political candidates are investing more heavily in personal and campaign security measures in response to heightened threats and targeted attacks.

Cybersecurity Brief – 2026-02-18

Wed, 18 Feb 2026 00:00:00 +0000

Major Incidents or Breaches

Eurail confirmed a data breach with millions of user records being offered for sale on cybercrime forums. The full scope of affected individuals is still under investigation.
Poland’s energy sector survived wiper attacks targeting wind and solar infrastructure, as well as a manufacturer and a heating/power plant. Russia-aligned groups are suspected.
Singapore and its four major telecommunications providers successfully fended off a zero-day attack attributed to Chinese hackers.
Microsoft Teams experienced a significant outage affecting users in the United States and Europe, causing delays and access issues.

Newly Discovered Vulnerabilities

A critical zero-day vulnerability (CVE-2026-22769) in Dell RecoverPoint has been exploited since mid-2024 by a Chinese state-backed group (UNC6201).
CISA added four security flaws to its Known Exploited Vulnerabilities (KEV) catalog due to evidence of active exploitation.
Multiple high- and critical-severity vulnerabilities were discovered in popular Visual Studio Code (VSCode) extensions, exposing over 128 million downloads to potential credential and file theft.
Google released an emergency update for Chrome to patch an actively exploited zero-day allowing code execution via malicious webpages.
Password managers including Bitwarden, LastPass, Dashlane, and 1Password were found vulnerable to vault compromise if a malicious server is present.
Notepad++ enhanced its update security with a new “double-lock” mechanism following a supply-chain compromise.
Research identified widespread exposure of secrets such as API keys in JavaScript front-end code, after scanning 5 million applications.

Notable Threat Actor Activity

Kaspersky uncovered the Keenadu Android backdoor, embedded in device firmware and Google Play apps, with links to major Android botnets. Keenadu enables data exfiltration, remote control, ad fraud, and browser hijacking via supply chain compromise.
Chinese state-backed hackers exploited a Dell zero-day (CVE-2026-22769) for espionage purposes.
A 47-year-old suspect linked to the Phobos ransomware group was arrested in Poland; authorities seized evidence including stolen credentials and server access data.
ClickFix campaigns are abusing DNS lookup commands to deliver ModeloRAT malware, adapting to bypass recent security defenses.
SmartLoader attacks are distributing a trojanized Oura MCP server to deploy StealC infostealer malware.

Trends, Tools, or Tactics of Interest

Attackers are increasingly abusing legitimate DKIM-signed emails (DKIM replay attacks) to bypass security filters and deliver scams, leveraging trusted invoice and notification templates.
Sophisticated phishing campaigns are bypassing Microsoft 365 multi-factor authentication (MFA) protections.
Remote Monitoring and Management (RMM) software is being widely abused by threat actors for stealth, persistence, and operational efficiency, often replacing traditional malware.
AI-powered assistants (including Copilot and Grok) with web access are being demonstrated as potential command-and-control (C2) proxies for malware operations.
Attackers are exploiting API vulnerabilities at greater scale and speed, with AI-driven systems amplifying potential impact.
The use of AI and context-aware tools is accelerating security operations, especially in cloud breach investigations and SOC workflows.
Three new threat groups began targeting industrial control systems (ICS/OT) in 2025, according to Dragos.
Hobbyist coding error led to the exposure of live camera feeds, microphones, and floor plans from thousands of vacuum robots, highlighting risks in IoT device security.

Regulatory or Policy Developments

Spain’s courts ordered NordVPN and ProtonVPN to block access to 16 websites facilitating illegal LaLiga football match streaming.
Ireland’s Data Protection Commission opened a formal investigation into X (formerly Twitter) over the use of its Grok AI tool to generate sexual images, focusing on data protection and regulatory compliance.

Cybersecurity Brief – 2026-02-17

Tue, 17 Feb 2026 00:00:00 +0000

Major Incidents or Breaches

Washington Hotel in Japan disclosed a ransomware attack that compromised its servers and exposed business data.
Eurail B.V. confirmed that data stolen in a breach earlier this year is now being sold on the dark web. The breach impacted traveler data for the European rail operator.
Dutch telecom provider Odido was hit by a data breach, as noted in Check Point’s weekly threat intelligence report.
Dior, Louis Vuitton, and Tiffany were fined $25 million in South Korea following data breaches linked to attacks on Salesforce instances by the Scattered LAPSUS$ Hunters group.

Newly Discovered Vulnerabilities

Google released emergency updates for Chrome, patching CVE-2026-2441, a high-severity vulnerability exploited in zero-day attacks. The flaw could allow arbitrary code execution and marks the first actively exploited Chrome zero-day patched in 2026.
CISA ordered US federal agencies to patch a vulnerability in BeyondTrust Remote Support within three days due to active exploitation.
A study identified 25 password recovery attack vectors in major cloud-based password managers, including Bitwarden, Dashlane, and LastPass, which could allow account compromise under certain conditions.

Notable Threat Actor Activity

The GS7 cyberthreat group (Operation DoppelBrand) is targeting US financial institutions by creating highly convincing fake corporate portals to steal credentials and gain remote access.
A new mobile spyware platform, ZeroDayRAT, is being advertised on Telegram, offering real-time surveillance and data theft capabilities.
Information-stealing malware has been observed targeting OpenClaw (formerly Clawdbot/Moltbot) AI agent configuration files, exfiltrating API keys, authentication tokens, and gateway credentials.
Attackers are leveraging the ClickFix attack technique, abusing DNS lookups (nslookup commands) to deliver the ModeloRAT remote access trojan to targeted systems.
A phishing campaign has been observed using fake incident reports as lures.

Trends, Tools, or Tactics of Interest

Over 260,000 Chrome users were deceived by 30 fake AI browser extensions posing as legitimate tools, indicating a continued trend in leveraging AI-themed lures for malware distribution.
The ClickFix campaign’s use of nslookup for RAT delivery highlights increased abuse of built-in system tools for malware deployment.
Infostealer malware is adapting to target secrets and configuration files associated with widely adopted AI agentic frameworks such as OpenClaw.
There is a growing focus on passwordless authentication and passkey adoption, with organisations seeking to maintain ISO/IEC 27001 compliance while moving away from traditional passwords.
Android 17 Beta introduces further secure-by-default features, strengthening privacy and app security controls.
Apple is testing end-to-end encryption for RCS messaging in the iOS 26.4 developer beta, expanding secure messaging capabilities.

Regulatory or Policy Developments

Dior, Louis Vuitton, and Tiffany were fined $25 million in South Korea for data breaches involving Salesforce, following regulatory action related to the Scattered LAPSUS$ Hunters attacks.
CISA is operating at 38% staff capacity due to the ongoing DHS shutdown, potentially impacting the agency’s ability to respond to cyber incidents.
Amazon’s Ring terminated its partnership with Flock Safety, a police surveillance technology company, following public backlash.
Lithuania is advancing national initiatives to address AI-driven cyber fraud, with the KTU Consortium outlining strategies for a safe and inclusive digital society.

Cybersecurity Brief – 2026-01-16

Fri, 16 Jan 2026 00:00:00 +0000

Major Incidents or Breaches

Grubhub confirmed a data breach involving unauthorised access to its systems, with reports of extortion demands from attackers.
Central Maine Healthcare suffered a breach impacting 145,000 individuals, with theft of patient personal, treatment, and health insurance data.
Eurail reported a breach in which hackers stole personal and reservation information of travellers.
Microsoft, in coordination with US and UK authorities, disrupted the RedVDS cybercrime infrastructure, which was used for large-scale online fraud.

Newly Discovered Vulnerabilities

Cisco patched a maximum-severity zero-day remote code execution vulnerability in Cisco AsyncOS Software for Secure Email Gateway and Secure Email and Web Manager. The flaw was exploited in the wild by a China-linked APT.
A critical misconfiguration in AWS CodeBuild was discovered, exposing AWS’s own GitHub repositories-including the AWS JavaScript SDK-to potential supply chain attacks.
A critical vulnerability (CVE-2026-23550, CVSS 10.0) in the WordPress Modular DS plugin is under active exploitation, allowing attackers to bypass authentication and gain admin-level access.
Palo Alto Networks released patches for a high-severity DoS vulnerability in GlobalProtect Gateway and Portal, which can allow unauthenticated attackers to crash firewalls without needing to log in.
A critical vulnerability in Google’s Fast Pair Bluetooth protocol (“WhisperPair”) allows attackers to hijack, track, and eavesdrop on Bluetooth audio devices. Hundreds of millions of devices are impacted.
Researchers disclosed “StackWarp,” a new attack affecting AMD processors that can enable remote code execution inside confidential VMs.
Three critical vulnerabilities were identified in Delta Industrial PLCs, with debate among experts regarding their severity.
Siemens, Schneider, Aveva, and Phoenix Contact released advisories addressing vulnerabilities in their industrial control products as part of ICS Patch Tuesday.

Notable Threat Actor Activity

China-linked APT groups exploited the Cisco Secure Email Gateway zero-day prior to patch release.
Gootloader malware is now using malformed ZIP archives split into up to 1,000 parts to evade detection during delivery.
Researchers highlighted the VoidLink Linux malware framework, which targets cloud and container environments for long-term persistence using loaders, implants, and rootkits.
Intellexa’s Predator spyware was observed using vendor-controlled command-and-control (C2) infrastructure, with failed deployments and thwarted infections used to refine attack methods.
Threat actors are increasingly exploiting network misconfigurations to spoof internal emails for phishing campaigns, as observed by Microsoft.

Trends, Tools, or Tactics of Interest

The “Reprompt” attack technique enables single-click exfiltration of sensitive data from AI chatbots, including Microsoft Copilot, bypassing existing data leak protections-even after chat sessions have ended.
AI voice cloning exploits are on the rise, with new applications emerging for the detection of deepfake voice attacks.
A surge in reported vulnerabilities has been noted, particularly in WordPress plugins, with the overall picture complicated by inconsistent reporting from different organisations.
The Gootloader malware’s adoption of multi-part ZIP archives signals a trend toward more sophisticated evasion strategies in malware delivery.
Security focus in AI is shifting from model security to workflow security, as incidents demonstrate greater risk in workflow integrations and extensions.
Vibe coding tests indicate that AI agents can effectively exploit SQL injection vulnerabilities but perform poorly in implementing security controls.
The VoidLink framework’s targeting of cloud/container environments underscores increased threat activity against cloud infrastructure.
Security leaders are prioritising supply chain security, governance, and operational efficiency over predictive approaches.

Regulatory or Policy Developments

The US Federal Trade Commission (FTC) has banned General Motors from selling drivers’ location data for five years, following findings that GM sold such data without user consent.
Microsoft’s legal action against RedVDS was coordinated in both the US and UK, demonstrating cross-jurisdictional efforts to disrupt cybercrime-as-a-service operations.
Former CISA Director Jen Easterly has been appointed to lead the RSA Conference, reflecting leadership changes at a major industry event.