Critical

Spiderman Phishing Kit Targets European Banks with Real-Time Credential Theft

Hackread – Cybersecurity News, Data Breaches, Tech, AI, Crypto and More
Actively Exploited

Overview

Varonis threat analysts have identified a new phishing kit named Spiderman that specifically targets European banks and cryptocurrency customers. This kit automates the process of stealing users' credentials and personal information, creating a complete identity profile of the victim. The implications of this attack are significant, as it not only compromises individual accounts but can also lead to broader financial fraud and identity theft. Banks and crypto platforms should be on high alert and enhance their security measures to protect against this sophisticated threat. Users must also remain vigilant and be cautious about sharing their information online.

Key Takeaways

  • Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
  • Affected Systems: European banks, cryptocurrency platforms
  • Action Required: Banks and crypto platforms should enhance security protocols, implement two-factor authentication, and educate users on recognizing phishing attempts.
  • Timeline: Newly disclosed

Original Article Summary

Varonis threat analysts warn about Spiderman, a dangerous new kit that automates attacks against European banks and crypto customers, stealing a victim’s full identity profile.

Impact

European banks, cryptocurrency platforms

Exploitation Status

This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.

Timeline

Newly disclosed

Remediation

Banks and crypto platforms should enhance security protocols, implement two-factor authentication, and educate users on recognizing phishing attempts.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to Phishing.

Related Coverage

Training AIs to Solve CAPTCHAs

Schneier on Security

Researchers have developed a new system that trains artificial intelligence (AI) to solve visual CAPTCHAs more effectively. Unlike traditional CAPTCHA solvers that tackle each challenge independently, this system uses a combination of a fine-tuned YOLOv8 detector and a vision-language model (VLM) that learns from its experiences. As the AI encounters CAPTCHAs, it adapts and improves, achieving an accuracy of 85.4% across various categories. This advancement poses a challenge for CAPTCHA operators, as their attempts to disrupt the AI's performance can be countered by the VLM's ability to provide training labels. The research shows that adaptive AI can quickly recover from countermeasures, suggesting that current CAPTCHA defenses may be insufficient against evolving bot technologies.

Oct 19, 2026

Spyware found on devices belonging to prominent Serbian critics as elections loom

CyberScoop

Recent reports have confirmed that spyware has been discovered on the devices of several prominent critics in Serbia, coinciding with the lead-up to parliamentary elections. Among the targets are a university rector who supports ongoing protests and a prosecutor involved in investigating a controversial real estate development linked to former President Donald Trump. This situation raises serious concerns about the surveillance of political dissenters in Serbia, particularly as the country approaches a critical electoral period. The presence of spyware suggests that these individuals may be under threat from government or politically motivated actors aiming to suppress opposition voices. This incident underscores the broader issue of digital privacy and security in environments where political tensions are high.

Oct 19, 2026

MITRE ATT&CK v20 Catalogs AI Abuse, MFA Bypass, Water Utility Attacks

SecurityWeek

MITRE has released version 20 of its ATT&CK framework, which now includes 15 new detection strategies to help organizations combat various cybersecurity threats. This update introduces six strategies for Enterprise systems and nine for Industrial Control Systems (ICS), along with 38 supporting analytics. Notably, the catalog addresses issues such as AI abuse, multi-factor authentication (MFA) bypass, and attacks on water utilities. These insights are crucial for defenders as they enhance the tools available for identifying and mitigating emerging threats. With more organizations relying on digital systems, understanding these tactics can help prevent significant breaches and disruptions.

Oct 19, 2026

Japan’s SiteGuard WAF flaw CVE-2026-106931 is already being exploited

Security Affairs

A serious vulnerability, identified as CVE-2026-106931, has been discovered in the SiteGuard Server Edition, which is a web application firewall (WAF) used in Japan. This flaw allows attackers to execute commands with root or SYSTEM privileges, posing significant risks to affected systems. EG Secure Solutions has issued an urgent alert, confirming that this vulnerability is already being exploited in the wild. Organizations using SiteGuard Server Edition need to be particularly vigilant, as the ability for attackers to gain elevated access could lead to severe data breaches or system compromises. Immediate attention to this issue is crucial to protect sensitive information and maintain system integrity.

Oct 19, 2026

Half the AI bot traffic hammering your website comes from Meta

Help Net Security

According to DataDome's latest report, AI bot traffic surged by 41.5% in the third quarter of 2026, reaching nearly 25 billion requests. A significant portion of this traffic, nearly half, originated from Meta's Muse, which generated 29.1 million requests during its initial launch period from September 22 to October 3. Most of these requests, about 99.3%, came from cloud and content delivery network (CDN) sources. This increase in AI-generated traffic raises concerns for website operators, as it can lead to potential slowdowns and increased costs, complicating the management of legitimate user interactions. As AI technologies continue to evolve, businesses must stay vigilant about the implications of bot traffic on their online operations.

Oct 19, 2026

Ransomware pressure now reaches employees’ homes and families

Help Net Security

A recent survey by Semperis revealed that ransomware attackers are now targeting employees' families, with 37% of organizations reporting threats made against relatives or friends of staff members. This alarming trend was highlighted in the 2026 Ransomware Risk Report, which surveyed 1,200 IT and security professionals from companies that have faced successful ransomware attacks. The findings suggest that cybercriminals are willing to escalate their tactics to intimidate victims into paying ransoms. Mickey Bresman, CEO of Semperis, emphasized the serious nature of these threats, noting that they can cause both cyber and physical harm. This shift in tactics raises significant concerns about the safety of employees outside of the workplace and the lengths to which attackers will go to maximize their profits.

Oct 19, 2026