Security researchers have uncovered a sophisticated Chinese cyber-espionage campaign, dubbed PoisonedSeed, that successfully bypasses FIDO2 hardware authentication using a stealthy malware framework and man-in-the-middle (MitM) techniques.

This marks the first known public case of a successful attack targeting FIDO2 USB security keys, long considered one of the most secure authentication methods available.

Who’s Behind It?

The campaign is believed to be the work of a Chinese nation-state threat actor, with activity observed targeting:

• Journalists
• Dissidents
• Think tanks
• Government-related organizations in Southeast Asia and Europe

The attackers used highly targeted phishing and malware implants to compromise endpoints and steal credentials even when FIDO-based 2FA was in place.

How Was FIDO Bypassed?

Researchers at [Insert Attribution if Available] discovered that attackers deployed a malware chain designed to intercept authentication requests and manipulate browser or application behavior in real-time.

Key aspects:

• FIDO2 tokens were not broken cryptographically, but instead:
• Malware positioned itself between the user and the authentication interface, performing MitM-style manipulation of the session.
• Credential session hijacking was used post-authentication to gain access.

This technique highlights that even strong hardware security is ineffective if the endpoint is already compromised.

The PoisonedSeed Malware Framework

The malware used in the campaign is modular and stealthy:

• Signed drivers and rootkit-level access
• Persistence via UEFI or low-level boot mechanisms
• Injection into authentication workflows (browser plugins, desktop apps)
• Custom payloads that adapt based on target profile

According to analysis, it includes:

• Credential harvesting
• Network monitoring
• Session token theft
• C2 communications disguised as legitimate traffic

Mitigation and Defensive Recommendations

To defend against advanced threats like PoisonedSeed:

• Treat endpoint security as critical – FIDO keys do not protect against malware on a compromised system.
• Monitor for anomalous logins and token reuse.
• Use trusted boot, EDR/XDR tools, and behavioral monitoring.
• Educate users against highly targeted phishing.
• Implement out-of-band authentication if possible for high-risk operations.

Takeaway

This campaign is a stark reminder that hardware-backed security like FIDO2 is only part of the equation. When attackers own the endpoint, they can undermine even the strongest authentication systems.

🔐 “PoisonedSeed” proves that attackers are adapting faster than ever – and endpoint integrity is the new battlefield.”

Source: https://thehackernews.com/2025/07/poisonseed-hackers-bypass-fido-keys.html

🇩🇰 Danish Government Shifts to Linux – A Smart Move with Hidden Risks?

In a bold and future-oriented decision, Denmark’s Agency for Digital Government has announced a plan to transition from Microsoft Windows and Office to Linux and LibreOffice. The shift is part of a larger effort to reduce dependency on proprietary software and embrace open standards and open-source alternatives.

But while this is a progressive and cost-effective step, it also comes with both challenges and unforeseen cybersecurity implications.

The Benefits of Going Open Source

There are many advantages to this decision:

• Cost Efficiency: Eliminating costly Microsoft licenses can save millions of Danish kroner over time.
• Sovereignty and Control: By using open-source software, the government avoids vendor lock-in and gains greater control over its digital infrastructure.
• Transparency and Security: Open-source code can be audited by anyone, potentially increasing trust and reducing hidden backdoors or telemetry.
• Flexibility: Linux systems are highly customizable and often more efficient on older hardware.

This move mirrors similar actions taken by other governments and institutions over the years — like Munich’s initial Linux migration or France’s adoption of open-source in the military sector.

The Migration Challenge

However, the human aspect of this change shouldn’t be underestimated. Many public employees are deeply familiar with Windows and Microsoft Office. Transitioning to Linux desktops and tools like LibreOffice will require:

• Training programs
• Documentation and support
• Patience during the adaptation period

This learning curve could lead to temporary productivity loss — a factor that must be managed carefully through strong onboarding strategies.

🛡️ Linux as a New Target?

A crucial and often overlooked consequence of such transitions is the shifting threat landscape.

“If more governments and major institutions adopt Linux, attackers will follow.”

Historically, Linux desktops have enjoyed a degree of “security through obscurity” — not because they are invulnerable, but because attackers focused primarily on Windows, which dominates the desktop market.

However, this shift means:

• More Linux systems in high-value environments (like government agencies)
• Increased attacker interest in Linux vulnerabilities, malware, and privilege escalation techniques
• More Linux-targeted phishing campaigns and social engineering

🔐 The Security Paradox

Linux is often seen as more secure by design. Features like strict user privilege models, package repositories with signature verification, and SELinux/AppArmor profiles can offer enhanced protection. But more usage equals more risk:

• Unpatched third-party software becomes a bigger problem
• Threat actors may begin crafting more Linux-specific rootkits and ransomware
• Public institutions may lack deep Linux security expertise at scale

A Shift Worth Watching

Denmark’s move may signal the beginning of a larger trend. If successful, other EU countries and institutions may follow suit, especially in the context of digital sovereignty and tightening IT budgets.

But with great power comes great responsibility. As Linux gains adoption, defenders must be proactive in adapting their cybersecurity strategies to cover this new threat surface.

What do you think? Will Linux dominate the public sector in the next decade, or will it remain a niche choice? And are we prepared for the security consequences of such a shift?

Cyberattacks against Sweden: What is happening – and how can we ALL prepare?
Published: June 12, 2025

In recent weeks, cyberattacks against Sweden’s critical societal functions have completely exploded. Public services, authorities and banks have all been hit by various types of attacks – from overload attacks to targeted intrusions. Most of the evidence points to a foreign power – probably Russia – being behind it. But why is this happening right now, and what does it mean for you and me? Can we do something, or are we just spectators while the great powers fight?

Why is this happening right now?

The attacks do not come out of nowhere. Here are some explanations:

1. NATO and geopolitics
   Sweden’s rapprochement with NATO and our changed security policy have provoked Russia. Historically, they respond with hybrid attacks: cyberattacks, influence operations and disinformation.
2. Election year and societal impact
   Ahead of the 2026 election, attackers want to sow division, create unrest and test how robust our digital society really is.
3. Vulnerabilities in the systems
   Many systems are vulnerable and not sufficiently protected. This applies to both authorities, companies and private individuals.

Is this the beginning of something bigger?

It is very possible. Overload attacks, intrusion attempts and influence against the media are classic steps in major campaigns – especially from state actors. The next step could very well be:

Destructive attacks on infrastructure (electricity, water, communication)

Targeted extortion attempts against companies or authorities

Massive disinformation spread on social media and via news sites

What can YOU do as a private individual?

It can feel overwhelming when the “cyber war of the great powers” ​​seems to be beyond your control. But the fact is that the digital resilience of private individuals plays a major role – not just for yourself but for the entire society. Here are some simple but powerful tips:

1. Review your passwords
   Use unique, strong passwords for each service.

Enable two-factor authentication (2FA) where possible – especially on email, social media and important apps.

Use a password manager (e.g. Bitwarden, 1Password, KeePassXC).

2. Update your devices and applications
   Make sure your phone, computer and tablet have the latest updates.

Also update your apps and browsers regularly.

3. Be vigilant about scams and disinformation
   Don’t click on links in strange emails or SMS – even if they appear to come from “your bank” or “the Swedish Tax Agency”.

Don’t blindly trust sensational news on social media. Always check the sender and source.

If you get “urgent” messages (“you need to log in NOW or your account will be closed”) – take a deep breath and check first.

4. Back up what’s important
   Save important files and photos both in the cloud and on an external hard drive.

If something happens (e.g. ransomware), you can restore without paying a ransom.

5. Talk about digital risks with family and friends
   Help those who are less digitally savvy – especially older relatives – to set up 2FA, choose good passwords and recognize scams.
6. Have a plan B in case of major disruptions
   Think about what you will do if the internet or banking services are down for a few days. Have some cash at home, and think about how you will contact loved ones without the internet.

Community defense starts at home
Swedish cyber defense is stronger than it was just a few years ago – but every individual is also part of the defense. If we all raise our digital threshold, we make society less vulnerable, both to state actors and cybercriminals.

Conclusion
Sweden is currently under attack – and it is no coincidence. Geopolitics is shaking, and cybersecurity is the new front line. But we are not powerless: if companies, governments and individuals do their part, we will be much stronger when the next big wave comes.

Be critical, be prepared – and stay informed!