Every day, the digital landscape evolves, thanks to innovations and technological advancements. Despite this growth, it suffers from a few roadblocks, cybercrime being a major one and not showing signs of ending anytime soon. Artificial Intelligence, large-scale data breaches, businesses, governments, and rising target refinement across media platforms have contributed to this problem. However, Nord VPN CTO Marijus Briedis believes, “Prevention alone is insufficient,” and we need resilience.
VPN provider Nord VPN experienced first-hand the changing cyber threat landscape after the spike in cybercrime cases attacking Lithuania, where the company is based, in the backdrop of the Ukraine conflict.
In the last few years, we have witnessed the expansion of cybercrime gangs and state-sponsored hackers and also the abuse of digital vulnerabilities. What is even worse is that “with little resources, you can have a lot of damage,” Briedis added. Data breaches reached an all-time high in 2024. The infamous “mother of all data breaches” incident resulted in a massive 26 billion record leak. Overall, more than 1 billion records were leaked throughout the year, according to NordLayer data.
Google’s Cybersecurity Forecast 2025 included Generative AI as a main threat, along with state-sponsored cybercriminals and ransomware.
Amid these increasing cyber threats, companies like NordVPN are widening the scope of their security services. A lot of countries have also implemented laws to safeguard against cyberattacks as much as possible throughout the years.
Over the years, governments, individuals, and organizations have also learned to protect their important data via vpn software, antivirus, firewall, and other security software. Despite these efforts, it’s not enough. According to Briedis, this happens because cybersecurity is not a fixed goal. "We have to be adaptive and make sure that we are learning from these attacks. We need to be [cyber] resilience."
In a RightsCon panel that Briedis attended, the discourse was aimed at NGOs, activists, and other small businesses, people take advantage of Nord’s advice to be more cyber-resilient. He gives importance to education, stressing it’s the “first thing.”
Cybercriminals are targeting Counter-Strike 2 (a free-to-play tactical first-person shooter game) players using a disguised Steam login page that looks quite convincing. The fake page tricks innocent gamers into giving away their account IDs and passwords.
The hackers distributed the attack on the websites that pretended to represent the sports team Navi. “Part of the campaign’s attack tactics also includes abusing the name of a professional esports team called Navi,” reports cybersecurity vendor Silent Push. The hackers offered visitors free weapons skins or a “free case” that could be used in the game. To get these freebies, the phishing page demanded users to log in to Steam.
“All of the websites our team has found so far were in English save one Chinese site, simplegive[.]cn, which was created in Mandarin, with some English wording, and used the top-level domain (TLD) '.cn,” reports Silent Push.
The campaign, an example of browser-in-the-browser tactic, is built around creating an almost real-looking fake browser pop-up windows that display the URL of the actual website. It aims to make a visitor feel safe; the users believe the pop-up window is part of the real site. When a victim tries to log into the fake Steam portal, the hackers steal their login credentials and also try to take over victim accounts for future resale. After this, the site shows a fake pop-up page that mimics the Steam login portal, including the official “steamcommunity.com” domain in the web address. But the pop-up is a dummy window inside the phishing webpage; Silent Push has shown this in its video.
According to Silent Push, the fake pop-up to the Steam login “cannot be maximized, minimized, or moved outside the browser window even though victims can ‘interact’ with the URL bar of the fake pop-up.” Silent Push also said that the campaign can be more effective for desktop users because the pop-ups are designed to be viewed on a larger resolution, in this case, big screens. All the fake Navi websites discovered were in English, except one Chinese site, which was in Mandarin with few English words.
The fake websites were hosted on domains like casenaps[.]com, caserevs[.]com, and caseneiv[.]com. However, it doesn’t seem likely that the hackers took the time to make fake pop-ups for mobile phone viewing. To stay safe, users should always check for fake URL bars in any login pop-ups. If you find any URL bar, always drag that window outside of your browser. If it doesn’t move, you can tell the pop-up is fake.
A serious security issue has been discovered in Vite, a widely used tool for building web applications. This flaw, identified as CVE-2025-30208, allows attackers to access restricted files on a server. If exploited, it could lead to leaks of sensitive data and potential security risks.
How the Vulnerability Works
Vite’s development server is designed to block access to certain files, ensuring that only permitted content is available. However, researchers have found a way to bypass these restrictions using specific URL parameters. By adding "?raw??"or "?import&raw??" to a web address, hackers can trick the system into providing access to protected files.
Who Is at Risk?
This issue only affects developers who have made their Vite development server accessible over the internet. Normally, this server is used for local testing, but some developers configure it to be available outside their network using options like “–host” or “server.host.” If a server is open in this way, attackers can use the vulnerability to retrieve private information.
How Hackers Can Exploit This Flaw
The problem occurs because Vite handles web addresses incorrectly. In some parts of the system, special characters like “?” are removed, while other parts fail to detect these changes. This inconsistency allows hackers to bypass security restrictions and gain access to files they should not be able to see.
A Proof-of-Concept (PoC) exploit has already been released, showing how attackers can use this flaw to steal sensitive data. For example, one attack method attempts to read the “.bash_history” file, which can contain records of past commands, stored passwords, and other important details.
Affected Versions
This security weakness is present in several versions of Vite, including:
• 6.2.0 to 6.2.2
• 6.1.0 to 6.1.1
• 6.0.0 to 6.0.11
• 5.0.0 to 5.4.14
• All versions before 4.5.9
How to Stay Safe
To protect against this threat, developers using affected versions of Vite should update immediately to a secure version. The patched versions are:
• 6.2.3 and newer
• 6.1.2 and newer
• 6.0.12 and newer
• 5.4.15 and newer
• 4.5.10 and newer
Additionally, it is best to avoid exposing Vite’s development server to the internet unless absolutely necessary. Keeping development environments private reduces the risk of attacks and protects sensitive data.
This vulnerability is a reminder that keeping software up to date is essential for security. Developers should act quickly to install the latest patches and ensure their applications remain protected from cyber threats.
The growing use of digital systems in cars, trucks, and mobility services has made the automotive industry a new favorite target for hackers. Companies involved in making vehicles, supplying parts, and even selling them are now dealing with a sudden rise in cyberattacks, many of which are leading to heavy losses.
A recent report by cybersecurity firm Upstream Security shows that these attacks are not only increasing but also affecting much larger groups of vehicles and connected systems. In 2024, nearly 60% of the reported incidents impacted thousands or even millions of assets—this includes vehicles, electric vehicle charging stations, smart driving apps, and other connected tools used in transportation.
Even more worrying is the spike in large-scale cyberattacks. Cases where millions of vehicles were hit at once rose sharply from 5% in 2023 to 19% in 2024. These massive events now account for almost 60% of all attacks recorded in the year.
Experts warn that attackers have changed their approach. Instead of just hacking into a single vehicle’s system, they now aim to cause widespread damage or steal large amounts of data. By doing so, they increase the pressure on companies to pay hefty ransoms to avoid public embarrassment or serious business disruption.
Jason Masker, a cybersecurity specialist from Upstream, explained that hackers often search for the most damaging way to force companies into paying them. If they can gain control of millions of vehicles or access sensitive information, they can easily threaten a company’s image and safety standards.
The report also shared a serious example of how hackers can even manipulate a car’s safety features. Researchers found that the radar used for adaptive cruise control— a system that keeps cars at a safe distance can be tricked. Hackers could make it appear that the vehicle ahead is speeding up when it isn’t, potentially causing a crash.
Several major cyber incidents have already occurred:
• A leading Japanese car company’s U.S. unit was targeted by ransomware, leaking 22GB of vehicle and customer data.
• A Chinese auto supplier suffered a large breach involving 1.2TB of sensitive information, affecting both local and global carmakers.
• In Italy, a German automaker’s branch faced a data breach that exposed private customer details.
The report further explains that traditional cyberattacks— like locking systems and demanding ransom, are slowly becoming less effective, as many companies have backups ready. Now, hackers prefer stealing data and threatening to leak it unless they’re paid.
What’s more concerning is the gap between what cybersecurity rules require and how prepared companies actually are. Many businesses falsely believe they are fully protected, while attackers continue finding new ways to break through.
Upstream Security suggests companies need to act beyond just following regulations. Safety, smooth operations, and protecting customer data must be prioritized.
To help prevent future attacks, Upstream monitors over 25 million vehicles worldwide, tracking billions of data points daily. They also watch online forums where cybercriminals sometimes plan their attacks.
Looking at the bigger picture, experts predict artificial intelligence will become a vital tool in spotting and blocking cyber threats quickly. As vehicles get more connected, the risk of cyberattacks is expected to grow, putting companies, drivers, and users of smart mobility systems at greater risk.