The Alza Data Breach That Never Happened

On Friday evening, news shot across the internet that hackers were selling a database of 437,000 Alza customers. Names, phone numbers, addresses, order history, loyalty points. Ideal material for targeted phishing and account takeovers.

On Friday evening, news broke that hackers were offering the customer database of the largest Czech e-shop for sale. The Dark Web Intelligence profile published a listing from a darknet forum claiming it contained roughly 437,000 records originating from Alza[.]cz. According to the description, the package was supposed to include names, email addresses, phone numbers, dates of birth, delivery addresses, loyalty program details including loyalty point balances, as well as order history and customer support records. Such a dataset would be ideal material for targeted phishing, social engineering, fraud, and account takeover attempts.

Alza, however, denied any incident. “Our investigation so far has not confirmed that the published data is authentic or that it originated from Alza[.]cz systems. At the same time, we have not detected any indication of unauthorized access to our systems in connection with this case,” company spokesperson Eliška Čeřovská told Lupa[.]cz.

On closer inspection, the listing raises doubts rather than concerns. According to its description, the package is supposed to contain items that Alza does not collect from customers at purchase at all. The scale is suspicious too: 437,000 records is unexpectedly few against the e-shop’s client base of over a million.

I looked into the matter through the platforms we use to track data leaks. When I correlated the results, I got 408,387 hits associated with the alza[.]cz domain for the period 2018–2026. The vast majority came from so-called combo lists (lists created by aggregating and recycling data from various older breaches), some from infostealer logs (data exfiltrated by malware running directly on the victim’s infected device). My conclusion, then, is that these are data leaks — but not from Alza itself, rather from the compromised computers of its customers and employees.

Are you sure your systems are secure?

Every week we bring examples of attacks and vulnerabilities that can affect anyone. If you’re not sure whether your infrastructure is resilient, we’d be glad to help you find out. At SysNetShield we offer vulnerability scanning, penetration testing, Red Teaming, and phishing campaign simulations.

Get in touch — the first consultation or a vulnerability scan of a single domain/IP address is free.

The Silent WhatsApp Account Hijack

There’s a type of security incident that’s harder to explain than others. Your WhatsApp account is sending your contacts messages you never wrote, asking them for money. But when you check the Linked Devices section, you see nothing suspicious. No unknown sessions, no foreign logins. That’s exactly what happened to several iPhone users in Italy in recent weeks.

The Italian forensics firm Forenser, which analyzed the cases, concluded that this is an active campaign using a so-called zero-click attack — an attack that requires no action from the victim.

The common denominator across all reported cases was older iPhones running iOS 16.

The attackers gained access to recent conversations and used them to send money-transfer requests, but apparently could not reach older or archived chats. None of the victims could recall scanning a QR code, sharing a verification code, or completing the pairing of a new device.

Because every documented case involved iOS 16, the Forenser team focused on known vulnerabilities in that version of the system. As the likely culprit they identified CVE-2025–43300, possibly in combination with CVE-2025–55177. CVE-2025–43300 is an “out-of-bounds write” flaw in the ImageIO framework, which Apple uses system-wide to process and preview images. Processing a maliciously crafted DNG-format image can corrupt memory, opening a path for an attacker. Apple patched this flaw in August 2025 after confirming it had been actively exploited as a zero-day across its systems.

The second vulnerability, CVE-2025–55177, is a flaw directly in WhatsApp for iOS and macOS that, due to insufficient authorization of synchronization messages between linked devices, allowed content to be processed from arbitrary URLs.

The most effective mitigation is updating iOS to the latest available version.

CIFSwitch: A New Linux Vulnerability That Hands the Attacker Root on a Range of Distributions

Security researcher Asim Manizada published a new Linux kernel vulnerability on May 28, which he named CIFSwitch. It is a local privilege escalation flaw that allows an unprivileged user on an affected system to obtain root privileges. The weakness lies at the interface between the in-kernel CIFS client and the userspace tool cifs-utils. The CIFS protocol, also known as SMB, is commonly used to access network shares (typically from Windows), and Linux uses it to mount, read, and write data from remote systems. Manizada published both a detailed technical write-up and a working proof-of-concept exploit.

The crux of the problem lies in how CIFS works with Linux keyrings. If a network share uses Kerberos authentication, the kernel requests a key of type cifs[.]spnego, and the system’s request-key configuration runs the helper program cifs[.]upcall with root privileges to handle the Kerberos/SPNEGO authentication.

The kernel, however, did not adequately reject key descriptions that did not originate from the kernel CIFS client. An unprivileged process can therefore request a forged cifs[.]spnego key description, and the helper program cifs[.]upcall then processes attacker-controlled fields as if they had been generated by the kernel.

The attack itself then consists of abusing these fields. By setting the value upcall_target=app, the attacker can force the helper program to switch into a namespace it controls. What’s especially dangerous is that the account lookup via the Name Service Switch (NSS) mechanism happens before the program drops its elevated privileges. In this state, an attacker-prepared NSS module can be loaded into the running process, and the attacker’s code thus executes with root privileges. According to the researcher, the root cause of the flaw was introduced into the code back in 2007 — roughly nineteen years ago.

The good news is that CIFSwitch does not automatically affect every Linux system. Manizada himself describes the vulnerability as “non-universal,” because its exploitability depends on a specific combination of conditions: a vulnerable kernel version, an affected version of cifs-utils, the default request-key rule for cifs[.]spnego, enabled unprivileged user and mount namespaces, and SELinux or AppArmor policies.

Dutch Police Take Down a Botnet of 17 Million Devices

The Dutch National Police, in cooperation with the country’s National Cyber Security Centre (NCSC), dismantled a botnet made up of at least 17 million infected devices. The network was controlled by approximately 200 servers, all of which were physically located in the Netherlands. The affected devices included computers, tablets, smartphones, routers, and other internet-connected devices, including smart security cameras.

It’s important to stress, however, that taking down the command-and-control servers does not automatically mean all devices are clean. Infected devices remain compromised until their owners remove the malware themselves or reset and update the device.

An interesting point raised by The Register is that neither the police nor the NCSC officially disclosed the botnet’s name — unusual for takedowns of this scale. According to the Dutch news outlet NL Times, however, it is the infrastructure underpinning the commercial service Asocks, which offers so-called residential and mobile proxies. Asocks presents itself as a “universal proxy service” with seven million IP addresses, 150 locations, and roughly 100,000 clients, with monthly subscriptions running, according to BleepingComputer, somewhere between $5 and $15. The service’s website remained operational even after the takedown, and it is not entirely clear whether some parts of the network survived.