Swiss Breach Rules, ESP32 Debate, MassJacker: Cybersecurity Triple Threat

At a glance

• Switzerland adds a cyberattack reporting duty for operators of critical infrastructure.
• Researchers and Espressif argue over an ESP32 “backdoor” made of hidden Bluetooth commands.
• MassJacker malware swaps crypto wallet addresses on infected Windows machines.

Swiss Reporting Rules: Cyberattacks Must Be Reported Within 24 Hours

Switzerland is tightening how cyberattacks get reported. Under the revised Information Security Act, operators of critical infrastructure must report cyberattacks to the National Cyber Security Centre (NCSC) within 24 hours of finding them, with the duty taking effect on April 1, 2025. Fines for failing to report start later, from October 2025, so companies have a grace period to set up the process.

The aim is a clearer national picture of attacks and faster warnings to other targets. The NCSC said it will use the reports to spot campaigns early and alert other operators.

Some companies back the move. Others worry about extra paperwork during an incident, when staff are already stretched. How smoothly it works will depend on how simple the reporting form turns out to be.

ESP32 Chip “Backdoor”: What the Researchers Found

The ESP32 chip from Espressif sits inside a huge number of IoT devices, from smart plugs to sensors. In March 2025, researchers at Spanish firm Tarlogic said they had found undocumented commands in the chip’s Bluetooth firmware, and early headlines called it a backdoor.

The hidden commands can read and write memory and change device addresses, but using them requires access to the device itself or its firmware. They cannot be triggered by a stranger over the air. That is why many researchers pushed back on the “backdoor” label, and Tarlogic later changed its wording to describe a hidden feature.

Espressif said the commands are debug tools meant for testing and promised a fix that removes them. The issue is tracked as CVE-2025-27840. Owners of ESP32-based gear should still apply firmware updates when vendors ship them.

MassJacker: Malware That Steals Crypto Through the Clipboard

MassJacker is a clipboard hijacker found by CyberArk researchers and reported in March 2025. It watches what a victim copies, and when it sees a cryptocurrency wallet address it quietly swaps in one controlled by the attackers, so payments go to the wrong place.

The malware spreads through sites offering pirated software. CyberArk said it uses anti-analysis tricks, including just-in-time hooking and obfuscated code, to slow researchers down, and that it tied more than 778,000 wallet addresses to the operation.

The defense is basic but works. Avoid cracked software. Check the first and last characters of any wallet address before you hit send. Keep endpoint protection running.

Three Stories, One Lesson

These three stories have little in common on the surface. One is a new law, one is a fight over chip firmware and one is a piece of theft malware. What links them is that each depends on people noticing problems early and saying so.

Switzerland wants faster reports. The ESP32 case shows why careful wording matters when flaws are disclosed. MassJacker shows that old tricks still pay for criminals, and that a quick check before a transfer can stop them.

Fred Templeton, CISA, CASP, SEC+

Fred Templeton is a practicing Information Systems Auditor in the Washington DC area. Fred works as a government contractor and uses his skills in cyber security to make our country's information systems safer from cyber threats. Fred holds a master's degree in cybersecurity and is currently working on his PHD in Information Systems.