Cyware Daily Threat Intelligence, April 01, 2025

shutterstock 1976022710 (1)

Daily Threat Briefing • April 1, 2025

Someone clicks a shortcut in a phishing email, and just like that, the whole machine turns. A new version of KoiLoader is making the rounds, delivering Koi Stealer through a layered infection chain that quietly builds persistence before pulling down malware designed to scoop up passwords, cookies, and system data. The final payload rides on a custom C2 channel and slips through with a script that even disables AMSI on its way in.

It’s hiding in plain sight - just not where anyone usually looks. Threat actors have been tucking malicious code into the mu-plugins folder on WordPress sites, a spot that doesn’t show up in the regular plugin dashboard. Redirects, webshells, and SEO spam are all part of the toolkit, with infections showing up through subtle changes in traffic, files, or system load before anyone notices what’s off.

Apple’s patch day wasn’t routine this time. Two zero-days, including a WebKit flaw and a USB bypass bug, were among dozens of vulnerabilities addressed across iOS, iPadOS, and macOS. While one bug could let attackers escape browser sandboxes, the other allowed physical access to sidestep device protections. Both are now patched - assuming your devices are up to date.

Top Malware Reported in the Last 24 Hours

New KoiLoader variant unearthed

Researchers identified a new version of KoiLoader, used for C&C and deploying Koi Stealer, an information stealer. The attack initiates with a phishing email containing a ZIP attachment, which holds a deceptive .lnk file. Upon clicking, it triggers a hidden PowerShell command that downloads two malicious JScript files. These scripts establish scheduled tasks, create an illusion of system-trusted processes, and download further payloads. The second script acts as the infection's engine room, retrieving system info, creating a unique file path for persistence, and downloading two PowerShell scripts. The first script disables AMSI, and the second loads the KoiLoader binary into memory. Finally, KoiLoader downloads and executes the KoiStealer malware, which is designed to extract saved passwords, system credentials, session cookies, and browser and application data. KoiLoader uses a custom HTTP-based C2 protocol and offers various command options. 

Operation HollowQuill: New cyber-espionage campaign

A sophisticated cyber-espionage campaign named Operation HollowQuill has been discovered by SEQRITE Labs. It targets academic, governmental, and defense-related networks in Russia, particularly the Baltic State Technical University (BSTU “VOENMEKH”), using malicious PDFs to deliver Cobalt Strike payload. The attack begins with a malicious RAR archive containing a .NET-based malware dropper disguised as research invitations. This archive includes a legitimate OneDrive executable, a Golang-based shellcode loader, and a decoy PDF. Upon execution, the dropper deploys the shellcode loader, injects malicious code into the OneDrive process, and opens the decoy PDF. The final stage involves deploying a Cobalt Strike beacon that connects to a C2 server.

New Triton RAT abuses Telegram

Cado Security Labs has discovered a new Python-based RAT called Triton RAT, which uses Telegram for remote system access and data exfiltration. This open-source malware, found on GitHub, can perform various malicious activities such as credential theft, system control, and persistence establishment. It initiates operation by retrieving a Telegram Bot token and chat ID from Pastebin, enabling communication with a Telegram bot serving as the C2 server. The RAT can execute keylogging, access webcams, steal clipboard data and saved passwords, and bypass 2FA to access Roblox accounts using stolen cookies. It also gathers system information, executes remote shell commands, records screens, changes wallpapers, and uploads or downloads files. 

Malware hidden in Mu-Plugins

Threat actors are hiding malicious code in the mu-plugins directory of WordPress websites. This directory is less noticeable as it's not listed in the standard WordPress plugin interface, making it easier for users to ignore during routine security checks. Three cases of malware were discovered: Fake Update Redirect Malware, Webshell, and a spam injector. These malware allow attackers to redirect traffic to malicious websites, maintain persistent access via backdoors, and inject spam content to manipulate SEO rankings. The malware can be identified by unusual behavior on the site, suspicious files in the mu-plugins directory, elevated server resource usage, and unexpected file modifications. 

Top Vulnerabilities Reported in the Last 24 Hours

Apple patches 0-days in older iPhones

Apple has released security updates for its desktop and mobile products, addressing dozens of vulnerabilities, including two zero-day flaws. The first zero-day, CVE-2025-24201, is an out-of-bounds write issue in WebKit that allows attackers to craft web content to break out of the Web Content sandbox. This flaw was fixed in iOS 18.3.2, iPadOS 18.3.2, and Safari 18.3.1, and has now been patched in older versions of iOS and iPadOS. The second zero-day, CVE-2025-24200, is a medium-severity authorization bug that could allow a physical attacker to disable USB Restricted Mode on a locked device. This was fixed in iOS 18.3.1 and iPadOS 18.3.1. Apple also released new security updates for the latest generation mobile devices, resolving 60 vulnerabilities with iOS 18.4 and iPadOS 18.4, and 38 flaws with iPadOS 17.7.6. macOS Sequoia 15.4, macOS Sonoma 14.7.5, and macOS Ventura 13.7.5 were also updated to address numerous bugs. 

Top Scams Reported in the Last 24 Hours

Rising use of lookalike domains in email attacks

Cybercriminals are increasingly using lookalike domains to carry out targeted email-based scams and financial fraud. They target various sectors, including finance, legal services, insurance, and construction. These scams begin with registering a similar domain, setting up email servers, compiling a list of potential victims, and sending deceptive emails to trick recipients into providing sensitive information or authorizing payments. Several campaigns have been spotted using lookalike domains, such as impersonating financial institutions, invoice scams, executive impersonation, account takeover, recruitment scams, and phishing.

Related Threat Briefings

Apr 2, 2025

Cyware Daily Threat Intelligence, April 02, 2025

Searching for a legal doc shouldn't get you malware but Gootloader is counting on it. In its latest campaign, the threat actors are using Google Ads to lure users into downloading malicious templates. One click leads to a ZIP file with a JavaScript payload that kicks off scheduled tasks and PowerShell scripts, pulling in further payloads from compromised WordPress blogs. Ukrainian banking customers are the latest target in a campaign using Emmenhtal Loader to drop SmokeLoader. Delivered via a booby-trapped 7-Zip archive, the attack blends PDF lures with LOLBAS tactics to execute payloads, slipping through defenses with anti-analysis tricks while quietly loading modular malware. Old routers don’t die, they just become attack surfaces. A 2017 Netgear model, long past its support window, was found riddled with zero-days. Eight vulnerabilities, including command injection and buffer overflows, expose critical functions like UPnP and email settings, giving attackers multiple ways in.

Mar 31, 2025

Cyware Daily Threat Intelligence, March 31, 2025

A deceptive Zoom installer was the entry point for a carefully executed ransomware attack involving BlackSuit. Attackers spent nine days inside the network. The full operation spanned more than 190 hours, combining stealth, staging, and social engineering. The CISA has released an analysis of a new malware named RESURGE, which targets a known vulnerability in Ivanti Connect Secure appliances. RESURGE operates like a rootkit, allowing attackers to create web shells, steal credentials, and establish persistence through SSH tunnels. The malware enables unauthenticated remote code execution and has been added to KEV catalog. A new Android banking trojan called Crocodilus is using fake alerts to trick users into handing over their crypto wallet seed phrases. Disguised as a warning about backing up recovery keys, the malware uses social engineering to gain full access to wallets. The threat has so far targeted users in Turkey and Spain.

Mar 28, 2025

Cyware Daily Threat Intelligence, March 28, 2025

Researchers have uncovered a supply chain compromise involving cryptocurrency-related packages on the npm registry. Several long-standing packages, some over nine years old, were found to contain rogue scripts that exfiltrate environment variables and API keys to remote servers. The incident is suspected to have stemmed from compromised maintainer accounts and highlights ongoing risks in third-party package management. Researchers emphasized the need for two-factor authentication and tighter controls over software dependencies. Splunk has issued security patches across multiple products, addressing a range of vulnerabilities including two high-severity flaws. One vulnerability allows remote code execution via file upload by low-privileged users, while another exposes user tokens that could be leveraged in phishing attacks. Updates cover both Splunk Enterprise and the Secure Gateway App. Although no active exploitation has been reported, users are strongly encouraged to apply the patches without delay. A now-retired Microsoft Stream domain was hijacked on March 27, 2025, leading to embedded videos across SharePoint sites displaying a fake Amazon page advertising a Thailand casino. The affected domain, microsoftstream[.]com, had been deprecated in favor of SharePoint but remained active for legacy content. Following the hijack, Microsoft shut down the domain to block the spam content and is working to prevent similar issues with embedded media from deprecated services.

Mar 26, 2025

Cyware Daily Threat Intelligence, March 26, 2025

The macOS malware loader ReaderUpdate is evolving fast, with new versions now written in Crystal, Nim, Rust, and Go. Originally distributed through free software sites, the loader continues to target Intel-based macOS systems, quietly collecting system data and generating unique identifiers. While its past activity has mostly involved adware, the loader’s ability to parse and execute remote commands leaves the door open for more serious threats. A zero-day exploit in the Microsoft Management Console has been linked to a threat actor known as EncryptHub, who’s actively using it in the wild. The flaw allows for security bypass via malicious MSC files, enabling attackers to deploy multiple payloads. This campaign is still in development, cycling through various delivery techniques and toolsets. In the gaming world, phishers have stepped up their game with a browser-in-the-browser attack targeting Steam users and Counter-Strike 2 players. The campaign spoofs a login window branded with a well-known pro eSports team, to lure victims into handing over credentials. With stolen accounts likely resold on underground markets, this scheme is aimed squarely at the gaming community.

Mar 25, 2025

Cyware Daily Threat Intelligence, March 25, 2025

A stealthy browser extension called Rilide has resurfaced with improved evasion capabilities and support for Chrome’s latest extension framework. Disguised as a utility for Google Drive, it quietly collects data, particularly those tied to cryptocurrency wallets. Ongoing campaigns have used lures ranging from fake PowerPoint documents to spoofed Twitter notifications, all aimed at embedding the extension into Chromium-based browsers. On GitHub, a seemingly innocent coding challenge is being used as a delivery mechanism for malware. A malicious repository targets Polish-speaking developers and installs FogDoor, a backdoor capable of data theft, remote command execution, and persistence. The campaign uses clever techniques, while quietly harvesting sensitive information. Kubernetes environments are facing serious risk after the discovery of IngressNightmare - a collection of five critical flaws in the Ingress NGINX Controller. These bugs open the door to unauthenticated remote code execution and expose thousands of clusters to full compromise. In the wrong hands, this vulnerability could allow attackers to exfiltrate secrets across all namespaces, effectively granting full control over affected clusters.

Mar 24, 2025

Cyware Daily Threat Intelligence, March 24, 2025

A newly surfaced threat actor, UAT-5918, has been quietly embedding itself into Taiwan’s critical infrastructure since 2023. With a focus on information theft, the group has been targeting multiple sectors using a mix of off-the-shelf tools and stealthy web shells. The threat actor also boasts of an extensive toolkit. Meanwhile, the Medusa ransomware operation is refining its ability to bypass defenses using a malicious driver disguised as a legitimate security component. Dubbed ABYSSWORKER, the driver is signed with compromised certificates. Once deployed, it disables anti-malware tools and clears the path for ransomware delivery through a loader. On the plugin front, a critical vulnerability in WP Ghost has put thousands of WordPress sites at risk. If certain non-default settings are enabled, the bug can be used to load arbitrary files - opening the door to remote code execution. Though a patch has been issued in version 5.4.02, the exposure window combined with the plugin’s wide install base makes this a notable concern for site admins still lagging on updates.

Mar 21, 2025

Cyware Daily Threat Intelligence, March 21, 2025

A stealthy cyber campaign briefly surfaced before vanishing. Researchers uncovered a public web server tied to a campaign targeting South Korean entities, hosting a Rust-based payload delivering Cobalt Strike Cat alongside open-source hacking tools. The infrastructure disappeared within 24 hours but revealed a target list of over 1,000 Korean domains. A backup tool vulnerability is now a fast track for attackers. CISA issued a warning for a path traversal flaw in Nakivo Backup and Replication, which is being actively exploited to execute code remotely and access sensitive enterprise data. The vulnerability has also been added to the KEV catalog. Fake ads are turning Semrush into phishing bait. A malicious ad campaign is tricking users into visiting fraudulent Semrush login pages, stealing Google credentials by forcing victims to use the “Log in with Google” option on spoofed pages.

Mar 20, 2025

Cyware Daily Threat Intelligence, March 20, 2025

Cybercriminals don’t just break in; they move in and redecorate. The DollyWay malware campaign, active since 2016, has now compromised over 20,000 WordPress sites, according to GoDaddy. By February 2025, it was redirecting 10 million users each month to scam sites. Originally a ransomware operation, it has evolved into a redirection scam using the VexTrio and LosPollos affiliate networks. Hackers have found a new disguise for malware—virtual hard disk files. Threat actors are distributing VenomRAT through phishing emails with .VHD files masked as purchase orders. These files help the malware evade detection while a hidden batch script self-replicates, maintains PowerShell persistence, and steals data using HVNC and Pastebin-based C2 communication. Meanwhile, a year-old sophisticated phishing campaign has shifted gears. After successfully tricking Windows users with fake Microsoft security alerts on windows[.]net, attackers are now targeting macOS users. For detailed Cyber Threat Intel, click ‘Read More’.

Mar 19, 2025

Cyware Daily Threat Intelligence, March 19, 2025

Cyber threats are increasingly targeting sensitive industries and posing national security concerns. Ukraine’s CERT-UA has raised alarms about a wave of cyberattacks leveraging the DarkCrystal RAT to target defense industry professionals and military entities. The attackers are using Signal messenger to send phishing messages disguised as trusted contacts, luring victims into opening a fake PDF file containing a malware dropper. When even your AI assistant can be tricked into working for hackers, the stakes couldn’t be higher. Security researchers have uncovered a supply chain attack known as the 'Rules File backdoor,' which compromises AI-powered code editors like GitHub Copilot and Cursor. Meanwhile, in the healthcare sector, PoC exploits have surfaced for vulnerabilities in Sante PACS servers. These flaws, including CVE-2025-2263 through CVE-2025-2284, could enable unauthorized data access and system disruption. For detailed Cyber Threat Intel, click ‘Read More’.

Mar 18, 2025

Cyware Daily Threat Intelligence, March 18, 2025

Cybercriminals are getting craftier, with Microsoft uncovering StilachiRAT, a stealthy malware that steals crypto, spies on systems, and evades detection. It targets digital wallets, browser data, and RDP sessions while maintaining persistence through Windows services. Meanwhile, a year-old SSRF flaw in ChatGPT (CVE-2024-27564) is under active exploitation, with over 10,000 attack attempts in a week, mainly targeting US financial and government entities. Phishers are now exploiting Microsoft 365 infrastructure in a BEC campaign, tricking users with fake support notifications and fraudulent call centers. Attackers collect credentials and take over accounts while avoiding detection. As AI vulnerabilities, RATs, and phishing tactics evolve, businesses must stay ahead to protect sensitive data. For detailed Cyber Threat Intel, click ‘Read More’.

Mar 17, 2025

Cyware Daily Threat Intelligence, March 17, 2025

The Black Basta gang has cooked up a relentless new tool. Its automated brute-forcing framework has been relentlessly probing edge networking devices since 2023, zeroing in on widely used edge networking devices. Something sinister was brewing in the PyPI repository. Multiple fraudulent packages racked up tens of thousands of downloads and hid a nasty secret: code designed to siphon cloud access tokens. However, the packages have been removed. Coinbase users are getting hit with a scam that’s all polish and bad intentions. Dressed up as an official notice about a court-ordered shift to self-custodial wallets, it nudges recipients to set up a new wallet with a recovery phrase - except it’s a trap, pre-controlled by the attackers.

Mar 14, 2025

Cyware Daily Threat Intelligence, March 14, 2025

A new ransomware group is making waves with tactics reminiscent of LockBit. Mora_001 has been exploiting Fortinet vulnerabilities to gain access to networks. Subsequently, it deploys its SuperBlack ransomware, ensuring persistent control before encrypting critical systems. GitLab users should patch now as critical authentication flaws surface. Two newly discovered GitLab vulnerabilities could allow attackers to impersonate users, potentially leading to data breaches and privilege escalation. Security updates have been released to mitigate the risk. Cybercriminals are faking Clop ransomware attacks to scam businesses. Fraudsters are posing as the Clop ransomware gang, fabricating extortion claims to trick victims into paying ransoms for non-existent data breaches.