Payment forms are being hijacked with surgical precision. A web skimming campaign is abusing an old Stripe API to validate stolen credit card data before exfiltrating it. The attack mimics legitimate payment screens and targets merchants running WooCommerce, WordPress, and PrestaShop, with cryptocurrency payment options thrown in for extra misdirection.

The Bruno API client just got hit with two high-severity vulnerabilities. One allows malicious collections to bypass Safe Mode and run arbitrary code, while the other abuses environment naming for cross-site scripting that could lead to file theft or remote code execution. Both flaws are now patched in version 1.39.1.

Cloudflare’s infrastructure is being turned against users in a phishing campaign that’s anything but basic. Attackers are using branded takedown notices hosted on Pages.dev and Workers.dev to lure victims into downloading malware. The payload sets up persistence and communicates via Pyramid C2, with Telegram now added for victim tracking.

Top Malware Reported in the Last 24 Hours

Recruitment emails drop BeaverTail and Tropidoor

On November 29, 2024, a malware attack was discovered where threat actors impersonated a recruitment email from the developer community, Dev[.]to. The attack involved a BitBucket link containing a project with malicious code. The project included BeaverTail malware disguised as "tailwind.config.js" and a downloader malware named car.dll. BeaverTail was found to be distributed primarily through phishing attacks disguised as job offers. The "car.dll" downloader shares similarities with the LightlessCan malware of the Lazarus group. The Tropidoor malware operates in memory through the downloader and connects to 4 C&C server addresses. 

Web skimmer campaign abuses Stripe API

A sophisticated web skimmer campaign has been identified by threat hunters, which uses a legacy Stripe API to validate stolen payment information before it's exfiltrated. The campaign has affected around 49 merchants so far, with 15 having removed the malicious script injections. The activity has been ongoing since at least August 20, 2024. The attack chain employs malicious domains to distribute the JavaScript skimmer, which intercepts and hides the legitimate payment form, serves a replica of the Stripe payment screen, validates it, and then transmits it to a remote server. The threat actors are likely exploiting vulnerabilities and misconfigurations in WooCommerce, WordPress, and PrestaShop to implant the initial stage script. The skimmer scripts have also been found impersonating a Square payment form and adding other payment options using cryptocurrencies. 

Malicious PyPI package targets WooCommerce

Socket spotted a malicious Python package named "disgrasya" on PyPI. This package contains an automated carding script targeting WooCommerce stores using CyberSource as their payment gateway. Unlike typical supply chain attacks, disgrasya made no attempt to appear legitimate. The script simulates real transactions to test stolen credit card numbers, making it hard to detect. It has been downloaded over 34,000 times. 

New RolandSkimmer campaign targets Bulagaria

A sophisticated cyber threat called RolandSkimmer has been targeting Microsoft Windows users, particularly in Bulgaria. This threat is a form of web-based credit card skimming that uses malicious browser extensions on Chrome, Edge, and Firefox to collect sensitive financial data from affected users. The attack is initiated through a deceptive LNK file, which executes obfuscated scripts to establish covert and persistent access to the victim's system. The malware then systematically harvests and exfiltrates sensitive data, often without detection.

Top Vulnerabilities Reported in the Last 24 Hours

High-severity bugs in Bru API client

The Bruno project has issued a security advisory, revealing two critical vulnerabilities in its API client. The first vulnerability, CVE-2025-30354, is a Safe-Mode bypass in Assert expressions with a CVSSv4 score of 8.7. It could allow attackers to execute arbitrary code on a user's system by tricking them into opening a malicious Bruno Collection within the app. The second vulnerability, CVE-2025-30210, also with a CVSSv4 score of 8.7, is an XSS vulnerability related to how environment names are handled. This could allow an attacker to read any files on the user's system and potentially achieve RCE. Affected versions for CVE-2025-30354 are <= 1.26.0, and for CVE-2025-30210 are >= 1.38.0 < 1.39.1. Both vulnerabilities are patched in version 1.39.1. 

Vulnerability in Verizon Call Filter API

A security vulnerability in Verizon's Call Filter feature allowed unauthorized access to the incoming call logs of other Verizon Wireless users through an unsecured API request. The flaw was fixed by Verizon in March, but the total period of exposure is unknown. The researcher found that the API endpoint used to retrieve call history did not verify the user's phone number, enabling anyone to access another user's call logs by manipulating the API request. This poses significant privacy risks, particularly for high-profile individuals.

Top Scams Reported in the Last 24 Hours

New phishing campaign exploits Cloudflare

A new, sophisticated phishing campaign misuses Cloudflare services and Telegram for malicious purposes. The attacks use Cloudflare-branded phishing pages and advanced tactics to evade detection. The phishing pages, hosted on Cloudflare’s Pages[.]dev and Workers[.]dev platforms, impersonate DMCA takedown notices and trick victims into downloading malicious files disguised as PDFs. The attackers exploit the "search-ms" protocol to initiate a malware infection chain. The malware establishes persistence and communicates with Pyramid C2 servers. A significant evolution in this campaign is the integration of Telegram for victim tracking. 

Phishing scam targets Spotify users

The scam involves a spoofed email that appears to be from Spotify, informing users of a payment failure and urging them to update their account information. The email, while appearing legitimate, has several red flags, such as a mismatched 'Return-Path' field and a suspicious URL embedded in the "Update Data" button. Upon clicking the link, users are redirected to a Linktree page, which then leads to a phishing landing page designed to mimic Spotify's login page. Any credentials entered are sent to a PHP C2 managed by the threat actors. After entering their credentials, users are prompted to update their credit card information, which is also sent to the malicious C2. Finally, users are asked for their "password issued by the bank," potentially giving the attackers access to their financial accounts.