Cyware Daily Threat Intelligence, April 07, 2025

Daily Threat Briefing • April 7, 2025

It starts with a PDF search and ends with malware on your machine. A new campaign is using fake CAPTCHAs and Cloudflare Turnstile to lure users into downloading LegionLoader. Victims are tricked into enabling browser notifications, setting off a silent infection chain that’s already impacted tech and finance users across multiple regions.

Seed phrases aren’t supposed to come from strangers. The PoisonSeed campaign is targeting crypto holders and enterprise users by compromising bulk email services. Victims are lured with fake wallet setup instructions that embed attacker-controlled recovery phrases - giving threat actors full access once the wallets are used.

One toll text turns into ten. A surge in phishing attacks is spoofing toll agencies, bombarding users with urgent text notifications. The messages link to fake payment sites designed to steal credit card and personal info, while rotating sender addresses help them bypass spam filters undetected.

Top Malware Reported in the Last 24 Hours

A new campaign, fake CAPTCHAs, and LegionLoader

Netskope discovered a new malicious campaign that distributes the LegionLoader malware using fake CAPTCHAs and CloudFlare Turnstile. This campaign, active since February, targets users searching for PDF documents online. The infection chain begins with a drive-by download from a malicious website, followed by a fake CAPTCHA that redirects victims to a notification page. If victims enable browser notifications, they are guided through a process that ultimately leads to the download of an MSI file containing the LegionLoader payload. The campaign has targeted over 140 Netskope customers, primarily in North America, Asia, and Southern Europe, with a focus on the technology and financial services sectors.

Malicious Python packages target crypto library

The ReversingLabs research team has discovered a sophisticated software supply chain attack aimed at cryptocurrency application developers. The attack involved two malicious Python packages, bitcoinlibdbfix and bitcoinlib-dev, which were uploaded to PyPI to steal sensitive database files. These packages were designed to exploit a known issue in bitcoinlib, a popular open-source library for managing cryptocurrency wallets and blockchain interactions. The malicious code attempted to overwrite the legitimate clw cli command to steal sensitive files.

Top Vulnerabilities Reported in the Last 24 Hours

Critical pgAdmin bug enables RCE

A critical RCE vulnerability (CVE-2025-2945) in pgAdmin, a widely used PostgreSQL database management tool, has been fixed. The flaw, found in pgAdmin versions ≤9.1, could allow authenticated users to execute arbitrary commands on affected systems due to the improper use of Python's eval() function in two endpoints. Attackers could potentially manipulate databases, move laterally within networks, steal credentials, or install persistent backdoors. The pgAdmin team has patched the issue in version 9.2 by removing the use of eval().

PoC released for Python JSON Logger flaw

A low severity RCE vulnerability, CVE-2025-27607, has been discovered in the Python JSON Logger package, affecting versions 3.2.0 to 3.2.1. The vulnerability is due to a missing dependency, msgspec-python313-pre, which could potentially be exploited by malicious actors. The Python JSON Logger has patched the vulnerability in version 3.3.0, and users are advised to upgrade immediately.

Top Scams Reported in the Last 24 Hours

PoisonSeed campaign - New supply chain spam

Silent Push spotted a sophisticated cyber threat dubbed PoisonSeed that targets enterprise organizations, VIP individuals, and cryptocurrency holders. The campaign involves compromising CRM and bulk email providers, and deploying a novel "crypto seed phrase" phishing attack. The threat actors have targeted significant platforms like Coinbase, Ledger, Mailchimp, SendGrid, Hubspot, Mailgun, and Zoho. The campaign involves presenting victims with security seed phrases to deceive them into copying and pasting these phrases into new cryptocurrency wallets, which the attackers can later compromise.

Phishing campaign impersonates E-ZPass

An ongoing phishing campaign impersonating toll agencies like E-ZPass has seen a recent surge, with recipients receiving multiple iMessage and SMS texts to steal personal and credit card information. The messages contain links that lead to a phishing site designed to steal personal information. This scam, although not new, has seen an increase in activity, bypassing anti-spam measures and coming from random email addresses, indicating an automated attack. The texts often claim to be from E-ZPass or the Department of Motor Vehicles and create a sense of urgency to pay a toll.

Related Threat Briefings

Apr 11, 2025

Cyware Daily Threat Intelligence, April 11, 2025

Bots don’t sleep and AkiraBot proves it. Since late 2024, this spam operation has flooded over 400,000 websites, zeroing in on small businesses using platforms like Shopify, Wix, and Squarespace. The messages push shady SEO services, powered by AI-generated content to dodge filters. With rotating domains, CAPTCHA bypass tools, and an expanding reach into live chats and comment sections, AkiraBot is becoming harder to pin down. One bug, admin access - just like that. A critical flaw in the OttoKit WordPress plugin is being actively exploited, allowing attackers to create admin accounts and take over sites. Only some configurations are vulnerable, but where it hits, it hits hard. When a checkout page starts asking for your card details twice, something’s wrong. A WordPress site was found hosting a fake credit card form. The malicious script captured payment info and funneled it to a freshly registered domain, designed to look harmless, but built to steal.

Apr 10, 2025

Cyware Daily Threat Intelligence, April 10, 2025

A torrent download might be doing more than delivering cracked software. A campaign has been distributing ViperSoftX to Korean users, likely run by Arabic-speaking threat actors. The malware quickly expands its footprint by downloading multiple payloads. It even manipulates Windows Defender settings to stay hidden, making cleanup far more difficult once it’s embedded. Dell users have a new reason to check their patch status. Six vulnerabilities in PowerScale OneFS could expose systems to compromise, including one high-severity flaw that warrants immediate attention. While version 9.10.1.1 addresses the issues, Dell has provided workaround steps and targeted patches for older releases. What looks like a harmless file-sharing notification is actually the start of a RAT deployment. A new phishing campaign mimics messages from files[.]fm, warning users of file deletion to create urgency. Clicking through leads to a real landing page, ultimately triggering malware. The payload often includes ConnectWise RAT, giving attackers persistent, remote access to compromised systems.

Apr 9, 2025

Cyware Daily Threat Intelligence, April 09, 2025

Invasive spyware campaigns are zeroing in on high-risk communities. MOONSHINE and BADBAZAAR are being deployed through trojanized mobile apps to surveil Uyghur, Tibetan, and Taiwanese individuals, as well as civil society groups. Some of the apps mimic popular platforms, while others are tailored to target interests. The campaign reflects a broader strategy to monitor groups viewed as threats to state control. A zero-day in Windows' core logging system has made its way into active exploitation. A use-after-free bug in the CLFS driver is being targeted by the PipeMagic trojan to escalate privileges and gain system-level access. Once exploited, attackers can bypass security protections, deploy additional malware, and harvest sensitive data. Search for QuickBooks during tax season, and you might land on a trap. Threat actors are placing deceptive Google Ads that link to phishing pages almost identical to the real QuickBooks login portal. The tactic preys on urgency and familiarity, making it easy for distracted users to miss small red flags.

Apr 8, 2025

Cyware Daily Threat Intelligence, April 08, 2025

What looked like useful dev tools were actually mining rigs in disguise. Several malicious extensions on the VSCode Marketplace were found silently installing XMRig miner. Over 300,000 installs flew under the radar before discovery. A wave of Mirai-linked scanning is hitting video surveillance systems. GreyNoise has tracked a spike in exploitation attempts targeting TVT NVMS9000 DVRs, with over 2,500 IPs launching attacks. The flaw could grant attackers admin access to DVRs. Two USB-related vulnerabilities in the Linux kernel have been weaponized in real-world attacks. Google patched them, both tied to information disclosure and privilege escalation. The latter was previously used in a targeted Android exploit late last year. All known active exploitation paths have now been patched in the latest round of 62 fixes.

Apr 4, 2025

Cyware Daily Threat Intelligence, April 04, 2025

Phishing lures are slipping through trusted channels. CERT-UA reports that attackers are using compromised government emails to send malicious links via trusted file-sharing platforms. The goal: to deliver WRECKSTEEL, a VBS loader that steals documents and screenshots. A tiny schema bug, massive consequences. A critical flaw in Apache Parquet allows attackers to run arbitrary code just by processing a malicious file. The issue affects data pipelines that rely on Parquet imports and has been patched in version 1.15.1. Scammers are feeding off crypto chaos. In the aftermath of the Bybit breach, nearly 600 phishing domains emerged, many mimicking the exchange or offering fake refund services. Most were designed to steal login credentials from users desperate to recover lost funds.

Apr 3, 2025

Cyware Daily Threat Intelligence, April 03, 2025

Payment forms are being hijacked with surgical precision. A web skimming campaign is abusing an old Stripe API to validate stolen credit card data before exfiltrating it. The attack mimics legitimate payment screens and targets merchants running WooCommerce, WordPress, and PrestaShop, with cryptocurrency payment options thrown in for extra misdirection. The Bruno API client just got hit with two high-severity vulnerabilities. One allows malicious collections to bypass Safe Mode and run arbitrary code, while the other abuses environment naming for cross-site scripting that could lead to file theft or remote code execution. Both flaws are now patched in version 1.39.1. Cloudflare’s infrastructure is being turned against users in a phishing campaign that’s anything but basic. Attackers are using branded takedown notices hosted on Pages.dev and Workers.dev to lure victims into downloading malware. The payload sets up persistence and communicates via Pyramid C2, with Telegram now added for victim tracking.

Apr 2, 2025

Cyware Daily Threat Intelligence, April 02, 2025

Searching for a legal doc shouldn't get you malware but Gootloader is counting on it. In its latest campaign, the threat actors are using Google Ads to lure users into downloading malicious templates. One click leads to a ZIP file with a JavaScript payload that kicks off scheduled tasks and PowerShell scripts, pulling in further payloads from compromised WordPress blogs. Ukrainian banking customers are the latest target in a campaign using Emmenhtal Loader to drop SmokeLoader. Delivered via a booby-trapped 7-Zip archive, the attack blends PDF lures with LOLBAS tactics to execute payloads, slipping through defenses with anti-analysis tricks while quietly loading modular malware. Old routers don’t die, they just become attack surfaces. A 2017 Netgear model, long past its support window, was found riddled with zero-days. Eight vulnerabilities, including command injection and buffer overflows, expose critical functions like UPnP and email settings, giving attackers multiple ways in.

Apr 1, 2025

Cyware Daily Threat Intelligence, April 01, 2025

Someone clicks a shortcut in a phishing email, and just like that, the whole machine turns. A new version of KoiLoader is making the rounds, delivering Koi Stealer through a layered infection chain that quietly builds persistence before pulling down malware designed to scoop up passwords, cookies, and system data. The final payload rides on a custom C2 channel and slips through with a script that even disables AMSI on its way in. It’s hiding in plain sight - just not where anyone usually looks. Threat actors have been tucking malicious code into the mu-plugins folder on WordPress sites, a spot that doesn’t show up in the regular plugin dashboard. Redirects, webshells, and SEO spam are all part of the toolkit, with infections showing up through subtle changes in traffic, files, or system load before anyone notices what’s off. Apple’s patch day wasn’t routine this time. Two zero-days, including a WebKit flaw and a USB bypass bug, were among dozens of vulnerabilities addressed across iOS, iPadOS, and macOS. While one bug could let attackers escape browser sandboxes, the other allowed physical access to sidestep device protections. Both are now patched - assuming your devices are up to date.

Mar 31, 2025

Cyware Daily Threat Intelligence, March 31, 2025

A deceptive Zoom installer was the entry point for a carefully executed ransomware attack involving BlackSuit. Attackers spent nine days inside the network. The full operation spanned more than 190 hours, combining stealth, staging, and social engineering. The CISA has released an analysis of a new malware named RESURGE, which targets a known vulnerability in Ivanti Connect Secure appliances. RESURGE operates like a rootkit, allowing attackers to create web shells, steal credentials, and establish persistence through SSH tunnels. The malware enables unauthenticated remote code execution and has been added to KEV catalog. A new Android banking trojan called Crocodilus is using fake alerts to trick users into handing over their crypto wallet seed phrases. Disguised as a warning about backing up recovery keys, the malware uses social engineering to gain full access to wallets. The threat has so far targeted users in Turkey and Spain.

Mar 28, 2025

Cyware Daily Threat Intelligence, March 28, 2025

Researchers have uncovered a supply chain compromise involving cryptocurrency-related packages on the npm registry. Several long-standing packages, some over nine years old, were found to contain rogue scripts that exfiltrate environment variables and API keys to remote servers. The incident is suspected to have stemmed from compromised maintainer accounts and highlights ongoing risks in third-party package management. Researchers emphasized the need for two-factor authentication and tighter controls over software dependencies. Splunk has issued security patches across multiple products, addressing a range of vulnerabilities including two high-severity flaws. One vulnerability allows remote code execution via file upload by low-privileged users, while another exposes user tokens that could be leveraged in phishing attacks. Updates cover both Splunk Enterprise and the Secure Gateway App. Although no active exploitation has been reported, users are strongly encouraged to apply the patches without delay. A now-retired Microsoft Stream domain was hijacked on March 27, 2025, leading to embedded videos across SharePoint sites displaying a fake Amazon page advertising a Thailand casino. The affected domain, microsoftstream[.]com, had been deprecated in favor of SharePoint but remained active for legacy content. Following the hijack, Microsoft shut down the domain to block the spam content and is working to prevent similar issues with embedded media from deprecated services.

Mar 26, 2025

Cyware Daily Threat Intelligence, March 26, 2025

The macOS malware loader ReaderUpdate is evolving fast, with new versions now written in Crystal, Nim, Rust, and Go. Originally distributed through free software sites, the loader continues to target Intel-based macOS systems, quietly collecting system data and generating unique identifiers. While its past activity has mostly involved adware, the loader’s ability to parse and execute remote commands leaves the door open for more serious threats. A zero-day exploit in the Microsoft Management Console has been linked to a threat actor known as EncryptHub, who’s actively using it in the wild. The flaw allows for security bypass via malicious MSC files, enabling attackers to deploy multiple payloads. This campaign is still in development, cycling through various delivery techniques and toolsets. In the gaming world, phishers have stepped up their game with a browser-in-the-browser attack targeting Steam users and Counter-Strike 2 players. The campaign spoofs a login window branded with a well-known pro eSports team, to lure victims into handing over credentials. With stolen accounts likely resold on underground markets, this scheme is aimed squarely at the gaming community.

Mar 25, 2025

Cyware Daily Threat Intelligence, March 25, 2025

A stealthy browser extension called Rilide has resurfaced with improved evasion capabilities and support for Chrome’s latest extension framework. Disguised as a utility for Google Drive, it quietly collects data, particularly those tied to cryptocurrency wallets. Ongoing campaigns have used lures ranging from fake PowerPoint documents to spoofed Twitter notifications, all aimed at embedding the extension into Chromium-based browsers. On GitHub, a seemingly innocent coding challenge is being used as a delivery mechanism for malware. A malicious repository targets Polish-speaking developers and installs FogDoor, a backdoor capable of data theft, remote command execution, and persistence. The campaign uses clever techniques, while quietly harvesting sensitive information. Kubernetes environments are facing serious risk after the discovery of IngressNightmare - a collection of five critical flaws in the Ingress NGINX Controller. These bugs open the door to unauthenticated remote code execution and expose thousands of clusters to full compromise. In the wrong hands, this vulnerability could allow attackers to exfiltrate secrets across all namespaces, effectively granting full control over affected clusters.