Cryptocurrency developers are the latest targets in a calculated cyber offensive orchestrated by a North Korean threat group known as Slow Pisces. The group is leveraging seemingly legitimate coding challenges embedded with malware, in a calculated effort to breach systems, steal sensitive information, and funnel funds back to the DPRK government.

A severe security vulnerability has surfaced in the widely-used BentoML framework, posing a significant threat to Python-based production environments. Tracked as CVE-2025-27520, the flaw allows remote attackers to take full control of affected servers without authentication.

In a long-awaited move, Google has rolled out a fix in Chrome version number 136 for a 20-year-old privacy loophole that allowed websites to track users' browsing history using visited link styles.

Top Malware Reported in the Last 24 Hours

North Korean hackers target cryptocurrency developers

The North Korean hacking group, Slow Pisces, has been linked to a malicious campaign targeting cryptocurrency developers. The group engages with developers on LinkedIn, posing as potential employers and sending malware disguised as coding challenges. This malware, named RN Loader and RN Stealer, infects the developers' systems. The multi-stage attack chain involves sending a malicious payload only to validated targets, likely based on IP address, geolocation, time, and HTTP request headers. This information stealer harvests sensitive information from infected Apple macOS systems.

New affordable RAT raises alarm

A new RAT dubbed GYware is causing widespread concern among cybersecurity professionals and researchers. The malware, advertised as the "best of 2025" by its creator, is currently being sold on a popular hacker forum for $35 per month. GYware's alarming features include advanced self-spreading capabilities, full undetectability, and a web-based management panel that allows cybercriminals to remotely control infected devices.

Microsoft Teams chats deliver malware

A new cyberattack campaign, active since March, has been using Microsoft Teams chats to infiltrate Windows PCs with malware, primarily targeting the finance and professional services sectors. This attack, linked to the Storm-1811 group known for deploying the Black Basta ransomware, begins with attackers impersonating internal IT support staff via Microsoft Teams. They target high-level employees, often during late afternoons, and coax them into launching a remote support session using Windows’s built-in Quick Assist tool. The malware deploys a heavily obfuscated PowerShell backdoor, which sends a unique identifier to the attackers via a Telegram bot, signaling successful infection and opening a persistent channel for C2.

Top Vulnerabilities Reported in the Last 24 Hours

High-severity security flaw in BentoML

CVE-2025-27520, a critical RCE vulnerability with a CVSSv3 base score of 9.8, has been recently discovered in the BentoML Python library on PyPI. This vulnerability, caused by Insecure Deserialization, allows unauthenticated attackers to execute arbitrary code and potentially take control of a server by sending maliciously crafted HTTP requests.

Google fixes 20 year old privacy flaw 

Google has been resolving a longstanding privacy issue in version number 136 that has enabled websites to track users' browsing activity for about 20 years. This flaw allowed websites to apply distinct styling, such as a different color, to previously clicked links using the ':visited' pseudo-class. This issue introduced significant security risks, including tracking, profiling, and phishing. Google will implement a "triple-key partitioning" of visited links to mitigate these threats and finally address this 20-year-old problem.

Security flaw in Jupyter Remote Desktop Proxy extension

A critical security vulnerability (CVE-2025-32428, CVSSv4 score 9.0) has been discovered in the Jupyter Remote Desktop Proxy extension. The flaw emerges when the extension is used with TigerVNC, unintentionally exposing VNC services over the network. This exposure contradicts the extension's intended design, as the VNC server initiated by the extension remains accessible via the network even when configured to use UNIX sockets solely accessible to the current user.