Cookie Settings

This website uses cookies and similar technologies to provide essential functionality and improve your experience. Some features, such as demo scheduling and chat support, require marketing cookies to function. By clicking "Accept All", you consent to all cookies. Alternatively, you can customize your preferences, but note that declining marketing cookies will limit certain website features.

Cyware Daily Threat Intelligence, March 06, 2025

shutterstock 2424424363 (1)

Daily Threat Briefing • Mar 6, 2025

Social media’s open doors are proving a playground for malware with a Middle Eastern twist. Desert Dexter, a sly campaign, has been hitting the Middle East and North Africa with a tweaked AsyncRAT. It’s hunting cryptocurrency wallets and chatting with a Telegram bot, spreading through legit file-sharing accounts and Telegram channels.

A WordPress plugin’s chatty nature just turned into a hacker’s dream. A critical flaw in the Chaty Pro plugin, used by tens of thousands of websites, lets attackers upload malicious files thanks to lax security checks. Left unpatched, it’s a fast track to site takeovers.

LinkedIn’s polished veneer is getting a malware makeover, and it’s a convincing act. Cofense spotted a campaign mimicking LinkedIn InMail, complete with branding and a sales director’s pitch for a quote - though the person’s real, the company’s fake. Those “Read More” and “Reply To” buttons? They’re a one-way ticket to the ConnectWise RAT, sidestepping the usual phishing playbook for something nastier.

Top Malware Reported in the Last 24 Hours

Russian attackers mimic EFF, target gamers

Researchers discovered a targeted cybercriminal campaign that impersonates the Electronic Frontier Foundation (EFF) to target Albion Online players. The attackers used phishing strategies and decoy documents to steal in-game assets, employing the Stealc malware and Pyramid C2 infrastructure. The threat actors exploited the game's player-driven economy, where in-game assets are traded for real money through third-party markets. The campaign involved phishing emails that tricked victims into downloading malicious PDF reports, supposedly from the EFF, which claimed unauthorized transactions on their accounts. Once opened, the document launched a malware infection chain designed to steal sensitive data. 

New Desert Dexter drops modified AsyncRAT

Positive Technologies uncovered a malicious campaign targeting the Middle East and North Africa since September 2024. The campaign, named Desert Dexter, leverages social media to distribute a modified version of the AsyncRAT malware, which targets cryptocurrency wallets and communicates with a Telegram bot. The attackers host the malware in legitimate online file-sharing accounts or Telegram channels set up for this purpose. Approximately 900 victims have been identified across various countries, with Egypt, Libya, the UAE, Russia, Saudi Arabia, and Turkey being the most targeted. 

New PyPI malware steals Ethereum private keys

Socket has discovered a malicious PyPI package called set-utils that steals Ethereum private keys by exploiting common account creation functions. The package is disguised as a simple utility for Python sets and mimics popular libraries, tricking developers into installing it. Since January 29, it has been downloaded over 1,000 times, targeting Ethereum developers and organizations working with Python-based blockchain applications. The package intercepts Ethereum account creation and exfiltrates private keys via the blockchain using a C2 server. 

Top Vulnerabilities Reported in the Last 24 Hours

Elastic patches Kibana bug

Elastic has released a security update for Kibana, to address a critical vulnerability tracked as CVE-2025-25012. This vulnerability, with a CVSS score of 9.9, could allow attackers to execute arbitrary code on vulnerable systems. The issue stems from a prototype pollution problem that can be exploited through a crafted file upload and specific HTTP requests. The impact varies depending on the Kibana version, with versions 8.15.0 to 8.17.0 being exploitable by users with the 'Viewer' role, and versions 8.17.1 and 8.17.2 being exploitable by users with specific privileges. Elastic has fixed this vulnerability in Kibana version 8.17.3.

Critical flaw in Chaty pro plugin

A critical vulnerability, CVE-2025-26776, has been identified in the Chaty Pro plugin for WordPress. This plugin, used by around 18,000 websites for chat functionality, has an arbitrary file upload vulnerability that could allow attackers to take over websites. The issue arises from a lack of proper authorization and security checks in the code handling user input, enabling attackers to upload and execute malicious files. The developers have addressed this vulnerability in version 3.3.4 of the plugin, which now uses the secure wp_handle_upload() function and implements proper checks. 

Top Scams Reported in the Last 24 Hours

YouTube warns of phishing attacks

YouTube has issued a warning about a phishing scam that uses an AI-generated video of its CEO to steal creators' credentials. The scammers send private videos to targeted users via emails, claiming that YouTube is changing its monetization policy. The linked video directs users to a fake YouTube page where they are asked to sign in to confirm the updated terms, but the page is designed to steal their credentials. The scammers create urgency by threatening account restrictions if users do not comply. 

Beware of this LinkedIn phishing scam!

Cofense discovered a LinkedIn-impersonating malware campaign that distributes the ConnectWise RAT. The email, disguised as a LinkedIn InMail notification, uses LinkedIn branding to appear genuine, although it's not entirely accurate to current legitimate LinkedIn emails. Unlike typical LinkedIn-spoofed emails used for credential phishing or BEC, this campaign delivers the ConnectWise RAT. The email, which appears to be from a sales director requesting a quote, contains a photo of a real person unrelated to the message. The company mentioned in the email is a combination of two legitimate corporations but does not exist. The email's "Read More" and "Reply To" buttons lead to the ConnectWise RAT installer.

Related Threat Briefings

Mar 7, 2025

Cyware Daily Threat Intelligence, March 07, 2025

Step right up to the slickest show in the digital shadows, where EncryptHub is running the ring. This rising cybercrime crew is dazzling victims across platforms like QQ Talk, WeChat, and Google Meet with trojanized apps and clever multi-stage attack chains. They’re even teasing a new act called EncryptRAT to keep their audience on edge. Something wicked is crashing the WordPress party, and it’s not on the guest list. Over 1,000 sites have been slipped a nasty surprise, planting backdoors that swing wide open for hackers. These uninvited intruders are ready to sneak back in and turn the festivities into a free-for-all. These dusty old cameras are stealing the spotlight, but it’s a scene straight out of a cyber horror flick. A critical flaw in Edimax IC-7100 IP cameras has botnets buzzing with excitement, exploiting shaky default passwords. They’re staging a takeover, dropping Mirai malware to keep the chaos rolling.

Mar 5, 2025

Cyware Daily Threat Intelligence, March 05, 2025

The internet’s weakest links are turning into a cyber army with an Iranian twist. The new Eleven11bot botnet, loosely tied to Iran, has hijacked tens of thousands of IoT devices to unleash massive DDoS attacks on telecoms and gaming servers across the world. Booking a trip shouldn’t come with a side of malware, but here we are. A slick new campaign is sneaking LummaStealer onto devices worldwide through fake CAPTCHAs on booking websites, leveraging malvertising to snag victims in places like the Philippines and Germany with this info-stealing menace. Snail mail just got a sinister upgrade in the scam department. Fraudsters posing as the BianLian ransomware gang are mailing tailored ransom notes, demanding Bitcoin payments to keep “stolen” data under wraps. However, it’s a bluff and not a breach.

Mar 4, 2025

Cyware Daily Threat Intelligence, March 04, 2025

In a digital masquerade, attackers are wielding trust as a weapon to breach elite targets. A highly targeted phishing campaign has struck a few UAE entities in aviation and satellite communications, deploying a new backdoor called Sosano. Using a hijacked email account from an Indian firm, the attackers sent polyglot PDFs, designed to exploit multiple formats. Your smartphone might be a gateway to more than just selfies in this lawless digital frontier. Google’s latest Android Security Bulletin confronts 44 vulnerabilities, with two actively exploited flaws in Cisco and Windows systems that could hand attackers the keys to your device. Patches are rolling out fast to help lock things down. Sometimes a simple click can unravel a digital Pandora’s box. A new ClickFix campaign is luring victims into running malicious PowerShell commands. It installs the Havoc post-exploitation framework, granting attackers remote access to the compromised device.

Mar 3, 2025

Cyware Daily Threat Intelligence, March 03, 2025

In a digital game of cat and mouse, cybercriminals are upping their ante with a new trick up their sleeve. The Black Basta and Cactus ransomware groups have armed themselves with BackConnect malware to maintain persistent control over compromised machines and exfiltrate sensitive data. Once inside, BackConnect—linked to the infamous QakBot loader—takes the reins, ensuring the attackers keep their grip even after initial access. Phishing emails are casting a wider net, and this time, they’re impersonating the taxman. FortiGuard Labs has uncovered a new wave of cyberattacks targeting Taiwanese companies with the sophisticated Winos 4.0 malware. Spread through phishing emails, the malware arrives via a malicious attachment posing as a tax inspection list. Winos 4.0 is a modular menace, boasting of multiple functionalities. Even the smallest chip can have a big impact when it comes to security. MediaTek revealed 10 newly discovered vulnerabilities in its chipsets, which power smartphones, tablets, AIoT devices, and smart TVs. Affected chipsets include the MT67xx, MT68xx, and MT69xx series. MediaTek has issued patches to manufacturers.

Feb 28, 2025

Cyware Daily Threat Intelligence, February 28, 2025

Stay ahead of emerging cyber threats with the latest intelligence on the Vo1d botnet infecting Android TV devices, Redox Stealer spreading via GitHub, and a critical Better Auth vulnerability. Plus, insights on Mustang Panda and Lotus Blossom espionage campaigns, Nakivo backup software flaws, and scams hijacking Google Chrome extensions and PayPal checkout. Get the latest cybersecurity updates now!

Feb 26, 2025

Cyware Daily Threat Intelligence, February 26, 2025

It took just one cleverly disguised Batch script to outmaneuver security tools for over 48 hours, slipping past defenses with ease. A new malware delivery framework is making waves with its advanced obfuscation techniques, allowing it to remain undetected for an extended period. The malware, deploying either XWorm or AsyncRAT, operates almost entirely in memory, minimizing its footprint. The irony couldn’t be greater - an advanced security training platform now carries a critical vulnerability that lets attackers turn the tables. A severe RCE flaw has been discovered in MITRE’s Caldera, an open-source tool designed for simulating cyber threats. The vulnerability affects all versions except 5.1.0+ and the latest master branch, enabling attackers to take over systems remotely. A viral video you’ll regret clicking - scammers have found a new way to bait their victims. Researchers uncovered a surge in phishing campaigns that use fake viral video links to lure users into downloading malware. The attack starts with a deceptive PDF file claiming to contain a must-watch clip, but clicking the link sends victims down a rabbit hole of fake pages, intrusive ads, and misleading download buttons.

Feb 25, 2025

Cyware Daily Threat Intelligence, February 25, 2025

Even security tools aren’t safe from exploitation. A massive malware campaign is abusing a vulnerable Windows driver from Adlice’s product suite to sneak in Gh0st RAT, with over 2,500 unique variants identified. When even protective software turns into a backdoor, no system is off-limits. Opposition activists and Ukrainian military entities are in the crosshairs. SentinelLABS uncovered a stealthy campaign using weaponized Excel documents to deliver new adaptations of PicassoLoader. This isn’t just cyber warfare, it’s an evolving espionage toolkit aimed at destabilizing governments. Oracle’s Agile Product Lifecycle Management software has a serious flaw. Now in CISA’s KEV catalog, this bug allows low-privileged attackers to execute arbitrary code, proving once again that supply chain vulnerabilities are prime real estate for cybercriminals.

Feb 21, 2025

Cyware Daily Threat Intelligence, February 21, 2025

Pirated software continues to be a favorite hunting ground for cybercriminals, and LummaC2 is the latest parasite lurking in cracked downloads. The malware is being spread through fake versions of Total Commander, using Reddit and Google Collab Drive to lure victims. Once installed, it harvests sensitive credentials from browsers and emails, proving once again that shortcuts to free software often come at a steep cost. Old malware doesn’t die, it evolves. Researchers uncovered links between the infrastructure of Stately Taurus and the long-running Bookworm malware, showing that the espionage group has been refining its tactics since the past nine years. Using DLL sideloading, Bookworm quietly infiltrates Windows systems under the guise of legitimate executables. Its resemblance to the ToneShell backdoor suggests that these tools may have been built by the same developers. Phishing-as-a-service is getting a dangerous upgrade. The Darcula PhaaS platform is rolling out Darcula Suite, a new version that lets cybercriminals create customized phishing sites with just a few clicks. Currently in beta, this DIY phishing kit includes a chockful of features, making sophisticated scams more accessible than ever.

Feb 20, 2025

Cyware Daily Threat Intelligence, February 20, 2025

Ransomware attacks on healthcare are becoming disturbingly routine, and now, NailaoLocker has entered the fray. This new strain exploited a flaw to infiltrate European healthcare organizations. While its encryption method is solid, the malware lacks the sophistication of more advanced threats, relying on DLL sideloading and missing key evasion techniques. Microsoft has patched two actively exploited vulnerabilities affecting Bing and Power Pages. The flaws allowed unauthorized code execution and privilege escalation, but details on the actual attacks remain scarce. Users are urged to patch up at the soonest. Russian cyber-espionage groups are taking their spying operations straight into encrypted messaging apps. Signal users tied to military and government affairs in Ukraine are their latest targets, with one group tricking victims through malicious QR codes and another using a fake military app to lure them into phishing traps. Google warns that these tactics have also been aimed at Telegram and WhatsApp.

Feb 19, 2025

Cyware Daily Threat Intelligence, February 19, 2025

Cybercriminals are luring victims with the promise of free software but the price is your data. ASEC has observed a surge in ACRStealer infections, often disguised as cracks and keygens. The malware uses a Dead Drop Resolver technique, hiding its C2 infrastructure within Google Docs. It targets browser data, cryptocurrency wallets, and VPN credentials, feeding stolen information back to its operators. Firefox and Thunderbird users, update now. CERT-In has flagged multiple high-severity vulnerabilities in Mozilla products, which could allow attackers to spoof identities, steal sensitive data, or cause DoS attacks. Users are urged to upgrade immediately to patch these flaws before threat actors exploit them. Snake Keylogger isn’t going away - it’s evolving. Researchers uncovered a new, more advanced version that has already triggered 280 million blocked infection attempts globally. This info-stealer thrives on phishing emails, using AutoIt scripting to evade antivirus detection and harvesting credentials from popular browsers.

Feb 18, 2025

Cyware Daily Threat Intelligence, February 18, 2025

Earth Preta is stepping up its game. Trend Micro uncovered a new campaign where attackers use the Microsoft Application Virtualization Injector to sneak malicious payloads. The malware masquerades as an Electronic Arts application, deploying a backdoor to exfiltrate data. Proofpoint identified FrigidStealer, a fresh macOS malware spread by TA2727, an unknown but sophisticated threat actor. The campaign tricks users into bypassing Gatekeeper protections, allowing FrigidStealer to quietly siphon browser data, Apple Notes, and cryptocurrency credentials. With attackers refining their approach to slip past Apple’s defenses, even a cautious click could prove costly. Search results aren't what they seem. CloudSEK exposed a large-scale Search Engine Poisoning campaign targeting over 150 Indian government, educational, and financial websites. Attackers manipulate search rankings to redirect users to fraudulent rummy and investment scams. Mobile users are sent to scam pages, while desktop users see error messages.

Feb 17, 2025

Cyware Daily Threat Intelligence, February 17, 2025

XCSSET is back with a vengeance. Microsoft uncovered a new variant of the macOS-targeting malware, now with better obfuscation, stronger persistence, and stealthier infection methods. This version randomly generates payloads to dodge detection, injects itself into Xcode projects, and still goes after digital wallets, Notes app data, and system files. SonicWall and Palo Alto Networks customers have an urgent patching assignment. SonicWall’s authentication bypass bug lets attackers sidestep security in SonicOS. Meanwhile, Palo Alto’s PAN-OS vulnerability allows unauthenticated access to management interfaces. While no major exploits have been reported, researchers have already spotted attempts. Patch now, before attackers make these vulnerabilities their next playground. Russian hackers are getting creative with Microsoft 365 phishing. Since mid-January, three distinct groups have been impersonating high-profile officials, luring victims into fake Teams meetings and chatrooms. These attacks exploit Device Code Authentication, granting attackers stealthy access to compromised accounts.