Cybercriminals are getting craftier, with Microsoft uncovering StilachiRAT, a stealthy malware that steals crypto, spies on systems, and evades detection. It targets digital wallets, browser data, and RDP sessions while maintaining persistence through Windows services. Meanwhile, a year-old SSRF flaw in ChatGPT (CVE-2024-27564) is under active exploitation, with over 10,000 attack attempts in a week, mainly targeting US financial and government entities.

Phishers are now exploiting Microsoft 365 infrastructure in a BEC campaign, tricking users with fake support notifications and fraudulent call centers. Attackers collect credentials and take over accounts while avoiding detection. As AI vulnerabilities, RATs, and phishing tactics evolve, businesses must stay ahead to protect sensitive data.

Top Malware Reported in the Last 24 Hours

StilachiRAT steals crypto and performs reconnaissance

Microsoft found a new remote access trojan (RAT) named StilachiRAT that uses advanced methods to avoid detection and extract sensitive information. Although it is not widely spread, Microsoft shared details to help network defenders address this threat. StilachiRAT can steal data from browsers, digital wallets, and the clipboard, and collect system information. It can scan specific cryptocurrency wallets and monitor RDP sessions. The malware maintains persistence by using Windows services and can also block analysis attempts. It allows attackers to execute commands, clear logs, and manipulate systems.

Steganographic campaign distributes Remcos and AsyncRAT

A new attack campaign was found using JPG files to spread malware, such as Remcos and AsyncRAT. The attack starts with a phishing email that has a malicious Excel document exploiting a known vulnerability. Opening this document sends a request to download a .hta file with VBScript, which leads to a series of downloads, including a disguised JPG file that hides malicious code. The JPG file uses steganography to conceal the malware, making detection difficult. Both Remcos and AsyncRAT are remote access Trojans (RATs) that can log keystrokes and execute additional payloads. They utilize techniques like process hollowing and masquerading to avoid detection. 

Free decryptor released for Linux Akira ransomware

A researcher developed a free decryptor for the Linux variant of Akira ransomware, using GPU resources to brute force decryption keys. The tool operates differently from traditional decryptors, using timestamp-based methods. A researcher created the decryption technique after assisting a company to recover data from Akira ransomware without paying. The method exploits weaknesses in the key generation process. Using cloud GPUs for faster processing, the researcher employed 16 RTX 4090s, achieving results in about 10 hours.

Top Vulnerabilities Reported in the Last 24 Hours

Two reflected XSS bugs in the Laravel framework

Security researchers found two reflected cross-site scripting (XSS) vulnerabilities, CVE-2024-13918 and CVE-2024-13919, in the Laravel framework. These affect Laravel versions 11.9.0 to 11.35.1, allowing attackers to run harmful JavaScript in a user’s browser. These vulnerabilities arise from incorrect encoding of request and route parameters in debug-mode error pages. An attacker can exploit these by tricking a user into clicking a malicious link and executing harmful code. Laravel has released a patch in version 11.36.0, and users are advised to upgrade or disable debug mode by setting APP_DEBUG=false.

SSRF flaw in ChatGPT exploited

Threat actors are exploiting a year-old server-side request forgery (SSRF) vulnerability in ChatGPT, primarily targeting financial entities and US government organizations. The bug, CVE-2024-27564, allows unauthorized URL injections, leading to arbitrary requests. Researchers observed over 10,000 attack attempts in one week, mainly against US organizations in various sectors, including banks and fintech, which rely on AI services.

Schneider Electric offers a hotfix for a critical issue 

Schneider Electric issued a security notification about a critical vulnerability in the WebHMI component of its EcoStruxure Power Automation System User Interface and EcoStruxure Microgrid Operation Large (EMO-L) solution. The vulnerability, CVE-2025-1960, can allow unauthorized access if default passwords are not changed. Schneider Electric offers a hotfix to address the issue and recommends applying hardening guidelines to reduce risks.

Top Scams Reported in the Last 24 Hours

Microsoft 365 infrastructure abused in a BEC campaign

Security researchers are warning about new phishing attacks that exploit Microsoft 365 infrastructure in a BEC campaign to collect credentials and conduct account takeover (ATO) attacks. Attackers create fake messages mimicking Microsoft notifications and redirect users through call centers to avoid detection. The attackers alter organization names and send phishing emails with bogus support numbers, directing victims to a fake call center.