Cybercriminals don’t just break in; they move in and redecorate. The DollyWay malware campaign, active since 2016, has now compromised over 20,000 WordPress sites, according to GoDaddy. By February 2025, it was redirecting 10 million users each month to scam sites. Originally a ransomware operation, it has evolved into a redirection scam using the VexTrio and LosPollos affiliate networks.

Hackers have found a new disguise for malware—virtual hard disk files. Threat actors are distributing VenomRAT through phishing emails with .VHD files masked as purchase orders. These files help the malware evade detection while a hidden batch script self-replicates, maintains PowerShell persistence, and steals data using HVNC and Pastebin-based C2 communication.

Meanwhile, a year-old sophisticated phishing campaign has shifted gears. After successfully tricking Windows users with fake Microsoft security alerts on windows[.]net, attackers are now targeting macOS users.

Top Malware Reported in the Last 24 Hours

DollyWay campaign hits 20,000 sites

GoDaddy reported that the 'DollyWay' malware campaign, active since 2016, has compromised over 20,000 WordPress sites by February 2025. The campaign redirected 10 million monthly impressions to scam sites via advanced evasion and reinfection tactics, evolving from ransomware to a redirection scam. The attackers leveraged VexTrio and LosPollos affiliate networks and ensured persistence through auto-reinfection and hidden admin accounts.

VenomRAT distributed via VHD files

Forcepoint X-Labs reported that hackers are distributing VenomRAT via phishing emails with virtual hard disk (.VHD) files disguised as purchase orders. VHD files are commonly used for disk imaging and virtualization, making this new distribution technique effective in evading security software. The attackers evade defenses by hiding a malicious batch script that self-replicates, uses PowerShell for persistence, and steals data through HVNC and Pastebin C2 communication.

Top Vulnerabilities Reported in the Last 24 Hours

PHP flaw exploited to spread malware

Threat actors are actively exploiting a severe PHP vulnerability, identified as CVE-2024-4577, an argument injection flaw affecting Windows-based systems in CGI mode, enabling RCE since late 2024. Bitdefender noted a surge in attacks, predominantly in Taiwan (54.65%), Hong Kong (27.06%), Brazil (16.39%), Japan (1.57%), and India (0.33%), deploying the Quasar RAT and XMRig cryptocurrency miners. Approximately 15% of attempts involved basic checks like "whoami," while another 15% focused on reconnaissance, gathering system metadata and user data. About 5% of attacks installed XMRig, with some disguising Nicehash miners as legitimate processes like javawindows.exe.

Whatsapp zero-day fixed

WhatsApp reported addressing a zero-click, zero-day vulnerability in December 2024, which allowed remote exploitation without user interaction. This flaw, patched server-side without a client update or CVE-ID, was uncovered after Citizen Lab’s findings on Paragon’s Graphite spyware attacks, though specifics remain undisclosed. The vulnerability enabled attackers to bypass interaction, potentially through a crafted PDF, targeting devices via WhatsApp group chats.

Critical vulnerability found in Veeam product

Security researchers at watchTowr discovered a critical vulnerability, CVE-2025-23120, in Veeam Backup & Replication versions up to 12.3.0.310. The vulnerability, with a CVSS score of 9.9, allowed authenticated domain users to perform remote code execution. Veeam patched this flaw in version 12.3.1 (build 12.3.1.1139), urging immediate updates due to its appeal to ransomware groups targeting backup systems. Though no public exploit exists yet, the vulnerability’s severity and Veeam’s widespread use amplify risks.

Top Scams Reported in the Last 24 Hours

Phishers switch from Windows to macOS

LayerX Labs warned of a sophisticated phishing campaign, tracked for over a year, which originally targeted Windows users by hosting fake Microsoft security alerts on the trusted windows[.]net platform, tricking victims into entering credentials under the guise of a locked, compromised system. The campaign, noted for its professional design and use of randomized subdomains, evaded traditional defenses until Microsoft, Chrome, and Firefox introduced anti-scareware features in February 2025, slashing Windows attacks by 90%. Within two weeks, attackers pivoted to Mac users, adapting the same infrastructure with minor tweaks to target macOS and Safari, maintaining legitimacy via Windows[.]net and redirecting victims through compromised domain parking pages, highlighting their adaptability and Macs as emerging targets.