Cyware Daily Threat Intelligence, March 28, 2025

shutterstock 1861096885

Daily Threat Briefing • March 28, 2025

Researchers have uncovered a supply chain compromise involving cryptocurrency-related packages on the npm registry. Several long-standing packages, some over nine years old, were found to contain rogue scripts that exfiltrate environment variables and API keys to remote servers. The incident is suspected to have stemmed from compromised maintainer accounts and highlights ongoing risks in third-party package management. Researchers emphasized the need for two-factor authentication and tighter controls over software dependencies.

Splunk has issued security patches across multiple products, addressing a range of vulnerabilities including two high-severity flaws. One vulnerability allows remote code execution via file upload by low-privileged users, while another exposes user tokens that could be leveraged in phishing attacks. Updates cover both Splunk Enterprise and the Secure Gateway App. Although no active exploitation has been reported, users are strongly encouraged to apply the patches without delay.

A now-retired Microsoft Stream domain was hijacked on March 27, 2025, leading to embedded videos across SharePoint sites displaying a fake Amazon page advertising a Thailand casino. The affected domain, microsoftstream[.]com, had been deprecated in favor of SharePoint but remained active for legacy content. Following the hijack, Microsoft shut down the domain to block the spam content and is working to prevent similar issues with embedded media from deprecated services.

Top Malware Reported in the Last 24 Hours

API keys exfiltrated

Researchers found that several cryptocurrency packages on the npm registry have been hijacked to steal sensitive data, like environment variables. Some of these packages have been available for over nine years and contain rogue scripts that collect data like API keys and send them to a remote server. Per researchers, the hijacking may have occurred via compromised NPM maintainer accounts. This situation highlights the importance of using two-factor authentication (2FA) and improving supply chain security. Firms need to be vigilant about third-party software security.

SnakeKeylogger evades detection

A malicious campaign was observed using SnakeKeylogger, an advanced info-stealer malware that can avoid detection. The malware installs itself in multiple stages and works stealthily to grab sensitive data from victims. Victims receive spam emails with . img files, which, when opened, present a fake PDF but contain an executable file. This file acts as a downloader and loader, contacting a remote server to get a disguised encoded payload that is decrypted in memory. The secondary payload is a harmful .NET-based DLL that is injected into legitimate processes, enabling SnakeKeylogger to steal a wide range of data, including browser credentials and Wi-Fi settings. The campaign is part of a larger Malware-as-a-Service (MaaS) operation, using a server to frequently update malicious files, ensuring its persistent threat to security defenses.

APT36 hits Windows and Android users

A Pakistan-based APT group, APT36 (Transparent Tribe), created a fake IndiaPost website to hit Windows and Android users. A rogue Android executable was developed in the Pakistan time zone and linked to a laptop from Pakistan's Prime Minister Youth Laptop Scheme. A bogus website pretending to be the Indian Post Office was found that promotes a harmful Android app and a PDF with “ClickFix” instructions for Windows users. For desktop visitors, the site downloads a rogue PDF, guiding users to execute potentially harmful commands. For mobile users, the site offers an APK named “indiapost[. ]apk,” which requests numerous permissions to extract sensitive data. This Android app disguises itself as a non-threatening Google Accounts icon, complicating uninstallation. It provides links to legitimate India Post services but also aims to extract user data. The app maintains persistence on devices and redirects users to auto-start settings specific to certain devices. 

J-Magic and Tiny backdoors infect networking devices 

Backdoored Juniper networking devices are involved in two key cybersecurity incidents, highlighting flaws in network infrastructure. The first incident, reported in January 2025, discussed an attack campaign named J-Magic, where a backdoor resembling the open-source cd00r was placed on Juniper routers. The second incident, reported on March 11, by Mandiant, involved another backdoor based on Tiny Shell, targeting Juniper routers as well. Both attacks used customized open-source software to enable stealthy behavior. Mandiant noted that threats to network devices are increasing, complicating investigations due to the unique nature of proprietary hardware. 

Top Vulnerabilities Reported in the Last 24 Hours

Emergency patch for Chrome on Windows issued

Google released an emergency patch for Chrome on Windows to fix a serious vulnerability, CVE-2025-2783, that attackers have been using, particularly against targets in Russia. This exploit bypassed Chrome's security features, allowing potential further attacks. Mozilla also found a similar, unexploited flaw, CVE-2025-2857, in its Firefox browser, which also allowed sandbox escapes. Following this, Mozilla issued a fix for its issue. Other browsers based on Chromium, like Edge and Opera, may also need updates soon. The Tor browser also released an emergency update for Windows to address urgent security concerns.

Splunk ships security patches

Splunk announced patches for various vulnerabilities in its products, including two high-severity issues in Splunk Enterprise and Secure Gateway App. One flaw allows RCE by low-privileged users through a file upload, fixed in several Splunk Enterprise and Cloud versions. Another issue exposes user tokens, which attackers could use in phishing attempts. Patches for medium and low severity defects were also released. Users are advised to update their systems promptly, as there are no known exploits.

Top Scams Reported in the Last 24 Hours

Microsoft Stream domain hijacked

On March 27, 2025, the legacy domain for Microsoft Stream was hijacked to show a fake Amazon site promoting a Thailand casino. This resulted in all SharePoint sites with old embedded videos displaying spam content. The video content was accessed through the portal at microsoftstream[.]com, which Microsoft announced it would retire in April 2024, moving the service to SharePoint. After the hijack, SharePoint servers displaying embedded videos from the old domain showed the spam page instead. Reports from users indicated that the issue was linked to the hijacked domain. Microsoft has responded by shutting down the domain to block the spam page and is taking steps to prevent further access.

Pirated 2025 Snow White movie hits Torrent users

Disney's newest Snow White movie has a very low IMDb rating of 1.6/10 and is considered the company's biggest failure. It is not available on Disney+. Researchers reported that scammers are offering pirated versions of the movie, targeting torrent users to spread malware. A blog post on “TeamEsteem” lured users with a fake torrent link, which included malicious files. Downloading these files can disable security, install malware, and connect devices to the Dark Web, putting users' data at risk.

Related Threat Briefings

Apr 2, 2025

Cyware Daily Threat Intelligence, April 02, 2025

Searching for a legal doc shouldn't get you malware but Gootloader is counting on it. In its latest campaign, the threat actors are using Google Ads to lure users into downloading malicious templates. One click leads to a ZIP file with a JavaScript payload that kicks off scheduled tasks and PowerShell scripts, pulling in further payloads from compromised WordPress blogs. Ukrainian banking customers are the latest target in a campaign using Emmenhtal Loader to drop SmokeLoader. Delivered via a booby-trapped 7-Zip archive, the attack blends PDF lures with LOLBAS tactics to execute payloads, slipping through defenses with anti-analysis tricks while quietly loading modular malware. Old routers don’t die, they just become attack surfaces. A 2017 Netgear model, long past its support window, was found riddled with zero-days. Eight vulnerabilities, including command injection and buffer overflows, expose critical functions like UPnP and email settings, giving attackers multiple ways in.

Apr 1, 2025

Cyware Daily Threat Intelligence, April 01, 2025

Someone clicks a shortcut in a phishing email, and just like that, the whole machine turns. A new version of KoiLoader is making the rounds, delivering Koi Stealer through a layered infection chain that quietly builds persistence before pulling down malware designed to scoop up passwords, cookies, and system data. The final payload rides on a custom C2 channel and slips through with a script that even disables AMSI on its way in. It’s hiding in plain sight - just not where anyone usually looks. Threat actors have been tucking malicious code into the mu-plugins folder on WordPress sites, a spot that doesn’t show up in the regular plugin dashboard. Redirects, webshells, and SEO spam are all part of the toolkit, with infections showing up through subtle changes in traffic, files, or system load before anyone notices what’s off. Apple’s patch day wasn’t routine this time. Two zero-days, including a WebKit flaw and a USB bypass bug, were among dozens of vulnerabilities addressed across iOS, iPadOS, and macOS. While one bug could let attackers escape browser sandboxes, the other allowed physical access to sidestep device protections. Both are now patched - assuming your devices are up to date.

Mar 31, 2025

Cyware Daily Threat Intelligence, March 31, 2025

A deceptive Zoom installer was the entry point for a carefully executed ransomware attack involving BlackSuit. Attackers spent nine days inside the network. The full operation spanned more than 190 hours, combining stealth, staging, and social engineering. The CISA has released an analysis of a new malware named RESURGE, which targets a known vulnerability in Ivanti Connect Secure appliances. RESURGE operates like a rootkit, allowing attackers to create web shells, steal credentials, and establish persistence through SSH tunnels. The malware enables unauthenticated remote code execution and has been added to KEV catalog. A new Android banking trojan called Crocodilus is using fake alerts to trick users into handing over their crypto wallet seed phrases. Disguised as a warning about backing up recovery keys, the malware uses social engineering to gain full access to wallets. The threat has so far targeted users in Turkey and Spain.

Mar 26, 2025

Cyware Daily Threat Intelligence, March 26, 2025

The macOS malware loader ReaderUpdate is evolving fast, with new versions now written in Crystal, Nim, Rust, and Go. Originally distributed through free software sites, the loader continues to target Intel-based macOS systems, quietly collecting system data and generating unique identifiers. While its past activity has mostly involved adware, the loader’s ability to parse and execute remote commands leaves the door open for more serious threats. A zero-day exploit in the Microsoft Management Console has been linked to a threat actor known as EncryptHub, who’s actively using it in the wild. The flaw allows for security bypass via malicious MSC files, enabling attackers to deploy multiple payloads. This campaign is still in development, cycling through various delivery techniques and toolsets. In the gaming world, phishers have stepped up their game with a browser-in-the-browser attack targeting Steam users and Counter-Strike 2 players. The campaign spoofs a login window branded with a well-known pro eSports team, to lure victims into handing over credentials. With stolen accounts likely resold on underground markets, this scheme is aimed squarely at the gaming community.

Mar 25, 2025

Cyware Daily Threat Intelligence, March 25, 2025

A stealthy browser extension called Rilide has resurfaced with improved evasion capabilities and support for Chrome’s latest extension framework. Disguised as a utility for Google Drive, it quietly collects data, particularly those tied to cryptocurrency wallets. Ongoing campaigns have used lures ranging from fake PowerPoint documents to spoofed Twitter notifications, all aimed at embedding the extension into Chromium-based browsers. On GitHub, a seemingly innocent coding challenge is being used as a delivery mechanism for malware. A malicious repository targets Polish-speaking developers and installs FogDoor, a backdoor capable of data theft, remote command execution, and persistence. The campaign uses clever techniques, while quietly harvesting sensitive information. Kubernetes environments are facing serious risk after the discovery of IngressNightmare - a collection of five critical flaws in the Ingress NGINX Controller. These bugs open the door to unauthenticated remote code execution and expose thousands of clusters to full compromise. In the wrong hands, this vulnerability could allow attackers to exfiltrate secrets across all namespaces, effectively granting full control over affected clusters.

Mar 24, 2025

Cyware Daily Threat Intelligence, March 24, 2025

A newly surfaced threat actor, UAT-5918, has been quietly embedding itself into Taiwan’s critical infrastructure since 2023. With a focus on information theft, the group has been targeting multiple sectors using a mix of off-the-shelf tools and stealthy web shells. The threat actor also boasts of an extensive toolkit. Meanwhile, the Medusa ransomware operation is refining its ability to bypass defenses using a malicious driver disguised as a legitimate security component. Dubbed ABYSSWORKER, the driver is signed with compromised certificates. Once deployed, it disables anti-malware tools and clears the path for ransomware delivery through a loader. On the plugin front, a critical vulnerability in WP Ghost has put thousands of WordPress sites at risk. If certain non-default settings are enabled, the bug can be used to load arbitrary files - opening the door to remote code execution. Though a patch has been issued in version 5.4.02, the exposure window combined with the plugin’s wide install base makes this a notable concern for site admins still lagging on updates.

Mar 21, 2025

Cyware Daily Threat Intelligence, March 21, 2025

A stealthy cyber campaign briefly surfaced before vanishing. Researchers uncovered a public web server tied to a campaign targeting South Korean entities, hosting a Rust-based payload delivering Cobalt Strike Cat alongside open-source hacking tools. The infrastructure disappeared within 24 hours but revealed a target list of over 1,000 Korean domains. A backup tool vulnerability is now a fast track for attackers. CISA issued a warning for a path traversal flaw in Nakivo Backup and Replication, which is being actively exploited to execute code remotely and access sensitive enterprise data. The vulnerability has also been added to the KEV catalog. Fake ads are turning Semrush into phishing bait. A malicious ad campaign is tricking users into visiting fraudulent Semrush login pages, stealing Google credentials by forcing victims to use the “Log in with Google” option on spoofed pages.

Mar 20, 2025

Cyware Daily Threat Intelligence, March 20, 2025

Cybercriminals don’t just break in; they move in and redecorate. The DollyWay malware campaign, active since 2016, has now compromised over 20,000 WordPress sites, according to GoDaddy. By February 2025, it was redirecting 10 million users each month to scam sites. Originally a ransomware operation, it has evolved into a redirection scam using the VexTrio and LosPollos affiliate networks. Hackers have found a new disguise for malware—virtual hard disk files. Threat actors are distributing VenomRAT through phishing emails with .VHD files masked as purchase orders. These files help the malware evade detection while a hidden batch script self-replicates, maintains PowerShell persistence, and steals data using HVNC and Pastebin-based C2 communication. Meanwhile, a year-old sophisticated phishing campaign has shifted gears. After successfully tricking Windows users with fake Microsoft security alerts on windows[.]net, attackers are now targeting macOS users. For detailed Cyber Threat Intel, click ‘Read More’.

Mar 19, 2025

Cyware Daily Threat Intelligence, March 19, 2025

Cyber threats are increasingly targeting sensitive industries and posing national security concerns. Ukraine’s CERT-UA has raised alarms about a wave of cyberattacks leveraging the DarkCrystal RAT to target defense industry professionals and military entities. The attackers are using Signal messenger to send phishing messages disguised as trusted contacts, luring victims into opening a fake PDF file containing a malware dropper. When even your AI assistant can be tricked into working for hackers, the stakes couldn’t be higher. Security researchers have uncovered a supply chain attack known as the 'Rules File backdoor,' which compromises AI-powered code editors like GitHub Copilot and Cursor. Meanwhile, in the healthcare sector, PoC exploits have surfaced for vulnerabilities in Sante PACS servers. These flaws, including CVE-2025-2263 through CVE-2025-2284, could enable unauthorized data access and system disruption. For detailed Cyber Threat Intel, click ‘Read More’.

Mar 18, 2025

Cyware Daily Threat Intelligence, March 18, 2025

Cybercriminals are getting craftier, with Microsoft uncovering StilachiRAT, a stealthy malware that steals crypto, spies on systems, and evades detection. It targets digital wallets, browser data, and RDP sessions while maintaining persistence through Windows services. Meanwhile, a year-old SSRF flaw in ChatGPT (CVE-2024-27564) is under active exploitation, with over 10,000 attack attempts in a week, mainly targeting US financial and government entities. Phishers are now exploiting Microsoft 365 infrastructure in a BEC campaign, tricking users with fake support notifications and fraudulent call centers. Attackers collect credentials and take over accounts while avoiding detection. As AI vulnerabilities, RATs, and phishing tactics evolve, businesses must stay ahead to protect sensitive data. For detailed Cyber Threat Intel, click ‘Read More’.

Mar 17, 2025

Cyware Daily Threat Intelligence, March 17, 2025

The Black Basta gang has cooked up a relentless new tool. Its automated brute-forcing framework has been relentlessly probing edge networking devices since 2023, zeroing in on widely used edge networking devices. Something sinister was brewing in the PyPI repository. Multiple fraudulent packages racked up tens of thousands of downloads and hid a nasty secret: code designed to siphon cloud access tokens. However, the packages have been removed. Coinbase users are getting hit with a scam that’s all polish and bad intentions. Dressed up as an official notice about a court-ordered shift to self-custodial wallets, it nudges recipients to set up a new wallet with a recovery phrase - except it’s a trap, pre-controlled by the attackers.

Mar 14, 2025

Cyware Daily Threat Intelligence, March 14, 2025

A new ransomware group is making waves with tactics reminiscent of LockBit. Mora_001 has been exploiting Fortinet vulnerabilities to gain access to networks. Subsequently, it deploys its SuperBlack ransomware, ensuring persistent control before encrypting critical systems. GitLab users should patch now as critical authentication flaws surface. Two newly discovered GitLab vulnerabilities could allow attackers to impersonate users, potentially leading to data breaches and privilege escalation. Security updates have been released to mitigate the risk. Cybercriminals are faking Clop ransomware attacks to scam businesses. Fraudsters are posing as the Clop ransomware gang, fabricating extortion claims to trick victims into paying ransoms for non-existent data breaches.