Cookie Settings

This website uses cookies and similar technologies to provide essential functionality and improve your experience. Some features, such as demo scheduling and chat support, require marketing cookies to function. By clicking "Accept All", you consent to all cookies. Alternatively, you can customize your preferences, but note that declining marketing cookies will limit certain website features.

Cyware Daily Threat Intelligence

Cyware Daily Threat Intelligence - Featured Image

Daily Threat Briefing • Apr 3, 2020

Threat actors spawned a variety of COVID-19-themed phishing attacks in the past 24 hours to trick users across the globe. Two of these attacks impersonated the World Health Organization (WHO) to steal Microsoft login credentials and distribute the LokiBot Trojan, respectively. On the other hand, a third phishing attack relied on a Microsoft Office remote code execution vulnerability to propagate a new trojan dubbed ‘BlueTea Action’.

Amidst all these COVID-19-related attack campaigns, security researchers also came across a sophisticated cyberespionage campaign that was used to spread several notorious malware. This included the XMRig cryptominer, AZORult trojan, a variant of Remcos RAT, and DarkVNC backdoor trojan.

Top Breaches Reported in the Last 24 Hours

Data from OnlyFans on sale

Reports suggest that a massive database containing up to 4 terabytes of data from OnlyFans has been put up for sale on several hacking forums. The compromised data, which is on sale since January 24, 2020, includes photos and videos of adult film stars.

Elasticsearch servers defaced

A hacker broke into and defaced more than 15000 Elasticsearch servers in the past two weeks. These servers were found left open on the internet without a password. The first intrusion had begun on March 24, 2020.

OGUsers hacked again

OGUsers, a popular hacking forum, disclosed a security breach that had enabled attackers to steal the details of more than 200,000 users. This was the second time that the forum was attacked in the past year.

Top Malware Reported in the Last 24 Hours

COVID-19-themed-phishing email

A new phishing email attack that leverages the ongoing COVID-19 disease has been found targeting individuals. The email appears to come from the World Health Organization (WHO) and uses a subject line, “HIGH-RISK: New confirmed cases in your city”. The body of the email urges the recipients to find out if there are cases of COVID-19 in their area by clicking on ‘Read on’. However, they are actually redirected to a fake Microsoft page that steals their login credentials.

LokiBot trojan returns

Another similar COVID-19-themed phishing email attack that is used to distribute LokiBot trojan, has been observed by researchers. The email pretends to be from the WHO, and includes an attachment entitled “COVID_19- WORLD HEALTH ORGANIZATION CDC_DOC.zip.arj”. The subject line of the email reads, “Coronavirus disease (COVID-19) Important Communication[.].”

New BlueTea Action trojan

Researchers have come across a new strain of trojan called BlueTea Action that spreads via phishing emails related to COVID-19. The header of these emails goes as ‘The Truth of COVID-19’ and includes a malicious RTF file carrying the exploit for the CVE-2017-8570 vulnerability. Once the vulnerability is triggered, it executes the .SCT script to evade detection.

AZORult used in a complex campaign

A sophisticated attack campaign that distributes a wide range of malware such as XMRig, AZORult, a variant of Remcos RAT, and DarkVNC backdoor trojan, has been uncovered by security experts. The infection chain starts with a ZIP file, which contains an ISO disk image file. The campaign uses several obfuscation techniques to bypass antivirus software.

Office 365 voicemail lure

Cybercriminals are using an Office 365 voicemail lure to trick users into visiting phishing pages that steal their personal information. The phishing campaign uses the Cascading Style Sheets (CSS) tricks to bypass Secure Email Gateways (SEG) while preserving the normal appearance of the email to a recipient.

Top Vulnerabilities Reported in the Last 24 Hours

Faulty Contact Form 7 Datepicker plugin

Contact Form 7 Datepicker WordPress plugin is affected by a cross-site scripting (XSS) vulnerability that can allow attackers to create rogue admins or take over admin sessions. Therefore all Contact Form 7 Datepicker users are urged to immediately remove or deactivate the plugin from all sites it is installed on.

TicTocTrack fixes a bug

Australia-based kids’ smartwatch maker, TicTocTrack has fixed a bug that could have allowed hackers to spoof the location of a child as well as download the personal information of customers. It appears that the flaw arose due to code integrated into the watch.

25 flaws in Windows

Over 25 potential vulnerabilities, including some that could lead to elevation of privileges, have been found in Windows. The bugs impact the user interface win32 kernel component and affect all versions of Windows, including Windows 10. Researchers have released Proofs-of-Concept (PoCs) for 13 of the 25 vulnerabilities. Meanwhile, Microsoft has claimed to have addressed some of these issues through its security patches.

Flaws in Firefox and IE exploited

Two previously-known flaws in Firefox and Internet Explorer have been exploited by the DarkHotel group to launch attacks in Japan and China. While the exploited Firefox vulnerability is CVE-2019-17026, the Internet Explorer flaw is tracked as CVE-2020-0674. Both Mozilla and Microsoft have issued patches for the vulnerabilities affecting their web browsers. Therefore, users are advised to apply the updates as soon as possible.

Top Scams Reported in the Last 24 Hours

IRS warns about COVID-19 scams

The Internal Revenue Service (IRS) has urged taxpayers to be on the lookout for phishing emails related to Coronavirus as they can lead to tax-related fraud and identity theft. The agency has highlighted a few activities of scammers that can easily trick taxpayers into sharing their personal details or parting away with the money. Some of the scams include the use of words like ‘Stimulus Check’ or ‘Stimulus Payment’, mailing users with a bogus check, or asking victims to share their banking/personal data over the phone, email, or social media.

Quarantine text scam

Scammers are targeting people in London with fake fine notification texts that accuse victims of violating the country’s lockdown rules. The malicious texts have been designed to look genuine and appear to come from the UK government. Victims are asked to pay a fine of £35 for neglecting the rules on a particular day.

Related Threat Briefings

Feb 7, 2025

Cyware Daily Threat Intelligence, February 07, 2025

North Korean hackers are refining their phishing playbook, now using the forceCopy malware to hijack credentials. The Kimsuky hacking group is targeting victims with deceptive emails containing Windows shortcut files disguised as Microsoft Office or PDF documents. The attack also involves the usage of additional malware. CISA has added critical vulnerabilities to its KEV catalog, signaling an urgent need for patching. The list includes flaws in Microsoft Outlook and Sophos XG Firewall, both carrying a CVSS score of 9.8. Federal agencies have until February 27 to patch these. A long-standing Chinese cyber-espionage group, GreenSpot APT, is running a phishing campaign that preys on users of the popular Chinese email service 163[.]com. The group, which has been active since 2007, has registered fake domains to steal login credentials from government and military personnel

Feb 6, 2025

Cyware Daily Threat Intelligence, February 06, 2025

Cybercriminals are getting more sophisticated, turning search engines into traps. A fake Google ad for Cisco AnyConnect led unsuspecting users to a counterfeit website, mimicking a German university to evade security filters. The fraudulent site redirected victims to a spoofed Cisco download page, pushing NetSupport RAT as the legitimate AnyConnect installer. Russian organizations are under fire as attackers distribute NOVA stealer, a new variant of SnakeLogger, through phishing emails. Advertised on underground forums as MaaS for as little as $50 per month, NOVA is designed for credential theft, keylogging, and clipboard data extraction. Cisco has patched two critical vulnerabilities in its Identity Services Engine, which could allow remote attackers to execute commands and manipulate system configurations. Exploited through specially crafted API requests, these flaws pose significant risks for enterprises using ISE for authentication and network control.

Feb 5, 2025

Cyware Daily Threat Intelligence, February 05, 2025

North Korean hackers are turning fake job interviews into a gateway for cyber espionage. SentinelOne identified new variants of the macOS malware FlexibleFerret, used in the Contagious Interview operation to lure targets with fake job interviews. Victims are tricked into downloading malicious software disguised as virtual meeting tools, allowing attackers to gain control over their systems. Cyberespionage groups are shifting their sights to the backbone of enterprise networks. A newly discovered malware, linked to the DaggerFly APT group, is targeting Linux-based network devices instead of standard endpoints. By hijacking SSH connections and replacing system binaries, the malware ensures long-term persistence while silently extracting sensitive data. A security flaw in AMD processors has raised concerns over hardware-based attacks. This bug could allow attackers with admin access to load malicious microcode, potentially undermining system integrity. This exploit underscores the growing risks of hardware security gaps, where even minor weaknesses can have major consequences.

Feb 4, 2025

Cyware Daily Threat Intelligence, February 04, 2025

Cybercriminals are finding new ways to weaponize everyday tools, and this time, they’re using TryCloudflare to hide their tracks. Researchers uncovered a phishing campaign that stealthily delivers AsyncRAT via Python scripting and cloud tunnels. The attack starts with a Dropbox link leading to a maze of scripts that ultimately drop a harmful payload. Even AI developers aren’t safe from deception. Threat actors have infiltrated PyPI with two malicious packages disguised as legitimate tools for DeepSeek. These fraudulent packages steal sensitive data, from user credentials to API keys, proving once again that trust in open-source repositories can be a double-edged sword. One small vulnerability, one massive risk. Russian cybercriminals exploited a zero-day in 7-Zip to deliver SmokeLoader in attacks on Ukrainian entities. By bypassing Windows Mark-of-the-Web protections, the attackers tricked victims into executing malware-laden files.

Feb 3, 2025

Cyware Daily Threat Intelligence, February 03, 2025

Cybercriminals are exploiting trust and social engineering at scale, preying on unsuspecting victims across industries. The Russian-speaking cybercrime gang Crazy Evil has been linked to over 10 social media scams, tricking users into installing malware like StealC and AMOS. Operating primarily through Telegram, the group specializes in identity fraud, cryptocurrency theft, and info-stealers. A wedding invitation should bring good news, not malware. Hackers in Malaysia and Brunei are targeting users with fake wedding invites spread via WhatsApp and Telegram, tricking them into installing a new Android malware called Tria. The campaign resembles UdangaSteal but focuses on new social engineering tactics. Even the tightest security can come undone with a race condition. Apple patched a critical vulnerability in macOS Sonoma, Sequoia, and iPadOS, which allowed hackers to escalate privileges and run code at the kernel level. Apple fixed the issue by improving memory management, but this serves as another reminder that even the most secure systems need constant vigilance.

Jan 31, 2025

Cyware Daily Threat Intelligence, January 31, 2025

Cybercriminals are sharpening their tactics, and Brazilian financial firms are the latest target. The Coyote banking trojan is on the prowl, using malicious Windows LNK files to execute PowerShell scripts that steal data and compromise systems. Meanwhile, a new browser-based threat is emerging—syncjacking. This attack exploits malicious extensions to hijack browsers, disable security settings, and access stored credentials. In its final stage, attackers gain full control of devices, including cameras and audio, without detection. Speaking of hidden threats, users of Microsoft Ads are being tricked by fraudulent Google ads leading to phishing pages designed to steal their login credentials. This campaign has persisted for two years, slipping past security filters and mimicking Microsoft’s login process with deceptive precision. For detailed Cyber Threat Intel, click ‘Read More’.

Jan 29, 2025

Cyware Daily Threat Intelligence, January 29, 2025

Cybercriminals are refining their tactics, blending deception with persistence to breach defenses. A financially motivated threat actor has been running a phishing email campaign since last year, targeting users in Poland and Germany. The attacks use payloads like Agent Tesla, Snake Keylogger, and a new backdoor named TorNet. Zyxel CPE Series devices are under siege as researchers uncover an actively exploited zero-day vulnerability. This flaw allows attackers to execute remote commands, potentially leading to system takeovers, data loss, and network intrusions. The attacks, originating primarily from Taiwan, have compromised over 1,500 devices, sparking urgent calls for users to apply security updates. Phishing scams continue to evolve, with a new campaign exploiting PDF documents to steal Amazon Prime credentials. Victims receive emails warning of an expired membership, leading them to a fake Amazon login page where they unknowingly hand over personal and credit card information.

Jan 28, 2025

Cyware Daily Threat Intelligence, January 28, 2025

Even the sleekest systems have their cracks. Apple has patched a critical CoreMedia vulnerability that hackers have already exploited to target devices. The flaw, which impacts how audio and video are processed, had been actively used against earlier versions of iOS prior to iOS 17.2. Apple’s fix is now available for iPhones XS and later, select iPads, and the company’s latest hardware. Security shouldn’t feel like Swiss cheese. Yet, SonicWall’s SMA1000 appliances are under siege, with attackers exploiting a critical vulnerability to install malware without requiring credentials. Despite a patch being available, over 5,000 devices remain exposed, allowing hackers to hijack SSL VPN sessions remotely. Think twice before clicking on that delivery notification. Phishers posing as USPS are sending fraudulent SMS messages claiming a package couldn’t be delivered due to “incomplete address information.” With over 630 phishing pages spanning 50 countries, the campaign targets unsuspecting individuals at an alarming scale. In today’s digital landscape, not all deliveries are worth opening - especially the fraudulent ones.

Jan 27, 2025

Cyware Daily Threat Intelligence, January 27, 2025

Once again proving there’s no honor among thieves, hackers were found preying on script kiddies via a trojanized XWorm RAT builder, compromising over 18,000 devices globally. The fake builder allowed operators to steal data and issue commands through a Telegram-based C2. LTE and 5G networks face a critical challenge as researchers uncover 119 vulnerabilities that could disrupt services or breach core networks. These flaws, linked to buffer overflows and memory corruption, leave mobile users exposed to potential monitoring and targeted attacks. A deceptive malware campaign leverages fake CAPTCHA pages and clipboard hijacking to spread Lumma Stealer across industries in multiple regions. The malware uses advanced evasion tactics to outmaneuver security defenses while stealing sensitive data.

Jan 24, 2025

Cyware Daily Threat Intelligence, January 24, 2025

Hackers are crafting convincing traps by mimicking trusted platforms. Nearly 1,000 fake web pages imitating Reddit and WeTransfer are being used to distribute Lumma Stealer. Fraudsters fake Reddit discussions and provide malicious WeTransfer links, creating an illusion of authenticity. Juniper edge devices are under attack by J-magic, a stealthy malware that activates only when it detects a specific magic packet. Targeting multiple industries J-magic’s reverse shell remains dormant until triggered, enabling covert communications. A flaw in Cloudflare's CDN exposes users’ locations via images sent through apps like Signal and Discord. By exploiting this vulnerability, attackers can pinpoint a target’s location within a 250-mile radius, leveraging Cloudflare's caching system to silently gather data.

Jan 23, 2025

Cyware Daily Threat Intelligence, January 23, 2025

Cybercriminals are finding new ways to exploit the cloud. The financially driven TRIPLESTRENGTH group has been targeting platforms like Google Cloud and AWS for cryptojacking and ransomware, often leveraging stolen credentials from malware infections. The QakBot loader has a new ally: BackConnect (BC) malware. Researchers uncovered its use in tandem with tools like DarkVNC and KeyHole, bolstering system data theft and remote access capabilities. This innovation is linked to Storm-1811 and the deployment of Black Basta ransomware. AIRASHI, an AISURU botnet variant, has been exploiting zero-day vulnerabilities in Cambium Networks cnPilot routers to deliver DDoS attacks reaching up to 3 Tbps. Its operators flaunt their capabilities on Telegram, with compromised devices found across the globe.

Jan 22, 2025

Cyware Daily Threat Intelligence, January 22, 2025

A covert supply chain attack compromised a South Korean VPN provider, with the China-linked APT group PlushDaemon embedding its SlowStepper backdoor into a malicious installer. Active since 2019, this espionage campaign leverages a sophisticated toolkit, hijacked app updates, and server vulnerabilities to target victims across multiple nations. The Murdoc botnet has emerged as a formidable threat, exploiting vulnerabilities in AVTECH IP cameras and Huawei routers to infect over 1,370 systems in Southeast Asia and Latin America. With its roots in Mirai, this botnet uses shell scripts tailored to IoT architectures, aiming to power massive DDoS campaigns. Oracle’s latest Critical Patch Update addresses 318 vulnerabilities, including a severe flaw in its Agile Framework. With critical risks spanning products like JD Edwards and Communications Routers, organizations are urged to update immediately to mitigate the danger of exploitation.