Some attacks are subtle and devious, like the newly discovered Voldemort malware campaign. The stealthy malware campaign takes advantage of a vulnerability in Cisco Webex to deploy backdoors via DLL hijacking, bypassing security defenses. Once activated, it creates persistent tasks and communicates with C2 servers on legitimate cloud platforms.

Cybercriminals are putting a modern twist on their attacks with Rust-based botnets like RustoBot. FortiGuard Labs discovered the Rust-based botnet targeting TOTOLINK and DrayTek routers using vulnerabilities like CVE-2022-26210 to perform RCE. The botnet is spread across Japan, Taiwan, Vietnam, and Mexico.

A massive ad fraud operation is quietly raking in billions of fake ad requests.  The Scallywag ad fraud operation reportedly generated 1.4 billion fake ad requests daily, exploiting WordPress plugins like Soralink and Droplink to target piracy and URL shortening sites, helping criminals monetize low-quality sites.

Top Malware Reported in the Last 24 Hours

Voldemort malware targets Cisco Webex

A sophisticated malware campaign, dubbed Voldemort, has been uncovered, exploiting a critical vulnerability in Cisco Webex to deploy backdoors on targeted systems. The campaign leverages DLL hijacking techniques, using legitimate Cisco executables to load malicious code without triggering typical security alerts. The malware, once executed, creates scheduled tasks for persistence and communicates with C2 servers hosted on legitimate cloud services.

Attackers deploy Ammyy Admin malware

Attackers have been found targeting poorly managed MS-SQL servers to install Ammyy Admin, a remote control tool, exploiting weak credentials and vulnerable systems. Ammyy Admin is used to control systems remotely along with AnyDesk, ToDesk, TeamViewer, and others. During the attacks, the threat actors installed multiple payloads, including Ammyy Admin (mscorsvw.exe), the settings file for Ammyy Admin (settings3.bin), and PetitPotato (p.ax) on vulnerable systems.

RustoBot botnet exploits router vulnerabilities

FortiGuard Labs discovered a sophisticated botnet named RustoBot, which is written in Rust. This botnet exploits vulnerabilities (CVE-2022-26210, CVE-2022-26187, and CVE-2024-12987) in TOTOLINK and DrayTek routers to gain RCE capabilities, thereby establishing a foothold in tech infrastructures across Japan, Taiwan, Vietnam, and Mexico.

Top Vulnerabilities Reported in the Last 24 Hours

Critical flaw found in Yokogawa industrial devices

A high-severity vulnerability, tracked as CVE-2025-1863, has been identified in multiple industrial recorders and data acquisition systems manufactured by Yokogawa Electric Corporation, a Japan-based provider of automation and measurement solutions. Classified under CWE-306: Missing Authentication for Critical Function, the flaw stems from insecure default configurations—specifically, the lack of authentication enabled by default on several affected devices.

Vulnerability in Greenshift Plugin puts 50,000 WordPress sites at risk

A high-severity vulnerability has been discovered in the Greenshift WordPress plugin, which is installed on over 50,000 websites. The vulnerability, disclosed by Wordfence, allows unauthenticated attackers to perform arbitrary file uploads due to missing file type validation in the plugin. This flaw could potentially lead to RCE on affected WordPress sites, allowing threat actors to take full control of the server.

Top Scams Reported in the Last 24 Hours

Scallywag ad fraud hits 1.4 billion fake ad requests daily

​A large-scale ad fraud operation named Scallywag has been found exploiting specially crafted WordPress plugins to generate up to 1.4 billion fraudulent ad requests per day. The fraud-as-a-service operation primarily targets pirating and URL shortening sites, which are typically avoided by legitimate advertisers due to legal and brand safety concerns.​ The operation revolves around four WordPress plugins, namely Soralink, Yu Idea, WPSafeLink, and Droplink, that are marketed as tools to monetize low-quality or risky websites. They are sold to various threat actors, enabling them to establish their ad fraud schemes.