SpyNote, which usually steals user data or conducts espionage campaigns, appears to have taken a new course toward bank fraud. It masquerades as different applications while gaining access to Accessibility services, thus, engaging in malicious activities, such as keylogging and 2FA bypass. In other news, Minecraft faces the BleedingPipe vulnerability, enabling hackers to run remote code on players' computers through infected servers or clients with certain mods installed. The exploit utilizes Java deserialization and poses a threat to users who use vulnerable mods on their servers.

Do you use Stremio? Users are advised to take necessary precautions in the wake of an unpatched security flaw in the application. Security researchers published their findings after the 90-day disclosure period.

Top Breaches Reported in the Last 24 Hours

Tempur Sealy faces cyberattack

Global mattress seller Tempur Sealy has been hit by a cyberattack, forcing the company to shut down parts of its IT systems. The attack, which began on July 23, hindered operations and prompted the activation of incident response and business continuity plans. While it remains unclear whether it was a ransomware attack, the company has engaged cybersecurity experts and law enforcement authorities. So far, no specific hacking group has claimed responsibility for the attack.

Top Malware Reported in the Last 24 Hours

Sophisticated malware targets Italian organizations

Proofpoint researchers spotted a new malware called WikiLoader that has been deployed in multiple campaigns, mainly targeting Italian organizations. The malware boasts various evasion techniques and custom code implementation to hinder detection and analysis. It acts as a downloader, aiming to install a secondary malware payload. Owing to its use by several threat actors, it is anticipated that WikiLoader may be offered for sale to other cybercriminal groups, including initial access brokers.

SafeChat spyware by Indian APT

Hackers are employing a deceptive Android app, named SafeChat, to distribute spyware, with an aim to steal call logs, texts, and GPS locations from devices. Researchers suspect the spyware to be a variant of ‘Coverlm’, targeting communication apps like Telegram, Signal, WhatsApp, Viber, and Facebook Messenger. CYFIRMA researchers link the Iranian APT hacking group Bahamut to the campaign.

Spike in SpyNote activities

Cleafy Threat Intelligence Team has witnessed an increase in spyware infections, particularly SpyNote, known for espionage campaigns and now, for bank fraud. The attack chain often starts with a fake SMS message, redirecting users to download a "certified banking app" that is actually SpyNote. Notably, TeamViewer has been exploited by threat actors in these fraud operations through social engineering attacks, where attackers impersonate bank operators to execute fraudulent transactions on victims' devices.

NodeStealer targets Facebook Business accounts

Unit 42 researchers have discovered an unreported phishing campaign aimed at Facebook business accounts, distributing a NodeStealer variant, written in Python. Besides stealing cryptocurrency, the malware targets credentials from browsers. While this campaign is no longer active, indications suggest the threat actors may continue using and evolving NodeStealer or employing similar techniques to target Facebook business accounts.

Top Vulnerabilities Reported in the Last 24 Hours

Bug exploited in Minecraft Mods

Cybercriminals are actively exploiting the BleedingPipe vulnerability in Minecraft mods to execute malicious commands on servers and clients, gaining control over the devices. The flaw arises from incorrect deserialization usage in the 'ObjectInputStream' class in Java, impacting several Minecraft mods running on 1.7.10/1.12.2 Forge. By sending specially crafted network packets, attackers compromise vulnerable Minecraft mod servers, enabling them to exploit the same mods used by connecting players, spreading malware to their devices.

Security hole in Stremio

CyFox researchers have identified a severe DLL planting/hijacking vulnerability in Stremio, a popular media center application. Attackers could exploit this flaw to execute code on victims' systems, potentially leading to information theft and system compromise. The vulnerability affects Stremio for Windows v4.4 and arises from the use of Windows API functions, enabling attackers to plant malicious DLLs in the application directory.