When trust is exploited, even a simple email can become a cyber minefield. FortiGuard Labs has uncovered a phishing campaign that uses customer impersonation to launch multi-stage malware attacks, deploying threats like XWorm, Venom RAT, AsyncRAT, and PureHVNC with advanced obfuscation techniques.

Meanwhile, a hidden vulnerability lurked for nearly two decades, exposing AMD processors to potential exploitation. The newly disclosed SinkClose flaw (CVE-2023-31315) allows attackers with Kernel-level access to escalate privileges to the rarely reached Ring -2, enabling stealthy malware installation on affected systems.

In another disclosure, a newly discovered flaw in Microsoft Office puts NTLM hashes at risk of remote theft. The vulnerability (CVE-2024-38200) could let attackers access sensitive information across multiple Office versions.

Top Malware Reported in the Last 24 Hours

**PureHVNC deployed via multi-stage loader **

FortiGuard Labs discovered a recent phishing campaign targeting employees, tricking them into opening a malicious attachment by posing as a customer. Once a victim clicked on the malicious attachment, it initiated a multi-stage attack chain resulting in the deployment of multiple malware families, including XWorm, Venom RAT, AsyncRAT, and PureHVNC. Notably, the PureHVNC malware targets specific applications and can carry out further attacks using its plugins. All the malware used in this attack employ the same packing and obfuscation techniques, including a Python obfuscator called ‘Kramer,’ a shellcode generator called 'donut,' and a shellcode loader called 'laZzzy' to avoid detection.

Top Vulnerabilities Reported in the Last 24 Hours

**Unpatched Office bug exposes NTLM hashes **

Microsoft has revealed a serious vulnerability in Office 2016 that could expose NTLM hashes to remote attackers. The flaw, tracked as CVE-2024-38200, allows unauthorized actors to access protected information. It affects various Office versions, including Office 2016, Office 2019, Office LTSC 2021, and Microsoft 365 Apps for Enterprise. Microsoft suggests blocking outbound NTLM traffic to remote servers as a mitigation strategy.

Vulnerabilities in Ewon Cosy+

Security vulnerabilities have been disclosed in the industrial remote access solution Ewon Cosy+. The bugs allow attackers to gain root privileges on devices, decrypt encrypted firmware files, access encrypted data such as passwords, and hijack VPN sessions. The vulnerabilities include an OS command injection flaw, a filter bypass for obtaining a reverse shell via OpenVPN configuration upload, and a persistent cross-site scripting vulnerability that could lead to administrative access and root compromise. Additionally, a hard-coded key for password encryption could be exploited to extract sensitive information.

SinkClose flaw in AMD processors

AMD has issued a warning about a high-severity (CVSS score: 7.5) CPU vulnerability called SinkClose that affects multiple generations of EPYC, Ryzen, and Threadripper processors. The flaw, tracked as CVE-2023-31315, has gone undetected for almost 20 years. It allows attackers with Kernel-level privileges to gain Ring -2 privileges, enabling the installation of nearly undetectable malware on the system. The vulnerability affects the System Management Mode (SMM) feature of modern CPUs, which is isolated from the operating system to prevent easy targeting by malware.

OpenVPN endpoints at risk

Microsoft has identified four security flaws in OpenVPN that could allow attackers to achieve remote code execution (RCE) and local privilege escalation (LPE). These vulnerabilities, affecting versions prior to 2.6.10 and 2.5.10, can lead to data breaches and unauthorized access to sensitive information. The flaws include a stack overflow issue, unauthorized access to a Windows service, a plugin vulnerability, and a memory overflow problem.

Top Scams Reported in the Last 24 Hours

Fake X content warning scams proliferate

X is facing a rise in scams exploiting the Ukraine war and earthquake in Japan to lure users into clicking on fake content that leads to scam adult sites, harmful browser extensions, and suspicious affiliate sites. These scams involve posts that initially appear to be pornographic videos but actually redirect users to fake adult sites. Scammers are now also sharing posts claiming to have information about Ukrainian forces invading Kursk or earthquake warnings in Japan. These posts contain fake content warnings that, when clicked, connect to URLs that ultimately lead to scam sites.