Cyware Daily Threat Intelligence, August 15, 2025

Brazil’s banking sector faces a new NFC threat as PhantomCard malware spreads through fake Google Play “Card Protection” apps, tricking users into tapping their cards on infected devices. The malware steals card data via NFC, relays it to cybercriminals, and enables fraudulent transactions.

Cisco firewalls just got a wake-up call after researchers uncovered a critical flaw (CVE-2025-20217) in Secure Firewall Threat Defense Software that allowed attackers to trigger DoS loops during packet inspection. The vulnerability, rooted in the Snort 3 engine, caused service disruptions on affected devices, Cisco has stressed that immediate patching is the only way to stay protected.

Dream Netflix jobs are turning into phishing traps as scammers impersonate company recruiters with fake marketing roles to lure jobseekers onto phishing sites. Victims are tricked into handing over Facebook credentials, giving attackers a path to hijack business accounts and exploit corporate resources for malicious purposes.

Top Malware Reported in the Last 24 Hours

UAT-7237 strikes at Taiwanese web hosting providers

Cisco Talos identified UAT-7237, a Chinese-speaking APT group targeting web infrastructure entities in Taiwan since 2022, using open-source and customized tools for long-term persistence. UAT-7237 employs a customized Shellcode loader called "SoundBill" to decode and load shellcodes, including Cobalt Strike payloads. It is assessed as a subgroup of UAT-5918, sharing victimology and tooling but differing in tactics such as selective web shell deployment and reliance on SoftEther VPN and RDP access. The group exploits known vulnerabilities on unpatched servers to gain initial access and uses tools for reconnaissance, credential extraction, and network scanning.

Blue Locker ransomware targets Pakistani organizations

Blue Locker ransomware is targeting critical government institutions and the oil and gas sector in Pakistan, including Pakistan Petroleum Limited (PPL). The ransomware uses PowerShell-based loaders and phishing emails to deliver its payload, encrypt files, and demand ransom payments. NCERT issued high-alert notifications to 39 ministries to mitigate risks, emphasizing robust cybersecurity measures and employee awareness training. Blue Locker is linked to the Shinra malware family, which shares similarities with RaaS models like Conti and Black Basta.

New NFC-driven malware in mobile banking security

PhantomCard, a new Android NFC-based malware, has been targeting Brazilian banking customers, relaying NFC data from victims' cards to fraudsters' devices. The malware is distributed via fake Google Play pages, disguised as "Card Protection" apps with fake positive reviews to lure victims. PhantomCard operates by requesting victims to tap their cards on the infected device, transmitting NFC data to a server controlled by cybercriminals for fraudulent transactions. The malware relies on the ISO-DEP standard of EMV cards and uses the "scuba_smartcards" library to parse and relay card data. The actor behind PhantomCard, "Go1ano developer," is a reseller who customized the malware purchased from Chinese-originated "NFU Pay" Malware-as-a-Service.

Top Vulnerabilities Reported in the Last 24 Hours

Cisco Firewall flaw enables DoS attacks

A critical vulnerability (CVE-2025-20217) in Cisco’s Secure Firewall Threat Defense Software allows remote attackers to execute DoS attacks by exploiting the Snort 3 Detection Engine. The vulnerability stems from incorrect processing of inspected traffic, causing affected devices to enter an infinite loop during packet inspection, leading to temporary service disruption despite Cisco's automatic recovery mechanisms. The flaw impacts Cisco devices running Secure FTD Software with Snort 3 intrusion policies enabled but does not affect other Cisco products like ASA Software, Meraki, or Umbrella. Cisco has released patches to address the issue as part of its August 2025 security advisory bundle, emphasizing immediate patching as the only mitigation strategy.

New HTTP/2 vulnerability poses a major DDoS threat

Researchers disclosed a critical HTTP/2 vulnerability, "MadeYouReset" (CVE-2025-8671), enabling massive DDoS attacks by bypassing concurrency limits and requiring minimal resources. The vulnerability builds upon 2023’s "Rapid Reset" attack but circumvents previous mitigation strategies, tricking servers into automatically canceling requests. MadeYouReset affects most HTTP/2-compliant servers, causing DoS and out-of-memory crashes, highlighting the need for immediate patching. 

Top Scams Reported in the Last 24 Hours

Scammers impersonate Netflix

Netflix scammers target jobseekers by impersonating the company and offering fake marketing roles. They lure victims to a phishing site where they request Facebook login credentials, using sophisticated methods to intercept and misuse them. The scam targets professionals with access to business accounts, aiming to exploit company resources and assets.