Cyware Daily Threat Intelligence, August 18, 2025

Daily Threat Briefing • August 18, 2025

Trojan Horses are making a comeback as AI-powered apps like "JustAskJacky" disguise malware within useful tools such as recipe or image search apps. By leveraging AI-generated websites, attackers make them look legitimate while slipping past antivirus defenses.

A critical flaw (CVE-2025-7353) in Rockwell’s ControlLogix Ethernet modules could let hackers remotely manipulate memory and hijack industrial processes. Rockwell has released firmware version 12.001 and urges immediate patching, with no workarounds available.

Cybercriminals are cashing in on the back-to-school rush with fake e-commerce sites posing as trusted retailers. Luring victims with deep discounts and realistic AI-driven ads, these fraudulent shops steal money and personal data.

Top Malware Reported in the Last 24 Hours

Multi-stage attack using termncolor and colorinal packages

Zscaler ThreatLabz identified malicious Python packages termncolor and colorinal, which facilitate multi-stage malware operations. The malware uses terminate.dll for AES decryption, stealthy file deployment, and persistence via registry entries. The attack targets both Windows and Linux systems, employing terminate.dll and terminate.so files for execution.

AI fuels the comeback of Trojan Malware

AI-powered tools like "JustAskJacky" and other apps have led to a resurgence of true Trojan Horses, which were previously rare. Websites and applications appear professional and legitimate, making them indistinguishable from safe platforms, bypassing traditional user caution. Trojan Horses now integrate malicious code within functional applications, such as recipe apps or image search tools, exploiting AI-generated content. Large Language Models (LLMs) enable threat actors to create convincing websites and applications, reducing the effort required to evade antivirus detection.

Top Vulnerabilities Reported in the Last 24 Hours

Severe vulnerability in Elastic's EDR system

A critical 0-day vulnerability was discovered in Elastic’s Endpoint Detection and Response (EDR) kernel driver, allowing attackers to exploit the system it is supposed to protect. The attack chain involves bypassing Elastic’s security solutions, enabling remote code execution, establishing persistence, and triggering a DoS attack. The vulnerability stems from mishandled memory operations in the kernel driver, leading to a CWE-476: NULL Pointer Dereference that causes system crashes (BSOD). The flaw allows the trusted Elastic driver to exhibit malware-like behavior, making it a weapon against its own host system.

Critical flaw in ControlLogix modules

Rockwell Automation has identified a critical vulnerability (CVE-2025-7353) in its ControlLogix Ethernet modules, which could allow remote attackers to execute malicious code on industrial control systems. The flaw stems from an insecurely configured web-based debugger agent that enables unauthorized access, memory manipulation, and control of industrial processes. The vulnerability carries a CVSS score of 9.8, highlighting its severity. Affected modules include several ControlLogix communication models, essential for industrial automation. Rockwell Automation has released firmware version 12.001 to address the issue, urging immediate patching as no workarounds are available.

Top Scams Reported in the Last 24 Hours

Chinese cybercriminals exploit NFC technology for retail fraud

Chinese-speaking threat actors are leveraging Ghost-tapping techniques, a new way to commit retail fraud via NFC relay fraud, utilizing stolen payment card details linked to mobile wallets like Apple Pay and Google Pay. Cybercriminals sell burner phones loaded with stolen payment card credentials and proprietary software capable of relaying payment card data for ghost-tapping campaigns. Chinese syndicates recruit mules to purchase physical goods using ghost-tapping techniques, resell them for cash, and launder funds through platforms like Huione Guarantee, Xinbi Guarantee, and Tudou Guarantee.

Scammers capitalize on back-to-school deals

Scammers exploit the back-to-school shopping season by creating fraudulent e-commerce sites that mimic legitimate retailers to steal funds and personal data. These sites offer fake discounts on high-demand items and use phishing tactics to harvest sensitive information. Social media and AI-driven ads target shoppers with realistic promotions, leading them to scam domains. Smishing campaigns also pose risks, impersonating delivery notifications to lure users into malware-laden sites.

Related Threat Briefings

Aug 15, 2025

Cyware Daily Threat Intelligence, August 15, 2025

PhantomCard malware hits Brazilian banks, Cisco patches critical firewall flaw, and Netflix job scams steal Facebook logins from professionals.

Aug 14, 2025

Cyware Daily Threat Intelligence, August 14, 2025

A crafty malvertising campaign is slipping PS1Bot into systems through deceptive compressed archives. With techniques like environmental polling and dynamic C# DLL compilation, PS1Bot evades detection while siphoning off passwords and cryptocurrency wallet data, echoing tactics of Skitnet and AHK Bot. Crypto24 is striking high-profile organizations with surgical precision, blending legitimate IT tools like PSExec and AnyDesk with custom malware to devastating effect. Targeting sectors from finance to entertainment across Asia, Europe, and the U.S., this ransomware group uses privileged accounts and scheduled tasks to maintain stealthy persistence. Fortinet is sounding the alarm on a critical FortiSIEM vulnerability that’s already being exploited in the wild with circulating exploit code. Rated 9.8 on CVSS, this remote unauthenticated command injection flaw allows attackers to execute unauthorized commands via crafted CLI requests.

Aug 13, 2025

Cyware Daily Threat Intelligence, August 13, 2025

Lurking in the shadows since mid-2024, the Curly COMrades group is weaving a web of cyber-espionage across Georgia’s government and Moldova’s energy sector. Their weapon, MucorAgent, uses AES-encrypted PowerShell scripts and hijacked COM objects to slip past defenses, employing erratic scheduled tasks and legitimate remote tools to steal credentials. Microsoft’s August 2025 Patch Tuesday dropped a hefty fix for 111 vulnerabilities, including a zero-day Kerberos flaw that’s raising alarms. Dubbed BadSuccessor, this privilege escalation bug allows attackers with sufficient access to hijack Active Directory domains via Managed Service Accounts. A slick phishing campaign is hitting UK organizations hard, masquerading as the Home Office to swipe Sponsorship Management System credentials. Using urgent emails to lure victims to fake login pages, attackers are raking in £15,000 to £20,000 per scam through fake job offers and visa fraud.

Aug 12, 2025

Cyware Daily Threat Intelligence, August 12, 2025

GitHub repositories are turning into unexpected traps, with SmartLoader malware lurking behind seemingly legitimate projects like game cheats and software cracks. Disguised in README files and compressed archives, it activates via a malicious batch file that loads an obfuscated Lua script, delivering infostealers. A formidable new ransomware, Charon, is borrowing pages from APT playbooks to deliver tailored strikes against organizations. Using DLL sideloading and process injection via legitimate binaries, it deploys advanced encryption with Curve25519 and ChaCha20 and spreads across networks by targeting shares. Dutch cybersecurity officials are spotlighting active exploits of a critical Citrix NetScaler vulnerability, hitting key organizations since early May. The bug enables control flow hijacking and DoS attacks on Gateway or AAA configurations, with web shells found on compromised devices.

Aug 11, 2025

Cyware Daily Threat Intelligence, August 11, 2025

ScarCruft is pulling out all the stops with a malware campaign disguised as a simple postal code update, blending languages and abusing legitimate services for maximum stealth. This North Korean APT group deploys phishing emails with malicious LNK files in RAR archives, unleashing nine malicious components. A fresh twist on the DarkCloud malware is catching victims off guard through phishing emails packed with obfuscated JavaScript in RAR archives. Written in Visual Basic 6, this variant dodges sandboxes by monitoring user activity, steals credentials and payment data from apps, and exfiltrates it all via SMTP as text files. Attackers are turning Windows domain controllers into unwitting DDoS weapons with a clever technique called Win-DDoS. This leverages the sheer bandwidth of thousands of DCs, while exposed critical DoS vulnerabilities in LDAP and LSASS add to the remote exploitation risks, turning the platform against itself.

Aug 8, 2025

Cyware Daily Threat Intelligence, August 08, 2025

A new breed of EDR killer tool is arming multiple ransomware gangs with the power to silently disable security defenses. This heavily obfuscated binary, injected into legitimate applications, uses a signed driver with a random name to execute BYOVD attacks, terminating processes of major security tools. Shared among threat groups, its varied builds suggest a collaborative framework, amplifying its threat to compromised systems. CISA is sounding the alarm with a tight deadline, urging federal agencies to patch a critical Microsoft Exchange vulnerability by Monday morning. Tracked as a high-risk flaw affecting Exchange Server 2016, 2019, and Subscription Edition, it allows attackers with on-premises admin access to breach cloud environments, potentially seizing full domain control. GreedyBear is rewriting the playbook for crypto theft with a sprawling campaign that’s as bold as it is cunning. Deploying over 150 malicious Firefox extensions, 500 executables, and numerous phishing sites, the group uses Extension Hollowing to weaponize initially benign extensions for stealing wallet credentials. This highly organized operation runs from a centralized server, posing a major risk to users.

Aug 7, 2025

Cyware Daily Threat Intelligence, August 07, 2025

Lazarus Group is back with a cunning new Python-based RAT, PyLangGhost, targeting tech and finance sectors with a fresh twist. Using fake job interviews and deceptive error prompts, attackers trick developers and executives into running scripts that grant remote access. A sneaky flaw in Amazon’s ECS, dubbed ECScape, is opening the door to privilege escalation in shared cloud environments. By exploiting an undocumented internal protocol and metadata service, low-privileged containers can steal IAM credentials from higher-privileged tasks on the same EC2 instance. Ghost Calls, a new evasion tactic, is turning Zoom and Microsoft Teams into covert channels for malicious activity, slipping past traditional defenses with ease. This tactic exploits TURN servers to tunnel C2 traffic disguised as legitimate WebRTC video conferencing data.

Aug 6, 2025

Cyware Daily Threat Intelligence, August 06, 2025

Phishing emails disguised as court summons are delivering a malicious payload to Ukrainian government and defense sectors, courtesy of UAC-0099. These attacks use shortened URLs to deploy HTA files that execute obfuscated VB scripts, installing malware like MATCHBOIL, MATCHWOK, and DRAGSTARE. The CISA is sounding the alarm on three actively exploited vulnerabilities in D-Link Wi-Fi cameras and video recorders, now added to its KEV catalog. These flaws, with severity scores up to 8.8, include a remote password disclosure issue, an authenticated command injection vulnerability, and an unpatched code execution flaw tied to end-of-life models. A critical set of flaws dubbed ReVault is exposing over 100 Dell laptop models to devastating firmware attacks. Affecting the ControlVault3 firmware in Latitude and Precision series, these vulnerabilities allow attackers with physical access to bypass Windows login, execute arbitrary code, and install persistent malware that survives system reinstalls.

Aug 5, 2025

Cyware Daily Threat Intelligence, August 05, 2025

A stealthy Python-based PXA Stealer is sweeping across 62 countries, pilfering sensitive data from unsuspecting victims. This infostealer campaign has exfiltrated hundreds of thousands of passwords and more. Using sideloading tricks with legitimate software, it targets browsers, cryptocurrency wallets, and financial sites, posing a severe threat to users and organizations alike. ClickTok is luring TikTok Shop users into a trap with a crafty blend of phishing and malware. This global campaign deploys over 10,000 fake TikTok websites and 5,000 malicious apps, impersonating TikTok’s e-commerce platforms to steal cryptocurrency wallet credentials. Trojanized apps laced with SparkKitty spyware snatch sensitive data, making this a sophisticated scam targeting digital shoppers. Google’s August 2025 Android security update is a critical shield against newly discovered vulnerabilities threatening millions of devices. Addressing six flaws, the update also patches high-severity Android framework bugs and issues in Arm and Qualcomm components. With two patch levels rolled out, manufacturers are now racing to deploy fixes to keep users secure.

Aug 4, 2025

Cyware Daily Threat Intelligence, August 04, 2025

Akira ransomware is striking with surgical precision, exploiting a suspected zero-day flaw in SonicWall SSL VPN devices, even those fully patched. Since mid-July 2025, attackers have used Virtual Private Server logins to bypass MFA, hitting multiple targets in rapid succession. A cunning Android RAT, PlayPraetor, is sweeping through six countries, already compromising over 11,000 devices with its deceptive tactics. Masquerading as legitimate apps via fake Google Play Store pages and Meta Ads, it exploits accessibility services to overlay phishing screens on nearly 200 banking and crypto apps. MediaTek chipsets powering smartphones and IoT devices are vulnerable to new flaws that could expose millions of users. These issues, affecting a wide range of Android devices, allow attackers to escalate privileges or execute malicious code. With some exploits requiring no user interaction, unpatched systems face significant risks, urging immediate updates.

Aug 1, 2025

Cyware Daily Threat Intelligence, August 01, 2025

In a move straight out of a spy novel, Russian state hackers have been caught red-handed targeting embassies in Moscow with a sophisticated cyberespionage campaign. Known as Secret Blizzard, these attackers wielded the ApolloShadow malware to manipulate system certificates and disguise their activities as trusted applications. A critical flaw in PostgreSQL's pg_dump utility has left databases vulnerable to a race condition attack, potentially handing attackers superuser privileges. This TOCTOU vulnerability impacts multiple PostgreSQL versions, allowing those with sufficient privileges to execute arbitrary SQL commands during the dump process. Cybercriminals are donning digital disguises, impersonating trusted enterprises with fake Microsoft OAuth applications to steal credentials and bypass multi-factor authentication. Proofpoint uncovered campaigns redirecting users to phishing URLs through OAuth apps mimicking services like RingCentral, DocuSign, and Adobe. A newly discovered cyberattack technique, dubbed Man in the Prompt, is turning browser extensions into unwitting accomplices in data theft from generative AI tools. By exploiting DOM access, malicious extensions can intercept and manipulate interactions with platforms like ChatGPT and Google Gemini - no elevated permissions required.

Jul 31, 2025

Cyware Daily Threat Intelligence, July 31, 2025

With a cunning pivot, the North Korean Lazarus Group has flooded npm and PyPI with over 200 malicious packages, potentially compromising 36,000 developers. Mimicking legitimate libraries, these packages deploy multi-stage attacks to steal secrets and target DevOps-heavy organizations, risking intellectual property theft and reputational damage through compromised build pipelines. A critical chink in Lenovo’s armor has exposed Secure Boot vulnerabilities in its IdeaCentre AIO 3 and Yoga AIO series desktops. Six flaws in the Insyde UEFI firmware allow local attackers to execute arbitrary code via SMM exploits, potentially implanting undetectable malware, with firmware updates already available for some models. Apple’s latest security updates have fortified its ecosystem against a barrage of vulnerabilities across iOS, iPadOS, macOS, watchOS, tvOS, and visionOS. Addressing over 90 issues in macOS Sequoia alone, the patches tackle memory corruption, privilege escalation, and WebKit flaws, while enhancing privacy protections for microphone and camera access across devices.