Cyware Daily Threat Intelligence, August 21, 2025

Slipping through the cracks like a chameleon, QuirkyLoader is spreading infostealers and remote access tools with a multi-stage attack. Since November 2024, it’s used malicious emails with legitimate executables, leveraging DLL side-loading to target organizations, evading detection with process hollowing.

A zero-day flaw has Apple racing to patch millions of devices with emergency iOS and iPadOS updates. This critical ImageIO vulnerability, triggered by malicious images, allows sophisticated attacks—potentially by nation-state actors—to corrupt memory and access devices like iPhone XS and various iPads.

Hackers are hijacking Microsoft’s own infrastructure to steal 365 logins with a sly phishing trick. Using legitimate office[.]com links and ADFS redirects, attackers funnel users from Google searches to deceptive phishing pages, bypassing MFA and URL detection with custom tenants and conditional loading.

Top Malware Reported in the Last 24 Hours

Researchers unveil QuirkyLoader malware

QuirkyLoader is a newly identified malware loader that has been actively delivering various infostealers and remote access tools since November 2024. This multi-stage infection process begins with malicious emails containing an archive file that includes a legitimate executable, an encrypted payload, and a malicious DLL. By employing DLL side-loading, QuirkyLoader executes the DLL, which decrypts and injects the final payload into target processes using techniques like process hollowing. Notably, the loader's DLL module is consistently written in C# .NET and utilizes Ahead-of-Time (AOT) compilation to disguise its true nature. QuirkyLoader has been observed in campaigns targeting specific organizations, such as Nusoft in Taiwan, and employs unique encryption methods, including the Speck-128 cipher, to evade detection and execute its malicious activities effectively.

Lovable AI platform abused for cybercrime

Cybercriminals are increasingly exploiting the AI-powered website builder Lovable to create a variety of malicious sites, including phishing pages and malware portals that impersonate well-known brands. Since February, Proofpoint has detected tens of thousands of Lovable URLs used in phishing campaigns, with attackers sending hundreds of thousands of emails targeting organizations. Examples include fake Microsoft login pages designed to harvest user credentials and a UPS impersonation scheme that collected personal and financial information. Additionally, a cryptocurrency theft campaign tricked users into connecting their wallets to fraudulent sites, while malware delivery efforts utilized Lovable-hosted links to distribute remote access trojans. 

Top Vulnerabilities Reported in the Last 24 Hours

Apple patches critical 0-day

Apple issued emergency updates for iOS 18.6.2 and iPadOS 18.6.2 to fix a critical zero-day vulnerability actively exploited in attacks. The vulnerability (CVE-2025-43300) is an out-of-bounds write issue in the ImageIO framework, triggered by malicious image files. Exploitation can lead to memory corruption and unauthorized device access, affecting millions of users globally. Devices impacted include iPhone XS and later models, and various iPad generations such as iPad Pro, iPad Air, and iPad mini. The attacks are described as "extremely sophisticated," potentially linked to nation-state actors or advanced threat groups.

Threat actors exploit GeoServer bug 

Attackers are exploiting the CVE-2024-36401 vulnerability in GeoServer to gain unauthorized access to victims' machines and monetize their bandwidth. This critical-severity vulnerability allows for RCE, with a CVSS score of 9.8. Criminals deploy legitimate SDKs or modified applications to generate passive income through network sharing, mimicking strategies used by some legitimate developers. Since March, attackers have targeted publicly accessible GeoServer instances, shifting their tactics and infrastructure to evade detection. The exploitation involves injecting arbitrary code into JXPath query statements, enabling attackers to execute system commands covertly. The malicious applications run silently in the background, utilizing victims' internet resources without their knowledge, creating a stealthy yet profitable operation for cybercriminals.

Top Scams Reported in the Last 24 Hours

Hackers exploit ADFS for phishing attacks

Hackers are employing a novel technique that leverages legitimate office[.]com links and Active Directory Federation Services (ADFS) to redirect users to phishing pages aimed at stealing Microsoft 365 logins. This method allows attackers to bypass traditional URL detection and multi-factor authentication by utilizing trusted Microsoft infrastructure for initial redirects. Researchers analyzed a campaign where users were directed from a Google search result to a legitimate Microsoft site, which then redirected them to a phishing page. The attackers set up a custom Microsoft tenant with ADFS, enabling them to receive authorization requests and create a deceptive experience that masked the phishing site as legitimate. By implementing conditional loading restrictions, the phishing page only appeared to valid targets, further complicating detection efforts.