Cyware Daily Threat Intelligence, August 26, 2025

Sneaky adware is sneaking onto millions of Android devices through 77 malicious apps yanked from Google Play. With over 19 million installs, these apps pack Joker malware that steals info and signs up for premium services, alongside Harly variants and the evolving Anatsa trojan.

A Docker Desktop flaw is handing attackers the keys to host systems on Windows and macOS. This SSRF vulnerability lets malicious containers bypass isolation to access the Engine API, mount drives, and escalate privileges, fixed in version 4.44.3 to curb unauthorized file access.

Phony Tesla sites are reeling in robot enthusiasts with Google Ads promising Optimus preorders for a $250 deposit. These scams mimic Tesla's look to harvest credit card details for underground markets, using rotating domains and Cloudflare to stay elusive.

Top Malware Reported in the Last 24 Hours

Malicious Android apps removed from Play Store

Seventy-seven malicious Android apps with over 19 million installs were removed from Google Play after a discovery by Zscaler's ThreatLabs. These apps primarily delivered adware, with Joker malware being the most prevalent, affecting nearly 25% of the analyzed applications. Joker can steal sensitive information, send texts, and subscribe users to premium services. Another variant, Harly, hides its malicious payload within seemingly legitimate apps like games and photo editors. The Anatsa banking trojan has also evolved, expanding its target list to 831 banking and cryptocurrency apps while using advanced evasion techniques. This latest campaign has shifted from remote code loading to direct payload installation, employing malformed APKs to evade detection. 

UNC6384 targets diplomats with PlugX

A China-nexus threat actor known as UNC6384 has been linked to a series of sophisticated attacks targeting diplomats in Southeast Asia and beyond. Utilizing advanced social engineering techniques, the group employs valid code signing certificates and AitM attacks to deliver PlugX malware. The attack begins with a captive portal redirect, leading victims to download a malicious executable disguised as an Adobe Plugin update, called STATICPLUGIN. This downloader retrieves a malicious MSI package that deploys the SOGU.SEC backdoor in memory. The operation leverages legitimate-looking websites and HTTPS connections to trick users, showcasing the evolving capabilities of UNC6384. The malware is signed by Chengdu Nuoxin Times Technology Co., Ltd, with numerous samples linked to Chinese cyber activities dating back to early 2023.

Phishing campaign delivers malware via voicemails

A new phishing campaign is exploiting fake voicemails and purchase orders to distribute the UpCrypter malware loader, primarily targeting sectors such as manufacturing, technology, healthcare, and retail since August 2025. Cybersecurity researchers have noted that the campaign uses deceptive emails containing malicious URLs leading to convincing phishing pages. These pages entice victims to download JavaScript files that serve as droppers for UpCrypter, which then facilitates various RATs like PureHVNC and DCRat. The infection process begins with phishing emails designed to appear legitimate, prompting users to download seemingly harmless files. UpCrypter employs advanced techniques, including steganography and anti-analysis measures, to evade detection and minimize forensic traces.

Top Vulnerabilities Reported in the Last 24 Hours

Critical Docker Desktop vulnerability exposed

A critical vulnerability in Docker Desktop for Windows and macOS, identified as CVE-2025-9074, allows attackers to hijack host systems by running malicious containers, even with Enhanced Container Isolation (ECI) enabled. This SSRF flaw permits unauthorized access to the Docker Engine API without authentication, enabling attackers to launch additional containers and access sensitive files on the host. Security researcher Felix Boulet demonstrated that a malicious container could bind the Windows host’s C: drive to its filesystem using simple HTTP requests. While the risk is lower on macOS due to additional safeguards, attackers can still manipulate application configurations. The vulnerability is particularly severe on Windows, where it allows complete filesystem access and potential privilege escalation. Docker has since addressed this issue in version 4.44.3.

CISA adds three bugs to KEV catalog

The CISA has added three vulnerabilities to its KEV catalog, affecting Citrix Session Recording and Git, due to evidence of active exploitation. The vulnerabilities include CVE-2024-8068, which involves improper privilege management in Citrix, allowing privilege escalation for authenticated users in the same Windows Active Directory domain, and CVE-2024-8069, a deserialization flaw that permits limited remote code execution. The third vulnerability, CVE-2025-48384, found in Git, arises from inconsistent handling of carriage return characters in configuration files, potentially leading to arbitrary code execution. Citrix patched its vulnerabilities in November 2024, while Git addressed its issue in July 2025. 

Top Scams Reported in the Last 24 Hours

Google Ads promote fake Tesla preorders

Scammers are leveraging Google Ads to create counterfeit Tesla websites, targeting users interested in preordering the unreleased Optimus humanoid robot. These deceptive sites mimic Tesla’s official domain and design, demanding a non-refundable deposit of $250, which aligns with Tesla’s previous pricing strategies to enhance credibility. Investigations reveal that these fraudulent platforms do not process payments immediately; instead, they collect credit card information for potential exploitation on underground markets. The scams employ rotating domains and are hosted through Cloudflare, making them difficult to trace and shut down.