Cyware Daily Threat Intelligence, August 28, 2025

A data theft campaign attributed to UNC6395 targeted Salesforce instances via compromised OAuth tokens linked to the Salesloft Drift app, exfiltrating sensitive credentials between August 8-18, 2025. Salesloft and Salesforce responded by revoking all active access tokens and removing the Drift app from AppExchange.

Truesec uncovered a cybercrime campaign distributing a trojanized "AppSuite PDF Editor" via Google ads, installing "TamperedChef" malware that steals credentials and web cookies. The campaign started on June 26, 2025, with malicious capabilities activated on August 21, 2025.

Cisco warned of a high-severity vulnerability (CVE-2025-20241) in Nexus 3000 and 9000 Series switches that could enable DoS attacks via crafted network packets. Cisco released software updates to address the vulnerability and recommends immediate patching.

Top Malware Reported in the Last 24 Hours

Data theft campaign targets Salesforce instances via Salesloft Drift

Google Threat Intelligence Group has identified a widespread data theft campaign, attributed to the actor UNC6395, targeting Salesforce customer instances through compromised OAuth tokens associated with the Salesloft Drift third-party application. Between August 8 and August 18, 2025, the actor exfiltrated large volumes of data from numerous corporate Salesforce instances, primarily seeking credentials such as AWS access keys and Snowflake-related access tokens. In response, Salesloft and Salesforce have revoked all active access tokens with the Drift application and removed it from the Salesforce AppExchange.

TamperedChef malware campaign

Truesec has identified a large cybercrime campaign promoting a trojanized PDF editor called "AppSuite PDF Editor" through Google advertising. The malicious PDF Editor.exe file installs an information-stealing malware dubbed "TamperedChef," which harvests sensitive data, including credentials and web cookies. The campaign began on June 26, 2025, and the malicious capabilities were activated on August 21, 2025. The threat actor has used digital certificates from various companies to sign the malware.

Top Vulnerabilities Reported in the Last 24 Hours

Zip Slip vulnerability: path traversal during File compression

The Zip Slip vulnerability is a path traversal vulnerability that occurs when compression programs improperly validate file paths during decompression, allowing attackers to create files outside the target directory or overwrite existing files. This vulnerability affects various compression formats, including ZIP, TAR, RAR, and 7Z. Recent vulnerabilities such as CVE-2025-8088 and CVE-2025-6218 in WinRAR have been exploited by attackers to achieve arbitrary file creation and remote code execution.

FreePBX servers hacked via zero-day vulnerability

The Sangoma FreePBX Security Team has warned about an actively exploited zero-day vulnerability in FreePBX servers with the Administrator Control Panel (ACP) exposed to the internet. Hackers have been exploiting this vulnerability since August 21, 2025, to breach servers. An emergency EDGE module fix has been released for testing, with a standard security release scheduled for later.

Cisco Nexus 3000 & 9000 vulnerability enables DoS attacks

Cisco has issued a high-severity security advisory for a vulnerability (CVE-2025-20241) in its Nexus 3000 and 9000 Series switches that could allow attackers to trigger denial of service (DoS) attacks through crafted network packets. The vulnerability affects the Intermediate System-to-Intermediate System (IS-IS) feature in Cisco NX-OS Software and can be exploited by unauthenticated, adjacent attackers. Cisco has released software updates to address this vulnerability and recommends immediate patching as the primary defense measure.