Cyware Daily Threat Intelligence, August 29, 2025

Posing as a golden ticket from the Bangladesh Education Board, SikkahBot is preying on students with fake scholarship lures. Active since July 2024, this Android malware grabs high-risk permissions to intercept SMS and steal financial data, spread via smishing links, with evolving variants showing sharper automation.

A sneaky loophole in the VS Code Marketplace is letting attackers recycle names of deleted extensions to push ransomware. The “shiba” extension, active from late 2024 to mid-2025, encrypts files and demands Shiba Inu tokens, exploiting the platform’s name-reuse flaw to dodge detection.

Click Studios is sounding the alarm on a dangerous flaw in Passwordstate’s password manager. This authentication bypass lets attackers access the admin section via a crafted URL, threatening the credentials of 370,000 IT pros across 29,000 firms, with a fix in Build 9972.

Top Malware Reported in the Last 24 Hours

SikkahBot malware targets students in Bangladesh

SikkahBot is an Android malware campaign that has been active since July 2024, specifically targeting students in Bangladesh. Disguised as applications from the Bangladesh Education Board, it lures victims with false promises of scholarships, coercing them into sharing sensitive personal and financial information. Once installed, SikkahBot requests high-risk permissions, including Accessibility Service and SMS access, enabling it to intercept bank-related messages and execute unauthorized transactions. The malware is distributed through shortened links, likely circulated via smishing attacks, and maintains low detection rates on VirusTotal. As it evolves, newer variants exhibit enhanced automation features, demonstrating the ongoing development by threat actors. 

JSCoreRunner: New Mac malware spotted

Mosyle revealed a new Mac malware strain called JSCoreRunner, which evades detection and spreads through a fake PDF conversion site, fileripple[.]com. The malware operates in two stages: "FileRipple.pkg," a signed package now blocked by macOS, and "Safari14.1.2MojaveAuto.pkg," an unsigned package that bypasses Gatekeeper protections. JSCoreRunner hijacks Chrome browser settings, redirecting searches to fraudulent sites, enabling phishing attacks, and facilitating data theft. The malware modifies Chrome profiles, hides crash logs, and avoids detection while targeting search engine settings.

Malicious VS Code extensions exploit loophole

A campaign exploiting VS Code extensions revealed a loophole in the VS Code Marketplace, allowing attackers to reuse names of previously removed packages to distribute ransomware. The malicious extension “shiba” executed a multi-stage attack, encrypting files and demanding ransom in Shiba Inu tokens, though no payment wallet address was provided. The loophole arises because removed extensions free up their names for reuse, contradicting VS Code Marketplace's documentation stating extension names must be unique. Attackers repeatedly used the name-reuse tactic from late 2024 to mid-2025.

Top Vulnerabilities Reported in the Last 24 Hours

Passwordstate users urged to patch vulnerability

Click Studios, the developer of Passwordstate, urged users to patch a high-severity authentication bypass vulnerability in its enterprise-grade password manager. Passwordstate allows organizations to manage passwords, API keys, certificates, and credentials through a centralized web interface, used by 370,000 IT professionals across 29,000 companies globally. The vulnerability, which lacks a CVE ID, enables attackers to exploit a crafted URL on the Emergency Access page to bypass authentication and access the administration section. Click Studios released Passwordstate Build 9972 with two security updates, including the patch for this vulnerability, and recommended immediate upgrades. 

Google patches critical bug

Google has addressed a critical vulnerability (CVE-2025-9478) in the Chrome browser's ANGLE graphics library. This use-after-free flaw, rated 9.8 on the CVSS scale, could allow attackers to execute malicious code via deceptive web pages, although no exploitation has been observed yet. The vulnerability was flagged on August 11, and the latest Chrome update (version 139.0.7258.154/.155) is now available for users.