Cyware Daily Threat Intelligence, July 09, 2025
Daily Threat Briefing • July 9, 2025
A PDF reader with 50,000 downloads turned out to be anything but harmless. The Anatsa banking trojan slipped back into Google Play, targeting North American users with fake maintenance screens while logging keystrokes and automating fraudulent transactions. However, the app has been pulled by Google.
This month’s Patch Tuesday came with a hefty payload. Microsoft released fixes for 137 vulnerabilities, including a zero-day in SQL Server, which allowed access to uninitialized memory. Among the 14 critical issues were remote code execution bugs in SharePoint and multiple RCE and side-channel flaws affecting AMD-based systems.
When a tap does more than you think, it’s probably TapTrap. Researchers have uncovered a sneaky Android exploit that uses near-invisible UI animations to trick users into approving sensitive actions. By overlaying transparent elements, TapTrap misleads users into tapping unintended buttons.
Top Malware Reported in the Last 24 Hours
Iranian ransomware group reemerges
An Iranian ransomware-as-a-service group, linked to Tehran's Pioneer Kitten, has resurfaced after a five-year hiatus, offering affiliates 80% profits for targeting US and Israeli organizations. The updated malware, Pay2Key.I2P, incorporates Mimic ransomware capabilities and operates via the I2P network for anonymity. The group emphasizes anonymity to bypass ceasefire restrictions and continues cyberattacks despite geopolitical tensions. The malware was updated to target Linux systems, further incentivizing attacks against U.S. and Israeli targets.
Anatsa trojan sneaks into Google Play
Anatsa, a banking trojan, has once again infiltrated Google Play, disguised as a PDF viewer app that garnered over 50,000 downloads. Once installed, the malware activates and targets North American banking applications by displaying deceptive messages about scheduled maintenance, which obscures its malicious activities like keylogging and unauthorized transactions. The latest app, Document Viewer – File Reader, was removed by Google, following its detection of the trojan, which had been active between June 24 and 30, shortly after its release. The malware can execute keylogging, automate transactions, and steal sensitive information.
Multiple malicious Chrome extensions spotted
Researchers discovered nearly a dozen malicious Chrome extensions with 1.7 million downloads that track users, steal browser activity, and redirect to unsafe web addresses. These extensions pose as legitimate tools like color pickers, VPNs, volume boosters, and emoji keyboards, with many verified and highly rated on the Chrome Web Store. Malicious functionality is embedded in the background service worker of the extensions, capturing visited URLs and exfiltrating data to remote servers, potentially enabling cyberattacks. The malicious code was introduced via updates after the extensions were initially safe, possibly due to hijacking by external actors. Similar malicious extensions were found in the Microsoft Edge store, infecting over 600,000 users, bringing the total affected across browsers to 2.3 million.
Top Vulnerabilities Reported in the Last 24 Hours
Microsoft Patch Tuesday July 2025
Microsoft released security updates for 137 flaws, including one publicly disclosed zero-day vulnerability in Microsoft SQL Server. The updates addressed 14 critical vulnerabilities, including 10 remote code execution flaws, one information disclosure issue, and two AMD side-channel attack vulnerabilities. The zero-day vulnerability (CVE-2025-49719) in Microsoft SQL Server allows remote attackers to access uninitialized memory due to improper input validation. Microsoft SharePoint's critical RCE vulnerability (CVE-2025-49704) enables remote exploitation by authenticated users.
New Android TapTrap attack exploits permissions
Researchers have developed a novel Android exploit called TapTrap, which uses invisible UI animations to bypass permissions and trick users into performing risky actions. TapTrap works by launching a transparent activity over a malicious app, creating a visual mismatch between what users see and the actions registered by the system. The exploit leverages custom low-opacity animations to make risky prompts nearly invisible, increasing the likelihood of accidental user interaction. TapTrap remains unmitigated in Android 15 and 16, exposing devices unless animations are disabled via developer options or accessibility settings.
July 2025 Patch Tuesday ICS security advisories
Siemens, Schneider Electric, and Phoenix Contact released ICS security advisories for July 2025 Patch Tuesday, addressing vulnerabilities in ICS and OT. Siemens addressed critical flaws in products like Sinec NMS, TIA Administrator, and Ruggedcom ROS, among others, which could lead to privilege escalation, code execution, and denial-of-service (DoS) attacks. Schneider Electric disclosed vulnerabilities in EcoStruxure IT Data Center Expert and other products, including issues enabling remote code execution, privilege escalation, and sensitive data exposure. Phoenix Contact revealed critical vulnerabilities in PLCnext firmware and Charx EV charging controllers, allowing DoS conditions, unauthorized access, and privilege escalation.