Cyware Daily Threat Intelligence, July 16, 2025

A harmless-looking app on Google Play may have a malicious twin elsewhere. A new Konfety variant uses the same package name as a legitimate app but hides the real payload in a lookalike version distributed through third-party stores. It employs obfuscation tactics to evade detection, while leveraging the CaramelAds SDK.

Some malware no longer travels through links or attachments, it hides in plain text. Researchers have spotted attackers embedding payloads in DNS records, allowing malware to slip past traditional security tools. By encoding binaries as hex and retrieving them during DNS resolution, this technique avoids common detection points and delivers disruptive code without a visible trace.

One sandbox escape makes five. Google patched a high-severity Chrome flaw that lets attackers break out of the browser’s sandbox using crafted HTML and unvalidated GPU commands. The update also addressed issues in V8 and WebRTC, but only CVE-2025-6558 was under active exploitation, making it the fifth Chrome zero-day of the year.

Top Malware Reported in the Last 24 Hours

New Konfety malware variant spotted

A new variant of the Android malware Konfety uses an "evil twin" technique, where a benign app on the Google Play Store shares the same package name as a malicious version distributed via third-party sources. The malware employs sophisticated obfuscation tactics, including tampering with APK ZIP structures, dynamic code loading, and encryption flags to evade detection and complicate reverse engineering. It uses deceptive manifest declarations, such as falsely claiming BZIP compression, causing analysis tools to crash. This approach was previously observed in other malware like SoumniBot. Konfety leverages the CaramelAds SDK to fetch ads, deliver payloads, and maintain communication with attacker-controlled servers. It can redirect users to malicious websites, trigger app installs, and send spam notifications. 

Hackers hide malware inside DNS records

Threat actors are leveraging a novel technique to hide malware within DNS records, exploiting a blind spot in many security systems. This method enables early-stage malware to retrieve its payload without relying on traditional delivery vectors, such as suspicious downloads or email attachments, which are more likely to be intercepted by antivirus tools. Researchers recently identified this technique being used to distribute a nuisance malware strain known as Joke Screenmate. The malware interferes with normal computer operations and is delivered through DNS records, making it difficult to detect using conventional security tools. The malware is embedded in DNS records by converting its binary payload into hexadecimal format. This encoded data is then stored in DNS entries, allowing the malware to be fetched during DNS resolution processes.

Protestware disrupts Russian-language npm users Protestware targeting Russian-language users was found in 28 npm packages, disrupting UI interactions and playing the Ukrainian national anthem on Russian and Belarusian domains. The protestware script is hidden deep within the code and activates under specific conditions: browser language set to Russian, visiting Russian or Belarusian domains, and repeat visits. SweetAlert2, a popular package, openly disclosed the protestware starting from version 11.6.14, aligning with political stances against the war in Ukraine. Several other npm packages unintentionally included the protestware by copying code from SweetAlert2, leading to supply chain propagation.

Top Vulnerabilities Reported in the Last 24 Hours

Google patches another zero-day

Google released a Chrome security update to fix six vulnerabilities, including CVE-2025-6558, a high-severity sandbox escape flaw actively exploited by attackers. CVE-2025-6558 affects Chrome versions before 138.0.7204.157 and involves insufficient validation of untrusted input in ANGLE and GPU, allowing remote code execution through specially crafted HTML pages. ANGLE, a graphics abstraction layer in Chrome, is vulnerable due to processing GPU commands from untrusted sources, posing critical security risks. The update also fixes five other vulnerabilities, including CVE-2025-7656 (V8 engine flaw) and CVE-2025-7657 (WebRTC issue), though none are actively exploited. CVE-2025-6558 marks the fifth actively exploited Chrome flaw fixed in 2025, following other zero-day vulnerabilities patched earlier this year.

Critical design flaw in Windows Server 2025

A critical vulnerability in Windows Server 2025's delegated Managed Service Accounts (dMSAs) allows attackers to perform cross-domain lateral movement and maintain persistent access across Active Directory environments. Exploitation requires access to the Key Distribution Service (KDS) root key, which is typically held by privileged accounts like Domain Admins and Enterprise Admins. The flaw simplifies brute-force password generation due to predictable time-based components with only 1,024 possible combinations. Attackers can compromise dMSAs by extracting the KDS root key, enumerating accounts, identifying password attributes, and generating valid credentials using techniques like Pass the Hash.