Cyware Daily Threat Intelligence, July 25, 2025
Daily Threat Briefing • July 25, 2025
A browser tweak here, a fake mod there, and suddenly your crypto wallet spills its secrets. In a new campaign, the Scavenger trojan exploits DLL Search Order Hijacking to infiltrate password managers and wallets like MetaMask, Bitwarden, and Exodus. Delivered via fake game mods and malicious sites, the trojan uses multi-stage loaders and obfuscation.
Not every scam needs sophistication, sometimes all it takes is a lonely heart and a convincing profile picture. SarangTrap, a massive mobile spyware campaign, is luring victims on Android and iOS through fake dating apps. With over 250 malicious APKs and nearly 90 phishing domains, the campaign uses emotional manipulation and search engine indexing to appear credible.
Fire Ant doesn’t crash through the front door, it slips in quietly, sets up shop, and rewires the building. This advanced China-linked actor is targeting VMware ESXi and vCenter servers using old vulnerabilities to establish espionage footholds. The attackers extract credentials, deploy stealthy backdoors, and tamper with logs to stay hidden.
Top Malware Reported in the Last 24 Hours
Scavenger trojan targets crypto wallets
A new malware campaign involving the Scavenger trojan targets crypto wallets and password managers by exploiting DLL Search Order Hijacking. This technique allows attackers to introduce malicious files disguised as legitimate components, enabling them to extract sensitive information from applications like MetaMask, Exodus, and Bitwarden. The trojan is distributed through fake game mods and browser vulnerabilities, employing a multi-stage loader chain. Once activated, it manipulates browser security features, disables sandboxing, and alters popular extensions to harvest data such as mnemonic phrases and stored passwords. The malware also targets the Exodus wallet, leveraging DLL hijacking to access private keys and other critical information, all while evading detection by checking for virtual environments.
Meet the new Coyote malware
Coyote malware has emerged as a significant threat by exploiting Microsoft’s UI Automation (UIA) framework to steal credentials from Brazilian users linked to 75 banking institutions and cryptocurrency exchanges. This marks the first confirmed instance of UIA abuse in the wild, allowing Coyote to parse UI elements of applications to identify sensitive information. During its infection process, Coyote collects detailed victim data, including financial services used, by comparing active window titles and utilizing UIA to access sub-elements when no direct match is found.
Koske malware hides in panda pics
A new Linux malware named Koske uses AI and polyglot files to deploy cryptocurrency miners via seemingly benign JPEG images of panda bears. Koske exploits misconfigured JupyterLab instances for initial access and uses images that contain both valid JPEG headers and malicious scripts. The malware executes two payloads: a C-based rootkit compiled in memory and a shell script for persistence and stealth. It adapts to host resources, evaluating CPU/GPU to optimize mining for 18 different cryptocurrencies, switching to backups if needed. Researchers suspect Koske was developed using LLMs or automation frameworks due to its advanced adaptability.
SarangTrap: Large-scale malware campaign spotted
A large-scale malware campaign, named SarangTrap, uses fake dating and social networking apps to steal sensitive personal data on Android and iOS platforms. The apps mimic legitimate services, employing emotionally manipulative tactics like fake profiles and invitation codes to lure victims. Once installed, the apps exfiltrate data such as contacts, images, SMS content, and device identifiers to attacker-controlled servers. Over 250 malicious Android apps and 88 phishing domains have been linked to the campaign, with some indexed by search engines to appear credible.
Top Vulnerabilities Reported in the Last 24 Hours
Mitel warns of critical auth bypass bug
Mitel has released security updates to fix a critical authentication bypass vulnerability in its MiVoice MX-ONE communications platform, which could allow unauthorized access to administrator accounts. The flaw impacts versions 7.3 to 7.8 SP1 and has been patched in versions 7.8 and 7.8 SP1. Mitel advises deploying MX-ONE within trusted networks and restricting access to the Provisioning Manager service. Mitel also disclosed a high-severity SQL injection vulnerability (CVE-2025-52914) in its MiCollab platform, which could allow execution of arbitrary SQL commands on unpatched devices. CISA previously warned of other MiCollab vulnerabilities, including a path traversal flaw (CVE-2024-55550) and a zero-day file read bug (CVE-2024-41713), which were exploited in attacks.
Fire Ant abuses VMware vulnerabilities
A threat actor known as Fire Ant has been targeting VMware ESXi and vCenter environments in a sophisticated cyber espionage campaign, leveraging vulnerabilities such as CVE-2023-34048 and CVE-2023-20867. This group, linked to the China-based UNC3886, demonstrates advanced capabilities by establishing persistent control over compromised systems, extracting credentials, and deploying backdoors. Fire Ant's tactics include bypassing network segmentation, deploying unregistered virtual machines, and tampering with logging processes to evade detection.
Sophos and SonicWall patch critical flaws
Sophos and SonicWall have announced critical patches for vulnerabilities in their Firewall and SMA 100 Series devices that could lead to remote code execution. Sophos identified two major flaws: CVE-2025-6704, an arbitrary file writing vulnerability in the Secure PDF eXchange feature, and CVE-2025-7624, an SQL injection vulnerability in the SMTP proxy. Both vulnerabilities have a CVSS score of 9.8 and affect a small percentage of devices. Additionally, they addressed CVE-2025-7382, a command injection vulnerability, alongside other issues. Meanwhile, SonicWall reported a critical bug in the SMA 100 Series web management interface (CVE-2025-40599), which also has a high CVSS score and allows remote attackers to upload arbitrary files.