Not all GitHub projects are built with good intentions. Researchers uncovered a widespread campaign involving more than 130 repositories booby-trapped with malware disguised as game cheats, hacking tools, and utilities. Hidden behind obfuscated code and automated workflows, the campaign deploys backdoors while using Telegram bots and paste sites to manage infections behind the scenes.

Destruction masquerading as maintenance tools is hitting Ukraine’s infrastructure. Researchers attributed a new wiper malware called PathWiper to a Russia-linked APT group, targeting critical systems by leveraging legitimate administrative frameworks. The malware erases storage media and key file system data. Though reminiscent of HermeticWiper, PathWiper shows a more advanced method of drive targeting and destruction.

Cisco is closing two critical gaps before attackers can exploit them further. A patch has been issued for CVE-2025-20129 in Cisco’s CCP chat interface, a flaw that could let attackers intercept sensitive data through manipulated HTTP requests. Another vulnerability, CVE-2025-20130 in Cisco ISE, allowed file uploads due to weak validation, now fixed in the latest patches for ISE versions up to 3.3.

Top Malware Reported in the Last 24 Hours

Malware campaign targets hackers and gamers

Cybersecurity researchers discovered a widespread campaign involving malicious code planted in over 130 open-source GitHub repositories, targeting cybercriminals and gamers. The operation focused on backdoored repositories disguised as game cheats, hacking tools, and other utilities, with malware hidden in obfuscated code. Four types of backdoors were identified: PreBuild, Python, screensaver (.scr), and JavaScript. The campaign employs automated workflows via YAML files to simulate repository maintenance. The threat actor uses Telegram bots for notifications and paste sites for intermediate infection stages.

New PathWiper malware targets Ukraine

Cisco Talos identified PathWiper, a destructive wiper malware targeting Ukrainian critical infrastructure, attributed to a Russia-linked APT group. The attackers used a legitimate administrative framework to deploy malicious VBScript and execute the PathWiper executable. PathWiper overwrites storage media and file system artifacts, including MBR and NTFS attributes, with randomized data. The malware demonstrates similarities to HermeticWiper but utilizes more advanced drive enumeration and corruption techniques. 

Chaos RAT targets Windows and Linux

A new variant of the Chaos RAT, an open-source remote access trojan written in Golang and inspired by frameworks like Cobalt Strike and Sliver, is actively targeting both Windows and Linux systems. The malware provides a cross-platform administrative panel for payload generation, session management, and control of compromised machines. Chaos RAT is primarily distributed via phishing emails containing malicious links or attachments. Upon execution, it drops a script that modifies the "/etc/crontab" file to establish persistence by periodically fetching the malware. Early campaigns used Chaos RAT mainly for reconnaissance and information gathering, while deploying cryptocurrency miners like XMRig separately.

Top Vulnerabilities Reported in the Last 24 Hours

Cisco patches two bugs

Cisco patched CVE-2025-20129, a vulnerability in Cisco Customer Collaboration Platform’s (CCP) web-based chat interface, which could allow attackers to intercept sensitive data through crafted HTTP requests. The affected CCP versions include those earlier than 12.5(1), with fixes available in Unified Contact Center Express 15.0(1). CVE-2025-20130 in Cisco ISE allows authenticated attackers to upload arbitrary files due to improper file validation. Affected ISE versions include ISE 3.0 and earlier, with fixes provided in versions 3.1 P10, 3.2 P7, and 3.3 P3, while ISE 3.4 is not vulnerable.

Reflected XSS Vulnerability in Splunk

A reflected XSS vulnerability, tracked as CVE-2025-20297 and documented as SVD-2025-0601, has been identified in Splunk Enterprise and Cloud Platform. The flaw affects the dashboard PDF generation component and allows low-privileged users to execute unauthorized JavaScript in another user's browser without requiring user interaction. The vulnerability enables attackers with minimal privileges to exploit the pdfgen/render REST endpoint to inject malicious JavaScript. This can lead to session hijacking or data exfiltration. The attack is remotely exploitable, requires no user interaction, and poses a heightened risk due to its low privilege requirements.