Cyware Daily Threat Intelligence, June 20, 2025

shutterstock 2288211741

Daily Threat Briefing • June 20, 2025

A new Android trojan is turning devices into data-harvesting tools under attackers’ full control. Attributed to the LARVA-398 group, AntiDot has infected thousands of devices through phishing and malicious ads. Using Accessibility Services and screen recording APIs, it steals credentials, intercepts messages, and mimics app logins.

A fake job offer could now come bundled with custom-built spyware. PylangGhost is targeting crypto professionals in India. Delivered through spoofed job sites, the malware includes registry tampering, remote control, and data exfiltration modules aimed at compromising Windows systems.

A popular WordPress plugin is exposing sites to full takeover. It affects the AI Engine plugin, allowing privilege escalation via the MCP module in versions 2.8.0 to 2.8.3. If enabled, this feature gives even low-level users the ability to run admin-level commands - impacting over 100,000 websites and opening the door to site-wide compromise.

Top Malware Reported in the Last 24 Hours

Antidot Android trojan: New MaaS emerges

The AntiDot Android trojan, attributed to the LARVA-398 threat group, has infected over 3,775 devices through 273 distinct attacks, focusing on personal and financial data theft. It operates on a MaaS model, disseminated via malicious ads and targeted phishing campaigns. AntiDot leverages the Android MediaProjection API and Accessibility Services to record screens, intercept SMS messages, and execute keylogging. It can replace authentic app interfaces with counterfeit login pages to capture credentials and sets itself as the default SMS application to monitor and manipulate communications. The malware is controlled through a C2 panel developed on the MeteorJS framework, enabling attackers to configure attacks and manage infected devices effectively.

New version of Godfather malware spotted

The Godfather Android malware has evolved to utilize virtualization, creating isolated environments on devices to hijack over 500 banking, cryptocurrency, and e-commerce applications worldwide. It employs an embedded virtualization framework, leveraging tools like VirtualApp and Xposed for API hooking, allowing it to intercept sensitive data such as credentials, PINs, and transaction details while displaying the legitimate app interface to the user. By using a StubActivity, the malware tricks Android into believing the real app is running, capturing user interactions and manipulating transactions.

Famous Chollima deploys new PylangGhost

Cisco Talos discovered a Python-based RAT named PylangGhost, used by the North Korean-aligned group Famous Chollima. PylangGhost is functionally similar to the GolangGhost RAT but is tailored for Windows, while the Golang version targets MacOS. The threat actors target professionals in cryptocurrency and blockchain industries, mostly in India, using fake job interviews. Fake job sites impersonate legitimate companies like Coinbase and Robinhood, tricking users into executing malicious commands. PylangGhost consists of six Python modules, including "nvidia.py," which handles system registry modifications, communication with the C2 server, and remote control functionalities. 

Malware hidden in JQuery Migrate

Trellix researchers discovered a malware infection using a corrupted version of the jQuery Migrate library, distributed through a compromised WordPress site. The attack leveraged the Parrot TDS, which selectively delivered malware based on user attributes such as device and browser. The malicious script was hidden within the legitimate jQuery Migrate library, using obfuscated code to evade detection and dynamically execute payloads. The malware could perform various actions, including stealing cookies, session data, and credentials, logging keystrokes, phishing, and deploying additional malicious scripts. The infection exploited WordPress's Autoptimize plugin, which left cache folders vulnerable to manipulation, allowing malware to be served from trusted domains.

Top Vulnerabilities Reported in the Last 24 Hours

Multiple bugs in IBM QRadar SIEM

IBM has issued a critical security update for its QRadar SIEM platform due to multiple vulnerabilities, including a severe flaw (CVE-2025-33117) that allows privileged users to execute arbitrary commands, scoring 9.1 on the CVSS scale. Other vulnerabilities include CVE-2025-36050, which permits local users to read sensitive information from log files (CVSS score: 6.2), and CVE-2025-33121, which exposes the system to XML External Entity (XXE) injection attacks (CVSS score: 7.1). These vulnerabilities affect QRadar SIEM versions 7.5 through 7.5.0 Update Package 12 IF01.

Vulnerability impacts 100,000 WordPress sites

A critical vulnerability (CVE-2025-5071) has been discovered in the AI Engine plugin for WordPress, affecting versions 2.8.0 to 2.8.3. This flaw allows authenticated users with subscriber-level access or higher to escalate privileges and execute administrative commands via the Model Context Protocol (MCP) module. The vulnerability has a CVSS score of 8.8 and impacts over 100,000 WordPress sites. Exploitation of this vulnerability can lead to full site compromise, including unauthorized user creation, content manipulation, and backdoor installation. However, this vulnerability only affects sites where the Dev Tools and MCP module have been manually enabled, as both are disabled by default.

Related Threat Briefings

Jun 19, 2025

Cyware Daily Threat Intelligence, June 19, 2025

Cloud services are being quietly turned into covert attack channels. The Serpentine#Cloud campaign is abusing Cloudflare Tunnels and Python to deploy fileless malware via invoice-themed phishing lures. Using layered scripts and memory-only payloads, the attack blends into normal traffic and ensures persistence through Windows startup routines, targeting users in the U.S., the U.K, and Germany. Unsecured DVRs are once again powering a wave of botnet-driven DDoS attacks. A critical command injection flaw in TBK DVR devices is being exploited by multiple botnets to gain unauthenticated remote access. Tens of thousands of devices have been hijacked to expand large-scale attacks through malware like Mirai, Condi, and Fodcha. Weak MySQL credentials are opening the door to full system compromise. ASEC has observed ongoing campaigns targeting mismanaged Windows-based MySQL servers in Korea, where attackers use brute-force techniques to deploy malware like Gh0stRAT and XWorm. With UDF modules and remote payloads, these intrusions enable deep access and persistent control.

Jun 18, 2025

Cyware Daily Threat Intelligence, June 18, 2025

An official-looking email from the tax department may be anything but. Silver Fox APT is targeting Taiwanese users with phishing emails posing as the National Taxation Bureau, delivering malware like Winos 4.0, HoldingHands RAT, and Gh0stCringe. The attack chain uses DLL side-loading, privilege escalation, and anti-analysis techniques to evade detection and maintain access through remote desktop and file management modules. One compromised travel site is now a launchpad for infostealer infections. A new ClickFix variant, LightPerlGirl, is using fake Cloudflare CAPTCHA prompts and clipboard hijacking to deliver the Lumma infostealer. By exploiting PowerShell and personal device access, the malware could lead to broader breaches across enterprise environments. A pair of Linux vulnerabilities could give attackers root in seconds. CVE-2025-6018 and CVE-2025-6019 impact multiple major Linux distributions, enabling local users to escalate privileges via flaws in PAM and libblockdev. If chained together, the bugs allow full system compromise with minimal friction, posing a serious risk if left unpatched.

Jun 17, 2025

Cyware Daily Threat Intelligence, June 17, 2025

Langflow, an open-source AI framework, is now being weaponized in a botnet campaign. A new variant of the Flodrix botnet is exploiting a critical vulnerability in unpatched Langflow servers, allowing attackers to run arbitrary code and deploy encrypted DDoS malware. Despite a fix released in March, many systems remain exposed, and threat actors are using publicly available exploits to scale their attacks. A simple "I'm not a robot" click is being used to launch a fileless RAT. A deceptive campaign targeting German-speaking users delivers AsyncRAT via obfuscated PowerShell triggered through fake CAPTCHA prompts. The malware runs entirely in memory, establishes persistence through registry edits, and communicates with a remote C2 server on TCP port 4444—all while avoiding traditional detection methods. A zero-day in Chrome is letting attackers break out of the browser and into the system. The TaxOff (Team46) group is actively exploiting CVE-2025-2783, a flaw in Chrome’s Mojo IPC component, through phishing emails masked as event invites. Once inside, they deploy a layered backdoor called Trinper, using encryption and anti-debugging techniques to maintain control and gather intel.

Jun 16, 2025

Cyware Daily Threat Intelligence, June 16, 2025

A trusted developer platform is now a delivery system for stealthy malware. The newly uncovered threat actor Water Curse is abusing GitHub to distribute weaponized repositories aimed at cybersecurity pros, game developers, and DevOps teams. With payloads hidden in build scripts and obfuscated, the campaign enables data theft, remote access, and persistent control. Some ransomware isn’t just extorting, it’s erasing everything in its path. Anubis, a new RaaS group, adds a destructive twist with its “wipe mode,” ensuring file recovery is impossible even if a ransom is paid. With ties to the older Sphinx malware, Anubis is now offering flexible affiliate terms, data extortion, and encryption via ECIES. A critical bug is still lurking across thousands of Grafana dashboards. A client-side redirect flaw leaves over 46,000 internet-facing Grafana instances at risk of account takeovers and plugin-based attacks. Despite a patch issued in May, more than a third of deployments remain exposed.

Jun 13, 2025

Cyware Daily Threat Intelligence, June 13, 2025

CyberEye lowers the barrier for cybercrime with a plug-and-play toolkit. This .NET-based RAT uses Telegram for command and control while offering modules for keylogging, credential theft, and platform-specific data grabbing. Its built-in evasion tactics and easy-to-use builder make it accessible even to low-skill attackers. Unpatched IT tools are once again opening the door to ransomware attacks. CISA has warned about vulnerabilities in SimpleHelp RMM software being exploited by groups like Play and DragonForce in double-extortion campaigns. The flaws, including CVE-2024-57727, have already led to breaches in sectors like utility billing. A subtle tweak in language could be all it takes to fool your AI. The TokenBreak attack manipulates how text is tokenized in classification models to sneak past defenses. While models using Unigram tokenization remain secure, others like BERT and RoBERTa are vulnerable—raising red flags for AI-based content moderation and detection systems.

Jun 12, 2025

Cyware Daily Threat Intelligence, June 12, 2025

Fog ransomware operators are blurring the line between admin tools and attack chains. In a recent incident, they deployed a mix of open-source and legitimate software to gain persistence and exfiltrate data undetected. The attack combined tools like Stowaway, Impacket, and 7-Zip to move laterally and quietly siphon off sensitive information. A flaw in Secure Boot could let attackers hijack your system before the OS even loads. It affects the UEFI firmware layer and allows unsigned code execution during boot, leading to persistent malware installation. The issue stems from a vulnerable BIOS flashing utility signed by Microsoft, raising concerns about trusted bootchain integrity. Legitimate testing tools are being twisted into powerful attack platforms. A campaign, dubbed UNK_SneakyStrike, has been using the TeamFiltration tool to compromise Microsoft Entra ID accounts and exploit services like OneDrive and Teams. Over 80,000 accounts have been targeted since late 2024, with activity tied to AWS-hosted infrastructure.

Jun 11, 2025

Cyware Daily Threat Intelligence, June 11, 2025

Recruiters are the new targets in FIN6’s evolving playbook. The financially motivated group is impersonating job seekers on platforms, sending phishing emails that deliver malware through deceptive resumes. Using AWS-hosted sites and fingerprinting tactics, they deploy the More Eggs backdoor to steal credentials and pivot further. Adobe just patched a mountain of vulnerabilities - most of them XSS. A total of 254 flaws were addressed across multiple products, with many posing risks of arbitrary code execution. Key patches include CVE-2025-47110 and CVE-2025-43585, both rated high in severity and impact. A sprawling scam network is impersonating trusted brands at scale. Researchers uncovered over 4,000 domains tied to GhostVendors, a fake marketplace campaign abusing Meta’s ad system to evade detection. By spoofing major brands and rotating scam sites, the operation continues to lure users into fraudulent purchases.

Jun 10, 2025

Cyware Daily Threat Intelligence, June 10, 2025

Fake wallet apps are slipping through the cracks on Google Play. Over 20 phishing applications impersonating popular crypto wallets have been found stealing mnemonic phrases to drain users’ funds. Distributed via compromised developer accounts, the apps have been linked to over 50 phishing domains. Wazuh servers are now a hot target for botnet operators. Researchers observed active exploitation of a critical flaw allowing remote code execution via unsanitized API requests. Both a Mirai variant and the Resbot botnet are abusing the flaw to infect IoT devices with malware across multiple architectures. Another day, another remote code execution bug patched under pressure. A critical RCE vulnerability in ManageEngine Exchange Reporter Plus has been patched following its discovery in the Content Search module. Attackers could use it to take over systems entirely, prompting an emergency update from ManageEngine.

Jun 9, 2025

Cyware Daily Threat Intelligence, June 09, 2025

What looks like support for defectors may actually be spyware in disguise. Kimsuky launched a stealthy campaign, targeting defense entities, activists, and crypto exchanges through Facebook impersonations, spear-phishing emails, and Telegram messages. Malware is delivered via EGG archives and disguised outreach, using encoded scripts, malicious DLLs, and registry tweaks. Malicious packages are creeping into trusted ecosystems under familiar names. A new supply chain attack compromised 16 packages linked to GlueStack, enabling command execution, data theft, and file deletion. The packages posed as developer tools or Instagram growth apps, stealing credentials and relaying them to external bot services. An old botnet just found a new way in. A Mirai variant is actively exploiting a command injection vulnerability in TBK DVR-4104 and DVR-4216 devices, to conscript them into a botnet for DDoS attacks. The exploit enables attackers to run shell commands via POST requests.

Jun 6, 2025

Cyware Daily Threat Intelligence, June 06, 2025

A silent takeover is unfolding through cheap, everyday smart devices. The FBI has reported over a million infections tied to BADBOX 2.0, a malware campaign targeting uncertified Android-based smart TVs, tablets, and IoT devices. Preinstalled malware and rogue updates turn these devices into residential proxies, with infections spanning 222 countries. A harmless-looking paste site is quietly fueling major malware campaigns. Cybercriminals are leveraging Paste[.]ee to host malicious scripts that deliver strains like XWorm and AsyncRAT through phishing emails. The platform’s anonymity helps attackers avoid detection while executing keylogging, credential theft, and remote system manipulation. A spearphishing campaign is exploiting a critical flaw in Roundcube to compromise webmail users. Threat actor UNC1151 targeted Polish organizations using CVE-2024-42009 to execute JavaScript via XSS and plant a persistent Service Worker. The vulnerability affects multiple Roundcube versions and carries a CVSS score of 9.3.

Jun 5, 2025

Cyware Daily Threat Intelligence, June 05, 2025

Not all GitHub projects are built with good intentions. Researchers uncovered a widespread campaign involving more than 130 repositories booby-trapped with malware disguised as game cheats, hacking tools, and utilities. Hidden behind obfuscated code and automated workflows, the campaign deploys backdoors while using Telegram bots and paste sites to manage infections behind the scenes. Destruction masquerading as maintenance tools is hitting Ukraine’s infrastructure. Researchers attributed a new wiper malware called PathWiper to a Russia-linked APT group, targeting critical systems by leveraging legitimate administrative frameworks. The malware erases storage media and key file system data. Though reminiscent of HermeticWiper, PathWiper shows a more advanced method of drive targeting and destruction. Cisco is closing two critical gaps before attackers can exploit them further. A patch has been issued for CVE-2025-20129 in Cisco’s CCP chat interface, a flaw that could let attackers intercept sensitive data through manipulated HTTP requests. Another vulnerability, CVE-2025-20130 in Cisco ISE, allowed file uploads due to weak validation, now fixed in the latest patches for ISE versions up to 3.3.

Jun 4, 2025

Cyware Daily Threat Intelligence, June 04, 2025

Cybercriminals are turning CAPTCHA prompts into malware gateways. A recent multi-stage malware campaign is using spoofed sites like fake Git repositories and bogus Docusign pages to lure users into executing PowerShell scripts that drop NetSupport RAT. By layering downloaders that each fetch the next stage, the attackers dodge detection and prolong infection. In a similar vein, a free software download could end up costing your entire crypto wallet. ViperSoftX is back in circulation, targeting crypto users with malicious PowerShell scripts bundled into cracked apps, keygens, and torrent packages. Beyond wallet theft, it pulls in additional payloads like Quasar RAT and PureHVNC, while using scheduled tasks and registry tricks to quietly maintain persistence. Meanwhile, Google’s June 2025 Android security update fixed a slate of high-severity issues, including a critical privilege escalation vulnerability in the System component affecting Android 13, 14, and 15. While most bugs haven't been exploited in the wild, three Qualcomm-related flaws made it to CISA’s KEV Catalog. For detailed Cyber Threat Intel, click ‘Read More’.