Encrypted messaging apps aren’t immune to state-backed malware delivery. APT28 is targeting Ukrainian government entities via Signal, sharing macro-laced documents that deploy a backdoor named Covenant. Once inside, the attackers use two new malware strains - BeardShell for PowerShell execution and data exfiltration, and SlimAgent for covert screenshot capture and encryption.

Some WordPress plugins are doing a lot more than extending site functionality. Researchers uncovered a long-running malware campaign that uses rogue plugins to skim credit card data, steal credentials, and manage backend systems on infected sites. The malware adapts its behavior to avoid admins, manipulates Google Ads, and hooks into WooCommerce to maintain stealth and persistence.

A simple archive file could compromise your entire system. A directory traversal flaw in WinRAR, allows attackers to execute arbitrary code when users open specially crafted archive files. The vulnerability affects all Windows versions of the tool.

Top Malware Reported in the Last 24 Hours

APT28 uses Signal chats, targets Ukraine

Russian state-sponsored hacking group APT28 is targeting Ukrainian government entities using Signal chats to deploy two new malware families: BeardShell and SlimAgent. These attacks involve sending malicious documents via Signal that leverage macros to load a backdoor named Covenant. BeardShell, a C++ malware, is designed to download and execute PowerShell scripts, with results exfiltrated to a C2 server via the Icedrive API. SlimAgent acts as a screenshot grabber, capturing and encrypting images for future exfiltration. 

APT36 targets Indian defense 

APT36, also known as Transparent Tribe, has launched a sophisticated phishing campaign targeting Indian defense personnel. The campaign involves emails containing malicious PDF attachments disguised as official government documents. When opened, these PDFs prompt users to click a deceptive button that leads to a fraudulent URL, triggering the download of a malicious executable. The malware, written in C/C++, employs advanced techniques to evade detection, including anti-debugging and anti-VM measures, while conducting keylogging and browser data theft. This operation aims for long-term access to sensitive defense networks, with the attack infrastructure linked to a domain registered in Brazil.

Malware targets WooCommerce and WordPress

Wordfence identified a modular malware family capable of credit card skimming, WordPress credential theft, and hosting live backend systems on infected websites. The malware disguises itself as a rogue WordPress plugin, with evidence of prolonged activity dating back to September 2023. Over 20 malware samples were analyzed, revealing shared obfuscation techniques, anti-analysis measures, and ongoing development efforts. Malware variants specifically target checkout pages and avoid WordPress admin panels to evade detection. Some malware variants use cookies to identify administrators or previously compromised users and avoid targeting them. Non-skimming variants manipulate Google Ads, steal WordPress login credentials, and distribute malware payloads. A rogue WordPress plugin acts as both a frontend skimmer and a backend tool for attackers, leveraging WooCommerce hooks and backend infrastructure.

Top Vulnerabilities Reported in the Last 24 Hours

Active exploitation of WinRAR bug

A critical vulnerability in WinRAR (CVE-2025-6218) enables remote code execution by exploiting directory traversal flaws in malicious archives. The attack requires user interaction, such as opening malicious files delivered through phishing emails or compromised websites. All Windows versions of WinRAR, including RAR, UnRAR, and related components, are affected, while Unix and Android versions remain unaffected. RARLAB has released WinRAR version 7.12 Beta 1 to address the issue.

Critical privilege escalation flaw in Notepad++

A critical privilege escalation vulnerability (CVE-2025-49144) in Notepad++ v8.8.1 allows attackers to gain full system control through a supply-chain attack. This flaw arises from the installer’s insecure search path behavior, enabling unprivileged users to escalate privileges to NT AUTHORITY\SYSTEM with minimal interaction. Attackers can exploit this by placing malicious executables in directories accessible to victims, leading to automatic execution with SYSTEM privileges during installation. Proof-of-concept materials are available, demonstrating the ability to steal sensitive data and install persistent malware.