Cyware Daily Threat Intelligence, June 26, 2025

shutterstock_2285026091

Daily Threat Briefing • June 26, 2025

A phishing email is all it takes to breach critical infrastructure. The OneClik APT campaign is targeting energy and oil sectors using Microsoft ClickOnce to deliver a .NET loader and Golang backdoor. The malware uses AWS infrastructure to hide in plain sight, evolving through multiple variants with increasingly stealthy techniques.

What do a server board, a home router, and a firewall have in common? They’re all vulnerable, and now officially on CISA’s hit list.CISA has added three exploited vulnerabilities to its KEV catalog, affecting AMI MegaRAC, D-Link DIR-859 routers, and Fortinet FortiOS.

A familiar name in your WhatsApp inbox might not be who you think it is. APT42 is targeting Israeli cybersecurity experts and academics through highly personalized spear-phishing campaigns. By posing as journalists or researchers and using platforms like WhatsApp, they lure victims to phishing pages disguised as Google Meet, aiming to steal credentials. With over 100 domains linked to the campaign, the scope likely extends well beyond Israel.

Top Malware Reported in the Last 24 Hours

OneClik malware campaign uncovered

The OneClik APT campaign targets the energy, oil, and gas sectors through phishing attacks utilizing Microsoft ClickOnce. This campaign deploys a .NET-based loader named OneClikNet, which installs a Golang backdoor called RunnerBeacon. The malware leverages cloud infrastructure, specifically AWS services, to evade detection by blending malicious activity with legitimate traffic. Key techniques include AppDomainManager hijacking, multi-layer encryption, and anti-debugging measures. The campaign has evolved through three variants—v1a, BPI-MDM, and v1d—each exhibiting increasing sophistication in evasion tactics and C2 obfuscation. 

Malicious Python package targets passlib library

Socket discovered a malicious Python package named "psslib," which typosquats the legitimate "passlib" library. This package, published by the threat actor umaraq, forces Windows systems to shut down immediately upon incorrect password input, exploiting developer trust in security libraries. The malicious code uses the `os` module to execute shutdown commands, resulting in data loss and disruption. While effective on Windows, the shutdown command fails harmlessly on Linux and macOS systems, indicating a targeted attack on Windows development environments.

Chinese Hive0154 targets Tibet

IBM X-Force researchers identified targeted cyberattacks by China-aligned group Hive0154 deploying Pubload malware via phishing lures aimed at the Tibetan community. Campaigns coincided with culturally significant events like the Dalai Lama’s 90th birthday and the World Parliamentarians’ Convention on Tibet (WPCT). Hive0154 utilized spear phishing emails with Google Drive links containing weaponized ZIP/RAR archives, exploiting DLL sideloading to activate the Claimloader DLL and Pubload payload. Pubload malware features advanced techniques, including TripleDES decryption, reverse shell access, and dynamic API imports, showcasing Hive0154's technical sophistication. 

Top Vulnerabilities Reported in the Last 24 Hours

CISA issues urgent alert

CISA alerted about severe vulnerabilities in ControlID iDSecure software, risking authentication bypass and sensitive data leakage. The vulnerabilities include Improper Authentication (CVE-2025-49851), Server-Side Request Forgery (CVE-2025-49852), and SQL Injection (CVE-2025-49853), with CVSS scores up to 9.3. ControlID released version 4.7.50.0 to fix these issues, and CISA advised organizations to update and follow defensive measures like network isolation, secure remote access, and risk assessments.

DoS attacks exploit NetScaler bug

Citrix has issued a warning about a critical vulnerability in NetScaler appliances, tracked as CVE-2025-6543, which is being actively exploited in denial-of-service (DoS) attacks. This flaw affects NetScaler ADC and Gateway versions prior to 14.1-47.46 and 13.1-59.19, as well as ADC 13.1-FIPS and NDcPP before 13.1-37.236. The vulnerability allows unauthenticated remote requests to cause the appliance to go offline. Additionally, another critical vulnerability known as "CitrixBleed 2" (CVE-2025-5777) enables attackers to hijack user sessions by extracting session tokens from memory. Both vulnerabilities pose significant risks, and Citrix has released patches for the affected versions.

CISA adds three flaws to KEV catalog

The CISA added three actively exploited vulnerabilities to its KEV catalog, affecting AMI MegaRAC, D-Link DIR-859 routers, and Fortinet FortiOS. CVE-2024-54085 allows remote attackers to take control of AMI MegaRAC SPx devices via authentication bypass. CVE-2024-0769 is a path traversal vulnerability in D-Link DIR-859 routers, enabling privilege escalation; these devices are no longer supported (end-of-life). CVE-2019-6693 involves a hard-coded cryptographic key in Fortinet products, exploited by Akira ransomware actors for network access.

Top Scams Reported in the Last 24 Hours

APT42 spies on Israeli cyber experts

An Iranian state-backed hacking group, APT42 (Charming Kitten, Manticore), is targeting Israeli cybersecurity and computer science experts using spear-phishing tactics. The group impersonates relevant personas, such as journalists or researchers, to gain trust and initiate contact, often using WhatsApp to bypass email filters and appear more legitimate. Their phishing campaigns include personalized messages and requests for meetings, leading victims to credential phishing pages mimicking platforms like Google Meet. The primary targets are high-profile cybersecurity experts, academics, and journalists, possibly as a retaliation for alleged Israeli cyber operations against Iran. Over 100 domains and subdomains have been identified in this campaign, suggesting a broader scope with potential targets beyond Israel.

Related Threat Briefings

Jun 25, 2025

Cyware Daily Threat Intelligence, June 25, 2025

A familiar package name could be hiding far more than useful code. North Korean actors behind the Contagious Interview campaign have published 35 malicious npm packages, including keyloggers and multi-stage malware loaders like HexEval and InvisibleFerret. By mimicking popular libraries, they’ve tricked thousands of developers into pulling in backdoors designed for cross-platform surveillance. Search results for AI tools are leading users straight into malware traps. Researchers uncovered a campaign that abuses SEO tactics to rank malicious sites for AI-related queries. These sites distribute payloads like Vidar Stealer and Lumma, wrapped in deceptive installers and ZIP files, while using obfuscation techniques like XOR encryption and browser fingerprinting to stay hidden. Even AI model frameworks aren’t immune to critical flaws. NVIDIA has patched two vulnerabilities in its Megatron-LM framework that could allow attackers to inject code or escalate privileges. The bugs, affecting the Python component, pose a serious risk to model integrity and data security if left unpatched.

Jun 24, 2025

Cyware Daily Threat Intelligence, June 24, 2025

Encrypted messaging apps aren’t immune to state-backed malware delivery. APT28 is targeting Ukrainian government entities via Signal, sharing macro-laced documents that deploy a backdoor named Covenant. Once inside, the attackers use two new malware strains - BeardShell for PowerShell execution and data exfiltration, and SlimAgent for covert screenshot capture and encryption. Some WordPress plugins are doing a lot more than extending site functionality. Researchers uncovered a long-running malware campaign that uses rogue plugins to skim credit card data, steal credentials, and manage backend systems on infected sites. The malware adapts its behavior to avoid admins, manipulates Google Ads, and hooks into WooCommerce to maintain stealth and persistence. A simple archive file could compromise your entire system. A directory traversal flaw in WinRAR, allows attackers to execute arbitrary code when users open specially crafted archive files. The vulnerability affects all Windows versions of the tool.

Jun 23, 2025

Cyware Daily Threat Intelligence, June 23, 2025

A fake Windows update might just be the start of something worse. The EvilConwi campaign is abusing ConnectWise ScreenConnect to deliver signed malware through tampered installers. Using phishing links hosted on Canva and Facebook ads, attackers lure victims into downloading infected software, leading to erratic system behavior and stealthy compromise via Authenticode stuffing. A handful of outdated routers is all it takes to build a persistent espionage network. The LapDogs campaign is targeting SOHO devices with a custom backdoor called ShortLeash, giving attackers root access and control over compromised systems. Spoofed Nginx servers and TLS certificates help mask the activity, with signs pointing to China-nexus threat actors based on the tooling and code comments. Resetting an admin password shouldn’t be this easy. A bug in the WordPress Motors theme allows attackers to hijack websites by exploiting a flaw in the password recovery function. Despite a patch, widespread inaction has led to a surge in attacks, with thousands of login takeovers and persistent backdoor accounts being reported.

Jun 20, 2025

Cyware Daily Threat Intelligence, June 20, 2025

A new Android trojan is turning devices into data-harvesting tools under attackers’ full control. Attributed to the LARVA-398 group, AntiDot has infected thousands of devices through phishing and malicious ads. Using Accessibility Services and screen recording APIs, it steals credentials, intercepts messages, and mimics app logins. A fake job offer could now come bundled with custom-built spyware. PylangGhost is targeting crypto professionals in India. Delivered through spoofed job sites, the malware includes registry tampering, remote control, and data exfiltration modules aimed at compromising Windows systems. A popular WordPress plugin is exposing sites to full takeover. It affects the AI Engine plugin, allowing privilege escalation via the MCP module in versions 2.8.0 to 2.8.3. If enabled, this feature gives even low-level users the ability to run admin-level commands - impacting over 100,000 websites and opening the door to site-wide compromise.

Jun 19, 2025

Cyware Daily Threat Intelligence, June 19, 2025

Cloud services are being quietly turned into covert attack channels. The Serpentine#Cloud campaign is abusing Cloudflare Tunnels and Python to deploy fileless malware via invoice-themed phishing lures. Using layered scripts and memory-only payloads, the attack blends into normal traffic and ensures persistence through Windows startup routines, targeting users in the U.S., the U.K, and Germany. Unsecured DVRs are once again powering a wave of botnet-driven DDoS attacks. A critical command injection flaw in TBK DVR devices is being exploited by multiple botnets to gain unauthenticated remote access. Tens of thousands of devices have been hijacked to expand large-scale attacks through malware like Mirai, Condi, and Fodcha. Weak MySQL credentials are opening the door to full system compromise. ASEC has observed ongoing campaigns targeting mismanaged Windows-based MySQL servers in Korea, where attackers use brute-force techniques to deploy malware like Gh0stRAT and XWorm. With UDF modules and remote payloads, these intrusions enable deep access and persistent control.

Jun 18, 2025

Cyware Daily Threat Intelligence, June 18, 2025

An official-looking email from the tax department may be anything but. Silver Fox APT is targeting Taiwanese users with phishing emails posing as the National Taxation Bureau, delivering malware like Winos 4.0, HoldingHands RAT, and Gh0stCringe. The attack chain uses DLL side-loading, privilege escalation, and anti-analysis techniques to evade detection and maintain access through remote desktop and file management modules. One compromised travel site is now a launchpad for infostealer infections. A new ClickFix variant, LightPerlGirl, is using fake Cloudflare CAPTCHA prompts and clipboard hijacking to deliver the Lumma infostealer. By exploiting PowerShell and personal device access, the malware could lead to broader breaches across enterprise environments. A pair of Linux vulnerabilities could give attackers root in seconds. CVE-2025-6018 and CVE-2025-6019 impact multiple major Linux distributions, enabling local users to escalate privileges via flaws in PAM and libblockdev. If chained together, the bugs allow full system compromise with minimal friction, posing a serious risk if left unpatched.

Jun 17, 2025

Cyware Daily Threat Intelligence, June 17, 2025

Langflow, an open-source AI framework, is now being weaponized in a botnet campaign. A new variant of the Flodrix botnet is exploiting a critical vulnerability in unpatched Langflow servers, allowing attackers to run arbitrary code and deploy encrypted DDoS malware. Despite a fix released in March, many systems remain exposed, and threat actors are using publicly available exploits to scale their attacks. A simple "I'm not a robot" click is being used to launch a fileless RAT. A deceptive campaign targeting German-speaking users delivers AsyncRAT via obfuscated PowerShell triggered through fake CAPTCHA prompts. The malware runs entirely in memory, establishes persistence through registry edits, and communicates with a remote C2 server on TCP port 4444—all while avoiding traditional detection methods. A zero-day in Chrome is letting attackers break out of the browser and into the system. The TaxOff (Team46) group is actively exploiting CVE-2025-2783, a flaw in Chrome’s Mojo IPC component, through phishing emails masked as event invites. Once inside, they deploy a layered backdoor called Trinper, using encryption and anti-debugging techniques to maintain control and gather intel.

Jun 16, 2025

Cyware Daily Threat Intelligence, June 16, 2025

A trusted developer platform is now a delivery system for stealthy malware. The newly uncovered threat actor Water Curse is abusing GitHub to distribute weaponized repositories aimed at cybersecurity pros, game developers, and DevOps teams. With payloads hidden in build scripts and obfuscated, the campaign enables data theft, remote access, and persistent control. Some ransomware isn’t just extorting, it’s erasing everything in its path. Anubis, a new RaaS group, adds a destructive twist with its “wipe mode,” ensuring file recovery is impossible even if a ransom is paid. With ties to the older Sphinx malware, Anubis is now offering flexible affiliate terms, data extortion, and encryption via ECIES. A critical bug is still lurking across thousands of Grafana dashboards. A client-side redirect flaw leaves over 46,000 internet-facing Grafana instances at risk of account takeovers and plugin-based attacks. Despite a patch issued in May, more than a third of deployments remain exposed.

Jun 13, 2025

Cyware Daily Threat Intelligence, June 13, 2025

CyberEye lowers the barrier for cybercrime with a plug-and-play toolkit. This .NET-based RAT uses Telegram for command and control while offering modules for keylogging, credential theft, and platform-specific data grabbing. Its built-in evasion tactics and easy-to-use builder make it accessible even to low-skill attackers. Unpatched IT tools are once again opening the door to ransomware attacks. CISA has warned about vulnerabilities in SimpleHelp RMM software being exploited by groups like Play and DragonForce in double-extortion campaigns. The flaws, including CVE-2024-57727, have already led to breaches in sectors like utility billing. A subtle tweak in language could be all it takes to fool your AI. The TokenBreak attack manipulates how text is tokenized in classification models to sneak past defenses. While models using Unigram tokenization remain secure, others like BERT and RoBERTa are vulnerable—raising red flags for AI-based content moderation and detection systems.

Jun 12, 2025

Cyware Daily Threat Intelligence, June 12, 2025

Fog ransomware operators are blurring the line between admin tools and attack chains. In a recent incident, they deployed a mix of open-source and legitimate software to gain persistence and exfiltrate data undetected. The attack combined tools like Stowaway, Impacket, and 7-Zip to move laterally and quietly siphon off sensitive information. A flaw in Secure Boot could let attackers hijack your system before the OS even loads. It affects the UEFI firmware layer and allows unsigned code execution during boot, leading to persistent malware installation. The issue stems from a vulnerable BIOS flashing utility signed by Microsoft, raising concerns about trusted bootchain integrity. Legitimate testing tools are being twisted into powerful attack platforms. A campaign, dubbed UNK_SneakyStrike, has been using the TeamFiltration tool to compromise Microsoft Entra ID accounts and exploit services like OneDrive and Teams. Over 80,000 accounts have been targeted since late 2024, with activity tied to AWS-hosted infrastructure.

Jun 11, 2025

Cyware Daily Threat Intelligence, June 11, 2025

Recruiters are the new targets in FIN6’s evolving playbook. The financially motivated group is impersonating job seekers on platforms, sending phishing emails that deliver malware through deceptive resumes. Using AWS-hosted sites and fingerprinting tactics, they deploy the More Eggs backdoor to steal credentials and pivot further. Adobe just patched a mountain of vulnerabilities - most of them XSS. A total of 254 flaws were addressed across multiple products, with many posing risks of arbitrary code execution. Key patches include CVE-2025-47110 and CVE-2025-43585, both rated high in severity and impact. A sprawling scam network is impersonating trusted brands at scale. Researchers uncovered over 4,000 domains tied to GhostVendors, a fake marketplace campaign abusing Meta’s ad system to evade detection. By spoofing major brands and rotating scam sites, the operation continues to lure users into fraudulent purchases.

Jun 10, 2025

Cyware Daily Threat Intelligence, June 10, 2025

Fake wallet apps are slipping through the cracks on Google Play. Over 20 phishing applications impersonating popular crypto wallets have been found stealing mnemonic phrases to drain users’ funds. Distributed via compromised developer accounts, the apps have been linked to over 50 phishing domains. Wazuh servers are now a hot target for botnet operators. Researchers observed active exploitation of a critical flaw allowing remote code execution via unsanitized API requests. Both a Mirai variant and the Resbot botnet are abusing the flaw to infect IoT devices with malware across multiple architectures. Another day, another remote code execution bug patched under pressure. A critical RCE vulnerability in ManageEngine Exchange Reporter Plus has been patched following its discovery in the Content Search module. Attackers could use it to take over systems entirely, prompting an emergency update from ManageEngine.