A Turkish phishing lure leads straight to SnakeKeylogger. The DBatLoader (aka ModiLoader) malware is making the rounds again - this time disguised as a Turkish bank email. Victims who open the fake attachment trigger a chain of BAT scripts, DLL sideloading, and obfuscated executables that ultimately deploy SnakeKeylogger.

glibc gets an unexpected twist. A newly identified vulnerability in the GNU C Library affects how static setuid binaries interact with shared libraries, specifically through improper use of LD_LIBRARY_PATH. While no known software currently exploits this bug, developers are urged to patch or update glibc to avoid potential abuse in custom or legacy applications.

A quiet wave of phishing hits Kuwait. An ongoing campaign is targeting telecom, insurance, and fisheries sectors across the country, using hundreds of domains to impersonate familiar brands. The operation cleverly masks itself with lookalike domains and fake mobile payment portals, siphoning off sensitive data.

Top Malware Reported in the Last 24 Hours

Defendnot: New tool tricks Windows 

The Defendnot tool disables Microsoft Defender by spoofing antivirus registration using an undocumented Windows Security Center API. It bypasses system safeguards by injecting its DLL into a trusted process (Taskmgr.exe), allowing it to register a fake antivirus product. Once registered, Microsoft Defender shuts down, leaving the device without active protection. The tool includes configuration options and creates persistence via Windows Task Scheduler.

Ransomware groups move to new Skitnet

Ransomware gangs are using a new malware, named Skitnet, for post-exploitation activities, gaining traction since early 2025. Skitnet starts with a Rust-based loader that decrypts a Nim binary, establishing a reverse shell for C2 communication. The malware supports commands for persistence, screenshots, remote access tool installation, and antivirus enumeration. Skitnet's .NET loader allows deeper attack customization, offering a cheaper and quicker alternative to custom tools.

DBatLoader targets Turkish users

The DBatLoader (ModiLoader) malware is being distributed via phishing emails impersonating a Turkish bank, prompting users to open malicious attachments containing BAT files. DBatLoader executes SnakeKeylogger, a .NET-based malware that exfiltrates data through emails, FTP, SMTP, or Telegram. The malware uses obfuscated and decrypted BAT scripts, DLL side-loading, and disguised file names to evade detection and execute malicious activities. It manipulates legitimate processes (e.g., easinvoker.exe, powershell.exe) and tools (cmd.exe, extrac32.exe, etc.) for malicious purposes like bypassing Windows Defender and injecting SnakeKeylogger. 

Top Vulnerabilities Reported in the Last 24 Hours

Bug puts Linux systems at risk

A newly discovered vulnerability (CVE-2025-4802) in the GNU C Library (glibc) affects the shared library loading mechanism of static setuid binaries, potentially allowing malicious code execution. The vulnerability stems from improper handling of the LD_LIBRARY_PATH environment variable by static setuid binaries when invoking dynamic library calls via dlopen(). Exploitation requires a statically linked setuid binary, the invocation of dlopen(), and an environment that permits setting LD_LIBRARY_PATH. No vulnerable programs have been identified yet, but custom or legacy binaries are at risk. Recommended mitigations include updating glibc to version 2.39 or applying fixes manually.

Critical Crawlomatic plugin flaw

Thousands of WordPress websites are at risk due to a critical vulnerability (CVE-2025-4389) in the Crawlomatic Multisite Scraper Post Generator plugin. The flaw, present in versions up to 2.6.8.1, allows unauthenticated attackers to upload malicious files, potentially leading to remote code execution. Rated with a CVSS score of 9.8 (critical), the vulnerability stems from missing file type validation in the plugin's _generate_featured_image() function. A patched version (2.6.8.2) has been released, and users are strongly advised to update immediately to mitigate risks.

Top Scams Reported in the Last 24 Hours

Ongoing phishing campaign targets Kuwait

A phishing campaign targeting Kuwait's fisheries, telecommunications, and insurance sectors has been active since early 2025, utilizing over 230 domains to impersonate legitimate organizations. The operation leverages shared SSH keys and consistent hosting patterns across multiple servers, primarily within Aeza International Ltd's network. Key domains include those mimicking the National Fishing Company and Zain, employing transliterations and unrelated brand names. The campaign also features mobile payment portals designed to harvest sensitive user information, indicating a sophisticated approach to credential theft and social engineering.