Cyware Daily Threat Intelligence, October 01, 2025

Hiding behind trusted EV certificates, hackers are slipping undetectable DMG payloads into macOS systems. This campaign mimics legitimate developers to deploy Odyssey Stealer, a trojan that harvests credentials and runs malicious binaries without triggering Apple’s security checks.

Through cunning DNS trickery, Detour Dog is spreading Strela Stealer via TXT records and compromised sites. Partnering with Hive0145, this threat actor uses botnets like REM Proxy to deliver spam and malware, impacting over 30,000 hosts with encoded DNS queries.

A VMware zero-day flaw, exploited by China’s UNC5174 since last October, is granting attackers root access. This critical bug in Aria Operations and VMware Tools enables privilege escalation, with patches now available but open-vm-tools on Linux also at risk.

Top Malware Reported in the Last 24 Hours

Hackers exploit EV certificates, drop malware

Security researchers have discovered a new macOS malware campaign where hackers are misusing Extended Validation (EV) code-signing certificates to distribute fully undetectable DMG payloads. A recently identified DMG sample appears legitimate due to the rigorous verification process associated with EV certificates. However, the malware employs tactics such as mimicking legitimate developer names and executing a credential-harvesting trojan known as Odyssey Stealer. This trojan downloads and runs malicious binaries without triggering security alerts, undermining the trust model of Apple’s code-signing system.

CERT-UA warns of CABINETRAT backdoor

CERT-UA has reported targeted cyberattacks utilizing a backdoor known as CABINETRAT, linked to the threat cluster UAC-0245. This malware is distributed through XLL files, masquerading as documents shared via ZIP archives on the Signal messaging app. Once executed, CABINETRAT creates malicious executables on the compromised host and modifies the Windows Registry for persistence. It employs anti-virtual machine techniques to avoid detection, checking for specific hardware configurations. Designed in C, CABINETRAT collects system information, captures screenshots, and facilitates file operations while communicating with a remote server over TCP. 

Detour Dog: Evolving DNS malware threats

Detour Dog is a sophisticated threat actor leveraging DNS-based malware to conduct campaigns that distribute Strela Stealer. This actor uses DNS TXT records for C2 operations, allowing for multi-stage payload delivery through compromised websites. Initially focused on redirecting users to scams, Detour Dog evolved to host and distribute malware by executing remote code via DNS. Collaborating with Hive0145, the operator of Strela Stealer, Detour Dog employs botnets like REM Proxy to facilitate spam delivery. Recent sinkholing efforts have revealed a significant global footprint, with over 30,000 infected hosts generating substantial bot traffic. The use of encoded IP addresses in DNS queries indicates sophisticated tactics aimed at evading detection.

Top Vulnerabilities Reported in the Last 24 Hours

VMware zero-day exploited by UNC5174

A critical VMware vulnerability, tracked as CVE-2025-41244, has been exploited as a zero-day since October 2024, allowing attackers to execute code with elevated privileges on virtual machines. This flaw affects both VMware Aria Operations and VMware Tools, enabling privilege escalation to root on systems that have these tools installed. Broadcom recently released patches but did not disclose the ongoing exploitation by the Chinese state-sponsored group UNC5174, which has reportedly used this vulnerability for over a year. The vulnerability impacts various discovery features within VMware, including both credential-based and credential-less modes. The open-source version, open-vm-tools, used in major Linux distributions, is also susceptible.

Western Digital issues firmware updates

Western Digital has issued firmware updates for several My Cloud NAS models to address a critical vulnerability, tracked as CVE-2025-30247, which allows remote command injection through specially crafted HTTP POST requests. This flaw affects models including My Cloud PR2100, PR4100, EX4100, EX2 Ultra, and others, while some devices like the DL2100 and DL4100 have reached end of support and may not receive updates. The vulnerability poses significant risks, enabling unauthorized access, modification, and deletion of files, as well as potential execution of arbitrary commands. Exploiting CVE-2025-30247 could lead to unauthorized file access, modification, deletion, user enumeration, configuration changes, or binary execution. Users are advised to update their firmware to version 5.31.108 immediately or take devices offline until updates can be applied. Offline devices can still function locally in LAN mode.