Cyware Daily Threat Intelligence, October 02, 2025

Luring UAE users with fake Signal and ToTok apps, Android/Spy.ProSpy and ToSpy are pilfering sensitive data. Spread through phishing sites, these spyware variants steal SMS, contacts, and chat histories, maintaining persistent access with active C2 servers.

Posing as an IPTV and VPN app, Klopatra is snaring over 3,000 European Android devices. This Turkish-linked banking RAT uses Accessibility Service and hidden VNC to monitor screens and steal bank data, evading detection with anti-debugging tricks.

A OneLogin IAM flaw once left OIDC client secrets exposed to attackers with API credentials. Rated at CVSS 7.7, this bug allowed application impersonation, now patched in release 2025.3.0 to secure integrated services and block unauthorized access.

Top Malware Reported in the Last 24 Hours

New spyware campaigns target Android users

ESET researchers have identified two Android spyware campaigns, Android/Spy.ProSpy and Android/Spy.ToSpy, targeting users in the UAE who favor secure communication apps like Signal and ToTok. These spyware families are distributed through deceptive websites that impersonate legitimate apps, employing phishing tactics to lure victims into manual installations. ProSpy masquerades as both Signal and ToTok, while ToSpy focuses solely on ToTok users, specifically targeting .ttkmbackup files to extract chat history. Once installed, the spyware exfiltrates sensitive data, including SMS messages, contacts, and files, while maintaining persistence on devices through various methods. Both campaigns remain active, with ongoing distribution and control servers still operational.

New Android malware Klopatra targets users

A new Android malware named Klopatra, disguised as an IPTV and VPN app, has infected over 3,000 devices in Europe. It is a banking RAT with advanced features like real-time screen monitoring, input capture, and a hidden VNC mode. The malware is distributed through a dropper app called "Modpro IP TV + VPN" outside the Google Play Store. It employs advanced evasion techniques like code protection, anti-debugging mechanisms, and emulator detection. Klopatra exploits Android's Accessibility Service to gain permissions, simulate user actions, and monitor sensitive information. It also features a black-screen VNC mode for performing unauthorized actions, such as bank transactions, while appearing idle to the victim. Researchers link Klopatra to a Turkish-speaking cybercrime group, with evidence of active development since March, including 40 different builds.

MatrixPDF toolkit turns PDFs into threats

MatrixPDF is a new phishing and malware distribution toolkit that transforms ordinary PDF files into interactive lures, bypassing email security and redirecting victims to credential theft or malware downloads. The toolkit is marketed as a phishing simulation and blackteaming tool, featuring drag-and-drop PDF import, real-time preview, and customizable security overlays for crafting professional-grade phishing scenarios. MatrixPDF allows attackers to add malicious features to legitimate PDFs, such as blurred content, fake prompts, and clickable overlays leading to external payload URLs. Embedded JavaScript actions in MatrixPDF can trigger malicious actions, like opening external sites or phishing pages, when users interact with the document.

Top Vulnerabilities Reported in the Last 24 Hours

OneLogin bug exposes OIDC client secrets

A significant security vulnerability, tracked as CVE-2025-59363, was identified in OneLogin's IAM solution, allowing attackers with valid API credentials to access sensitive OpenID Connect (OIDC) client secrets. This flaw, classified with a CVSS score of 7.7, arose from the application listing endpoint returning excessive data, including client_secret values. By authenticating with valid API credentials, an attacker could enumerate applications, retrieve client secrets, and impersonate OIDC applications to access integrated services. The vulnerability's broad impact was amplified by OneLogin's role-based access control, which permitted extensive endpoint access, and the absence of IP address allowlisting. OneLogin addressed the issue in its 2025.3.0 release, ensuring that client_secret values are no longer exposed. 

Multiple flaws in Nvidia and Adobe Acrobat

Cisco Talos disclosed several vulnerabilities affecting Nvidia and Adobe products. Five vulnerabilities were identified in Nvidia's CUDA Toolkit, including an arbitrary code execution vulnerability in the DWARF parsing functionality of cuobjdump and multiple out-of-bounds write issues in nvdisasm. These vulnerabilities could allow attackers to execute malicious code by providing specially crafted files. Additionally, a use-after-free vulnerability was found in Adobe Acrobat Reader, which could be triggered by malicious JavaScript in a PDF document, potentially leading to memory corruption and arbitrary code execution. All vulnerabilities have been patched by their respective vendors.