Cyware Daily Threat Intelligence, October 03, 2025
Daily Threat Briefing • October 3, 2025
Beware of the new digital tricksters! The Impact Solutions phishing toolkit empowers even novice cybercriminals to craft sophisticated attacks using a user-friendly interface, enabling them to bypass security measures with deceptive tactics like fake invoices and malicious attachments.
Both Google and Mozilla have released security updates for their browsers, addressing multiple high-severity vulnerabilities. Chrome 141 fixes 21 security issues, including two high-severity heap buffer overflows in WebGPU and Video components, while Firefox 143.0.3 resolves two critical flaws in the Graphics and JavaScript Engine components.
A bug in Microsoft Defender's BIOS security feature has been causing false alerts, leading to unnecessary remediation actions. The issue, identified as a false positive, has been acknowledged by Microsoft, and users are advised to update their Defender definitions to resolve the problem.
Top Malware Reported in the Last 24 Hours
New phishing kit bypasses security
Abnormal AI introduces Impact Solutions, a user-friendly phishing toolkit enabling cybercriminals with minimal technical skills to craft advanced malware-laden emails. The toolkit allows attackers to generate weaponized Windows shortcut files (.lnk), HTML pages, and SVG images that mimic legitimate documents, such as invoices. These malicious attachments exploit human trust rather than technical vulnerabilities, employing tactics like icon spoofing and file masquerading to bypass security filters and deceive users into executing malware.
Evolution of Rhadamanthys 0.9.x
Check Point Research analyzes the latest version (0.9.2) of the Rhadamanthys malware, a multi-modular stealer that has evolved since its 2022 release. The update introduces changes that impact detection tools, including a new custom executable format and enhanced obfuscation techniques. The malware's operators have rebranded as "RHAD security" and "Mythical Origin Labs," offering a polished interface and additional products like Elysium Proxy Bot and Crypt Service. Defenders are provided with updated tools to counteract these developments.
Top Vulnerabilities Reported in the Last 24 Hours
Chrome 141 and Firefox 143 patches fix high-severity vulnerabilities
Google and Mozilla released updates for Chrome 141 and Firefox 143, addressing multiple high-severity vulnerabilities in browser components. Chrome 141 fixed 21 security issues, including two high-severity heap buffer overflow bugs (CVE-2025-11205 and CVE-2025-11206) in WebGPU and Video components, with $50,000 awarded to external researchers. Firefox 143 patched two high-severity flaws: CVE-2025-11152 (Graphics integer overflow leading to sandbox escape) and CVE-2025-11153 (JavaScript Engine JIT miscompilation). Neither Google nor Mozilla reported active exploitation of these vulnerabilities, but users are urged to update browsers promptly.
Microsoft Defender bug causes false BIOS security alerts
A critical software bug in Microsoft Defender for Endpoint is causing false BIOS security alerts, particularly for Dell device users. The bug incorrectly flags up-to-date BIOS versions as outdated or vulnerable, leading to confusion among IT administrators and users. Microsoft has identified the issue as a flaw in the vulnerability detection logic and is deploying a targeted fix with reference number DZ1163521.
DrayTek warns of remote code execution bug in Vigor Routers
DrayTek issued an advisory about a remote code execution vulnerability (CVE-2025-10547) in several Vigor router models, allowing unauthenticated attackers to exploit the Web User Interface (WebUI). The flaw arises from an uninitialized stack value, enabling attackers to manipulate the free() function for arbitrary memory operations and remote code execution.