Cyware Daily Threat Intelligence, October 09, 2025
A cunning Python-based RAT is outsmarting defenses by rewriting its code on every run. This malware encrypts and executes from memory, sidestepping file scans, while injecting junk code and shuffling functions to create unique signatures, all to power its network scanning, data theft, and bot commands.
Chinese hackers, likely state-linked, are hijacking the Nezha monitoring tool to deploy Gh0st RAT, compromising over 100 servers. They bypass antivirus systems, showcasing how trusted open-source tools can become covert weapons in sophisticated cyberattacks.
A severe flaw in the Service Finder WordPress theme lets attackers bypass authentication, risking admin account takeovers. With over 13,800 exploitation attempts since August, this vulnerability in versions up to 6.0 threatens site hijacking, redirects, and malware hosting, urging immediate updates.
Top Malware Reported in the Last 24 Hours
Polymorphic Python malware evades detection
A new Python-based RAT employs advanced polymorphic and self-modifying techniques, altering its code signature with each execution to evade detection. The RAT uses functions like self_modifying_wrapper(), decrypt_and_execute(), and polymorph_code() for on-the-fly mutation, leveraging Python’s introspection and serialization capabilities. The malware wraps critical code in a self-modifying layer, encrypts and decrypts code using XOR encryption, and executes it from memory, bypassing traditional file-based scanning. The polymorph_code() function introduces random junk code, renames variables, shuffles functions, and injects no-op routines to create unique file signatures for every execution. The RAT includes offensive features like network scanning, payload delivery, data theft, self-propagation, and bot command interaction via platforms like Discord and Slack.
APT hackers misuse AI for malware development
Volexity has identified UTA0388, a China-aligned threat actor conducting sophisticated spear phishing campaigns since April, targeting organizations globally with a focus on Asian geopolitical issues, particularly Taiwan. Utilizing OpenAI's ChatGPT, UTA0388 crafts convincing phishing emails and develops a custom malware family known as GOVERSHELL, which has five distinct variants, each with evolving capabilities and communication methods. The phishing emails often exhibit incoherence, featuring fabricated personas and nonsensical details, indicative of LLM usage. The GOVERSHELL malware employs techniques like search order hijacking and scheduled tasks for persistence, while its infrastructure has shifted from direct-to-IP connections to more complex DNS-based domains.
Chinese hackers exploit Nezha tool to drop Gh0st RAT
Chinese hackers with suspected ties to the state have begun exploiting the open-source Nezha monitoring tool to deliver the Gh0st RAT malware. This campaign, identified by Huntress, utilizes log poisoning techniques to implant web shells on vulnerable servers, primarily targeting systems with exposed phpMyAdmin panels. The attackers have compromised over 100 machines globally, with significant infections reported in Taiwan, Japan, South Korea, and Hong Kong. By leveraging Nezha, the hackers execute commands and bypass antivirus protections, showcasing a concerning trend of using legitimate tools for malicious activities. The operation is characterized by its technical sophistication, as the threat actors manipulate SQL commands to drop PHP web shells, enabling further exploitation of the affected systems.
Top Vulnerabilities Reported in the Last 24 Hours
Critical bug in WordPress Service Finder theme
A critical vulnerability (CVE-2025-5947, CVSS score: 9.8) in the Service Finder WordPress theme allows attackers to bypass authentication and access any account, including administrator accounts. The flaw stems from improper cookie validation in the "service_finder_switch_back()" function, enabling privilege escalation and site hijacking. Exploitation of the vulnerability can lead to malicious activities such as redirecting users to fake sites or hosting malware. The vulnerability affects all versions of the theme up to 6.0 and was patched in version 6.1 on July 17. Over 13,800 exploitation attempts have been detected since August 1, though the success rate remains unclear.
GitLab patches two high-severity flaws
GitLab has released patch versions 18.4.2, 18.3.4, and 18.2.8 for both Community Edition (CE) and Enterprise Edition (EE), addressing critical security vulnerabilities and various bugs. It fixed CVE-2025-11340, allowing authenticated users with read-only API tokens to perform unauthorized write operations due to improperly scoped GraphQL mutations. CVE-2025-10004 impacts both CE and EE, allowing remote attackers to degrade performance or make GitLab instances unresponsive by exploiting GraphQL blob type functionality with large repository blobs. CVE-2025-10004 does not require authentication, increasing its risk for publicly accessible GitLab instances. GitLab also addressed moderate and low-severity issues, such as CVE-2025-9825 (authorization flaw) and CVE-2025-2934 (webhook-based DoS).
Severe vulnerability in Figma allows RCE
A critical vulnerability (CVE-2025-53967) has been discovered in the Figma MCP server, allowing attackers to execute arbitrary code through command injection due to unsanitized user input in shell commands. This flaw enables malicious actors to craft specially designed URLs or headers, leading to remote code execution under the server's privileges. The exploitation process involves the MCP client sending requests that can be manipulated to inject commands. Discovered by Imperva, this vulnerability poses significant risks to developers, particularly as AI-driven tools become more prevalent. The issue was addressed in version 0.6.3 of the Figma MCP, released on September 29.