Cyware Daily Threat Intelligence, September 02, 2025

Masquerading as a scholarly newsletter, North Korea’s ScarCruft is targeting South Korean academics and ex-officials with RokRAT malware. Launched via spear-phishing emails with malicious LNK files, Operation HanKook Phantom uses PowerShell and obfuscated scripts to steal sensitive data, cloaking exfiltration as Chrome uploads to hit government and research sectors.

A fake PDF editor peddled through Google ads is dishing out the TamperedChef infostealer to unsuspecting users. Promoted across 50 domains since June, AppSuite PDF Editor, signed with bogus certificates, activates its data-stealing tricks post-update, grabbing credentials and cookies while dodging security agents.

WhatsApp and Apple are racing to patch critical zero-day flaws exposing users to spyware attacks. A WhatsApp vulnerability, paired with an Apple OS flaw, allows exploits via malicious image files and device sync messages, potentially targeting high-profile individuals in sophisticated campaigns.

Top Malware Reported in the Last 24 Hours

ScarCruft targets South Korean academics 

North Korea-linked hacking group ScarCruft (APT37) launched Operation HanKook Phantom, targeting South Korean academics and former government officials using RokRAT malware for espionage purposes. The attack begins with a spear-phishing email disguised as a "National Intelligence Research Society Newsletter," using malicious LNK files to deploy RokRAT malware, which exfiltrates data via popular cloud services. A second campaign involves PowerShell scripts and obfuscated batch files to deploy malware that steals sensitive data while masking network activity as Chrome file uploads. The campaign includes tailored spear-phishing attacks and covert exfiltration mechanisms targeting South Korean government sectors and research institutions.

Brokewell malware spreads through fake ads

Cybercriminals are exploiting Meta's advertising platforms to distribute Brokewell malware through fraudulent ads promising a free TradingView Premium app, specifically targeting Android users interested in cryptocurrency. This campaign, active since July 22, employs around 75 localized ads that redirect users to a fake TradingView site, where they download a malicious APK file. Once installed, the malware requests extensive permissions under the guise of an update prompt, allowing it to steal sensitive information, including device lockscreen PINs. Brokewell is equipped with advanced capabilities, enabling it to monitor and control infected devices, steal cryptocurrency credentials, bypass two-factor authentication, and intercept messages. This operation is part of a broader scheme that initially targeted Windows users through deceptive Facebook ads impersonating well-known brands.

Fake PDF Editor drops infostealer

Cybercriminals are distributing the TamperedChef infostealer through a fraudulent PDF editing application called AppSuite PDF Editor, promoted via Google ads across multiple websites. This campaign, which began on June 26, involves over 50 domains and utilizes apps signed with fake certificates from various companies. Initially, the app functions normally, but an update on August 21 activates its malicious capabilities, allowing it to collect sensitive data such as credentials and web cookies. Researchers discovered that the malware checks for security agents on the host system and queries installed web browsers using Windows' Data Protection API. The threat actors employed a strategy to maximize downloads before activating the infostealer, suggesting a well-coordinated operation.

Top Vulnerabilities Reported in the Last 24 Hours

WhatsApp patches 0-day, 0-click bug

WhatsApp has addressed a critical zero-day vulnerability (CVE-2025-55177) that allowed unauthorized users to exploit linked device synchronization messages, potentially leading to sophisticated attacks. This vulnerability is believed to have been used in conjunction with an Apple OS-level flaw (CVE-2025-43300), which involved an out-of-bounds write issue that could result in memory corruption when processing malicious image files. Both vulnerabilities may have been exploited as part of a commercial spyware campaign targeting specific individuals. 

Three new flaws in Sitecore Experience Platform

Three new security vulnerabilities have been identified in the Sitecore Experience Platform, including HTML cache poisoning, RCE via insecure deserialization, and information disclosure through brute-force enumeration of cache keys. The vulnerabilities, assigned CVEs CVE-2025-53693, CVE-2025-53691, and CVE-2025-53694, could allow unauthorized access to sensitive information and execution of malicious code. Patches for the first two vulnerabilities were released in June, while the patch for the information disclosure flaw followed in July. Researchers indicated that these vulnerabilities could be exploited in a chain, where attackers could use the ItemService API to enumerate cache keys and send poisoned requests, ultimately leading to the execution of arbitrary code.