Cyware Daily Threat Intelligence, September 03, 2025

Slithering through networks like a digital phantom, TinyLoader malware is hitting Windows systems with a crafty mix of network share and USB attacks. It delivers threats like Redline Stealer and DCRat, hijacking cryptocurrency transactions by swapping wallet addresses while spreading via deceptive shortcuts and shared folders.

Lazarus Group is playing a dangerous game of impersonation, wielding three new RATs against a DeFi target. Using fake Telegram profiles and sham scheduling sites, they deploy PondRAT for initial access, ThemeForestRAT for advanced monitoring, and RemotePE for high-value control, showcasing their evolving tactics.

Chrome 140 is locking down a critical flaw that could let attackers run rogue code in your browser. Fixing a severe use-after-free bug in the V8 engine, alongside issues in the Toolbar, Extensions, and Downloads, Google’s latest update is a must for Windows, macOS, and Linux users.

Top Malware Reported in the Last 24 Hours

TinyLoader malware targets Windows systems

A sophisticated malware campaign known as TinyLoader is actively targeting Windows systems through various attack methods, including network share exploitation and USB device propagation. This malware functions primarily as a delivery mechanism for other threats, such as Redline Stealer and DCRat, and is designed to steal cryptocurrency by monitoring clipboard activity. TinyLoader replaces legitimate cryptocurrency wallet addresses with those controlled by attackers during transactions, making detection nearly impossible. The malware spreads by creating deceptive shortcuts that appear legitimate and by scanning local networks for accessible shared folders, allowing it to propagate rapidly within corporate environments. Its infrastructure spans multiple countries, indicating a well-organized operation. 

Lazarus expands malware arsenal

The North Korea-linked Lazarus Group has expanded its malware arsenal with three new tools: PondRAT, ThemeForestRAT, and RemotePE. These were deployed in a social engineering campaign targeting a DeFi organization, where the attackers impersonated an employee on Telegram and used fake scheduling websites to gain access. Once inside, they utilized PondRAT, a basic remote access tool, to establish a foothold and deploy more sophisticated malware. ThemeForestRAT was then used for advanced operations, including monitoring remote desktop sessions and executing commands. The final stage involved RemotePE, a more complex RAT designed for high-value targets. 

MystRodX backdoor uses stealthy techniques

MystRodX is a sophisticated backdoor malware implemented in C++ that features capabilities such as file management, port forwarding, reverse shell, and socket management. Also known as ChronosRAT, it is linked to the Liminal Panda cyber espionage group and is notable for its stealth and flexibility. MystRodX employs various encryption methods to obscure its code and can operate in both passive and active modes, triggered by specially crafted DNS or ICMP packets. Delivered via a dropper, it undergoes checks to verify its environment before decrypting its payload, which includes components that monitor and launch processes. The malware’s configuration, encrypted with AES, contains critical information about its C2 server and operational parameters, allowing it to adapt dynamically based on its setup.

Top Vulnerabilities Reported in the Last 24 Hours

Android patches zero-days

The September 2025 Android Security Bulletin highlights two critical zero-day vulnerabilities, CVE-2025-38352 and CVE-2025-48543, that are actively being exploited in the wild. CVE-2025-38352 affects the Android Runtime component, while CVE-2025-48543 impacts Android versions 13 through 16. Both vulnerabilities are classified as elevation of privilege flaws, allowing attackers to execute remote code without any user interaction or additional privileges. The existence of these zero-days poses a significant threat to Android devices, as they can be exploited by malicious actors to compromise system integrity and user data. Google has responded by notifying partners of these vulnerabilities ahead of public disclosure. 

Chrome 140 patches critical security vulnerabilities

Google has released Chrome 140 for Windows, macOS, and Linux, addressing six security vulnerabilities, including a critical use-after-free flaw in the V8 JavaScript engine, identified as CVE-2025-9864. This high-severity vulnerability poses a significant risk as it could allow attackers to execute arbitrary code within the browser. Alongside this critical fix, the update also addresses medium-severity vulnerabilities affecting the Toolbar (CVE-2025-9865), Extensions (CVE-2025-9866), and Downloads (CVE-2025-9867). 

IIS Web Deploy vulnerability allows RCE

A newly identified RCE vulnerability, tracked as CVE-2025-53772, has emerged in Microsoft’s IIS Web Deploy toolchain. This flaw exists within the unsafe deserialization of the msdeployagentservice and msdeploy.axd endpoints, enabling authenticated attackers to execute arbitrary code on compromised web servers. The vulnerability arises from the improper handling of the MSDeploy.SyncOptions HTTP header, which is expected to be GZip-compressed and Base64-encoded. Attackers can exploit this flaw by sending a crafted payload that, when processed by the server, leads to the execution of malicious commands. A proof-of-concept has been made public. Microsoft has assigned a severity score of 8.8 to this vulnerability.