Cyware Daily Threat Intelligence, September 08, 2025

Posing as Microsoft Teams with chilling accuracy, cybercriminals are tricking macOS users into downloading the Odyssey stealer. This malware grabs browser credentials and crypto wallet data, using social engineering to gain privileges and swap out legitimate apps for persistent theft.

A gaping hole in Progress Software’s OpenEdge AdminServer is letting attackers run rogue code with ease. This high-severity flaw allows command injection via the Java RMI interface, now patched with better input sanitization and disabled remote RMI.

iCloud Calendar invites are being hijacked to deliver phishing emails that dodge spam filters. Masquerading as payment alerts from Apple’s servers, they lure victims to fake support lines, enabling scammers to steal data or deploy malware via remote access.

Top Malware Reported in the Last 24 Hours

Fake Teams site spreads Odyssey stealer

Cybercriminals are intensifying their attacks on macOS users by deploying the Odyssey stealer through a fraudulent Microsoft Teams download site. This sophisticated campaign involves attackers impersonating Microsoft Teams via the domain teamsonsoft[.]com, complete with official branding to deceive victims. When users attempt to download what they believe is the legitimate application, they are prompted to execute a command that installs the malware. The Odyssey stealer is capable of extensive data theft, targeting sensitive information such as browser credentials, cryptocurrency wallet data, and system details. It employs social engineering tactics to gain elevated privileges and maintains persistence by replacing legitimate applications. The stolen data is exfiltrated to the attackers' C2 server, making it a significant threat to macOS users.

GPUGate malware exploits trusted platforms

GPUGate is a sophisticated malware campaign targeting IT professionals in Western Europe by exploiting Google Ads and GitHub infrastructure to deliver malicious payloads. The attackers created counterfeit links that appeared legitimate, targeting IT professionals in Western Europe. The malware masquerades as a GitHub Desktop installer, embedding numerous dummy executables to evade detection. Its unique feature is a GPU-gated decryption mechanism, which ensures that the payload remains encrypted on systems without specific GPU configurations, effectively bypassing many analysis tools. By leveraging psychological manipulation and trusted platforms, the threat actors aim to gain initial access for credential theft, ransomware deployment, and further malicious activities. 

AI-powered malware compromises GitHub accounts

A recent supply chain attack known as s1ngularity has compromised 2,180 GitHub accounts and leaked over 7,200 repositories. Attackers exploited a vulnerability in the Nx open-source build system by publishing a malicious version of its package on NPM, which included a credential-stealing malware script called "telemetry[.]js." This malware targeted Linux and macOS systems, aiming to steal sensitive information such as GitHub tokens, SSH keys, and crypto wallets. The attackers utilized artificial intelligence tools to enhance their methods, rapidly evolving their techniques throughout the attack. The incident unfolded in three phases, with the initial phase impacting 1,700 users and leading to the exposure of thousands of secrets. 

Top Vulnerabilities Reported in the Last 24 Hours

New Apache Jackrabbit bug

A critical vulnerability in Apache Jackrabbit Core and JCR Commons, tracked as CVE-2025-58782, exposes systems to JNDI injection and potential RCE. Affecting versions 1.0.0 through 2.22.1, this flaw arises from improper handling of JNDI URIs during repository lookups. Attackers can exploit this vulnerability by injecting malicious JNDI references, which may lead to arbitrary code execution, data exfiltration, or service disruptions. Users are advised to upgrade to version 2.22.2, which disables JCR lookup through JNDI by default.

Progress patches RCE flaw

Progress Software has addressed a high-severity vulnerability, identified as CVE-2025-7388, in the OpenEdge AdminServer component, which enables RCE through the Java RMI interface. This flaw affects OpenEdge LTS Releases 12.2.17, 12.8.8, and earlier versions, allowing attackers to exploit exposed RMI stubs to inject OS commands due to inadequate input sanitization. The vulnerability arises from the AdminServer's elevated privileges, which can be manipulated even by authenticated users. To mitigate the issue, Progress has released updates that include input sanitization measures and the default disabling of remote RMI in AdminServer configurations. 

Top Scams Reported in the Last 24 Hours

iCloud Calendar invites exploited for phishing

iCloud Calendar invites are being exploited to send phishing emails disguised as payment notifications, originating from Apple’s email servers to bypass spam filters. The phishing emails aim to scare recipients into calling a fake support number, where scammers attempt to gain remote access to steal money, deploy malware, or extract sensitive data. These phishing emails pass email security checks (SPF, DKIM, DMARC) and appear legitimate due to their origin from Apple’s servers. Scammers use the Notes field in iCloud Calendar invites to embed phishing messages and send them to mailing lists, targeting multiple victims.