Cyware Daily Threat Intelligence, September 11, 2025

Slipping through macOS like a shadow in the fog, ChillyHell malware cloaks itself as a harmless app to wreak havoc. Using LaunchAgent, LaunchDaemon, and shell injections, it digs into systems at boot, stealing data and launching reverse shells while evading Apple’s notarization checks.

A rogue Chrome extension, Madgicx Plus, is preying on Meta advertisers with a slick AI optimization pitch. This malware, spread through polished domains tied to past scams, hijacks Google and Facebook accounts, siphoning off valuable ad assets with deceptive ease.

NVIDIA’s NVDebug tool is under siege from three high-severity flaws, opening doors to code execution and privilege escalation. These vulnerabilities, with the worst scoring 8.2, allow attackers to tamper with systems or steal data in multi-user setups, fixed in version 1.7.0.

Top Malware Reported in the Last 24 Hours

ChillyHell: Newly-spotted macOS modular malware

ChillyHell is a sophisticated macOS malware that has recently emerged, utilizing advanced techniques to evade detection and maintain persistence. This malware employs three primary methods for persistence: LaunchAgent, LaunchDaemon, and shell profile injection, allowing it to execute upon user login or system boot. It masquerades as a benign application while actively collecting environmental data and profiling the host system. Notably, ChillyHell has remained notarized by Apple, which underscores its stealth capabilities. Its modular architecture enables various malicious activities, including spawning reverse shells, downloading payloads, and conducting brute force attacks on user credentials.

Malicious Chrome extension targets Meta advertisers

A malicious Chrome extension campaign is targeting Meta (Facebook/Instagram) advertisers by masquerading as a legitimate AI-driven ad optimization tool called Madgicx Plus. This extension, promoted as a productivity enhancer, actually functions as malware capable of hijacking business sessions and stealing credentials. The campaign utilizes a network of professionally crafted domains, some previously linked to other malicious activities, to distribute the compromised extension. It captures Google account details before prompting users to connect their Facebook accounts, thereby broadening its access to valuable advertising assets. The reuse of infrastructure and domains indicates that this campaign is an evolution of prior malicious efforts rather than isolated incidents.

AdaptixC2: New threat in cybersecurity landscape

AdaptixC2 is an open-source post-exploitation framework increasingly exploited by threat actors for real-world attacks. It allows attackers to execute commands, transfer files, and perform data exfiltration on compromised systems. Its modular design enables customization, making it a flexible tool for evading detection. Recent incidents revealed that AdaptixC2 was deployed through social engineering tactics, such as phishing attacks impersonating IT support. Attackers often use fileless techniques, leveraging PowerShell scripts for in-memory execution, which minimizes their footprint. The framework supports various beacon types and communication methods, facilitating covert operations. 

Top Vulnerabilities Reported in the Last 24 Hours

NVIDIA patches high-severity bugs

NVIDIA has released an update for its NVDebug tool, fixing three high-severity vulnerabilities (CVE-2025-23342, CVE-2025-23343, CVE-2025-23344) that could lead to code execution, privilege escalation, and data tampering. Users are urged to upgrade to version 1.7.0 or later. CVE-2025-23342, the most severe vulnerability with a CVSS score of 8.2, allows attackers to gain access to privileged accounts and perform actions like code execution and denial of service. It poses significant risks in shared or multi-user environments. CVE-2025-23343, rated 7.6, involves improper file write handling, enabling attackers to overwrite sensitive system components, leading to information disclosure and persistent tampering. CVE-2025-23344, scored 7.3, allows non-privileged users to execute code on the host platform, facilitating lateral movement and privilege escalation. Exploitation requires low privileges but can have serious consequences.

New vulnerability affects Kunbus Revolution Pi

A critical authentication bypass vulnerability (CVE-2025-41646) has been identified in Kunbus Revolution Pi Webstatus. This flaw allows remote attackers to gain unauthorized access without credentials, posing a significant threat to industrial and operational technology environments. Researchers have observed active exploitation attempts, and a public proof-of-concept is available, increasing the urgency for immediate remediation. The vulnerability allows attackers to gain full administrative control of affected devices. Successful exploitation could result in unauthorized system access, data manipulation, or disruption of critical industrial processes. CVE-2025-41646 is an authentication bypass vulnerability caused by improper credential handling in Kunbus Revolution Pi Webstatus. It can be exploited remotely over the network without user interaction.

Top Scams Reported in the Last 24 Hours

Salty2FA: New phishing kit targets EU and U.S.

Salty2FA is a new and advanced phishing kit that targets enterprises in the U.S. and EU, designed to bypass various two-factor authentication methods. This PhaaS framework has been identified in campaigns targeting sectors such as finance, energy, and telecom. It employs multi-stage execution tactics, starting with convincing email lures that prompt urgency, leading victims to fake login pages that mimic legitimate sites. Once credentials are entered, the kit can intercept 2FA codes, allowing attackers to gain unauthorized access to accounts.