Cyware Daily Threat Intelligence, September 16, 2025

Maranhão Stealer is hunting gamers through pirated software. Built with Node.js and Inno Setup, it mimics Microsoft components to hide, using DLL injection for persistence. It steals crypto wallet credentials, grabbing hardware and network data for targeted attacks.

AppSuite, OneStart, and ManualFinder are a malware triple threat. Posing as legit tools like PDF editors, they use Electron and PowerShell to track users and install sneaky extensions. Active since 2018, they evolve with randomized domains for control.

Phoenix is cracking DDR5 memory defenses wide open. This Rowhammer variant bypasses SK Hynix protections, flipping bits to gain root access in minutes. It targets RSA-2048 keys and binaries, impacting all DDR5 chips from 2021 to 2024.

Top Malware Reported in the Last 24 Hours

SmokeLoader malware evolves with new variants

SmokeLoader, a modular malware loader active since 2011, is designed to deliver various second-stage payloads such as trojans and ransomware. Following Operation Endgame in 2024, which aimed to dismantle its infrastructure, new variants emerged in early 2025, specifically version 2025 alpha and version 2025. These updates include significant bug fixes that enhance performance and improve evasion tactics against detection systems. Version 2025 alpha introduces a mutex check to prevent repeated injections into processes, while version 2025 modifies the network protocol and adds checks for the victim's keyboard layout. Additionally, both versions incorporate obfuscation techniques to hinder analysis and detection. Despite efforts to mitigate its impact, SmokeLoader continues to be actively used by multiple threat groups, with version 2025 alpha currently being the most prevalent variant.

New Maranhão Stealer targets gamers

A sophisticated malware campaign known as Maranhão Stealer has emerged, targeting gaming enthusiasts through malicious pirated software distributed on cloud-hosted platforms. Utilizing Node[.]js and Inno Setup installers, this malware employs advanced evasion techniques and social engineering to compromise user accounts and cryptocurrency wallets. Once installed, it creates a deceptive directory structure resembling legitimate Microsoft components, ensuring persistence through registry modifications and reflective DLL injection. Maranhão Stealer conducts extensive reconnaissance of infected systems, collecting hardware specifications, network details, and geolocation information. Its primary focus is on stealing credentials from popular cryptocurrency wallet applications, reflecting a shift towards targeting high-value digital assets.

Coordinated malware campaign uncovered

A coordinated malware campaign involving AppSuite, OneStart, and ManualFinder has been uncovered, revealing a shared infrastructure and overlapping tactics. These programs, often disguised as legitimate software like PDF editors or browsers, have evolved over time to include various components such as Electron, Node.js, and PowerShell scripts. The actors behind these threats have been active since at least 2018, leveraging deceptive installers and randomized domains to distribute and control malware. OneStart, derived from the Chromium browser, installs extensions that track user behavior and can silently add additional software. Older versions of OneStart employed PowerShell scripts and node.exe to execute malicious JavaScript, linking them to ManualFinder infections. Additionally, earlier iterations like SecureBrowser and DesktopBar were distributed under different names, showcasing the actors' evolving tactics.

Top Vulnerabilities Reported in the Last 24 Hours

New Phoenix attack bypasses DDR5 defenses

Researchers from ETH Zurich and Google have developed a new variant of Rowhammer attacks, named Phoenix, which successfully bypasses the latest protection mechanisms in DDR5 memory chips from SK Hynix. This attack exploits specific refresh intervals overlooked by the Target Row Refresh (TRR) defense, allowing attackers to flip bits in memory and potentially gain unauthorized access or escalate privileges. During testing, the team demonstrated that Phoenix could compromise all 15 DDR5 chips analyzed, achieving root access in under two minutes on a standard system. Additionally, the researchers found that the attack could manipulate sensitive data, including breaking SSH authentication by targeting RSA-2048 keys and altering binaries to elevate privileges. Phoenix is tracked as CVE-2025-6202 and affects all DDR5 DIMMs produced between January 2021 and December 2024.

Apple fixes critical vulnerabilities in software

Apple has released backported fixes for the critical vulnerability CVE-2025-43300, which affects the ImageIO component and can lead to memory corruption when processing malicious image files. This flaw has been actively exploited in sophisticated spyware attacks targeting fewer than 200 individuals. The company also addressed CVE-2025-55177, a vulnerability in WhatsApp's messaging apps, which was used in conjunction with CVE-2025-43300. Updates were rolled out for both recent and older versions of iOS, iPadOS, and macOS, including devices like the iPhone 6s and iPad Air 2. In addition to these vulnerabilities, Apple has patched several other security flaws across its platforms, including issues in Safari, LaunchServices, and CoreAudio.