Cyware Daily Threat Intelligence, September 18, 2025

A JPG file that looks like a simple image might now be the start of a full-blown infostealing operation. In a recent FileFix campaign, threat actors are hiding malicious PowerShell scripts and encrypted binaries inside seemingly innocent image files. Unlike earlier proof-of-concept variants, this iteration ups the ante by using multilingual phishing pages and deeply obfuscated JavaScript.

When package managers become threat vectors, even a string manipulation library can be a trap. Two rogue Python packages have been removed from PyPI after researchers discovered they were dropping SilentSync RAT. SilentSync is capable of executing arbitrary commands, exfiltrating files, and stealing browser credentials, making it especially dangerous for unsuspecting developers.

Another day, another zero-day. Google has shipped an urgent patch to plug a critical flaw in Chrome. Tracked as CVE-2025-10585, the newly patched vulnerability stems from a type confusion bug in the V8 JavaScript engine, which could allow attackers to remotely execute arbitrary code by luring users to maliciously crafted HTML pages. This marks the sixth actively exploited zero-day in Chrome this year.

Top Malware Reported in the Last 24 Hours

FileFix campaign drops StealC infostealer 

A recent FileFix campaign has emerged, utilizing steganography to conceal malicious PowerShell scripts and encrypted executables within JPG images. This attack encourages victims to paste harmful commands into a file upload interface, triggering an obfuscated PowerShell chain that extracts payloads from the images. Notably, this iteration of the campaign deviates from earlier proof of concept versions by employing multilingual phishing pages and extensive JavaScript minification, enhancing its deceptive tactics. The phishing site mimics a Meta support page, pressuring users into executing commands disguised as file paths. The infection chain begins with a PowerShell one-liner that downloads an image from BitBucket, ultimately leading to the deployment of StealC, an infostealer capable of harvesting sensitive data from various applications and services.

Raven Stealer: New malware emerges 

Raven Stealer is a lightweight and sophisticated information-stealing malware developed in Delphi and C++. It primarily targets Chromium-based browsers, extracting sensitive data such as passwords, cookies, payment details, and autofill entries. Utilizing a modular design, it allows attackers to easily embed configuration details like Telegram bot tokens for seamless data exfiltration. The malware operates stealthily by employing techniques such as in-memory execution and process injection, which help it evade detection by traditional security measures. Once active, it aggregates stolen credentials and system information, transmitting them directly to the attacker via Telegram, thereby posing significant risks to both personal and enterprise environments.

Malicious PyPI packages drop new RAT

Two malicious Python packages, "sisaws" and "secmeasure," were found in the PyPI repository, delivering the SilentSync RAT targeting Windows systems. SilentSync is capable of executing remote commands, exfiltrating files, and stealing browser data, including credentials and cookies from popular web browsers. The "sisaws" package masquerades as a tool for interfacing with Argentina's healthcare APIs but contains a backdoor that downloads malware using hardcoded tokens. Similarly, "secmeasure" claims to provide string manipulation functions while primarily serving as a malware distributor. SilentSync enables remote command execution, file exfiltration, and browser data theft, communicating with a C2 server via a REST API.

Top Vulnerabilities Reported in the Last 24 Hours

Critical bug in Firebox firewalls

WatchGuard has issued security updates to address a critical remote code execution vulnerability (CVE-2025-9242) in its Firebox firewalls, caused by an out-of-bounds write weakness. This flaw affects Fireware OS versions 11.x, 12.x, and 2025.1, with fixes included in specific updates. Vulnerable configurations primarily involve the IKEv2 VPN, but devices may still be at risk even after such configurations are removed, particularly if branch office VPNs to static gateway peers are still active. Although this vulnerability has not yet been exploited in the wild, it poses a significant threat, as firewalls are attractive targets for attackers, exemplified by previous incidents involving other firewall vulnerabilities. 

Google patches sixth 0-day of the year

Google has released a critical update for Chrome, addressing the sixth zero-day vulnerability of 2025, tracked as CVE-2025-10585. This vulnerability, a type confusion issue in the V8 JavaScript engine, allows attackers to exploit crafted HTML pages for remote code execution and other malicious activities. Alongside this, the update resolves two additional use-after-free vulnerabilities and a heap buffer overflow in the ANGLE graphics engine. The latest Chrome version is now being rolled out across Windows, macOS, and Linux platforms.