Cyware Daily Threat Intelligence, September 22, 2025

A rogue patch for Steam’s BlockBlasters game is pilfering crypto wallets and user data. This trojan-laced update, slipped past security checks, grabs IP addresses and Steam credentials, disables Microsoft Defender, and uploads data to a C2 server, impacting hundreds of players.

MalTerminal is breaking new ground as the first malware wielding GPT-4 to craft ransomware and backdoors. Using a deprecated OpenAI API, this LLM-embedded threat, paired with phishing that exploits Follina, dodges AI security to deliver malicious payloads.

A critical Entra ID flaw let attackers impersonate Global Administrators across tenants. This maximum-severity bug, tied to legacy Azure AD Graph API, allowed MFA bypass and undetected access, now fixed to block unauthorized tenant compromise.

Top Malware Reported in the Last 24 Hours

Infected Steam game spreads malware patch

A recent patch for the Steam game BlockBlasters has been found to contain malware that steals sensitive user information, including crypto wallet data. This malicious update bypassed security measures and has potentially affected hundreds of players. The patch includes a trojan batch file that collects various data points such as IP addresses and Steam login credentials, uploading them to a C2 server. Additionally, the malware unpacks hidden executables that disable Microsoft Defender scans and execute further malicious payloads. The infection has drawn significant attention, particularly after a live streaming incident where a user was infected during a charity event.

New RAT emerges, alternative to ScreenConnect

A threat actor is promoting a new RAT on underground forums, marketed as a fully undetectable alternative to ScreenConnect. This malware boasts advanced features designed to evade modern security measures, claiming zero detections during both static and runtime analysis. It effectively bypasses security warnings from Google Chrome and Windows SmartScreen by bundling with a valid EV certificate, creating a false sense of security for victims. The RAT employs social engineering tactics, including a convincing fraudulent Adobe Acrobat Reader download page, to deliver its payload. It allows attackers real-time access to compromised machines, enabling data exfiltration and system manipulation. Utilizing a PowerShell-based command for fileless execution, the RAT remains hidden from traditional antivirus solutions.

DPRK hackers drop BeaverTail via ClickFix campaign

North Korean hackers are increasingly using ClickFix-style lures to deliver malware such as BeaverTail and InvisibleFerret, primarily targeting marketing and trading roles in the cryptocurrency and retail sectors. This marks a shift from their traditional focus on software developers. The malware is distributed through fake hiring platforms that entice victims with job offers, leading them to download malicious software under the guise of technical assessments. Recent campaigns have also employed deepfake technology and trusted platforms like GitHub to enhance their tactics. Additionally, the Kimsuky group has been observed using phishing techniques involving forged military IDs to compromise individuals associated with South Korean defense. 

MalTerminal: New malware using GPT-4 capabilities

Researchers have discovered MalTerminal, the earliest known malware that incorporates GPT-4 capabilities, enabling it to dynamically generate ransomware code or reverse shell commands. MalTerminal utilizes a deprecated OpenAI API, suggesting it may serve as a proof-of-concept or red team tool. This malware exemplifies a new category of threats known as LLM-embedded malware, which poses significant challenges for cybersecurity defenses. Additionally, cybercriminals are employing sophisticated phishing techniques that utilize hidden prompts in emails to bypass AI security systems. These tactics exploit vulnerabilities like Follina, leading to the execution of malicious payloads. 

Top Vulnerabilities Reported in the Last 24 Hours

Microsoft patches critical Entra ID bug

Microsoft has patched a critical vulnerability in Entra ID (formerly Azure Active Directory) that allowed attackers to impersonate Global Administrators across multiple tenants. This flaw, tracked as CVE-2025-55241 and rated with a maximum CVSS score of 10.0, resulted from improper token validation in the deprecated Azure AD Graph API. Exploitation of this vulnerability could bypass multi-factor authentication and logging, enabling attackers to compromise entire tenant environments without detection. The issue stemmed from a combination of legacy API flaws and service-to-service actor tokens, which facilitated unauthorized access across tenants. 

Fortra warns of max severity vulnerability

Fortra released security updates to fix a critical vulnerability (CVE-2025-10035) in GoAnywhere MFT's License Servlet, which can be exploited remotely via command injection attacks. The flaw stems from a deserialization of untrusted data, allowing attackers to exploit systems with admin consoles exposed online. Fortra advises removing public access to the admin console and has provided patches in GoAnywhere MFT 7.8.4 and Sustain Release 7.6.3. Security analysts are monitoring over 470 GoAnywhere MFT instances, though it is unclear how many have been patched or are vulnerable. Threat actors frequently target secure file transfer solutions due to their role in handling sensitive data.