Cyware Weekly Threat Intelligence, July 07–11, 2025

The Bad

You don’t need to visit shady corners of the internet to get infected, GitHub will do. A malware campaign is disguising Lumma Stealer as tools like Free VPN for PC, using polished project pages, Base64 payloads, and trusted Windows processes to slip past defenses. The Anatsa banking trojan slipped back into Google Play, targeting North American users with fake maintenance screens while logging keystrokes and automating fraudulent transactions. Crypto users are being lured in by fake AI and gaming firms offering too-good-to-be-true deals.

• Cybercriminals are exploiting GitHub to distribute malware disguised as free software, specifically targeting users with applications like "Free VPN for PC" and "Minecraft Skin Changer." The malware dropper, named Launch.exe, utilizes sophisticated techniques such as obfuscation, process injection, and DLL side-loading to implant Lumma Stealer. This campaign involves hosting multiple malware samples on GitHub, where they employ Base64-encoded payloads concealed within seemingly harmless applications. The malware's execution process involves dynamic loading and the use of legitimate Windows processes, such as MSBuild.exe, to bypass security measures.
• A social engineering campaign targets cryptocurrency users through fake AI, gaming, and Web3 firms, tricking them into downloading malware via Telegram and Discord. These fake companies use spoofed social media accounts and legitimate platforms like GitHub and Notion to appear credible. The campaign, active since at least March 2024, employs stealer malware like Realst and AMOS to siphon cryptocurrency and sensitive data from Windows and macOS systems. Attackers leverage verified and compromised X accounts to approach victims, urging them to test software in exchange for cryptocurrency payments.
• A critical vulnerability (CVE-2025-47812) in Wing FTP Server, rated with a maximum severity score of 10.0, is being actively exploited. The flaw stems from improper handling of null ('\0') bytes in the server's web interface, enabling remote code execution. The vulnerability allows attackers to inject arbitrary Lua code into user session files, execute system commands with high privileges, and exploit anonymous FTP accounts. Threat actors have used the flaw for reconnaissance, creating persistence through new user accounts, and deploying malicious Lua files, though no evidence of remote desktop software installation has been confirmed. Over 8,000 publicly accessible Wing FTP Server devices are at risk, with 5,004 exposing their web interfaces. Most affected servers are located in the U.S., China, Germany, the U.K, and India.
• Anatsa, a banking trojan, has once again infiltrated Google Play, disguised as a PDF viewer app that garnered over 50,000 downloads. Once installed, the malware activates and targets North American banking applications by displaying deceptive messages about scheduled maintenance, which obscures its malicious activities like keylogging and unauthorized transactions. The latest app, Document Viewer – File Reader, was removed by Google, following its detection of the trojan, which had been active between June 24 and 30, shortly after its release. The malware can execute keylogging, automate transactions, and steal sensitive information.
• Researchers discovered nearly a dozen malicious Chrome extensions with 1.7 million downloads that track users, steal browser activity, and redirect to unsafe web addresses. These extensions pose as legitimate tools like color pickers, VPNs, volume boosters, and emoji keyboards, with many verified and highly rated on the Chrome Web Store. Malicious functionality is embedded in the background service worker of the extensions, capturing visited URLs and exfiltrating data to remote servers, potentially enabling cyberattacks. The malicious code was introduced via updates after the extensions were initially safe, possibly due to hijacking by external actors. Similar malicious extensions were found in the Microsoft Edge store, infecting over 600,000 users, bringing the total affected across browsers to 2.3 million.
• A recent SEO poisoning campaign has targeted over 8,500 small and medium-sized business users by delivering malware disguised as popular tools like PuTTY and WinSCP. This campaign utilizes a known malware loader called Oyster, which installs a backdoor upon execution. Cybercriminals employ black hat SEO techniques to manipulate search results, directing victims to malicious websites that deliver various malware, including Vidar and Lumma Stealers. The campaign exploits AI-related keywords to enhance its reach, while also hijacking tech support searches for major brands, misleading users with fake phone numbers. Additionally, threat actors spread malware through deceptive ads on social media and fake websites impersonating legitimate services, facilitating the theft of sensitive information and targeting cryptocurrency wallets. 

New Threats

Recent DoNot APT campaigns reveal a shift toward diplomatic espionage, using custom malware to exfiltrate data and maintain persistence through scheduled tasks and obfuscated binaries. A botnet announcing itself with Hello-World is now sweeping through Taiwan. A new scraper botnet has been using repeated GET requests across ports 80–85. Batavia spreads through phishing emails disguised as contract requests. Later stages drop Delphi-based malware that shows fake documents while harvesting data.

• Recent campaigns by the DoNot APT group show an expansion of targets to European diplomatic entities, emphasizing espionage motives. The group uses custom-built Windows malware (e.g., YTY and GEdit), delivered via spear-phishing emails or malicious documents, to achieve persistent surveillance and data exfiltration. A recent campaign targeted a European foreign affairs ministry, impersonating defense officials and using a malicious Google Drive link to deliver malware. The infection chain involved executing notflog.exe, deploying batch files, and creating scheduled tasks for persistence. The malware, LoptikMod, employs obfuscation techniques such as binary string encoding and selective packing to evade detection. 
• Cybersecurity researchers identified a new variant of ZuRu malware targeting macOS users through a trojanized Termius app, leveraging modified loaders and C2 techniques. ZuRu malware has been active since 2021, initially spreading via fake websites mimicking legitimate macOS apps like iTerm2, and later through pirated software such as Microsoft Remote Desktop for Mac. The malware employs the Khepri post-exploitation toolkit, enabling remote control, persistence, and system reconnaissance on infected hosts. It uses altered code signatures to bypass macOS security protocols. The loader checks for existing malware versions, compares MD5 hash values, and downloads updates if necessary, potentially serving as an update mechanism or integrity check. The latest variant uses trojanized helper applications instead of older Dylib injection techniques, aiming to evade detection while maintaining similar tactics for persistence and communication.
• GreyNoise has identified a new variant of a scraper botnet, primarily concentrated in Taiwan, which is detectable through unique behavioral fingerprints using JA4+ signatures. This botnet operates with a simple user-agent string, "Hello-World/1.0," and exhibits a traffic pattern characterized by repeated GET requests over ports 80-85, involving over 3,600 unique IPs globally. Notably, 54% of the botnet's infrastructure originates from Taiwanese networks, followed by Japan, Bulgaria, and France. This geographical concentration suggests potential compromises in local technologies or shared vulnerabilities among users. The analysis reveals that a significant portion of the detected IPs is classified as malicious or suspicious.
• Researchers have uncovered critical vulnerabilities in the BlueSDK Bluetooth stack, potentially exposing millions of vehicles to remote hacking. These flaws enable attackers to execute remote code on car infotainment systems, allowing them to track vehicle locations, record audio from inside the car, and access phonebook data. The vulnerabilities can be exploited through a method known as the PerfektBlue attack, which has been demonstrated on recent models from manufacturers like Mercedes-Benz, Skoda, and Volkswagen. Vulnerabilities include Use-After-Free (CVE-2024-45434), improper validation (CVE-2024-45431), incorrect function termination (CVE-2024-45433), and incorrect function parameters (CVE-2024-45432).
• An Iranian ransomware-as-a-service group, linked to Tehran's Pioneer Kitten, has resurfaced after a five-year hiatus, offering affiliates 80% profits for targeting U.S. and Israeli organizations. The updated malware, Pay2Key.I2P, incorporates Mimic ransomware capabilities and operates via the I2P network for anonymity. The group emphasizes anonymity to bypass ceasefire restrictions and continues cyberattacks despite geopolitical tensions. The malware was updated to target Linux systems, further incentivizing attacks against U.S. and Israeli targets.
• Researchers have developed a novel Android exploit called TapTrap, which uses invisible UI animations to bypass permissions and trick users into performing risky actions. TapTrap works by launching a transparent activity over a malicious app, creating a visual mismatch between what users see and the actions registered by the system. The exploit leverages custom low-opacity animations to make risky prompts nearly invisible, increasing the likelihood of accidental user interaction. TapTrap remains unmitigated in Android 15 and 16, exposing devices unless animations are disabled via developer options or accessibility settings. 
• A new spyware called Batavia has been targeting Russian industrial enterprises via phishing emails since July 2024, intensifying in early 2025. The phishing emails contain links disguised as contract attachments, downloading a malicious Visual Basic Encoded script (.VBE) file that profiles the system and sends data to a C2 server. The second stage deploys Delphi-based malware, which displays fake contracts while collecting system logs, documents, and screenshots, exfiltrating data to a separate server. The third-stage payload, 'javav.exe,' expands data collection to include additional file types, adds a startup shortcut for persistence, and potentially leads to a fourth payload ('windowsmsg.exe').
• BERT is a newly emerged ransomware group targeting Windows and Linux platforms, with confirmed victims primarily in healthcare, technology, and event services across Asia, Europe, and the U.S. BERT employs PowerShell-based loaders and privilege escalation techniques to execute concurrent file encryption. The group’s Windows variant features straightforward code that terminates critical processes and encrypts files using AES, while the Linux variant operates with up to 50 threads for rapid encryption and can forcibly shut down ESXi virtual machines to hinder recovery efforts. BERT ransomware group may have derived code from REvil and Babuk ransomware, showcasing overlaps in tactics and tools.