The UNC1151 threat actor is conducting a spearphishing campaign exploiting a critical vulnerability (CVE-2024-42009) in the Roundcube webmail client. Malicious JavaScript embedded in phishing emails installs a stealthy Service Worker in victims' browsers upon opening the email, intercepting login credentials and exfiltrating them without further user interaction. A second vulnerability (CVE-2025-49113) may be chained to increase persistence and impact. Stolen credentials enable attackers to access mailboxes, harvest address books, and propagate phishing internally, facilitating lateral movement. The campaign primarily targets Polish organizations but also threatens neighboring Central European countries with significant Roundcube deployments. Organizations are urged to patch vulnerabilities, monitor for unusual Service Worker activity, enforce multi-factor authentication, and enhance email filtering to mitigate risks.
A hacking group with alleged ties to Vietnam has been exploiting social media ads promoting AI video generators to distribute malware since mid-2024. The campaign, discovered by Mandiant, uses fake websites mimicking legitimate AI tools to deploy payloads including Python-based infostealers and backdoors. The group, tracked as UNC6032, has reached millions of users through Facebook and LinkedIn ads, primarily targeting EU countries and the US. The malware distributed includes STARKVEIL, XWORM, FROSTRIFT, and GRIMPULL, designed for information theft and capable of downloading additional plugins. The attackers employ a multi-payload mechanism for resilience against detection. Users are advised to exercise caution when engaging with AI tools and verify website legitimacy.
A spoofed Bitdefender website is being used in a malicious campaign to distribute VenomRAT, StormKitty, and SilentTrinity malware. The fake site mimics Bitdefender's legitimate antivirus download page but redirects visitors to malicious files hosted on Bitbucket and Amazon S3. The malware package allows attackers to gain remote access, gather credentials, and exfiltrate data while remaining hidden. The campaign also includes related phishing domains impersonating banks and IT services. The use of open-source malware frameworks demonstrates the increasing accessibility of cybercrime tools, enabling attackers to quickly assemble effective malware kits. Researchers emphasize the importance of verifying download sources and remaining cautious with email links and attachments.
Threat actors are exploiting user fatigue with anti-spam mechanisms through a technique called ClickFix. This method involves compromising websites and embedding fraudulent CAPTCHA images, which, when solved by unsuspecting users, lead to the execution of malicious code. The attack chain typically includes PowerShell commands and the use of legitimate Windows tools to download and execute additional payloads. Common malware delivered through this technique includes Lumma Stealer, NetSupport RAT, and SectopRAT. The success of ClickFix relies heavily on social engineering and user interaction, making user education and awareness crucial in mitigating these attacks. Recommendations include training users to recognize suspicious requests, restricting PowerShell execution, and deploying advanced EDR solutions.
Iranian cyber actors have been identified impersonating a German model agency in a suspected espionage operation. The attackers created a fraudulent website mimicking the authentic agency's branding and content, which triggers obfuscated JavaScript to capture detailed visitor information. This data collection enables selective targeting. The website also replaces a real model's profile with a fake one, likely for social engineering purposes. The operation's complexity and methods suggest involvement of an Iranian threat group, possibly overlapping with Agent Serpens (APT35 or Charming Kitten). This group is known for targeting Iranian dissidents, journalists, and activists abroad. The fake website includes sophisticated data collection routines and dynamic profile alterations, indicating an ongoing and evolving threat.
A series of attacks targeting poorly managed MS-SQL servers have been identified, involving the installation of Ammyy Admin, a remote control tool. The attackers exploit vulnerable servers, execute commands to gather system information, and use WGet to install additional malware. The installed malware includes Ammyy Admin (mscorsvw.exe), its settings file (settings3.bin), and PetitPotato (p.ax). The attackers utilize an old version of Ammyy Admin (v3.10) and employ known exploitation methods to gain remote control. They also use PetitPotato for privilege escalation, adding new users and activating RDP services. To prevent such attacks, administrators are advised to use strong passwords, update software regularly, and implement security measures like firewalls.
