A large cybercrime campaign has been observed involving multiple fraudulent websites promoted through Google advertising. The campaign aims to trick users into downloading and installing a trojanized PDF editor containing the TamperedChef information-stealing malware. The malware harvests sensitive data, including credentials and web cookies. The campaign began on June 26, 2025, with the PDF editor initially appearing harmless but later activating malicious capabilities. The threat actor used Google advertising to promote the PDF editor, with at least 5 different campaign IDs observed. The malware's activation occurred 56 days after the campaign's start, coinciding with a typical Google ad campaign duration. The threat actor has a history of distributing malicious code disguised as free utility tools, and this campaign has successfully affected several European organizations.
UK, US and Allies Blame Three Chinese Tech Firms for Global Cyberattacks
Source: https://hackread.com/uk-us-blame-3-chinese-tech-firms-global-cyberattacks/
Check Point Research uncovered an ongoing campaign by the Silver Fox APT group exploiting a previously unknown vulnerable driver to evade endpoint protection. The attackers used a Microsoft-signed WatchDog Antimalware driver to terminate protected processes on fully updated Windows systems. A dual-driver strategy ensured compatibility across Windows versions. Following disclosure, the vendor released a patched driver, but attackers quickly adapted by modifying it to bypass blocklists while preserving its valid signature. The campaign delivered ValleyRAT as the final payload, demonstrating sophisticated evasion techniques and highlighting the growing trend of weaponizing signed-but-vulnerable drivers to bypass security measures.
Global Salt Typhoon hacking campaigns linked to Chinese tech firms
Source: https://www.bleepingcomputer.com/news/security/global-salt-typhoon-hacking-campaigns-linked-to-chinese-tech-firms/
IT system supplier cyberattack impacts 200 municipalities in Sweden
Source: https://www.bleepingcomputer.com/news/security/it-system-supplier-cyberattack-impacts-200-municipalities-in-sweden/
A sophisticated phishing campaign called ZipLine is targeting U.S.manufacturing companies, especially those in supply chain-critical sectors. The attackers initiate contact through company contact forms, leading to weeks-long email conversations before delivering malicious payloads. They use legitimate-looking business interactions and AI-related pretexts to build trust. The campaign employs a custom malware called MixShell, which uses DNS TXT tunneling for command and control. The attackers utilize domains matching registered U.S.companies and maintain similar template websites across multiple domains. The campaign primarily targets U.S.-based organizations in industrial manufacturing, hardware, semiconductors, and other sectors, affecting both large enterprises and smaller businesses.
DSLRoot, a residential proxy provider, operates a network of hardware devices deployed in U.S.homes across at least 20 states. The network is managed by a Belarusian national with ties to both Minsk and Moscow. Unlike typical proxy services, DSLRoot uses dedicated hardware in American residences, creating persistent access to U.S.home networks. The company's custom software enables remote management of consumer modems and Android devices, allowing for IP address rotation and connectivity control. The network operates without authentication, permitting anonymous traffic routing through U.S.residential IPs. The operator also runs related services, including virtual credit card issuance and company formation, targeting both English and Russian-speaking markets. The discovery raises concerns about foreign-controlled infrastructure in sensitive locations, including military homes.
Healthcare Services Group data breach impacts 624,000 people
Source: https://www.bleepingcomputer.com/news/security/healthcare-services-group-data-breach-impacts-624-000-people/
Blind Eagle’s Five Clusters Target Colombia Using RATs, Phishing Lures, and Dynamic DNS Infra
Source: https://thehackernews.com/2025/08/blind-eagles-five-clusters-target.html
China linked Silk Typhoon targeted diplomats by hijacking web traffic
Source: https://securityaffairs.com/181584/security/china-linked-silk-typhoon-targeted-diplomats-by-hijacking-web-traffic.html
A sophisticated task scam cluster has been discovered, exploiting major brands like Delta Airlines, AMC Theatres, and Universal Studios. The scam uses API-driven templates and cryptocurrency payments, with over $1 million in attributable transactions. Victims are lured into 'earning' money by completing tasks such as booking flights. The scam requires initial cryptocurrency deposits to become a 'VIP' member. The infrastructure utilizes domains registered through Dominet, Alibaba Cloud's registrar, with a distinct registrant pattern. Multiple wallet addresses across different cryptocurrencies have been identified. The scam's configuration files reveal its adaptability across various brands and industries.
ShadowCaptcha Exploits WordPress Sites to Spread Ransomware, Info Stealers, and Crypto Miners
Source: https://thehackernews.com/2025/08/shadowcaptcha-exploits-wordpress-sites.html
MixShell Malware Delivered via Contact Forms Targets U.S. Supply Chain Manufacturers
Source: https://thehackernews.com/2025/08/mixshell-malware-delivered-via-contact.html
Nevada State Offices Halt Services After Cyber Incident
Source: https://www.databreachtoday.co.uk/nevada-state-offices-halt-services-after-cyber-incident-a-29290
A sophisticated phishing campaign has been identified, utilizing carefully crafted emails to deliver malicious URLs linked to convincing phishing pages. These pages entice recipients to download JavaScript files that act as droppers for UpCrypter, a malware that ultimately deploys various remote access tools (RATs). The attack chain begins with obfuscated scripts redirecting victims to spoofed sites personalized with the target's email domain. The campaign uses different lures, including voicemail-themed and purchase order-themed emails. UpCrypter, the central loader framework, stages and deploys multiple RATs, including PureHVNC, DCRat, and Babylon RAT. The malware employs anti-VM and anti-analysis techniques, downloads additional payloads, and establishes persistence. This campaign operates globally, affecting multiple industries, and demonstrates an adaptable threat delivery ecosystem capable of bypassing defenses and maintaining persistence across different environments.
