EvilAI Malware Masquerades as AI Tools to Infiltrate Global Organizations
Source: https://thehackernews.com/2025/09/evilai-malware-masquerades-as-ai-tools.html
For the latest discoveries in cyber research for the week of 29th September, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES Stellantis, Automotive maker giant which owns Citroën, FIAT, Jeep, Chrysler, and Peugeot, has suffered a data breach that resulted in exposure of North American customer contact information after attackers accessed a third-party […] The post 29th September – Threat Intelligence Report appeared first on Check Point Research .
FullHunt 💜 Open-Source: 39,408 Exploits from 0day.today is Back Online
Source: https://fullhunt.io/blog/2025/09/28/fullhunt-releases-0day-today-archive.html
ArcaneDoor Threat Actor Resurfaces in Continued Attacks Against Cisco
Source: https://www.infosecurity-magazine.com/news/arcanedoor-attacks-against-cisco/
Microsoft warns of new XCSSET macOS malware variant targeting Xcode devs
Source: https://www.bleepingcomputer.com/news/security/microsoft-warns-of-new-xcsset-macos-malware-variant-targeting-xcode-devs/
This analysis delves into the operations of DeceptiveDevelopment, a North Korea-aligned threat actor, and its connections to North Korean IT worker campaigns. The group targets software developers across major systems, focusing on cryptocurrency and Web3 projects. They use social engineering techniques like fake job offers and the ClickFix method to deliver malware. Their toolset includes multiplatform malware such as BeaverTail, InvisibleFerret, WeaselStore, and TsunamiKit. The group shows links to other North Korean cyber operations through shared malware like Tropidoor and AkdoorTea. The analysis also explores the activities of North Korean IT workers, who use stolen identities and AI-generated content to secure remote jobs, highlighting the interconnected nature of these cyber threats.
A new variant of the XCSSET malware, designed to infect Xcode projects, has been identified with key changes in browser targeting, clipboard hijacking, and persistence mechanisms. This variant employs sophisticated encryption and obfuscation techniques, uses run-only compiled AppleScripts for stealthy execution, and expands its data exfiltration capabilities to include Firefox browser data. It also adds another persistence mechanism through LaunchDaemon entries. The malware features a submodule for monitoring the clipboard and substituting wallet addresses. The infection chain consists of four stages, with modifications to the boot function and introduction of new modules. Changes include additional checks for Firefox browser, modified logic for Telegram existence check, and new info-stealer modules targeting Firefox data.
How secure are passkeys, really? Here's what you need to know
Source: https://www.bleepingcomputer.com/news/security/how-secure-are-passkeys-really-heres-what-you-need-to-know/
A self-propagating malware called Shai-Hulud has infected over 500 npm packages, including one with over two million weekly downloads. The worm steals sensitive data, exposes private repositories, and hijacks victim credentials to spread further. It executes when an infected package is installed, collecting system information and GitHub tokens. The malware exfiltrates secrets from repositories, migrates private repositories to public, and self-replicates by infecting the victim's most downloaded packages. Notable infected libraries include those from CrowdStrike. The infection started with ngx-bootstrap version 18.1.4. Prevention measures include using specialized solutions for monitoring open-source components and implementing comprehensive security systems.
Chinese Hackers RedNovember Target Global Governments Using Pantegana and Cobalt Strike
Source: https://thehackernews.com/2025/09/chinese-hackers-rednovember-target.html
Python Software Foundation Warns of Fake PyPI Login Site Stealing User Credentials
Source: https://hackread.com/psf-warn-fake-pypi-login-site-steal-credentials/
RedNovember, a Chinese state-sponsored threat group, has expanded its cyber-espionage activities globally. The group targets high-profile government, intergovernmental, and private sector organizations, focusing on defense, aerospace, and technology sectors. It uses the Go-based backdoor Pantegana and Cobalt Strike for intrusions, exploiting vulnerabilities in perimeter appliances. RedNovember's tactics include combining weaponized proof-of-concept exploits with open-source tools, allowing for scalable operations and attribution obfuscation. The group has shown particular interest in targets across the US, Taiwan, South Korea, and Panama, often aligning its activities with geopolitical events and Chinese strategic interests.
Moonlock Lab researchers have spotted a new macOS malware campaign that leverages **malvertising + fake social media profiles** to distribute malicious apps. Once installed, the malware exfiltrates sensitive data and can be updated remotely with new modules. This trend shows that macOS is no longer “low priority” for attackers – they’re actively adapting Windows-style tactics for Apple’s ecosystem.
New YiBackdoor Malware Shares Major Code Overlaps with IcedID and Latrodectus
Source: https://thehackernews.com/2025/09/new-yibackdoor-malware-shares-major.html
A campaign targeting telecommunications and manufacturing sectors in Central and South Asian countries has been discovered, delivering a new PlugX variant. The campaign, active since 2022, shows overlaps with RainyDay and Turian backdoors, including the abuse of legitimate applications for DLL sideloading and shared encryption methods. The new PlugX variant's configuration format resembles that of RainyDay, suggesting attribution to Naikon. Analysis of victimology and technical implementation indicates a potential connection between Naikon and BackdoorDiplomacy, possibly sourcing tools from the same vendor. The malware families use similar infection chains, loaders, and shellcode structures, with shared RC4 keys for payload decryption. This campaign highlights the evolving tactics of Chinese-speaking threat actors and the potential convergence of previously distinct groups.
Libraesva ESG issues emergency fix for bug exploited by state hackers
Source: https://www.bleepingcomputer.com/news/security/libraesva-esg-issues-emergency-fix-for-bug-exploited-by-state-hackers/
