Malware Injected into 5 npm Packages After Maintainer Tokens Stolen in Phishing Attack
Source: https://thehackernews.com/2025/07/malware-injected-into-6-npm-packages.html
Copy-Paste Pitfalls: Revealing the AppLocker Bypass Risks in The Suggested Block-list Policy
Source: https://www.varonis.com/blog/applocker-bypass-risks
IPv6 security has recently become a pressing issue. In this article, I will discuss attacks on IPv6 and methods of protection.
This article discusses attacks on IPv6 using passive NDP sniffing, RA spoofing, RDNSS spoofing, and DHCPv6 snooping. It also discusses methods of protection against these attacks.
Arch Linux pulls AUR packages that installed Chaos RAT malware
Source: https://www.bleepingcomputer.com/news/security/arch-linux-pulls-aur-packages-that-installed-chaos-rat-malware/
Years Long Linux Cryptominer Spotted Using Legit Sites to Spread Malware
Source: https://hackread.com/linux-cryptominer-using-legit-sites-to-spread-malware/
Malware campaigns exploiting vulnerabilities in Ivanti Connect Secure devices, specifically CVE-2025-0282, have been active from December 2024 through July 2025. Attackers use MDifyLoader to side-load Cobalt Strike Beacon DLLs, along with vshell RAT and Fscan network scanner, to maintain persistent access. Initial access is gained via brute-force attacks, direct exploitation, and stolen credentials. The threat actors employ advanced lateral movement, persistence mechanisms such as domain account creation and malware service/task registration, and evasion techniques including use of legitimate files and ETW bypasses. European organizations using Ivanti Connect Secure devices are particularly targeted. The threat is assessed as medium severity due to moderate impact and exploitation complexity. No public exploits are currently available.
This comprehensive analysis covers cyber threats and security issues affecting financial companies in South Korea and globally. It examines malware and phishing cases targeting the financial sector, including the top 10 malware strains and leaked Korean account statistics on Telegram. The report delves into dark web threats, focusing on credit card data breaches, financial institution database leaks, and ransomware attacks. Notable incidents include the M*** digital payment platform data breach in Indonesia, affecting 44 million users, and the Everest ransomware group's attack on J*** Bank in Jordan, compromising 11.7 GB of internal data. The analysis emphasizes the need for enhanced security measures, including real-time protection systems, account takeover detection, and strengthened internal defense mechanisms in the financial industry.
UNG0002, an espionage-focused threat group, has been conducting campaigns across Asian jurisdictions including China, Hong Kong, and Pakistan. The group employs sophisticated multi-stage attacks using LNK files, VBScript, and custom RAT implants. Their operations span two major campaigns: Operation Cobalt Whisper and Operation AmberMist, targeting various sectors such as defense, aviation, gaming, and academia. UNG0002 utilizes social engineering techniques like ClickFix and abuses DLL sideloading to evade detection. The group demonstrates high adaptability, evolving from using Cobalt Strike to developing custom implants like Shadow RAT and INET RAT. Attribution challenges persist, but the group is assessed to originate from South-East Asia with a focus on espionage activities.
AsyncRAT, an open-source remote access trojan, has spawned numerous forks since its 2019 release, becoming a cornerstone of modern malware. This analysis maps out the relationships among AsyncRAT variants, focusing on prominent forks like DcRat and VenomRAT, as well as lesser-known versions. The research explores the evolution of these forks, their unique features, and the methods used to identify them. It also delves into exotic variants with specialized plugins, such as NonEuclid RAT's jump scare and malware spreader functionalities. The proliferation of AsyncRAT forks highlights the risks associated with open-source malware frameworks and the need for proactive detection strategies.
Deriv security team recently uncovered a macOS malware campaign targeting developers - using a fake Homebrew install script, a malicious Google ad, and a spoofed GitHub page.
Broken down in the blog
Worth a read.
AsyncRAT's Open-Source Code Sparks Surge in Dangerous Malware Variants Across the Globe
Source: https://thehackernews.com/2025/07/asyncrats-open-source-code-sparks-surge.html
AMD Warns of Transient Scheduler Attacks Affecting Wide Range of Chipsets
Source: https://cybersecuritynews.com/amd-warns-of-transient-scheduler-attacks/
The report discusses the evolving landscape of vulnerability reporting and management, highlighting concerns about the long-term stability of the CVE system. It notes the emergence of competing projects and the potential fragmentation of vulnerability data sources. The first half of 2025 has seen an increase in CVE publications and Known Exploited Vulnerabilities (KEVs), with a growing proportion affecting network-related equipment. The report emphasizes the importance of continuous tracking and patching of vulnerabilities. It also covers Microsoft's July 2025 security update, addressing 132 vulnerabilities, including critical remote code execution issues. The report stresses the need for prompt application of patches to mitigate potential risks.
Atomic macOS Stealer (AMOS) has received a major update, now including an embedded backdoor for persistent access to victims' Macs. This upgrade allows attackers to maintain control, run remote tasks, and potentially gain full system compromise. The Russia-affiliated AMOS threat group has expanded its capabilities, mimicking North Korean attack strategies. The malware is distributed through fake software websites and spear-phishing campaigns. It uses a trojanized DMG file to bypass Gatekeeper, installs persistence via LaunchDaemon, and communicates with command-and-control servers. The backdoor functionality significantly increases the risk to victims, turning one-time breaches into long-term compromises. AMOS campaigns have already affected over 120 countries, with the potential to access thousands of Mac devices worldwide.
A new variant of macOS.ZuRu malware has been discovered, targeting users through a trojanized version of the Termius app. This backdoor, initially noted in 2021, now uses a modified Khepri C2 framework for post-infection operations. The malware is delivered via a .dmg disk image containing a hacked version of Termius.app. It adds two executables to the embedded Termius Helper.app and uses a new method to trojanize legitimate applications. The malware installs persistence via a LaunchDaemon and includes an md5 updater mechanism. The payload obtained from the C2 is a modified Khepri beacon with capabilities for file transfer, system reconnaissance, and command execution. The threat actor continues to target developers and IT professionals, adapting their techniques to evade detection.
