A newly identified threat actor, Water Curse, is exploiting GitHub to deliver weaponized repositories containing multistage malware. The group has been linked to at least 76 GitHub accounts, targeting cybersecurity professionals, game developers, and DevOps teams. Their malware enables data exfiltration, remote access, and long-term persistence on infected systems. The attack begins with trojanized open-source tools, progresses through complex infection chains using obfuscated scripts, and culminates in extensive system reconnaissance and data theft. Water Curse employs anti-debugging techniques, privilege escalation methods, and persistence mechanisms to maintain control over affected systems. The campaign poses a significant supply chain risk, especially to those relying on open-source tooling from GitHub.
Malicious PyPI Package Masquerades as Chimera Module to Steal AWS, CI/CD, and macOS Data
Source: https://thehackernews.com/2025/06/malicious-pypi-package-masquerades-as.html
A recent leak from I-SOON, a Chinese IT and cybersecurity company, has revealed connections to several state-sponsored cyber groups including RedAlpha, RedHotel, and Poison Carp. The leak exposes a sophisticated espionage network involving the theft of communications data for individual tracking. Analysis confirms operational and organizational ties between I-SOON and these groups, highlighting I-SOON's role as a digital quartermaster providing shared cyber capabilities in China's aggressive cyber ecosystem. Despite the leak, I-SOON is expected to continue operations with minor adjustments. The revelation enhances understanding of Chinese cyber espionage and may impact future US legal actions against I-SOON operatives.
Influencing LLM Output using logprobs and Token Distribution
Source: https://blog.sicuranext.com/influencing-llm-output-using-logprobs-and-token-distribution/
Visual Studio 17.8 Goes End-of-Life on July 8th
Source: https://www.lansweeper.com/blog/eol/visual-studio-end-of-life/?utm_source=reddit&utm_medium=social&utm_campaign=ls-global-end-of-life-2025&utm_content=visual-studio
SmartAttack uses smartwatches to steal data from air-gapped systems
Source: https://www.bleepingcomputer.com/news/security/smartattack-uses-smartwatches-to-steal-data-from-air-gapped-systems/
June 2025 Patch Tuesday: Microsoft Fixes 66 Bugs, Including Active 0-Day
Source: https://hackread.com/june-2025-patch-tuesday-microsoft-bugs-active-0-day/
OpenAI Shuts Down 10 Malicious ChatGPT AI Ops Linked to China, Russia, Iran and North Korea
Source: https://hackread.com/openai-shuts-down-ai-ops-china-russia-iran-nkorea/
Rare Werewolf APT Uses Legitimate Software in Attacks on Hundreds of Russian Enterprises
Source: https://thehackernews.com/2025/06/rare-werewolf-apt-uses-legitimate.html
APT41, a sophisticated Chinese state-sponsored threat actor, blends cyber espionage with cybercrime tactics. They target various sectors globally, including healthcare, telecom, and government entities. Recently, APT41 was observed using Google Calendar for malware command-and-control on a Taiwanese government website. Their attack chain involves spear-phishing emails, malicious ZIP archives, and a three-module malware system called ToughProgress. This malware uses stealthy techniques like in-memory execution, encryption, and process hollowing to evade detection. The unique aspect of ToughProgress is its use of Google Calendar events for covert data exchange, creating a stealthy communication channel for remote command execution and data exfiltration.
