Meet SpamGPT and MatrixPDF, New AI Toolkits Driving Malware and Phishing Attacks
Source: https://hackread.com/spamgpt-matrixpdf-ai-toolkits-malware-attacks/
Microsoft warns of new XCSSET macOS malware variant targeting Xcode devs
Source: https://www.bleepingcomputer.com/news/security/microsoft-warns-of-new-xcsset-macos-malware-variant-targeting-xcode-devs/
A new variant of the XCSSET malware, designed to infect Xcode projects, has been identified with key changes in browser targeting, clipboard hijacking, and persistence mechanisms. This variant employs sophisticated encryption and obfuscation techniques, uses run-only compiled AppleScripts for stealthy execution, and expands its data exfiltration capabilities to include Firefox browser data. It also adds another persistence mechanism through LaunchDaemon entries. The malware features a submodule for monitoring the clipboard and substituting wallet addresses. The infection chain consists of four stages, with modifications to the boot function and introduction of new modules. Changes include additional checks for Firefox browser, modified logic for Telegram existence check, and new info-stealer modules targeting Firefox data.
Darktrace uncovered a sophisticated cybercrime-as-a-service campaign utilizing Python and Go-based malware, Docker containerization, and a full operator UI. The attack combines DDoS techniques with targeted exploitation, featuring HTTP/2 rapid reset, Cloudflare UAM bypass, and large-scale HTTP floods. The infrastructure resembles a DDoS-as-a-service platform, mirroring legitimate cloud-native applications in design and usability. Initial access is gained through exposed Docker daemons on AWS EC2, with a multi-stage deployment process. The malware uses a Go-based RAT with RESTful communication and includes advanced evasion techniques. The campaign highlights the need for defenders to monitor cloud workloads, container orchestration, and API activity to counter evolving threats.
For the latest discoveries in cyber research for the week of 22nd September, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES Several major European airports including Heathrow, Berlin, Brussels, Dublin, and Cork have experienced a cyber-attack, resulting in disruptions to electronic check-in and baggage drop systems using Collins Aerospace’s MUSE software. The incident […] The post 22nd September – Threat Intelligence Report appeared first on Check Point Research .
17,500 Phishing Domains Target 316 Brands Across 74 Countries in Global PhaaS Surge
Source: https://thehackernews.com/2025/09/17500-phishing-domains-target-316.html
40% of Corporate Client Devices Still Run Windows 10
Source: https://www.lansweeper.com/blog/eol/are-you-prepared-for-windows-10-end-of-life/?utm_source=reddit&utm_medium=social&utm_campaign=ls-global-end-of-life-2025&utm_content=windows10
A widespread software supply chain attack targeting the Node Package Manager (npm) ecosystem has been discovered, involving a novel self-replicating worm called "Shai-Hulud". The worm has compromised over 180 software packages, including widely used libraries. It operates by harvesting credentials, exfiltrating data, and automatically propagating itself through compromised developer accounts. The attack likely originated from a phishing campaign spoofing npm. The malware scans for sensitive credentials, including npm tokens and cloud service API keys, and publicly exposes them on GitHub. This attack represents a significant evolution in supply chain threats, potentially leading to cloud service compromises, data theft, and lateral movement within networks.
RaccoonO365 Phishing Network Dismantled as Microsoft, Cloudflare Take Down 338 Domains
Source: https://thehackernews.com/2025/09/raccoono365-phishing-network-shut-down.html
A self-replicating worm named Shai-hulud has been detected on the npm registry, spreading through compromised developer accounts and injecting malicious code into legitimate packages. The worm steals cloud service tokens, primarily targeting npm, GitHub, AWS, and GCP. It also installs Trufflehog to detect additional secrets. The compromised packages include popular ones with millions of weekly downloads. The worm's functionality includes auto-spreading, token theft, and exposing private repositories. Similarities with previous npm compromises have been noted. The impact is significant, affecting numerous developers and organizations across various industries.
40 npm Packages Compromised in Supply Chain Attack Using bundle.js to Steal Credentials
Source: https://thehackernews.com/2025/09/40-npm-packages-compromised-in-supply.html
Two cyber criminal groups, UNC6040 and UNC6395, are targeting organizations' Salesforce platforms for data theft and extortion. UNC6040 uses social engineering, particularly voice phishing, to gain access to Salesforce accounts. They trick employees into granting access or sharing credentials, then use API queries or malicious connected apps to exfiltrate data. UNC6395 exploits compromised OAuth tokens for the Salesloft Drift application to access Salesforce instances. Both groups have been observed exfiltrating large volumes of customer data. Victims of UNC6040 have received extortion emails demanding cryptocurrency payments to prevent data publication. The FBI has provided numerous IP addresses and other indicators of compromise associated with these groups, along with recommended mitigations to enhance security and prevent such attacks.
New VoidProxy Phishing Service Bypasses MFA on Microsoft and Google Accounts
Source: https://hackread.com/voidproxy-phishing-service-bypasses-mfa-microsoft-google/
