ShadowCaptcha Exploits WordPress Sites to Spread Ransomware, Info Stealers, and Crypto Miners
Source: https://thehackernews.com/2025/08/shadowcaptcha-exploits-wordpress-sites.html
MixShell Malware Delivered via Contact Forms Targets U.S. Supply Chain Manufacturers
Source: https://thehackernews.com/2025/08/mixshell-malware-delivered-via-contact.html
Nevada State Offices Halt Services After Cyber Incident
Source: https://www.databreachtoday.co.uk/nevada-state-offices-halt-services-after-cyber-incident-a-29290
A sophisticated phishing campaign has been identified, utilizing carefully crafted emails to deliver malicious URLs linked to convincing phishing pages. These pages entice recipients to download JavaScript files that act as droppers for UpCrypter, a malware that ultimately deploys various remote access tools (RATs). The attack chain begins with obfuscated scripts redirecting victims to spoofed sites personalized with the target's email domain. The campaign uses different lures, including voicemail-themed and purchase order-themed emails. UpCrypter, the central loader framework, stages and deploys multiple RATs, including PureHVNC, DCRat, and Babylon RAT. The malware employs anti-VM and anti-analysis techniques, downloads additional payloads, and establishes persistence. This campaign operates globally, affecting multiple industries, and demonstrates an adaptable threat delivery ecosystem capable of bypassing defenses and maintaining persistence across different environments.
A sophisticated cyber espionage campaign attributed to the PRC-nexus threat actor UNC6384 targeted diplomats in Southeast Asia and other global entities. The attack chain involved hijacking web traffic through a captive portal redirect to deliver malware disguised as software updates. The multi-stage attack utilized advanced social engineering, adversary-in-the-middle techniques, and evasion tactics. The malware payload, SOGU.SEC backdoor, was deployed through a digitally signed downloader (STATICPLUGIN) and a side-loaded DLL (CANONSTAGER). The campaign demonstrated the evolving capabilities of PRC-nexus threat actors, employing stealthy tactics to avoid detection and leveraging legitimate Windows features for malicious purposes.
Malicious apps with +19M installs removed from Google Play because spreading Anatsa banking trojan and other malware
Source: https://securityaffairs.com/181528/malware/malicious-apps-with-19m-installs-removed-from-google-play-because-spreading-anatsa-banking-trojan-and-other-malware.html
Auchan retailer data breach impacts hundreds of thousands of customers
Source: https://www.bleepingcomputer.com/news/security/auchan-retailer-data-breach-impacts-hundreds-of-thousands-of-customers/
Transparent Tribe Targets Indian Govt With Weaponized Desktop Shortcuts via Phishing
Source: https://thehackernews.com/2025/08/transparent-tribe-targets-indian-govt.html
A sophisticated Android backdoor named Android.Backdoor.916.origin is targeting Russian business representatives. The malware, disguised as an antivirus app called 'GuardCB', has extensive surveillance capabilities including intercepting calls, streaming camera footage, stealing data from messaging apps and browsers, and keylogging. Distributed via messenger apps, it requests numerous system permissions and connects to C2 servers for commands. The backdoor can transmit SMS messages, contact lists, call logs, location data, and captured audio/video streams. It uses Accessibility Service to log keystrokes and intercept content from specific apps like Telegram and Chrome. The malware is believed to be used for targeted attacks rather than mass distribution.
LAMEHUG, discovered on July 10, 2025, is the first known malware integrating large language model capabilities into its attack methodology. Attributed to APT28 (Fancy Bear) with moderate confidence, it targeted Ukrainian government officials through phishing emails containing malicious executables. The malware uses the LLM Qwen2.5-Coder-32B-Instruct via Hugging Face's API to generate dynamic attack commands. Multiple variants were identified, with different data exfiltration methods. The attack appears to be a proof-of-concept exploration of LLM integration in state-sponsored cyber operations, demonstrating sophisticated reconnaissance capabilities through AI-generated commands. This development signals a new era of AI-incorporated malware operations, posing challenges for traditional cybersecurity approaches.
IoT under siege: The return of the Mirai-based Gayfemboy Botnet
Source: https://securityaffairs.com/181480/cyber-crime/iot-under-siege-the-return-of-the-mirai-based-gayfemboy-botnet.html
