The Batavia spyware campaign, active since July 2024, targets Russian industrial enterprises through phishing emails containing malicious links disguised as contract documents. The infection process involves three stages: a VBS script downloader, the WebView.exe spyware, and the javav.exe module. These components collect and exfiltrate various types of files, including system logs, office documents, and screenshots. The malware employs techniques to avoid duplicate file uploads and can download additional payloads. Over 100 users across dozens of organizations have been affected. The campaign highlights the importance of comprehensive cybersecurity measures and employee training to mitigate such threats.
A sophisticated SEO spam infection was discovered utilizing a cleverly crafted plugin that mimics the infected domain's name to avoid detection. The malware injects spam content into websites, targeting search engine rankings, and only activates under specific conditions like when a crawler is detected. The plugin's code is heavily obfuscated, using thousands of variable assignments broken into small parts. When decoded, the malware downloads files from external hosts, fetches remote content, and delivers custom spam to search engines while appearing normal to regular users. The attacker's domain, mag1cw0rld[.]com, is used for remote control. This technique allows the spam to remain undetected for longer periods, making it challenging to identify with traditional tools.
Bruce, the mechanical shark from Jaws, reflects on his role in the iconic film 50 years later. He shares insights on the challenges faced during filming due to unpredictable ocean conditions, drawing parallels to cybersecurity. Bruce emphasizes the importance of overpreparing, maintaining perspective, and having strong last-line defenses. The article then transitions to discussing Cisco Talos' enhanced email threat detection engine, addressing brand impersonation tactics using PDF payloads in phishing attacks. It highlights the increasing sophistication of these attacks and provides advice on staying vigilant against such threats.
NightEagle APT Exploits Microsoft Exchange Flaw to Target China's Military and Tech Sectors
Source: https://thehackernews.com/2025/07/nighteagle-apt-exploits-microsoft.html
China-linked group Houken hit French organizations using zero-days
Source: https://securityaffairs.com/179602/apt/china-linked-group-houken-hit-french-organizations-using-zero-days.html
China Linked Houken Group Breaches Top French Systems with Ivanti Zero Days
Source: https://hackread.com/china-houken-hackers-breach-french-ivanti-zero-days/
This analysis reveals a network of Pakistani freelancers creating websites for cracked software distribution, potentially linked to stealer malware campaigns. The report identifies specific email addresses, domain names, and hosting providers associated with these activities. It highlights the use of pay-per-install models and the involvement of freelance web developers in building and promoting cracking websites. The analysis also touches on Pakistan's cybersecurity landscape, including closer ties with China and Russia, and the challenges in prosecuting cybercriminals due to the lack of extradition treaties. The report provides actionable intelligence, including numerous indicators of compromise and recommendations for organizations to protect against these threats.
New FileFix attack runs JScript while bypassing Windows MoTW alerts
Source: https://www.bleepingcomputer.com/news/security/new-filefix-attack-runs-jscript-while-bypassing-windows-motw-alerts/
We broke Chrome’s AppBound cookie encryption used in enterprise environments. Using timing-based attacks against the WebView lifecycle, we were able to recover encryption keys and decrypt secure cookies — no root or sandbox escape required. This affects managed Android profiles using MDM and AppBound mode.
A sophisticated phishing campaign has targeted over 2,000 individuals by exploiting the theme of official Social Security statements. Cybercriminals used a convincing phishing lure, mimicking legitimate communication from the Social Security Administration. The attack involved a URL directing victims to a phishing page hosted on Amazon Web Services, enhancing its perceived legitimacy. Users were tricked into downloading and executing malware, which is a .NET application loader that installs ScreenConnect, establishing a silent connection to the attacker's command-and-control server. The malware's behavior includes loading additional files and executing a primary backdoor component. The campaign's impact is significant, with a large percentage of targeted users unknowingly installing the malware.
When Your Login Page Becomes the Frontline: Lessons from a Real-World DDoS Attack
Source: https://www.cloud-iam.com/post/our-resilience-against-cyber-attacks
New FileFix attack weaponizes Windows File Explorer for stealthy commands
Source: https://www.bleepingcomputer.com/news/security/filefix-attack-weaponizes-windows-file-explorer-for-stealthy-powershell-commands/
FileFix – New Alternative to ClickFix Attack
Source: https://www.mobile-hacker.com/2025/06/24/introducing-filefix-a-new-alternative-to-clickfix-attacks
APT36, a Pakistan-based cyber espionage group, is actively targeting Indian defense personnel through sophisticated phishing campaigns. The group disseminates emails with malicious PDF attachments resembling official government documents. When opened, these PDFs display a blurred background and a button mimicking the National Informatics Centre login interface. Clicking the button redirects users to a fraudulent URL and initiates the download of a ZIP archive containing a malicious executable disguised as a legitimate application. This campaign highlights APT36's focus on credential theft and long-term infiltration of Indian defense networks, emphasizing the need for robust email security, user awareness programs, and proactive threat detection systems.
Cybercriminals are exploiting Discord's invite system and content delivery features to distribute malware and steal sensitive data. They use fake invite links, expired codes, and vanity URLs to redirect users to malicious servers. The attack chain involves a sophisticated combination of social engineering, multi-stage loaders, and time-based evasion tactics. Victims are tricked into authorizing a fake bot, which leads to the deployment of AsyncRAT and a customized Skuld Stealer. These malware variants target browser credentials, Discord tokens, and cryptocurrency wallets. The campaign uses trusted platforms like GitHub and Bitbucket to host encrypted payloads, and employs advanced techniques to bypass security measures and maintain persistence.
A phishing campaign has been identified that exploits Vercel, a legitimate frontend hosting platform, to distribute a malicious version of LogMeIn. Cybercriminals send phishing emails with links to a malicious page on Vercel, impersonating an Adobe PDF viewer and prompting users to download a disguised executable. Once executed, the malware installs and connects to a LogMeIn server, allowing remote access and control of the compromised machine. Over 28 distinct campaigns targeting more than 1,271 users have been observed in the past two months. The technique's effectiveness stems from the use of a legitimate platform, a genuine remote access tool, and social engineering tactics. Recommendations include monitoring suspicious Vercel subdomains, educating employees about fake support scams, and implementing strict controls for remote access software installations.
