VulnHub

Email continues to be the main entry point for cyber attackers, with significant increases in various types of email threats. Malware delivered through email surged by over 130% year-over-year, while phishing scams rose by more than 20% and other scams increased by 30%. These alarming trends expose vulnerabilities across different industries, indicating that many security teams are still missing critical gaps in their defenses. As attackers increasingly exploit email for impersonation and account takeover, companies must reassess their email security strategies to better protect sensitive information and prevent breaches. The growing reliance on email as a communication tool makes it essential for organizations to prioritize security measures in this area.

A new social engineering attack called ClickFix is targeting the hospitality industry in Europe by using fake Windows Blue Screen of Death (BSOD) screens. This scheme tricks users into believing their systems have crashed, prompting them to manually compile and run malicious software. The attackers are specifically focusing on employees in hotels and related businesses, making this a significant threat to sensitive customer data and operational continuity. Companies in this sector need to raise awareness among staff and implement training to recognize such scams. The use of a familiar error screen is particularly deceptive, as it plays on users' fears of system failures, leading them to take harmful actions without realizing the risks.

A group of hackers known as UAC-0184, believed to be aligned with Russia, has been targeting Ukrainian military and government organizations by using the Viber messaging app. They are sending malicious ZIP files that likely contain malware designed for espionage. According to the 360 Threat Intelligence Center, these activities have been ongoing and are part of a broader strategy to gather intelligence on Ukraine's military operations. This incident highlights the ongoing cyber warfare between Russia and Ukraine, emphasizing the need for heightened security measures within government and military communications. As the conflict continues, the use of widely used messaging platforms for cyber attacks poses significant risks to sensitive information.

VVS Stealer is a new type of malware written in Python that specifically targets Discord users by stealing their credentials and tokens. Discovered by researchers at Palo Alto Networks, this malware has been available for purchase on Telegram since at least April 2025. The ease of access to this tool poses a significant risk to Discord users, as attackers can use stolen credentials to hijack accounts, potentially leading to further scams or unauthorized activities within the platform. This incident raises concerns about the security measures in place for popular communication tools like Discord, and users are urged to be vigilant about their account security. Protecting accounts with strong, unique passwords and enabling two-factor authentication can help mitigate some of the risks associated with such malware.

The latest Security Affairs Malware newsletter outlines several concerning cybersecurity incidents. Notably, the Evasive Panda APT group has been reported to poison DNS requests to deploy MgBot, a type of malware. Additionally, there is a spear-phishing campaign that targets U.S. and allied manufacturing and healthcare organizations by exploiting vulnerabilities in the npm registry. Furthermore, details have emerged about a supply chain incident involving EmEditor, where information-stealing malware has been distributed. These incidents demonstrate the ongoing threat posed by sophisticated cyber actors, particularly in sectors critical to national security and public health.

A new wave of the GlassWorm malware campaign is targeting macOS developers by distributing malicious extensions for Visual Studio Code and OpenVSX. These extensions contain trojanized versions of popular cryptocurrency wallet applications, which can compromise users' sensitive information and funds. Developers who install these malicious extensions may unknowingly expose themselves and their projects to significant risks. The attack highlights the ongoing vulnerabilities within software development environments and the need for developers to be cautious about the tools and extensions they use. Users are advised to verify the authenticity of any extensions before installation, especially those related to cryptocurrency.

The RondoDox botnet has been identified exploiting a serious vulnerability known as React2Shell (CVE-2025-55182) to compromise Next.js servers. This flaw allows attackers to inject malware and cryptominers into systems that have not been properly secured. Organizations using Next.js frameworks are particularly at risk, as the botnet targets these servers directly. This incident underscores the necessity for companies to regularly update their software and apply security patches to prevent such attacks. The ongoing exploitation of this vulnerability poses significant risks to data integrity and can lead to unauthorized resource usage, impacting both performance and costs for affected users.

The cybercriminal group known as Silver Fox has recently shifted its focus to Indian users, employing income tax-themed phishing emails to spread a remote access trojan called ValleyRAT. This malware is designed to give attackers remote control over infected systems. Researchers from CloudSEK, Prajwal Awasthi and Koushik Pal, noted that the attack utilizes a sophisticated method involving DLL hijacking to ensure the malware remains persistent on the target devices. Users in India should be particularly cautious of emails related to taxes, as they are being used as bait to deliver this malicious software. The rise in such targeted phishing campaigns emphasizes the need for increased awareness and cybersecurity measures among individuals and organizations.

Kaspersky's GReAT team has released findings on a sophisticated attack by a group known as Evasive Panda APT. This group employs a technique that poisons DNS requests to deploy a malicious implant called MgBot. The attack chain includes the use of shellcode that is encrypted with DPAPI and RC5, making it harder to detect. This method poses a significant risk as it can compromise systems and networks by redirecting legitimate traffic to malicious sites. Organizations need to be aware of these tactics to prevent potential breaches and protect their infrastructure.

Two malicious Chrome extensions called 'Phantom Shuttle' have been discovered in the Chrome Web Store, masquerading as tools for a proxy service. These extensions are designed to hijack user traffic and steal sensitive information, including login credentials. Users who have installed these extensions are at risk of having their personal data compromised. This incident serves as a reminder for users to be cautious when downloading browser extensions and to regularly review their installed plugins. Google has a responsibility to monitor the extensions available in its store to protect users from such threats.

A malicious package has been discovered in the Node Package Manager (NPM) registry that impersonates a legitimate WhatsApp Web API library. This package is designed to steal users' WhatsApp messages, collect their contacts, and gain unauthorized access to their accounts. Developers who may have downloaded and used this package are at risk, as it can lead to significant privacy breaches. The attack highlights the ongoing risks associated with third-party libraries and the importance of scrutinizing dependencies before integrating them into projects. Users are advised to remove any suspicious packages and monitor their accounts for unusual activity.

A new version of the MacSync Stealer malware has been discovered, which poses a serious risk to macOS users. Unlike earlier versions, this malware can execute without requiring user interaction with the terminal, making it easier for attackers to infect systems. The malware is reportedly distributed through a signed Swift application, which could mislead users into thinking it's legitimate software. This change in the malware's operation means that even less tech-savvy users could fall victim to it, potentially leading to unauthorized access to sensitive information. Users of macOS should be particularly cautious about the applications they install and ensure they come from trusted sources.

The latest Malware Newsletter from Security Affairs covers significant topics in the malware scene, including a focus on pro-Russian cyber attacks. One notable incident involves the deployment of a malware called Phantom Stealer through ISO-mounted executables, which could pose risks to users who interact with these files. Additionally, researchers have identified a method used by hackers to infect around 50,000 Firefox users by embedding malware in a PNG icon. These incidents highlight ongoing threats to cybersecurity, particularly from hacktivist groups and ransomware, emphasizing the need for users and organizations to remain vigilant against emerging tactics and techniques used by cybercriminals.

The Kimwolf Android botnet has been discovered infecting over 1.8 million devices, according to security researchers at XLab. This botnet, which is linked to the previously identified Aisuru botnet, has been responsible for sending more than 1.7 billion commands for Distributed Denial of Service (DDoS) attacks. The scale of these attacks is significant, raising concerns about the potential for disruption to various online services. The fact that millions of devices are compromised highlights the ongoing vulnerability of Android systems to malware. Users should be cautious and consider securing their devices to prevent further infections and attacks.