Tracking Threats, Incidents, and Vulnerabilities
Tracking Threats, Incidents, and Vulnerabilities
Mac users targeted by fake LinkedIn job offers to download Flexible Ferret malware via counterfeit software updates. Attackers impersonate recruiters to steal passwords and gain covert access through a backdoor. Individuals are advised to keep software updated, avoid running unverified commands, use real-time anti-malware, and verify sender authenticity to stay safe.
New ClickFix campaign mimics Windows updates to distribute malware. Attackers use fake update screens prompting users to run commands, leading to infections via steganography embedded in images. Users are urged to be cautious with commands from untrusted sources, limit copy-pasting, and utilize antivirus software for protection.
CISA warns of active spyware campaigns targeting Signal and WhatsApp users, utilizing social engineering and commercial spyware to gain unauthorized access. High-value individuals, including government officials, are primary targets. Notable campaigns exploit app features and security flaws to deploy malware. Users are advised to use encrypted communications, avoid SMS-based MFA, update software, and secure app permissions to enhance safety.
https://thehackernews.com/2025/11/cisa-warns-of-active-spyware-campaigns.html
TLDR: Major resurgence of Shai-Hulud malware, now called “Sha1-Hulud: The Second Coming,” compromises over 800 npm packages and tens of thousands of GitHub repos. It embeds credential-stealing payloads and can delete users' home directories if unsuccessful. It exploits GitHub Actions for remote code execution, allowing attackers to run commands through victim accounts. Organizations should scan endpoints, remove affected packages, rotate credentials, and audit workflows to mitigate risks.
Cybercriminals exploit browser push notifications via the Matrix Push C2 platform to deliver malware and phishing attacks. Users are deceived into granting permission through misleading prompts, allowing attackers to send fake alerts and gather personal data. The platform enables detailed monitoring of victims and custom URL management for malicious campaigns, often resulting in data theft or financial loss. Users are advised to manage notification permissions across their browsers to mitigate these risks.
ClickFix malware is a multi-stage attack using steganography to conceal infostealing malware within images. It begins with social engineering tactics, tricking users into executing malicious commands. Huntress identified two main ClickFix lures—one using a “Human Verification” tactic and the other mimicking a Windows Update interface. The process involves JavaScript to copy commands to the clipboard, PowerShell for loading .NET assemblies, and a complex steganographic algorithm to hide and extract shellcode from PNG images. This shellcode is then injected into target processes, ultimately delivering LummaC2 malware for data theft. The campaign has evolved with increasingly convincing user interfaces to deceive targets effectively.
https://www.huntress.com/blog/clickfix-malware-buried-in-images
Sturnus is a newly identified Android banking trojan capable of bypassing encrypted messaging apps like WhatsApp, Telegram, and Signal. It monitors communications by capturing screen content, harvests banking credentials via fake login screens, and allows extensive remote control of infected devices, including real-time screen viewing and activity injections. Currently in a pre-deployment phase, it primarily targets users in Southern and Central Europe, focusing on high-value applications. The malware's architecture incorporates advanced evasion techniques, including code obfuscation and complex communication protocols, posing significant threats to financial security and privacy.
https://www.threatfabric.com/blogs/sturnus-banking-trojan-bypassing-whatsapp-telegram-and-signal
DanaBot malware returns after 6-month hiatus, with version 669 using Tor for command-and-control. It's a banking trojan evolved into an info stealer, disrupted by law enforcement in May but now active again. It targets credentials and cryptocurrency data via nefarious emails and malvertising. Organizations can mitigate risks by updating security tools and blocking new threats identified by Zscaler.
GootLoader malware has resurfaced, utilizing custom fonts to obscure filenames on WordPress sites, complicating detection. It exploits SEO tactics and comment endpoints to deliver encrypted payloads, often leading to domain controller compromises. The malware has evolved to disguise its true nature, using deceptive techniques to evade automated analysis and remains tied to a broader cybercriminal ecosystem involving various threat actors.
https://thehackernews.com/2025/11/gootloader-is-back-using-new-font-trick.html
GlassWorm Malware targets VS Code via three malicious extensions, harvesting credentials and using invisible code to spread. Despite attempts to remove it, the campaign persists, affecting various regions, including government entities. The malware showcases evolving attack techniques, such as utilizing blockchain for command/control. Security researchers identified a Russian-speaking attacker behind it, indicating significant risks to organizations using affected tools.
https://thehackernews.com/2025/11/glassworm-malware-discovered-in-three.html
Attackers enhance ClickFix technique with online store tricks to pressure victims into malware installation, using countdown timers, tutorial videos, and user counters for urgency. This method has become prevalent, accounting for 47% of attacks in 2025, distributed via emails, social media, and malvertising.
https://www.helpnetsecurity.com/2025/11/07/newest-clickfix-tricks/
Gootloader malware has returned after a 7-month hiatus, using SEO tricks to promote fake websites that distribute malicious files. It tricks users into downloading harmful documents, often disguised as legal templates, to install additional malware like ransomware. Researchers have discovered new techniques to evade detection, including obfuscating filenames and using malformed ZIP archives. Users are cautioned to avoid suspicious sites when searching for legal documents.
TLDR: aurologic GmbH is a key German hosting provider supporting high-risk networks linked to cybercrime. Established in 2023, it provides services to many threat activity enablers like Aeza Group and Global-Data System, despite increasing scrutiny and sanctions. The company’s operational neutrality raises concerns about accountability in the internet hosting ecosystem, as it facilitates malicious activities while complying legally. Notable downstream customers have been linked to various malware and cybercrime infrastructures, indicating aurologic's significant role in the ongoing challenges of managing malicious online activities.
https://www.recordedfuture.com/research/malicious-infrastructure-finds-stability-with-aurologic-gmbh
Malicious Android apps on Google Play were downloaded over 42 million times between June 2024 and May 2025, with a 67% rise in mobile malware, especially spyware and banking trojans. Shift in cybercriminal tactics towards social engineering-based attacks is noted. The report highlights three significant malware families affecting users: Anatsa (banking trojan), Android Void (backdoor for Android TV boxes), and Xnotice (RAT targeting job seekers). Key advice for users includes applying security updates and using reputable app sources.
NFC relay malware significantly increased in Eastern Europe, with over 760 malicious Android apps identified stealing credit card data. This malware utilizes Android’s Host Card Emulation to capture payment information and perform unauthorized transactions without the card present. It first appeared in Poland and has spread to several countries. Security experts advise Android users to avoid installing risky apps, check permissions, and utilize built-in anti-malware tools.
