SecurityWeek Briefing.

"Cybersecurity News, Insights, and Analysis."

Views expressed in this cybersecurity, cyber crime update are those of the reporters and correspondents.  Accessed on 13 July 2025, 2354 UTC.

Content and Source:  "SecurityWeek Briefing."

URL-- https://www.securityweek.com/category/malware-cyber-threats/

Please check URL or scroll down to read your selections.  Thanks for joining us today.

Russ Roberts (https://www.hawaiicybersecurityjournal.net).

In Other News: Microsoft Finds AMD CPU Flaws, ZuRu macOS Malware Evolves, DoNot APT Targets Govs

Legitimate Shellter Pen-Testing Tool Used in Malware Attacks

A stolen copy of Shellter Elite shows how easily legitimate security tools can be repurposed by threat actors when vetting and oversight fail.

North Korean Hackers Use Fake Zoom Updates to Install macOS Malware

SentinelOne says the fake Zoom update scam delivers ‘NimDoor’, a rare Nim-compiled backdoor.

Chinese Hackers Target Chinese Users With RAT, Rootkit

China-linked Silver Fox hacking group is targeting Chinese users with fake installers carrying a RAT and a rootkit.

Hackers Abuse ConnectWise to Hide Malware

G Data has observed a surge in malware infections originating from ConnectWise applications with modified certificate tables.

SonicWall Warns of Trojanized NetExtender Stealing User Information

SonicWall says a modified version of the legitimate NetExtender application contains information-stealing code.

Russian APT Hits Ukrainian Government With New Malware via Signal

Russia-linked APT28 deployed new malware against Ukrainian government targets through malicious documents sent via Signal chats.

Prometei Botnet Activity Spikes

Palo Alto Networks has observed a spike in Prometei activity since March 2025, pointing to a resurgence of the botnet.

Photo-Stealing Spyware Sneaks Into Apple App Store, Google Play

Newly discovered spyware has sneaked into Apple’s App Store and Google Play to steal images from users’ mobile devices.

North Korean Hackers Take Over Victims’ Systems Using Zoom Meeting

North Korean hackers employ social engineering to trick Zoom Meeting participants into executing system-takeover commands.

Godfather Android Trojan Creates Sandbox on Infected Devices

The Godfather Android trojan uses on-device virtualization to hijack legitimate applications and steal users’ funds.

Cloudflare Tunnels Abused in New Malware Campaign

A threat actor is abusing Cloudflare Tunnels for the delivery of a Python loader as part of a complex infection chain.

New Campaigns Distribute Malware via Open Source Hacking Tools

Trend Micro and ReversingLabs uncovered over 100 GitHub accounts distributing malware embedded in open source hacking tools.

New ClickFix Malware Variant ‘LightPerlGirl’ Targets Users in Stealthy Hack

Researchers identify a previously unknown ClickFix variant exploiting PowerShell and clipboard hijacking to deliver the Lumma infostealer via a compromised travel site.

Recent Langflow Vulnerability Exploited by Flodrix Botnet

A critical Langflow vulnerability tracked as CVE-2025-3248 has been exploited to ensnare devices in the Flodrix botnet.

TeamFiltration Abused in Entra ID Account Takeover Campaign

Threat actors have abused the TeamFiltration pentesting framework to target over 80,000 Entra ID user accounts.

SimpleHelp Vulnerability Exploited Against Utility Billing Software Users

CISA warns that vulnerable SimpleHelp RMM instances have been exploited against a utility billing software provider’s customers.

Paragon ‘Graphite’ Spyware Linked to Zero-Click Hacks on Newest iPhones

Citizen Lab publishes forensic proof that spyware maker Paragon can compromise up-to-date iPhones. Journalists in Europe among victims.

Recently Disrupted DanaBot Leaked Valuable Data for 3 Years

Investigators leveraged a vulnerability dubbed DanaBleed to obtain insights into the internal operations of the DanaBot botnet.

Microsoft Patch Tuesday Covers WebDAV Flaw Marked as ‘Already Exploited’

Redmond warns that external control of a file name or path in WebDAV "allows an unauthorized attacker to execute code over a network."

More Articles