Kaspersky researchers have unveiled “PhantomRPC,” a novel privilege escalation technique in the Windows Remote Procedure Call (RPC) architecture that allows attackers to elevate privileges to SYSTEM level. Microsoft has classified the issue as moderate severity and declined to issue a CVE-ID or an immediate patch, citing the prerequisite of existing impersonation privileges.
Vulnerability Details
Affected Product: Microsoft Windows (All versions)
Exploitation Status: Proof of Concept exists (No mass exploitation observed)
Risk & Impact
Triage: Moderate urgency; monitor environments closely as no official patch is currently available.
Attack Vector: An attacker registers a malicious RPC server to intercept callbacks from legitimate, high-privileged background services (e.g., WDI or DHCP), abusing impersonation levels to execute arbitrary code as SYSTEM.
Ease of Exploit: Moderate; requires the attacker to have already compromised a local process possessing the SeImpersonatePrivilege (such as the Local Service account).
Action Plan
Immediate Action: No official patch is available; restrict local access and enforce strict least privilege principles.
Workaround: Implement robust monitoring for anomalous RPC traffic and unauthorized RPC server registrations.
Detection: Hunt for unusual RPC server registrations and unexpected RPC interactions involving background services like WdiSystemHost or DHCP Client.
Relevant professional terms
Remote Procedure Call (RPC)
A protocol that allows a computer program to execute a procedure or subroutine in another address space (commonly on another computer or process) without the programmer explicitly coding the details for this remote interaction.
SeImpersonatePrivilege
A Windows security privilege that allows a process to impersonate the security context of a client, often targeted by attackers to escalate privileges to SYSTEM.
Over 10,000 Zimbra Collaboration Suite (ZCS) servers remain exposed to ongoing attacks exploiting a cross-site scripting vulnerability (CVE-2025-48700). CISA has added the flaw to its Known Exploited Vulnerabilities catalog, urging immediate patching as threat actors actively abuse the bug to steal sensitive information and hijack user sessions.
Vulnerability Details
Affected Product: Zimbra Collaboration Suite (ZCS) versions 8.8.15, 9.0, 10.0, and 10.1
Identifier: CVE-2025-48700
CVSS Score: 6.1 (Medium)
Exploitation Status: Actively Exploited
Risk & Impact
Triage: High urgency due to active exploitation in the wild and inclusion in the CISA KEV catalog.
Attack Vector: Unauthenticated attackers send a maliciously crafted email that executes arbitrary JavaScript within the victim’s session when viewed in the Zimbra Classic UI.
Ease of Exploit: Low complexity; requires no user interaction beyond viewing the malicious email message.
Action Plan
Immediate Action: Apply the latest security patches provided by Synacor for ZCS versions 8.8.15, 9.0, 10.0, and 10.1.
Workaround: Discontinue use of the Zimbra Classic UI if patching is not immediately feasible, or restrict external access to the webmail interface.
Detection: Monitor for unauthorized session hijacking, unexpected email forwarding rules, and review logs for anomalous JavaScript execution or suspicious @import directives in email HTML.
Relevant professional terms
Cross-Site Scripting (XSS)
A security vulnerability that allows attackers to inject malicious client-side scripts into web pages viewed by other users, often leading to session hijacking or data theft.
CISA KEV Catalog
The Known Exploited Vulnerabilities catalog maintained by the Cybersecurity and Infrastructure Security Agency, listing flaws actively abused by threat actors that require mandatory remediation by federal agencies.
Hackers compromised Checkmarx’s KICS Docker images and VS Code extensions to inject credential-stealing malware into developer environments. This supply chain attack targeted CI/CD pipelines to exfiltrate sensitive infrastructure secrets.
Attack Overview
Attack Path: Poisoned official Docker Hub tags and VS Code extensions deployed a hidden ‘MCP addon’ fetching malicious payload mcpAddon.js.
Attacker:TeamPCP (suspected)
Impact Assessment
Data Stolen: Cloud credentials (AWS, Azure, GCP), GitHub/npm tokens, SSH keys, and environment variables.
Operational Impact: IaC scan outputs were encrypted and exfiltrated to attacker domains; fake GitHub repositories were created to store stolen data.
Detection & Hunting
IOCs:audit.checkmarx[.]cx, mcpAddon.js, fake Docker tag v2.1.21.
Detection Guidance: Rotate all CI/CD secrets immediately, audit cloud environments for unauthorized access, and hunt for malicious format-check.yml workflows.
Strategic Takeaway
Securing CI/CD pipelines is critical, as attackers increasingly weaponize trusted security tools to harvest infrastructure credentials at scale.
Relevant professional terms
Supply Chain Attack
A cyberattack targeting a software vendor or third-party service to compromise its downstream customers.
Infrastructure as Code (IaC)
Managing and provisioning computing infrastructure through machine-readable definition files rather than physical hardware configuration.
A China-linked threat actor compromised a US federal agency’s Cisco firewall using the ‘Firestarter’ backdoor. The malware maintains deep persistence, surviving standard firmware updates and graceful reboots.
Attack Overview
Attack Path: Exploitation of Cisco ASA/FTD vulnerabilities (CVE-2025-20333, CVE-2025-20362) to inject code into the LINA process.
Attacker:UAT-4356 (ArcaneDoor)
Impact Assessment
Data Stolen: Administrative credentials, certificates, and private keys.
Operational Impact: Backdoor survives patching; requires a hard power cycle or full reimaging to remove.
Bitwarden CLI Compromised to Harvest Developer Secrets
Executive Summary
Attackers compromised the Bitwarden CLI npm package via a poisoned GitHub Actions workflow to distribute a credential-stealing worm. The payload targeted developer environments to harvest cloud secrets, SSH keys, and authentication tokens.
Key TTPs
Initial Access: Supply chain compromise via a poisoned GitHub Actions CI/CD pipeline.
Execution: Malicious preinstall hook downloads the Bun runtime to launch an obfuscated payload.
Defense Evasion: Employs a Russian locale kill-switch and heavily obfuscated JavaScript payloads.
Campaign Analysis
This incident is part of a broader supply chain campaign linked to the Checkmarx breach. The self-propagating worm uses stolen npm tokens to infect other packages, amplifying its blast radius.
Targeting & Infrastructure
Target Profile: Software developers and CI/CD pipelines using the Bitwarden CLI.
Infrastructure: Leveraged a rogue C2 domain and abused legitimate GitHub repositories for exfiltration.
Actionable Intelligence
IPs: 94.154.172[.]43
Domains: audit.checkmarx[.]cx
Relevant Terms
CI/CD Pipeline: Automated workflows used by developers to build, test, and publish software.
Preinstall Hook: A script configured to automatically run before the main software installation begins.
Lazarus Exploits ClickFix to Breach macOS Networks
Executive Summary
North Korea’s Lazarus Group is running an active campaign dubbed “Mach-O Man” that deploys novel macOS malware via ClickFix social engineering attacks. The operation targets executives at cryptocurrency, fintech, and high-value organizations to steal credentials, browser sessions, and macOS Keychain data.
Key TTPs
Initial Access: Targets receive fake Zoom, Teams, or Google Meet invitations via Telegram, often from compromised contacts, redirecting to a page that prompts them to paste a “fix” command into their macOS Terminal.
Execution: The command downloads Go-compiled Mach-O binaries that profile the system, harvest browser data, cookies, and Keychain entries, and exfiltrate data via Telegram.
Defense Evasion: Bypasses macOS Gatekeeper because the victim runs the command manually; the kit self-destructs using rm after exfiltration to erase forensic traces.
Campaign Analysis
Discovered by Bitso’s Quetzal Team and analyzed by ANY.RUN, the Mach-O Man kit represents a shift toward native macOS threats from a group historically focused on Windows. The modular toolkit has already been observed in use beyond Lazarus, suggesting it may have been shared or sold within the threat actor ecosystem.
Targeting & Infrastructure
Target Profile: Executives and decision-makers at crypto, fintech, and Web3 firms using macOS environments.
Infrastructure: Fake meeting platform sites, Telegram-based C2 exfiltration, and compromised DeFi project domains with spoofed Cloudflare notices.
Actionable Intelligence
IPs:172.86.113[.]102, 144.172.114[.]220
Relevant Terms
ClickFix: A social engineering technique where attackers trick victims into copying and pasting a malicious command into their terminal to “fix” a simulated technical issue.
Mach-O: The native executable binary format for macOS and iOS, used by the Lazarus kit to run natively on both Intel and Apple Silicon systems.
Toronto Police dismantled a first-of-its-kind SMS blaster operation in Canada under “Project Lighthouse.” Three individuals were arrested after deploying vehicle-mounted rogue cell towers across the Greater Toronto Area to mass-distribute smishing messages, tricking tens of thousands of devices into connecting and causing over 13 million network disruptions.
Key Findings
SMS blasters mimicked legitimate cell towers using 2G technology, forcing nearby phones off their carrier networks and onto the rogue device without the user’s knowledge.
Fraudulent texts impersonated trusted organizations such as banks and Canada Post, directing victims to credential-harvesting phishing sites.
The devices also disrupted access to emergency services (911) for connected phones, creating a direct public safety risk beyond financial fraud.
The Bottom Line
SMS blasters represent a dangerous convergence of radio-frequency manipulation and social engineering that bypasses carrier-level spam filters entirely. As the technology becomes more portable and accessible, telecom providers and law enforcement must develop coordinated detection capabilities, including real-time triangulation from multiple carriers, to identify rogue cell towers before they reach critical mass.
Relevant Terms
SMS Blaster: A portable device that impersonates a legitimate cellular tower (IMSI catcher variant) to force nearby phones onto its network and deliver mass fraudulent text messages.
Smishing: A phishing attack conducted via SMS text messages, typically directing victims to malicious links designed to steal credentials or financial information.
