Team at laptops showing broken hearts surrounded by hexagonal shields, locks, malware, and world maps

Daily Dose of Cybersecurity News - September 17, 2025

Written by:Daily Cyber Briefing TeamVerified by:Kirill Gavrilenko

September 17, 2025 6:02 AM 5 min read

Self-Replicating Worm 'Shai-Hulud' Infects 180+ NPM Packages

High

What happened

A self-replicating worm named 'Shai-Hulud' has infected at least 187 JavaScript packages on the NPM repository. The malware steals developer credentials and publishes them on GitHub, further propagating by modifying and republishing the top 20 packages accessible with the stolen NPM tokens.

Who is affected

Developers and organizations utilizing the compromised NPM packages, including security vendor CrowdStrike, whose multiple code packages were briefly infected.

Why it matters

The worm's ability to self-propagate and exfiltrate sensitive credentials poses a significant threat to the integrity of widely-used JavaScript packages, potentially leading to widespread supply chain attacks.

How it could have been prevented

Implementing strict access controls and monitoring for unusual activity in code repositories; regularly rotating authentication tokens and credentials; and conducting thorough security audits of code packages before deployment.

Relevant professional terms

Self-replicating worm: A type of malware that can autonomously spread by copying itself to other systems or software packages.
Supply chain attack: A cyberattack that targets less secure elements in the supply chain to compromise a final target.

Recommended reading: Aikido Security

Source: krebsonsecurity.com

Google Removes 224 Malicious Android Apps Involved in Massive Ad Fraud Campaign

High

What happened

Google has removed 224 malicious Android applications from the Google Play Store that were part of an extensive ad fraud operation known as "SlopAds." These apps generated approximately 2.3 billion fraudulent ad requests daily by employing techniques like obfuscation and steganography to evade detection.

Who is affected

The fraudulent apps were downloaded over 38 million times by users across 228 countries, with the highest concentrations in the United States (30%), India (10%), and Brazil (7%).

Why it matters

This large-scale ad fraud not only deceives advertisers and disrupts the digital advertising ecosystem but also compromises user trust and device performance. The sophisticated evasion tactics used indicate a significant advancement in malicious app development.

How it could have been prevented

- Implementing stricter app review processes to detect obfuscation and steganography techniques. - Educating users to download apps only from reputable developers and to scrutinize app permissions and reviews.

Relevant professional terms

Obfuscation: The practice of deliberately making code difficult to understand to conceal its true purpose.
Steganography: A technique of hiding data within other non-secret data, such as embedding malicious code within image files.

Recommended reading: humansecurity.com

Source: bleepingcomputer.com

Self-Propagating Supply Chain Attack Compromises 187 npm Packages

High

What happened

A coordinated supply chain attack, dubbed 'Shai-Hulud,' compromised at least 187 npm packages by injecting a self-propagating malicious payload that infects other packages.

Who is affected

Developers and organizations utilizing the compromised npm packages, including those under CrowdStrike's npm namespace.

Why it matters

This attack highlights the vulnerability of software supply chains, where a single compromised package can cascade into widespread security breaches, potentially exposing sensitive data and systems.

How it could have been prevented

Implementing strict access controls, regularly auditing package dependencies, and monitoring for unusual activity within repositories can mitigate such supply chain attacks.

Relevant professional terms

Supply Chain Attack: A cyberattack that targets less secure elements within the supply chain to compromise a system or network.
Self-Propagating Malware: Malicious software capable of replicating itself to spread across systems without user intervention.

Source: bleepingcomputer.com

Jaguar Land Rover Extends Production Shutdown Following Cyberattack

High

What happened

Jaguar Land Rover (JLR) experienced a cyberattack in late August 2025, leading to significant disruptions in production and retail operations. The company has extended its production shutdown until September 24, 2025, as it continues to investigate and recover from the incident.

Who is affected

The cyberattack has impacted JLR's global operations, affecting approximately 39,000 employees and disrupting vehicle production and sales.

Why it matters

This incident highlights the vulnerability of major automotive manufacturers to cyber threats, emphasizing the need for robust cybersecurity measures to protect critical infrastructure and maintain operational continuity.

How it could have been prevented

Implementing comprehensive cybersecurity protocols, including regular system audits, employee training on phishing and social engineering attacks, and establishing incident response plans, could mitigate such risks.

Relevant professional terms

Incident Response Plan: A structured approach outlining procedures for detecting, responding to, and recovering from cybersecurity incidents.
Social Engineering: Manipulative techniques used by attackers to deceive individuals into divulging confidential information or performing actions that compromise security.

Recommended reading: Security Magazine

Source: bleepingcomputer.com

Apple Releases Patches for CVE-2025-43300 Zero-Day Vulnerability in Older iOS Devices

High

What happened

Apple has released security updates to address a zero-day vulnerability (CVE-2025-43300) in older iPhones and iPads. This flaw, an out-of-bounds write issue in the Image I/O framework, was exploited in highly sophisticated attacks.

Who is affected

Users of older Apple devices, including iPhone 6s, iPhone 7, iPhone SE (1st generation), iPhone 8, iPhone 8 Plus, iPhone X, iPad Air 2, iPad mini (4th generation), iPad 5th generation, iPad Pro 9.7-inch, iPad Pro 12.9-inch (1st generation), and iPod touch (7th generation).

Why it matters

The exploitation of this vulnerability could lead to memory corruption, data corruption, crashes, or remote code execution, posing significant security risks to affected devices.

How it could have been prevented

Regularly updating devices to the latest available software versions and applying security patches promptly can mitigate such vulnerabilities.

Relevant professional terms

Zero-day vulnerability: A security flaw that is exploited by attackers before the software vendor has released a fix.
Out-of-bounds write: A programming error where data is written outside the allocated memory buffer, potentially leading to crashes or code execution.

Recommended reading: Apple Security Updates

Source: bleepingcomputer.com

FileFix Attack Uses Steganography to Deploy StealC Malware

High

What happened

A new FileFix social engineering attack impersonates Meta account suspension warnings, tricking users into executing malicious commands that install the StealC infostealer malware.

Who is affected

Users receiving phishing emails claiming to be from Meta's support team are targeted.

Why it matters

The attack leverages steganography to conceal malicious code within images, making detection challenging and posing significant risks to user data security.

How it could have been prevented

Users should be educated on recognizing phishing attempts and avoid executing commands or opening files from untrusted sources.

Relevant professional terms

Steganography: The practice of concealing messages or information within other non-secret text or data.
Infostealer Malware: Malicious software designed to steal sensitive information from a victim's device.

Recommended reading: BleepingComputer

Source: bleepingcomputer.com

North Korean Group Kimsuky Utilizes AI-Generated Deepfakes in Targeted Attacks

High

What happened

The North Korean state-sponsored group Kimsuky employed AI tools like ChatGPT to create deepfake images of South Korean military identification documents. These were used in spear-phishing campaigns targeting journalists, researchers, and human-rights activists, aiming to deceive recipients into clicking malicious links.

Who is affected

South Korean defense-related institutions, journalists, researchers, and human-rights activists were the primary targets of this campaign.

Why it matters

The use of AI-generated deepfakes in cyberattacks represents a significant escalation in social engineering tactics, making phishing attempts more convincing and harder to detect. This trend poses increased risks to organizations and individuals, especially those in sensitive sectors.

How it could have been prevented

Implementing advanced email filtering solutions to detect and block phishing attempts, conducting regular security awareness training for employees to recognize and report suspicious communications, and verifying the authenticity of unexpected or unsolicited requests through independent channels.

Relevant professional terms

Deepfake: A synthetic media in which a person in an existing image or video is replaced with someone else's likeness using artificial intelligence.
Spear-phishing: A targeted attempt to steal sensitive information such as account credentials or financial information from a specific individual, often for malicious reasons, by masquerading as a trustworthy entity in electronic communications.

Recommended reading: North Korean Hackers Target Security Researchers — Again

Source: darkreading.com