Multiple hackers surrounding large screen displaying code with malware creatures, shields, locks, and threats

Daily Dose of Cybersecurity News - September 7, 2025

Written by:Daily Cyber Briefing TeamVerified by:Kirill Gavrilenko

September 7, 2025 6:01 AM 3 min read

Malware Phishing Campaign Disguised in SVG Files

High

What happened

A phishing campaign was discovered utilizing SVG files to impersonate Colombia's judicial system portal, aiming to deliver malware through embedded JavaScript.

Who is affected

Individuals interacting with the fraudulent SVG files, particularly those associated with or seeking information from Colombia's judiciary system.

Why it matters

This technique exploits the trust in SVG files, which are typically considered safe, to bypass security measures and deliver malicious payloads, posing a significant risk to users.

How it could have been prevented

Implementing advanced threat detection systems capable of analyzing file contents beyond their extensions and educating users about the risks of opening unsolicited attachments.

Relevant professional terms

SVG (Scalable Vector Graphics): An XML-based vector image format for two-dimensional graphics with support for interactivity and animation.
Phishing: A cyberattack method involving fraudulent communications that appear to come from a reputable source, typically to steal sensitive data.

Source: bleepingcomputer.com

AI-Powered Malware Compromises 2,180 GitHub Accounts in "s1ngularity" Attack

High

What happened

Attackers exploited a vulnerability in the GitHub Actions workflow of the Nx repository to publish a malicious version of the package on NPM, embedding a credential-stealing malware script named 'telemetry.js'.

Who is affected

The compromise led to the exposure of 2,180 GitHub accounts and 7,200 repositories, with numerous leaked secrets remaining valid.

Why it matters

This incident underscores the escalating threat of AI-powered malware in supply chain attacks, highlighting the need for robust security measures in software development pipelines.

How it could have been prevented

Implementing stringent security protocols in CI/CD workflows and regularly auditing for vulnerabilities could mitigate such risks.

Relevant professional terms

Supply Chain Attack: A cyberattack that targets less secure elements in the supply chain to compromise a system.
Credential Stealer: Malware designed to harvest sensitive information such as usernames, passwords, and tokens.

Recommended reading: Wiz.io

Source: bleepingcomputer.com

Noisy Bear's BarrelFire Phishing Campaign Targets Kazakhstan's Energy Sector

High

What happened

A threat actor known as Noisy Bear launched a phishing campaign named Operation BarrelFire, targeting employees of KazMunaiGas (KMG) by sending emails with malicious ZIP attachments containing LNK files that initiate a multi-stage malware infection.

Who is affected

Employees of KazMunaiGas, Kazakhstan's national oil and gas company, are the primary targets of this campaign.

Why it matters

The campaign demonstrates advanced social engineering and technical tactics, potentially compromising critical infrastructure within Kazakhstan's energy sector, leading to data exfiltration and operational disruptions.

How it could have been prevented

Implementing robust email filtering to detect and block phishing attempts, conducting regular employee training on recognizing phishing emails, and ensuring up-to-date endpoint protection to detect and prevent malware execution.

Relevant professional terms

Phishing: A cyberattack method where attackers impersonate legitimate entities to deceive individuals into providing sensitive information or executing malicious actions.
PowerShell Loader: A script or command executed via PowerShell to load and execute additional malicious payloads on a compromised system.

Recommended reading: cybersecuritynews.com

Source: thehackernews.com

Malicious npm Packages Impersonate Flashbots to Steal Ethereum Wallet Keys

High

What happened

Four malicious npm packages were discovered impersonating Flashbots, a legitimate Ethereum infrastructure project, to steal cryptocurrency wallet credentials. These packages exfiltrated private keys and mnemonic seeds to a Telegram bot controlled by the attackers.

Who is affected

Ethereum developers who downloaded and integrated the malicious npm packages into their projects are at risk of having their wallet credentials compromised.

Why it matters

The theft of private keys and mnemonic seeds grants attackers full control over victims' cryptocurrency wallets, leading to potential financial losses. The use of trusted names like Flashbots increases the likelihood of developers inadvertently incorporating malicious code.

How it could have been prevented

- Verify the authenticity of npm packages by checking the publisher's credentials and reviewing the code before integration. - Implement strict access controls and monitoring to detect unauthorized data exfiltration.

Relevant professional terms

Mnemonic Seed: A sequence of words used to generate a cryptocurrency wallet's private keys, allowing for wallet recovery.
Maximal Extractable Value (MEV): The maximum value that can be extracted from block production in excess of the standard block reward and gas fees, often through transaction reordering or inclusion.

Source: thehackernews.com