What’s in the July 2025 Cybersecurity Newsletter?
The July 2025 Cybersecurity Newsletter covers major global cyber incidents, new malware campaigns, critical vulnerabilities, and large-scale data breaches. Key highlights include North Korean IT schemes, Microsoft’s shift to password less security, supply chain risks in Open VSX, Linux privilege escalation flaws, and ransomware-driven breaches across healthcare, retail, and aviation.
Welcome to our July 2025 Cybersecurity Newsletter! This edition brings you the latest updates on global cyber incidents, emerging threats, and critical vulnerabilities impacting organizations and individuals alike. From high-profile arrests to massive data breaches and new malware campaigns, we cover the key developments shaping the cybersecurity landscape this month.
News Highlights:
1. U.S. Dismantles North Korean IT Worker Scheme, Seizes 29 Domains and Raids 21 Laptop Farms
The U.S. Department of Justice has arrested one individual and disrupted a major North Korean IT worker scheme by seizing 29 financial accounts, 21 domains, and nearly 200 computers. From June 10–17, 2025, authorities raided 21 suspected “laptop farms” across 14 states, uncovering how DPRK operatives secured jobs at over 100 U.S. companies using stolen or fake identities. The scheme, aiding North Korea’s sanctions evasion, facilitated the theft of sensitive data and nearly $900,000 in digital assets.
2. Microsoft to Discontinue Password Management in Authenticator App by August 2025
Microsoft will remove password management features from its Authenticator app starting August 1, 2025, as part of its broader shift toward a passwordless future. Autofill will stop working in July, and stored passwords will no longer be accessible within the app from August. The company encourages users to access saved passwords via their Microsoft account using the Edge browser. This move aligns with Microsoft’s push for more secure authentication methods like passkeys, Windows Hello, and FIDO2.
3. Critical Flaw in Open VSX Registry Puts Millions of Dev Machines at Supply Chain Risk
A critical vulnerability in the Open VSX Registry could have allowed attackers to hijack the entire Visual Studio Code extensions marketplace, posing a major supply chain threat to millions of developers. Discovered by Koi Security, the flaw stemmed from a CI pipeline issue that could let malicious actors push updates to any extension. Widely adopted by platforms like Gitpod and Google Cloud Shell, the registry’s compromise could have enabled silent distribution of malicious code. A final patch was issued on June 25, 2025, following responsible disclosure.
4. BlueNoroff Uses Deepfake Zoom Call to Deliver macOS Backdoor in Targeted Crypto Attack
North Korea-linked group BlueNoroff targeted a Web3 employee using a deepfake Zoom meeting of company executives to deliver macOS malware. The attack began with a Telegram message leading to a fake Zoom site, where the victim was tricked into installing a malicious AppleScript disguised as a Zoom extension. The script stealthily downloaded a second-stage payload, executed a shell script, and prepared the system by installing Rosetta 2 for further exploitation. Huntress attributed the intrusion to a sophisticated social engineering ploy.
5. Critical Linux Privilege Escalation Flaws Allow Root Access via PAM and Udisks
Security researchers at Qualys have discovered two critical local privilege escalation vulnerabilities—CVE-2025-6018 and CVE-2025-6019—that can be chained to grant full root access on major Linux distributions. The flaws, present in SUSE’s PAM configuration and the udisks daemon respectively, allow attackers with GUI or SSH access to escalate from a regular user to root in seconds by exploiting Polkit’s allow_active zone. Given the widespread use of udisks across Linux systems, nearly all are potentially vulnerable, posing significant risks of system compromise and backdoor implantation.
6. SERPENTINE#CLOUD Campaign Abuses Cloudflare Tunnels to Deliver Remote Access Trojans
A new malware campaign dubbed SERPENTINE#CLOUD is exploiting Cloudflare Tunnel subdomains to distribute remote access trojans (RATs) via phishing emails with invoice-themed lures. According to Securonix, the attackers use obfuscated scripts and LNK shortcut files disguised as documents to trigger a multi-stage infection chain that deploys memory-injected payloads through a Python-based loader. The campaign has targeted regions across the U.S., U.K., Germany, and parts of Europe and Asia, with final payloads including AsyncRAT, Remcos RAT, and XWorm.
Breaches Highlights:
1. Qantas Confirms Cyberattack Exposing Customer Data from Third-Party Platform
Australian airline Qantas has disclosed a cyberattack involving unauthorized access to a third-party customer service platform, potentially exposing data of up to 6 million customers. The stolen information includes names, emails, phone numbers, birthdates, and frequent flyer numbers. The airline confirmed that financial details and login credentials were not compromised. Authorities including the Australian Cyber Security Centre and Federal Police have been notified as investigations continue.
2. Esse Health Data Breach Exposes Sensitive Information of Over 263,000 Patients
St. Louis-based healthcare provider Esse Health has confirmed a data breach affecting 263,601 patients following a cyberattack on April 21, 2025. The attackers accessed and copied files containing sensitive information such as names, addresses, birth dates, health insurance details, medical record numbers, and other health data. Esse Health’s systems were fully restored by June 2, and breach notifications have been sent to affected individuals as investigations continue.
3. Ahold Delhaize Breach Exposes Data of Over 2.2 million Individuals in Ransomware Attack
Global retail giant Ahold Delhaize has disclosed a data breach impacting 2.2 million individuals following a ransomware attack on its U.S. systems in November 2024. The incident compromised personal, financial, and health information, affecting several of its American brands, including Stop & Shop, Food Lion, and Hannaford. The company confirmed that attackers gained access to internal business systems on November 6, prompting immediate mitigation efforts across impacted services.
4. McLaren Health Care Data Breach Exposes Information of 743,000 Patients After Ransomware Attack
McLaren Health Care has disclosed a data breach affecting 743,000 patients following a ransomware attack by the INC gang in July 2024. Although the breach was detected in August, a full impact assessment was only completed by May 2025. The attack caused widespread IT disruptions across McLaren’s 14 hospitals, prompting patients to manually provide appointment and medication details. Ransom notes allegedly from INC were found printed at a McLaren hospital, confirming the group’s involvement.
5. Nucor Confirms Data Theft Following Cyberattack That Disrupted Steel Production
Nucor, North America’s largest steel producer, has confirmed that attackers involved in a recent cyberattack also exfiltrated data from its network. The incident led to temporary shutdowns of production operations and restricted access to key IT systems across facilities in the U.S., Mexico, and Canada. In a new SEC filing, Nucor acknowledged the data breach as part of its ongoing investigation, with law enforcement and cybersecurity experts assisting in response efforts.
6. Krispy Kreme Data Breach Exposes Sensitive Info of Over 160,000 Individuals
Krispy Kreme has confirmed that a cyberattack in November 2024 led to the theft of personal data belonging to 161,676 individuals. The breach, disclosed in filings with state authorities, involved sensitive information such as Social Security numbers, financial account details, and driver’s license data. While no misuse has been reported, the doughnut chain took immediate steps to contain the incident and engaged cybersecurity experts to investigate the impact.
Malware Highlights:
1. EDDIESTEALER Malware Exploits CAPTCHA Scam to Evade Chrome Protections and Steal Sensitive Data
A new Rust-based malware dubbed EDDIESTEALER is being spread via fake CAPTCHA verification pages using the ClickFix social engineering technique. The campaign tricks users into running malicious PowerShell commands that deploy the infostealer, which harvests credentials, browser data, crypto wallets, and more. By bypassing Chrome’s app-bound encryption, EDDIESTEALER uses obfuscated scripts and JavaScript payloads to deliver its binary, with its targets controlled remotely by the attacker’s C2 server.
2. Chaos RAT Malware Targets Windows and Linux with Fake Network Tools and Phishing Campaigns
A new variant of Chaos RAT is targeting both Windows and Linux systems, disguising itself as a legitimate network troubleshooting tool, according to Acronis. Distributed via phishing emails, the malware establishes persistence by modifying system crontabs and enables full remote control of infected machines. Chaos RAT, written in Golang, supports features like reverse shells, file manipulation, and system surveillance, and is now being linked to cryptocurrency mining operations using Linux-based XMRig payloads.
3. Rust-Based Myth Stealer Malware Targets Chrome and Firefox Users via Fake Gaming Sites
A new Rust-based malware called Myth Stealer is being spread through fake gaming websites and cracked software, targeting users of Chrome, Firefox, and other popular browsers. Disguised as legitimate applications, the stealer decrypts and runs malicious code to harvest passwords, cookies, and autofill data. Initially shared for free on Telegram, it has evolved into a malware-as-a-service operation. Myth Stealer has been linked to fake Blogger pages and forums offering game cheats, although it is unrelated to the similar AgeoStealer campaign.
4. AntiDot Android Malware Targets Thousands via Overlay Attacks, NFC Theft, and Phishing Campaigns
Researchers have uncovered a surge in infections caused by AntiDot, a sophisticated Android malware used in over 273 campaigns, compromising more than 3,775 devices. Operated by the financially motivated group LARVA-398, AntiDot is sold as a malware-as-a-service (MaaS) and leverages Android’s accessibility and MediaProjection APIs to steal data, intercept SMS, and record screens. Delivered via fake Google Play updates and phishing lures, it uses obfuscation and a dynamic loader to evade detection, with active command-and-control servers coordinating real-time attacks.
5. Qilin Ransomware Introduces ‘Call Lawyer’ Feature to Boost Ransom Payouts
The Qilin ransomware gang has added a “Call Lawyer” option in its affiliate panel to pressure victims into larger ransom payments, according to Cybereason. This new tactic marks the group’s resurgence amid the decline of rival ransomware groups like LockBit and BlackCat. Active since October 2022, Qilin ranked among the most prolific ransomware actors in 2025, with 304 claimed victims to date and growing influence through a mature ecosystem and aggressive, targeted attack strategies.
6. GIFTEDCROOK Malware Upgraded to Spy Tool Targeting Ukrainian Government and Military
The GIFTEDCROOK malware has evolved from a simple browser data stealer into a sophisticated intelligence-gathering tool, according to Arctic Wolf Labs. Recent campaigns in June 2025 show its ability to exfiltrate sensitive documents, including proprietary files and browser secrets, with a focus on Ukrainian military and governmental entities. First spotted by CERT-UA in April, the malware is deployed via phishing emails containing macro-laced Excel files and targets data from Chrome, Edge, and Firefox browsers.
New Vulnerabilities:
1. CVE-2025-33053: Critical WEBDAV Remote Code Execution Vulnerability via Internet Explorer Fallback
CVE-2025-33053 is a critical remote code execution vulnerability in Windows WebDAV handling that forces the use of deprecated Internet Explorer components. Exploitation requires only a user click on a malicious URL, enabling attackers to execute arbitrary code. Due to its severity, Microsoft released emergency patches even for unsupported platforms like Windows 8 and Server 2012. Prompt patching is strongly advised.
2. CVE-2025-33070: Critical Windows Netlogon Elevation of Privilege Vulnerability in Domain Controllers
CVE-2025-33070 is a critical elevation of privilege vulnerability in Windows Netlogon that allows attackers to execute arbitrary code on domain controllers by sending specially crafted authentication requests. The flaw potentially grants high-level privileges equivalent to the Netlogon service. Microsoft rates exploitation as “more likely,” making prompt patching essential to defend against potential attacks.
3. CVE-2025-33073: Publicly Known Elevation of Privilege Vulnerability in Windows SMB Client
CVE-2025-33073 is a publicly disclosed Windows SMB Client elevation of privilege vulnerability that allows remote attackers to execute code with SYSTEM-level privileges. The flaw can be exploited by luring a user to connect to a malicious SMB server, enabling full compromise of the affected system. Multiple researchers reported the issue, and exploitation is considered viable, warranting immediate patching.
4. CVE-2025-5777: Critical Out-of-Bounds Read Vulnerability in Citrix NetScaler Enables Session Hijacking
CVE-2025-5777 is a critical out-of-bounds read vulnerability affecting Citrix NetScaler ADC and Gateway (prior to versions 14.1-43.56 and 13.1-58.32) that allows remote attackers to bypass authentication and hijack user sessions. With a CVSS score of 9.3, the flaw enables session token theft and MFA bypass through crafted HTTP requests. Active exploitation has been observed in the wild, with attackers conducting LDAP reconnaissance and persistent access campaigns.
5. CVE-2025-3248: Critical Authentication Bypass in Langflow AI Platform Enables Remote Code Execution Prior to v1.3.0
CVE-2025-3248 is a critical authentication bypass vulnerability in Langflow AI servers before version 1.3.0, allowing unauthenticated remote code execution. With a CVSS score of 9.8, the flaw is actively exploited to deploy the Flodrix IoT botnet, capable of launching DDoS attacks exceeding 100 Gbps. The vulnerability threatens AI development platforms and cloud-hosted ML services with data exfiltration and DDoS amplification.
6. CVE-2025-49596: Critical RCE Vulnerability in Anthropic MCP Inspector Prior to Version 0.14.1
CVE-2025-49596 is a critical remote code execution vulnerability in Anthropic MCP Inspector versions below 0.14.1. The flaw stems from missing authentication between the Inspector client and proxy, enabling unauthenticated attackers to issue MCP commands via stdio. This poses a serious risk to MCP server environments, and users are urged to upgrade to version 0.14.1 or later immediately.
Tools of the Month
- BrutDroid: It’s a powerful automation toolkit for Android emulator testing, built for red teamers and app security pros. It simplifies tasks like rooting, Frida setup, and Burp cert installation with a sleek CLI—saving hours of manual work.
- Newtowner: It’s a network testing tool that helps assess firewall and trust boundaries by simulating traffic from various global datacenters. It targets weak trust assumptions in modern cloud environments, which often allow traffic based on datacenter origin—a growing risk with increased cloud adoption.
Protect Your Business from Cyber Attacks!
In today’s world, cyber threats are constantly evolving, and staying one step ahead is crucial for your business. At iwebbs.com, we understand the stakes. Our team of certified security experts is here to help you pinpoint weak spots, implement rock-solid protection, and keep your business safe from even the most sophisticated attacks.
Don’t wait until it’s too late. Take control of your cybersecurity today. Reach out to us for a personalized consultation and find out how we can help you protect your organization from cyber risks. Let’s work together to secure your future!