Get your mallets ready, Digital Defenders.

It’s whack-a-mole on every front, from stealthy malware loaders and SQL injection bugs to state-sponsored actors burrowing into virtualization infrastructure. Meanwhile, CastleLoader is spreading through Cloudflare-themed phishing and GitHub scams, and attackers are hiding crypto miners in panda JPEGs.

Ready to jump into the fray?

Here’s what you need to know:

Zero-Day Download

Mitel Patches Critical MiVoice MX-ONE Auth Bypass, Warns of SQL Injection Risk in MiCollab

Mitel has issued urgent security updates for critical vulnerabilities affecting its MiVoice MX-ONE and MiCollab products.

Source: mitel.com

A high-risk authentication bypass flaw in MiVoice MX-ONE’s Provisioning Manager component could allow attackers to gain unauthorized admin or user access. Mitel also addressed a separate high-severity SQL injection bug in MiCollab that could let authenticated users run malicious database commands.

Users are strongly urged to patch immediately and restrict internet exposure to limit exploitation risk.

Fire Ant Cyber-Espionage Group Breaches VMware Environments Using Advanced Persistence Techniques

According to a new report from Sygnia, a sophisticated cyber-espionage campaign by a threat actor dubbed Fire Ant is targeting virtualization and network infrastructure, including VMware ESXi hosts, vCenter servers, and network appliances.

The attackers leveraged CVE-2023-34048—previously exploited as a zero-day by China-linked UNC3886—to extract credentials, deploy persistent backdoors like VIRTUALPITA, and pivot across segmented environments.

Users should harden and monitor their virtualization infrastructure on an ongoing basis to mitigate the risk of compromise.

CastleLoader Malware Spreads via Fake GitHub Repos and Cloudflare-Themed Phishing

PRODAFT researchers have uncovered a stealthy malware loader being distributed through Cloudflare-themed ClickFix phishing attacks and deceptive GitHub repositories impersonating legitimate apps.

Known as CastleLoader, the malware evades detection with dead code injection and runtime unpacking, then connects to a command-and-control server to deliver modular payloads. Its flexible, decoupled design allows attackers to continuously adapt tactics while masking attribution and intent.

Users should stay cautious of phishing links, verify software sources, and keep security tools updated to defend against loaders like CastleLoader.

Share this newsletter!

Pulse Check

How tight is your anti-malware game?

Yesterday's Pulse Check Results

What do you think of a ransomware‑payment ban?

Security Tools You Can Use

🛡️ This section contains sponsored cybersecurity insights. Advertise with us!

Threat Tracker

Koske Linux Malware Mines Crypto with Weaponized Panda JPEGs

A new Linux malware dubbed Koske uses deceptive JPEG images of panda bears—hosted on legitimate image services—to deploy cryptocurrency miners directly into system memory.

Source: aquasec.com

The malware appears to have been built using large language models or automation frameworks, showcasing adaptive behavior and stealthy execution. Koske exploits misconfigured JupyterLab instances for initial access, then drops polyglot files that act as both images and executable code.

To defend against Koske, devs should follow AquaSec’s risk mitigation guidelines.

ICAR Suffers Major Data Breach, Exposing Recruitment and Research Records

India’s top agricultural research body, the Indian Council of Agricultural Research (ICAR), experienced a significant security breach in April that compromised sensitive data across recruitment and research projects.

The breach impacted ICAR’s main servers in Delhi and Hyderabad, resulting in the loss of job application data, scientific project submissions, and internal communications.

To safeguard critical information against data breaches, users and organizations alike should regularly back up data, implement robust access controls, and ensure disaster recovery systems are fully functional and tested.

Security Tip of the Day

Protect Yourself Against Image-based Stegomalware

Attackers are embedding malicious code in image files and slipping them past your defenses without raising an eyebrow. This low-key but lethal method, known as image-based stegomalware, turns innocent-looking images into delivery vehicles for multi-stage attacks. 

Source: securiwiser.com

These image-based attacks often evade email filters by hiding in Word docs with macros or piggybacking on files that look legit. And once the loader code extracts the hidden payload, your network could be mining crypto, exfiltrating data, or worse, all without tripping a single alarm. Once they’re in, it’s game on.

Here’s what you can do to protect yourself against these threats.

Stegomalware Defense Tactics:

Hidden threats are getting harder to spot, but you don’t have to play blind—with the right strategy, even malware hiding behind a panda pic doesn’t stand a chance.

Meet Our Writer:

Leon Yen

Leon Yen is a cybersecurity expert and seasoned tech journalist with over a decade of experience, including founding a cyber risk startup and leading industry-focused research and reporting.

Secure your spotlight and Advertise in Cybersecurity Insider!

Cybersecurity Insider is a TechnologyAdvice business

© 2025 TechnologyAdvice, LLC. All rights reserved.

TechnologyAdvice, 3343 Perimeter Hill Dr., Suite 100, Nashville, TN 37211, USA.

Want to change how you receive these emails? Update your preferences or unsubscribe here.