Security Affairs newsletter Round 520 by Pierluigi Paganini – INTERNATIONAL EDITION
April 20, 2025 
A new round of the weekly SecurityAffairs newsletter arrived! Every week the best security articles from Security Affairs are free in your email box.
Enjoy a new round of the weekly SecurityAffairs newsletter, including the international press.
International Press – Newsletter
Pixel-Perfect Trap: The Surge of SVG-Borne Phishing Attacks
Threat actors misuse Node.js to deliver malware and other malicious payloads
Byte Bandits: How Fake PDF Converters Are Stealing More Than Just Your Documents
Man Helped Chinese Nationals Get Jobs Involving Sensitive US Government Projects
Unmasking the new XorDDoS controller and infrastructure
Malware
Malicious NPM Packages Targeting PayPal Users
New Malware Variant Identified: ResolverRAT Enters the Maze
Nice chatting with you: what connects cheap Android smartphones, WhatsApp and cryptocurrency theft?
BPFDoor’s Hidden Controller Used Against Asia, Middle East Targets
Gorilla, a newly discovered Android malware
Cascading Shadows: An Attack Chain Approach to Avoid Detection and Complicate Analysis
IronHusky updates the forgotten MysterySnail RAT to target Russia and Mongolia
**** Unmasking the new XorDDoS controller and infrastructure
***** Byte Bandits: How Fake PDF Converters Are Stealing More Than Just Your Documents
******Renewed APT29 Phishing Campaign Against European Diplomats
**** Goodbye HTA, Hello MSI: New TTPs and Clusters of an APT driven by Multi-Platform Attacks
******Slow Pisces Targets Developers With Coding Challenges and Introduces New Customized Python Malware
***** Threat actors misuse Node.js to deliver malware and other malicious payloads
**** Latest Mustang Panda Arsenal: ToneShell and StarProxy | P1
**** Latest Mustang Panda Arsenal: PAKLOG, CorKLOG, and SplatCloak | P2
***** Around the World in 90 Days: State-Sponsored Actors Try ClickFix
Malware analysis assisted by AI with R2AI
AOAFS: A Malware Detection System Using an Improved Arithmetic Optimization Algorithm
Hacking
Tycoon2FA New Evasion Technique for 2025
CVE-2025-30406 – Critical Gladinet CentreStack & Triofox Vulnerability Exploited In The Wild
Aiding reverse engineering with Rust and a local LLM
Apple fixes two zero-days exploited in targeted iPhone attacks
Task Scheduler– New Vulnerabilities for schtasks.exe
Over 16,000 Fortinet devices compromised with symlink backdoor
Notorious image board 4chan hacked and internal data leaked
Around the World in 90 Days: State-Sponsored Actors Try ClickFix
CVE-2025-24054, NTLM Exploit in the Wild
Intelligence and Information Warfare
Goodbye HTA, Hello MSI: New TTPs and Clusters of an APT driven by Multi-Platform Attacks
Taiwan charges Chinese ship captain with breaking subsea cables
Slow Pisces Targets Developers With Coding Challenges and Introduces New Customized Python Malware
Renewed APT29 Phishing Campaign Against European Diplomats
Gamaredon: The Turncoat Spies Relentlessly Hacking Ukraine
Latest Mustang Panda Arsenal: ToneShell and StarProxy | P1
Latest Mustang Panda Arsenal: PAKLOG, CorKLOG, and SplatCloak | P2
Cybersecurity
Making AI Work Harder for Europeans
Govtech giant Conduent confirms client data stolen in January cyberattack
CISA extends CVE program contract with MITRE for 11 months amid alarm over potential lapse
Google adds Android auto-reboot to block forensic data extractions
Pentagon’s ‘SWAT team of nerds’ resigns en masse
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, newsletter)