Cisco has disclosed critical security vulnerabilities affecting Cisco Unified Contact Center Express (Unified CCX) that could enable unauthenticated, remote attackers to execute arbitrary commands, escalate privileges to root, and bypass authentication mechanisms. The vulnerabilities reside in the Java Remote Method Invocation (RMI) process and CCX Editor application, presenting severe risks to enterprise contact center deployments. […]
Elastic Security Labs has uncovered a sophisticated campaign deploying a newly identified loader, dubbed RONINGLOADER, that weaponizes legitimately signed kernel drivers to systematically disable Microsoft Defender and evade endpoint detection and response (EDR) tools. Attributed to the Dragon Breath APT group (APT-Q-27), this campaign demonstrates a significant evolution in attack sophistication, primarily targeting Chinese-speaking users […]
Security researchers have uncovered a critical vulnerability in Cursor, the AI-powered code editor, that allows attackers to inject malicious code through rogue Model Context Protocol (MCP) servers. Unlike VS Code, Cursor lacks integrity checks on its runtime components, making it vulnerable to tampering through MCP server registration. The attack works by registering a local MCP […]
NVIDIA has released critical security patches addressing two high-severity vulnerabilities in its NeMo Framework that could allow attackers to execute arbitrary code and escalate privileges on affected systems. The vulnerabilities affect all versions of the framework before 2.5.0, and users should update to 2.5.0 immediately. CVE ID Description CVSS Score Severity CVE-2025-23361 Improper control of […]
Cybercriminals are deploying sophisticated phishing campaigns that weaponize seemingly legitimate invoice emails to distribute Backdoor.XWorm is a dangerous remote-access trojan (RAT) capable of stealing sensitive credentials, recording keystrokes, and installing ransomware. Security researchers have uncovered an active malware distribution operation using Visual Basic Script attachments disguised as routine business correspondence, representing a dangerous evolution of social […]
Jamf Threat Labs has identified a new family of malicious stealers tracked as DigitStealer, representing a significant evolution in macOS-targeted malware. Unlike traditional infostealers that follow linear execution paths, DigitStealer introduced sophisticated multi-stage attack techniques, extensive anti-analysis checks, and novel persistence mechanisms, demonstrating the threat actors’ deep understanding of macOS architecture. The DigitStealer campaign begins […]
Cybersecurity researchers have uncovered a sophisticated campaign where threat actors abuse legitimate JSON storage services to deliver malware to software developers.
The campaign, known as Contagious Interview, represents a significant shift in how attackers are concealing malicious payloads within seemingly legitimate development projects.
By exploiting platforms such as JSON Keeper, JSONsilo, and npoint.io, threat actors have found a way to blend malicious code delivery into legitimate traffic, making detection increasingly difficult.
The Contagious Interview campaign has been active since at least 2023 and is aligned with Democratic People’s Republic of Korea (DPRK) actors.
The operation specifically targets software developers across Windows, Linux, and macOS systems, with particular focus on those working in cryptocurrency and Web3 projects.
The attackers’ goal is financial gain, aiming to steal sensitive information and digital assets from victims.
Initial access is gained through meticulously crafted social engineering tactics, where fake recruiters approach potential victims on job searching platforms like LinkedIn with compelling job opportunities.
The attack typically begins with a professionally crafted message from a fake recruiter claiming to represent a legitimate company working on real estate or Web3 projects.
Overview of the Contagious Interview malware campaign (Source – NVISO Labs)
After several messages exchanging pleasantries and discussing the role, the recruiter shares a demo project hosted on GitLab or GitHub as part of an interview assessment.
NVISO Labs security analysts identified that this approach successfully tricks developers into downloading and executing trojanized code.
Attack Mechanism
The demo projects appear legitimate, featuring detailed readme files and professional layouts that showcase real estate platforms or cryptocurrency applications, creating a convincing facade.
Once developers download and run the projects using Node.js, the infection chain begins. The real technical cleverness lies in how the malware is delivered.
Configuration files within these projects contain base64-encoded variables that mask JSON storage service URLs. When decoded, these variables reveal links to JSON Keeper or similar platforms hosting heavily obfuscated JavaScript code.
This code is automatically fetched and executed through legitimate Node.js operations, making it difficult for traditional security tools to catch the attack.
The obfuscated JavaScript fetches the BeaverTail infostealer, which specializes in stealing wallet information, system data, and browser extension information related to cryptocurrency.
Following BeaverTail execution, the InvisibleFerret Remote Access Tool is deployed in subsequent stages.
This modular framework, written in Python, carries multiple capabilities, including data exfiltration, system fingerprinting, and downloading additional payloads.
The attack chain continues through multiple stages, utilizing legitimate services like Pastebin and Railway to host payloads and evade detection.
What distinguishes this campaign is the attacker’s sophisticated use of legitimate infrastructure to avoid detection.
By hosting malware through widely used JSON storage services and code repositories, the threat actors ensure their traffic appears normal.
Organizations should exercise extreme caution when receiving unsolicited code from recruiters or any unknown sources.
Inspecting configuration files for suspicious API keys and monitoring Node.js execution behaviors can help identify and prevent similar attacks before the threat establishes itself within the network.
Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.
A new campaign leveraging Formbook malware has emerged, showcasing sophisticated multi-stage infection tactics that underscore the importance of analyzing more than just executable files during malware investigations. When teaching malware reverse-engineering in courses like SANS FOR610, it’s critical to addressed that reverse engineering applies to every component in the infection chain, not just PE or […]
Cisco has released security updates to address two critical vulnerabilities in Unified Contact Center Express (Unified CCX) that could allow unauthenticated attackers to execute arbitrary commands with root privileges and bypass authentication mechanisms.
The flaws, tracked as CVE-2025-20354 and CVE-2025-20358, affect the Java Remote Method Invocation (RMI) process and CCX Editor application, respectively.
Both vulnerabilities stem from improper authentication mechanisms and carry CVSS base scores of 9.8 and 9.4, earning a “Critical” severity rating from Cisco.
CVE-2025-20354 represents the more severe threat, enabling remote attackers to upload malicious files through the Java RMI process without authentication.
Successful exploitation enables attackers to execute arbitrary commands on the underlying operating system with root privileges, granting complete system control.
CVE-2025-20358 targets the CCX Editor application, allowing attackers to circumvent authentication by redirecting the authentication flow to a malicious server.
This tricks the CCX Editor into granting administrative permissions for script creation and execution. While exploitation results in access as an internal non-root user rather than root, attackers can still create and execute arbitrary scripts on the affected server.
Cisco Unified CCX Vulnerability
The vulnerabilities affect all Cisco Unified CCX deployments regardless of configuration. Cisco has confirmed that related products, including Packaged Contact Center Enterprise and Unified Contact Center Enterprise, are not impacted by these flaws.
The authentication bypass in CVE-2025-20358 exploits weaknesses in communication protocols between the CCX Editor and Unified CCX servers, while CVE-2025-20354 leverages insufficient validation in the Java RMI process to enable arbitrary file uploads.
Cisco has released patches for affected versions:
Cisco Unified CCX 12.5 SU3 and earlier: Upgrade to 12.5 SU3 ES07
Cisco Unified CCX 15.0: Upgrade to 15.0 ES01
No workarounds are available to mitigate these vulnerabilities. Cisco strongly recommends that organizations running affected versions upgrade to the fixed releases immediately to remediate the security risks fully.
Organizations using Cisco Unified CCX should prioritize patching these vulnerabilities given their critical severity and the potential for unauthenticated remote code execution.
The Cisco Product Security Incident Response Team reports no evidence of active exploitation or public proof-of-concept code at this time, providing a window for proactive remediation.
System administrators should verify their current Unified CCX versions and schedule maintenance windows to apply the security updates. Given the lack of workarounds, patching remains the only effective defense against these vulnerabilities.
Researchers at Group-IB have uncovered a sophisticated phishing framework that demonstrates how cybercriminals are industrializing credential theft through automation, evasion techniques, and Telegram-based data exfiltration. The kit targets explicitly Aruba S.p.A., an Italian IT services provider serving over 5.4 million customers, highlighting the significant financial and operational risks posed by modern phishing-as-a-service operations. The analyzed […]
.webp)
.webp)