ThreatsDay: AI-Powered Hacking, 370 Chrome Flaws, SonicWall Attacks, DNS Hijacking + 22 More Stories
Weekly threat roundup: XWorm phishing, GenieLocker ransomware, CastleLoader variants, ClickFix evolution, 370 Chrome
ThreatsDay bulletin reports multiple active threats including xplogs22 targeting Russia with XWorm phishing, Toy Ghouls deploying custom GenieLocker ransomware across Russian sectors, CastleLoader distributing Needle Stealer variants, and ClickFix evolving to use fileless WebDAV execution. Additional stories cover 370 Chrome vulnerabilities, SonicWall attacks, DNS hijacking campaigns, and abuse of reused credentials and exposed systems.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Kaspersky?
Get an email when a new story names Kaspersky, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThis bulletin highlights a dangerous convergence of active threats spanning phishing campaigns, custom ransomware deployment, credential reuse, fileless malware execution, and a record number of browser vulnerabilities — all occurring simultaneously. The breadth of attack vectors (XWorm phishing, GenieLocker ransomware, Needle Stealer, WebDAV-based fileless execution, and DNS hijacking) illustrates how threat actors are combining social engineering with technical exploitation to maximize impact. Reused credentials and exposed systems represent persistent, preventable weaknesses that continue to grant attackers easy entry. The 370 Chrome vulnerabilities alone represent a massive unpatched attack surface for any organization running outdated browsers. Organizations that lack timely patching cadences, credential hygiene practices, and phishing-resistant controls are disproportionately exposed to this wave of threats.
What helps against this
How we list vendors
- Phishing-resistant MFA
A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.
- Privileged access management (PAM)
Admin accounts stop being one stolen password away from control of everything.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — XWorm
- malware — LunaSpy
- malware — GenieLocker
- malware — CastleLoader
- malware — Needle Stealer
- malware — ClickFix
- malware — Formbook
- malware — Snake Keylogger