What happened in Vegas (that you actually want to know about)
Summary: Cisco Talos identified a widespread malvertising campaign distributing a multi-stage malware framework it calls PS1Bot, which uses PowerShell and C# modules to steal information, log keystrokes, capture screenshots, and maintain persistent access, and which has been active and rapidly evolving throughout 2025. The newsletter also cites reports that Russian government hackers are allegedly behind a breach of the U.S. PACER court filing system, that the North Korean Kimsuky group suffered a data breach after two hackers leaked its data, and that a critical Citrix NetScaler flaw (CVE-2025-6543) was exploited against critical organizations in the Netherlands.
What's compelling: PS1Bot runs in memory, updates in modules, and targets browser-stored passwords and cryptocurrency wallets, so an infection can start from nothing more than a download clicked in a search result or ad.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Mentions
- CVE-2025-6543
- Related
- CVE-2025-6543: Citrix Net Scaler ADC and Gateway Buffer Overflow Vulnerability Known Exploited Vulnerabilities · Jun 30, 2025