Ankura CTIX FLASH Update - July 22, 2025

Malware Activity

From Sophisticated Authentication Bypasses to Stealthy Resource Exploitation

Recent cybersecurity research reveals a convergence of advanced attack strategies targeting digital authentication and e-commerce platforms. The PoisonSeed phishing campaign exploits the cross-device sign-in feature of WebAuthn to bypass FIDO2 protections without exploiting protocol vulnerabilities. Effectively tricking users into approving malicious sessions through QR codes and Bluetooth-based authorization. Meanwhile, a global surge in JavaScript-based cryptocurrency miners, reminiscent of the CoinHive era but more covert, infects over 3,500 websites. It leverages obfuscated scripts to hijack device resources for mining purposes. Attackers are also targeting e-commerce sites, injecting malicious scripts and backdoored plugins to facilitate data theft, spam distribution, and search ranking manipulation. These sophisticated techniques highlight a growing trend