Ankura CTIX FLASH Update - April 25, 2025

Malware Activity

Cyber Warfare and Stealthy Threats

April 2025 saw a flurry of malicious activity across various digital fronts. Iranian-linked hackers, likely affiliated with the Islamic Revolutionary Guard Corps (IRGC), launched a cyberattack targeting Israeli infrastructure. The attack, which used sophisticated malware and involved preliminary reconnaissance, sought to disrupt operations and potentially cause damage. While the specific targets and extent of the damage are not yet fully known, the incident highlights the ongoing cyber warfare between Iran and Israel. Meanwhile, researchers have demonstrated a proof-of-concept (PoC) attack that leverages a malicious Chrome extension to steal session tokens from websites. This attack targets users who have specific, vulnerable websites open in a browser, tricking them into installing the extension. The extension then silently harvests session tokens, potentially allowing attackers to impersonate logged-in users