Ankura CTIX FLASH Update - September 16, 2025

Malware Activity

Sophisticated Phishing and UEFI-Bypassing Ransomware

Recent cybersecurity developments reveal the rise of highly advanced and targeted malware platforms. VoidProxy, a sophisticated phishing-as-a-service platform, has gained prominence among cybercriminals due to its customizable phishing kits. The kits facilitate the creation of convincing fake login pages targeting Microsoft 365 and Google accounts. Its user-friendly interface and affordability have accelerated its adoption. This has led to a surge in credential theft campaigns. Employing techniques like dynamic domain generation and obfuscation, VoidProxy effectively evades detection, underscoring the escalating sophistication of phishing operations. Simultaneously, researchers have identified HybridPetya, a novel variant of the notorious Petya ransomware, capable of bypassing UEFI Secure Boot protections by exploiting a patched vulnerability (CVE-2024-7344). This bootkit hybrid can manipulate