SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 94

Key Takeaways

• Morpheus spyware ties to IPS Intelligence, targeting mobile communications.
• DarkSword and Coruna exploit iPhone vulnerabilities, undermining iOS security.
• Lotus Wiper attacks energy and utilities, raising sector-specific threats.
• NGate variant hides in compromised NFC payment app, expanding attack surface.
• Mirai botnet leverages CVE‑2025‑29635 to compromise D‑Link routers.

Pulse Analysis

Security newsletters like Security Affairs’ Malware Round 94 serve as an early‑warning system for cyber‑risk managers. By aggregating threat intel from vendors, researchers, and academic sources, the newsletter condenses a sprawling threat landscape into actionable insights. This curation is vital for organizations that lack dedicated threat‑hunting teams, allowing them to stay ahead of emerging malware families before they reach the production environment.

The latest edition spotlights several high‑impact campaigns. Morpheus, a new spyware, appears to be a surveillance tool tied to IPS Intelligence, suggesting state‑level espionage targeting mobile users. Meanwhile, the DarkSword and Coruna exploits demonstrate that iOS, once considered a fortress, now faces sophisticated zero‑day attacks capable of mass infection. In the energy sector, Lotus Wiper’s destructive payload threatens grid reliability, echoing the growing trend of sector‑specific wipers. The NGate variant’s concealment within a trojanized NFC payment app illustrates how financial‑service vectors are being weaponized, while Mirai’s exploitation of CVE‑2025‑29635 on D‑Link routers shows that legacy IoT devices remain a fertile ground for botnet expansion.

Beyond incident reporting, the newsletter references cutting‑edge research on malware detection, including few‑shot classification frameworks and provable defenses against evasion. These studies highlight a shift toward AI‑driven defenses that can adapt to rapidly mutating code. For security leaders, the takeaway is twofold: reinforce perimeter controls around mobile, IoT, and critical‑infrastructure assets, and invest in advanced analytics that leverage the latest academic breakthroughs. Proactive threat hunting, timely patching of known CVEs, and continuous monitoring of threat‑intel feeds are essential to mitigate the evolving malware threat landscape.