A critical security flaw (CVE-2025-5947, CVSS 9.8) has been discovered in the WordPress Service Finder theme that allows hackers to gain administrator access without a password. Over 6,100 sites using Service Finder versions 6.0 or earlier are vulnerable, and security researchers have already detected over 13,800 exploitation attempts in the wild. If you're using this theme, you need to update to version 6.1+ immediately and check if your site has been compromised. I've created a free PHP security scanner that will detect if you're vulnerable, scan your server logs for attack attempts, and provide .htaccess rules to block exploits - https://sevenlegend.io/?page=codes" target="_blank" rel="noopener">download it now from our code snippets page and run the check in under a minute. Don't wait until it's too late - this vulnerability could give attackers complete control of your website.
Everything we hear is an opinion, not a fact. Everything we see is a perspective, not the truth.
BatShadow’s “Vampire Bot” Targets Job Hunters — I’ve Got a PowerShell Fix
BatShadow is back with recruiter-themed lures: ZIPs that pair a legit-looking PDF with a booby-trapped LNK/EXE that quietly runs PowerShell to drop a Go-based Vampire Bot. Once in, it profiles the host, hides for persistence, and snap-shots your desktop (WEBP) while polling C2. I’ve published a PowerShell detector/cleaner you can use to find and remove it—grab it in my Papers section: https://sevenlegend.io/?page=papers">sevenlegend.io/?page=papers.
Source: https://www.aryaka.com/blog/batshade-vampire-bot-social-e...">Aryaka Threat Research Labs
Source: https://www.aryaka.com/blog/batshade-vampire-bot-social-e...">Aryaka Threat Research Labs
SORVEPOTEL: New WhatsApp Worm Targets Windows Users in Brazil
How It Works
The attack is deceptively simple but highly effective. SORVEPOTEL spreads through convincing phishing messages containing malicious ZIP file attachments. What makes this particularly concerning is its automated propagation mechanism: once a system is infected and WhatsApp Web is detected as active, the malware automatically distributes itself to every contact and group associated with the victim's account.
According to https://thehackernews.com/2025/10/researchers-warn-of-sel..." target="_blank" rel="noopener">The Hacker News report, the campaign is "engineered for speed and propagation" rather than traditional data theft or ransomware objectives. This focus on rapid spread makes it particularly dangerous in enterprise environments.
Enterprise Implications
One interesting detail caught my attention: the phishing messages specifically require users to open the malicious attachment on a desktop rather than mobile. This suggests the threat actors are deliberately targeting corporate networks where WhatsApp Web usage is common for business communication.
The automated spreading results in a high volume of spam messages, frequently leading to account suspensions or bans due to WhatsApp terms of service violations. But by the time the account is banned, the damage is done—the malware has already propagated to potentially hundreds of contacts.
Why This Matters
SORVEPOTEL represents a troubling evolution in malware distribution. By leveraging the trust users place in messaging platforms and contacts they know, attackers bypass traditional security awareness training. When a message comes from a colleague or business contact, users are far more likely to open attachments without scrutiny.
The campaign demonstrates how threat actors are increasingly exploiting legitimate communication platforms as attack vectors. WhatsApp, with its massive user base and enterprise adoption, provides an ideal environment for rapid, large-scale propagation with minimal user interaction required.
Protection Strategies
- Be extremely cautious with ZIP file attachments, even from known contacts
- Verify unusual requests through a secondary communication channel
- Keep WhatsApp and Windows systems fully patched
- Implement application whitelisting on enterprise systems
- Educate users about desktop-focused phishing attempts
- Monitor for unusual WhatsApp Web activity patterns
The Brazilian-focused nature of this campaign doesn't mean other regions are safe. Threat actors frequently test techniques in specific geographic areas before expanding globally. If SORVEPOTEL proves effective, we\'ll likely see variants targeting other regions soon.
For technical details and IOCs, read the https://thehackernews.com/2025/10/researchers-warn-of-sel..." target="_blank" rel="noopener">full Trend Micro analysis via The Hacker News.
The attack is deceptively simple but highly effective. SORVEPOTEL spreads through convincing phishing messages containing malicious ZIP file attachments. What makes this particularly concerning is its automated propagation mechanism: once a system is infected and WhatsApp Web is detected as active, the malware automatically distributes itself to every contact and group associated with the victim's account.
According to https://thehackernews.com/2025/10/researchers-warn-of-sel..." target="_blank" rel="noopener">The Hacker News report, the campaign is "engineered for speed and propagation" rather than traditional data theft or ransomware objectives. This focus on rapid spread makes it particularly dangerous in enterprise environments.
Enterprise Implications
One interesting detail caught my attention: the phishing messages specifically require users to open the malicious attachment on a desktop rather than mobile. This suggests the threat actors are deliberately targeting corporate networks where WhatsApp Web usage is common for business communication.
The automated spreading results in a high volume of spam messages, frequently leading to account suspensions or bans due to WhatsApp terms of service violations. But by the time the account is banned, the damage is done—the malware has already propagated to potentially hundreds of contacts.
Why This Matters
SORVEPOTEL represents a troubling evolution in malware distribution. By leveraging the trust users place in messaging platforms and contacts they know, attackers bypass traditional security awareness training. When a message comes from a colleague or business contact, users are far more likely to open attachments without scrutiny.
The campaign demonstrates how threat actors are increasingly exploiting legitimate communication platforms as attack vectors. WhatsApp, with its massive user base and enterprise adoption, provides an ideal environment for rapid, large-scale propagation with minimal user interaction required.
Protection Strategies
- Be extremely cautious with ZIP file attachments, even from known contacts
- Verify unusual requests through a secondary communication channel
- Keep WhatsApp and Windows systems fully patched
- Implement application whitelisting on enterprise systems
- Educate users about desktop-focused phishing attempts
- Monitor for unusual WhatsApp Web activity patterns
The Brazilian-focused nature of this campaign doesn't mean other regions are safe. Threat actors frequently test techniques in specific geographic areas before expanding globally. If SORVEPOTEL proves effective, we\'ll likely see variants targeting other regions soon.
For technical details and IOCs, read the https://thehackernews.com/2025/10/researchers-warn-of-sel..." target="_blank" rel="noopener">full Trend Micro analysis via The Hacker News.
My Own CMS Test
Decided to test my own CMS, who needs wordpress?