SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 63

Security Affairs Malware newsletter Round 63 is a curated collection of malware-focused articles and research from across the international landscape, compiled for readers by Pierluigi Paganini on 21 September 2025. The roundup highlights SmokeLoader rising from the ashes, and Hive0154 (aka Mustang Panda) delivering an updated Toneshell backdoor alongside a novel SnakeDisk USB worm.

It also features a supply chain alert about the popular Tinycolor npm package being compromised in a attack affecting 40+ packages, and coverage of self-replicating Shai-hulud worm spreading token-stealing malware on npm.

Additional items include FileFix in the wild leveraging steganography, and Satori Threat Intelligence Alert describing SlopAds fraud with layers of obfuscation, with an official notice about a malware analysis report on a malicious listener targeting Ivanti Endpoint Manager Mobile Systems, according to CISA. The edition closes by listing related reading on topics from GitHub Pages impersonation to large-language-model–related malware research, and invites readers to follow Security Affairs for more.