SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 62

Security Affairs Malware newsletter Round 62, authored by Pierluigi Paganini, was published on 14 September 2025 and presents a collection of the best articles and research on malware in the international landscape, according to Security Affairs.

The roundup includes items such as npm debug and chalk packages compromised; GPUGate Malware, which uses hardware-specific decryption and abuses Google Ads to target Western Europe; Trojanized ScreenConnect installers evolving to drop multiple RATs on a single machine; Salt Typhoon and UNC4841 with silent domain discoveries urging defenders to check telemetry and log data;

KillSec Ransomware targeting healthcare institutions in Brazil; AsyncRAT in Action focusing on fileless malware techniques; ChillyHell, a modular macOS backdoor; Off Your Docker, exposing APIs targeted by new malware; and HybridPetya, a Petya/NotPetya copycat with UEFI Secure Boot bypass. The newsletter also highlights TraceRAG, a framework for explainable Android malware detection, and related research papers on malware classification and detection trends.

Follow-up items point to additional analyses and practical security insights, with the piece listing several related articles under Malware, Cyber Crime and Breaking News categories.