ANALYZING EVOLUTION OF THE PIPEMAGIC MALWARE

Summary from the TLDR InfoSec newsletter

Kaspersky and BI.ZONE analyzed PipeMagic backdoor's evolution from 2022 to 2025, revealing new infections in Saudi Arabia and Brazil using fake ChatGPT apps, exploiting CVE-2025-29824 for privilege escalation. The malware now includes enhanced modules for asynchronous communication, payload injection, and .NET execution, with attackers using LSASS memory dumping for lateral movement across compromised networks.