Security Affairs

MAY 30, 2022

Experts warn of a new ongoing WhatsApp OTP scam that could allow attackers to hijack users’ accounts through phone calls. Recently CloudSEK founder Rahul Sasi warned of an ongoing WhatsApp OTP scam that could allow threat actors to hijack users’ accounts through phone calls. Follow me on Twitter: @securityaffairs and Facebook.

Scams 145

Scams Accountability Mobile Hacking 145

Security Affairs

APRIL 6, 2022

Ukraine’s technical security and intelligence service warns of threat actors targeting aimed at gaining access to users’ Telegram accounts. State Service of Special Communication and Information Protection (SSSCIP) of Ukraine spotted a new wave of cyber attacks aimed at gaining access to users’ Telegram accounts.

Accountability 140

Accountability Phishing Passwords Hacking 140

Security Affairs

MAY 23, 2022

“I found that we can pass another tokens type, and this leads to stealing money from victim’s PayPal account.” “there are online services that let you add balance using Paypal to your account for example steam! I can use the same exploit and force the user to add money to my account!”

Accountability 136

Accountability Hacking Cybersecurity Information Security 136

Security Affairs

FEBRUARY 10, 2022

Spanish National Police has arrested eight alleged members of a crime organization who were able to steal money from the bank accounts of the victims through SIM swapping attacks. Once hijacked a SIM, the attackers can steal money, cryptocurrencies and personal information, including contacts synced with online accounts.

Banking 132

Banking Accountability Mobile Cryptocurrency 132

Krebs on Security

APRIL 20, 2023

3CX hired incident response firm Mandiant , which released a report on Wednesday that said the compromise began in 2022 when a 3CX employee installed a malware-laced software package distributed via an earlier software supply chain compromise that began with a tampered installer for X_TRADER , a software package provided by Trading Technologies.

Malware 322

Malware Software Technology Accountability 322

Krebs on Security

APRIL 27, 2023

Until being contacted by this reporter on Monday, the state of Vermont had at least five separate Salesforce Community sites that allowed guest access to sensitive data, including a Pandemic Unemployment Assistance program that exposed the applicant’s full name, Social Security number, address, phone number, email, and bank account number.

Banking 330

Banking Government Information Security Authentication 330

Security Affairs

DECEMBER 5, 2023

Microsoft warns that the Russia-linked APT28 group is actively exploiting the CVE-2023-23397 Outlook flaw to hijack Microsoft Exchange accounts. ” reads trhe announcement published by DKWOC. “Activities using CVE-2023-23397 were first discovered by CERT-UA[2] and publicly described by Microsoft[3].

Accountability 136

Accountability Government Phishing Authentication 136

Krebs on Security

MAY 22, 2023

Social networks are constantly battling inauthentic bot accounts that send direct messages to users promoting scam cryptocurrency investment platforms. Chaput said that at one point last week the volume of bot accounts being registered for the crypto spam campaign started overwhelming the servers that handle new signups at Mastodon.social.

Scams 284

Scams DDOS Cryptocurrency Accountability 284

Security Affairs

AUGUST 9, 2023

Cloud account takeover scheme utilizing EvilProxy hit over 100 top-level executives of global organizations EvilProxy was observed sending 120,000 phishing emails to over a hundred organizations to steal Microsoft 365 accounts. Proofpoint noticed a worrisome surge of successful cloud account compromises in the past five months.

Accountability 98

Accountability Phishing Authentication Architecture 98

Security Affairs

JULY 29, 2022

Recenlty Atlassian released security updates to address a critical hardcoded credentials vulnerability in Confluence Server and Data Center tracked as CVE-2022-26138. Once installed the Questions for Confluence app (versions 2.7.34, 2.7.35, and 3.0.2), a Confluence user account with the username “ disabledsystemuser ” is created.

Passwords 140

Passwords Accountability Hacking Ransomware 140

Security Affairs

JUNE 21, 2024

French information security agency ANSSI reported that Russia-linked threat actor Nobelium is behind a series of cyber attacks that targeted French diplomatic entities. The French information security agency ANSSI reported that Russia-linked APT Nobelium targeted French diplomatic entities.

Phishing 139

Phishing Accountability Information Security Cyber Attacks 139

Security Affairs

AUGUST 1, 2023

Researchers spotted a Python variant of the NodeStealer that was designed to take over Facebook business accounts and cryptocurrency wallets. The malicious code was designed to take over Facebook business accounts and steal funds from cryptocurrency wallets. ” reads the analysis published by Palo Alto Networks.

Accountability 98

Accountability Cryptocurrency Malware Phishing 98

Security Affairs

NOVEMBER 20, 2023

US teenager Joseph Garrison (19) has pleaded guilty to his involvement in a credential stuffing campaign that targeted user accounts at a fantasy sports and betting website.3 3 On or about November 18, 2022, the man launched a credential stuffing attack on the Betting Website and gained access to approximately 60,000 accounts.

Accountability 142

Accountability Hacking Passwords Cybercrime 142

SecureList

NOVEMBER 23, 2021

For example, a popular tactic in spyware attacks is now to send phishing e-mails from compromised corporate mail accounts of a partner organization of the intended victim. And plans to improve information security and introduce new protection tools and measures are predicated, in some way, on the chosen adversary model.

Spyware 142

Spyware Phishing Cybercrime Energy and Utilities 142

Krebs on Security

DECEMBER 1, 2022

While modern Microsoft Windows operating systems by default will ask users whether they want to run a downloaded executable file, many systems set up for remote administration by MSPs disable that user account control feature for this particular application. build and the then-canary 22.9

Phishing 284

Phishing Architecture Passwords Accountability 284

Security Affairs

FEBRUARY 11, 2022

One of the vulnerabilities is an elevation of privilege vulnerability in Microsoft Windows SAM (Security Accounts Manager) vulnerability. “An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.An ” reads the advisory published by Microsoft.

IoT 143

IoT Accountability Authentication Hacking 143

Krebs on Security

DECEMBER 19, 2024

The makers of Acunetix, Texas-based application security vendor Invicti Security , confirmed Silent Push’s findings, saying someone had figured out how to crack the free trial version of the software so that it runs without a valid license key. ” Orn advertising Araneida Scanner in Feb. 2023 on the forum Cracked.

Hacking 149

Hacking Cybercrime Advertising Data breaches 149

Security Affairs

SEPTEMBER 16, 2022

— Uber Comms (@Uber_Comms) September 16, 2022. According to the New York Times , the threat actors hacked an employee’s Slack account and used it to inform internal personnel that the company had “suffered a data breach” and provided a list of allegedly hacked internal databases.

Hacking 145

Hacking Data breaches Engineering Information Security 145

Security Affairs

FEBRUARY 1, 2024

Once hijacked a SIM, the attacker can steal money, cryptocurrencies and personal information, including contacts synced with online accounts. The criminals could hijack social media accounts and bypass 2FA services based on SMS used by online services, including financial ones. ” reads the press release published by DoJ.

Cryptocurrency 141

Cryptocurrency Computers and Electronics Accountability Scams 141

Security Affairs

APRIL 4, 2022

pic.twitter.com/BQSB2uV1JW — Life in DeFi (@lifeindefi) April 3, 2022. 1/ — Trezor (@Trezor) April 3, 2022. A statement shared by Mailchimp CISO Siobhan Smyth with TechCrunch revealed that the company discovered the security breach on March 26. You may want to warn everyone.

Phishing 141

Phishing Data breaches Cryptocurrency Social Engineering 141

Security Affairs

MAY 27, 2022

This exposure of sensitive credential and network access information, especially privileged user accounts, could lead to subsequent cyber attacks against individual users or affiliated organizations.” Crooks obtain the information by conducting spear-phishing and ransomware attacks, or other means.

Cybercrime 145

Cybercrime Education Accountability Phishing 145

Security Affairs

NOVEMBER 4, 2022

The Europen Agency for cybersecurity ENISA releases its ENISA Threat Landscape 2022 (ETL) report , which is the annual analysis of the state of the cybersecurity threat landscape. This is the 10 th edition of the annual report and analyzes events that took place between July 2021 and July 2022. ENISA Threat Landscape Report 2022.

Cyber threats 144

Cyber threats Phishing Social Engineering Ransomware 144

Security Affairs

JULY 9, 2022

Four of the fixed issues have been rated as a “high” severity, they are CVE-2022-26117, CVE-2021-43072, CVE-2022-30302, and CVE-2021-41031. Impacted products are FortiADC, FortiAnalyzer, FortiManager, FortiOS, FortiProxy, FortiClient, FortiDeceptor, FortiEDR, FortiNAC, FortiSwitch, FortiRecorder, and FortiVoiceEnterprise.

Authentication 145

Authentication Passwords Hacking Accountability 145

Security Affairs

OCTOBER 4, 2023

. “Atlassian has been made aware of an issue reported by a handful of customers where external attackers may have exploited a previously unknown vulnerability in publicly accessible Confluence Data Center and Server instances to create unauthorized Confluence administrator accounts and access Confluence instances.”

Software 144

Software Accountability Authentication Internet 144

Security Affairs

SEPTEMBER 8, 2023

The Cybersecurity and Infrastructure Security Agency (CISA), Federal Bureau of Investigation (FBI), and Cyber National Mission Force (CNMF) identified the presence of indicators of compromise (IOCs) at an Aeronautical Sector organization as early as January 2023. The vulnerability was addressed by the company on October 27th, 2022.

VPN 143

VPN Firewall Accountability Cybersecurity 143

Security Affairs

JUNE 5, 2022

“CertiK analysis reveals that this community manager, account –@BorisVagner (“BorisVagner | SBS” on Discord)– posted a message to BAYC’s Discord server with a phishing link that led to the fake site. — Bored Ape Yacht Club (@BoredApeYC) June 4, 2022. As a reminder, we do not offer surprise mints or giveaways.

Phishing 145

Phishing Hacking Accountability Scams 145

Security Affairs

JULY 4, 2024

Healthcare firm HealthEquity disclosed a data breach caused by a partner’s compromised account that exposed protected health information. Healthcare fintech firm HealthEquity disclosed a data breach after a partner’s compromised account was used to access its systems. million HSA accounts with $20.5

Healthcare 130

Healthcare Data breaches Accountability Insurance 130

Security Affairs

MAY 21, 2024

pic.twitter.com/5OUODUt3fu — Dominic Alvieri (@AlvieriD) May 20, 2024 The gang claims to have stolen 730GB of data from ATLAS, including Corporate data: Accounts, HR, Finance, Executive, department data, and users and employees’ data. Sunoco is the largest at 8 billion gallons.

Hacking 144

Hacking Ransomware Phishing Malware 144

CyberSecurity Insiders

JANUARY 14, 2022

“Information security analyst” tops the U.S. News & World Report 2022 Best Jobs list. The list ranks the 100 best jobs across 17 sectors including business, healthcare and technology, taking into account factors such as growth potential, salary and work-life balance. Tough Contenders.

Cybersecurity 142

Cybersecurity Healthcare Information Security CISO 142

Security Affairs

NOVEMBER 23, 2022

The operators behind the Ducktail information stealer continue to improve their malicious code, operators experts warn. The end goal is to hijack Facebook Business accounts managed by the victims. Between 2nd and 4th October 2022, the security firm discovered new DUCKTAIL samples being submitted to VirusTotal from Vietnam.

Malware 141

Malware Accountability Media Marketing 141

SecureList

DECEMBER 12, 2023

Every year is abundant with major data leaks, biggest data breaches and hacks drawing massive media attention (such as Medibank and Optus data breach, Twitter data breach, and Uber and Rockstar compromise in 2022 and in T-Mobile , MailChimp and OpenAI in 2023). But are we really conscious of the true scale of the threat?

Data breaches 125

Data breaches Accountability Telecommunications Malware 125

Security Affairs

AUGUST 16, 2024

The marketplace had been active since 2012, it was allowing sellers to offer stolen login credentials, including usernames and passwords for bank accounts, online payment accounts, mobile phone accounts, retailer accounts, and other online accounts. Those credentials were subsequently linked to $1.2

Banking 132

Banking Accountability Retail Mobile 132

Security Affairs

APRIL 1, 2022

OpRussia #DDoSecrets pic.twitter.com/kATuo2CxC1 — Anonymous TV (@YourAnonTV) March 31, 2022. MORE: [link] pic.twitter.com/RPVtDUMWdy — Anonymous TV (@YourAnonTV) March 31, 2022. OpRussia Defend Ukraine #Anonymous pic.twitter.com/gaMzlGbejT — Anonymous • News (@Anonymous_Link) March 31, 2022. Pierluigi Paganini.

Hacking 142

Hacking Government Banking Accountability 142

Security Affairs

JANUARY 13, 2022

Cisco fixed a critical privilege escalation vulnerability, tracked as CVE-2022-20658, in Unified CCMP and Unified CCDM. The CVE-2022-20658 received a CVSS score of 9.6, A successful exploit could allow the attacker to create Administrator accounts. the flaw is caused by the lack of server-side validation of user permissions.

Accountability 130

Accountability Hacking Information Security Cybersecurity 130

Security Affairs

APRIL 12, 2022

These contained information for millions of credit cards, bank account numbers and routing information, and the usernames and associated passwords needed to access online accounts.” ” According to Europol, the joint effort and intense information sharing were the key to the success of Operation TOURNIQUET.

Cybercrime 145

Cybercrime Banking Accountability Hacking 145

Security Affairs

APRIL 23, 2024

. “North Korean hacking organizations sometimes infiltrated defense companies directly, and their security is relatively low. Hacking into vulnerable defense industry partners and stealing the defense industry company’s server account information.

Hacking 129

Hacking Malware Accountability Technology 129

Security Affairs

FEBRUARY 22, 2024

during the Russian invasion of Ukraine that began in 2022. barely and cannot afford to leave the camp, nor to operate his own bank account but only to survive miserably. “ barely and cannot afford to leave the camp, nor to operate his own bank account but only to survive miserably. “

Scams 140

Scams Banking Computers and Electronics Accountability 140