Security Affairs

FEBRUARY 24, 2025

A botnet of 130,000+ devices is attacking Microsoft 365 accounts via password-spraying, bypassing MFA by exploiting basic authentication. SecurityScorecard researchers discovered a botnet of over 130,000 devices that is conducting password-spray attacks against Microsoft 365 (M365) accounts worldwide.

Passwords 119

Passwords Accountability Authentication Malware 119

Krebs on Security

NOVEMBER 1, 2024

The missive bore the name of the hotel and referenced details from their reservation, claiming that booking.com’s anti-fraud system required additional information about the customer before the reservation could be finalized. One post last month on the Russian-language hacking forum BHF offered up to $5,000 for each hotel account.

Phishing 259

Phishing Accountability Artificial Intelligence Cybercrime 259

Krebs on Security

OCTOBER 30, 2024

Change Healthcare says it has notified approximately 100 million Americans that their personal, financial and healthcare records may have been stolen in a February 2024 ransomware attack that caused the largest ever known data breach of protected health information. Image: Tamer Tuncay, Shutterstock.com. Last month, Sens. Mark Warner (D-Va.)

Healthcare 292

Healthcare Insurance Computers and Electronics Data breaches 292

Krebs on Security

JANUARY 7, 2025

Besieged by scammers seeking to phish user accounts over the telephone, Apple and Google frequently caution that they will never reach out unbidden to users this way. The phishers also abused legitimate Google services to send Tony an email from google.com, and to send a Google account recovery prompt to all of his signed-in devices.

Phishing 334

Phishing Cryptocurrency Accountability Social Engineering 334

Malwarebytes

NOVEMBER 22, 2024

Meta provided insight this week into the company’s efforts in taking down more than 2 million accounts that were connected to pig butchering scams on their owned platforms, Facebook and Instagram. Here’s what you can do to keep yourself safe: Don’t give scammers the information they need.

Accountability 130

Accountability Scams Cryptocurrency Identity Theft 130

Malwarebytes

NOVEMBER 14, 2024

Employees of these companies were tricked into clicking malicious attachments and links and filling in their email account login information on fake sites. The entered information went straight to the phishers and allowed the criminals to monitor the emails of those employees.

Accountability 143

Accountability Banking Internet Internet 143

Krebs on Security

NOVEMBER 19, 2024

The financial technology firm Finastra is investigating the alleged large-scale theft of information from its internal file transfer platform, KrebsOnSecurity has learned. The Telegram account that abyss0 listed in their sales thread appears to have been suspended or deleted. This is a developing story.

Data breaches 290

Data breaches Banking Cybercrime Advertising 290

Malwarebytes

APRIL 22, 2025

Cybercriminals are abusing Googles infrastructure, creating emails that appear to come from Google in order to persuade people into handing over their Google account credentials. The difference is that anyone with a Google account can create a website on sites.google.com. Instead create an account on the service itself.

Risk 145

Risk Accountability Scams Phishing 145

Security Affairs

APRIL 7, 2025

Cybercriminals exploit compromised accounts for EDR-as-a-Service (Emergency Data Requests – EDR), targeting major platforms According to a detailed analysis conducted by Meridian Group, an increasingly complex and structured phenomenon, commonly referred to as EDR-as-a-Service, is taking hold in the cybersecurity landscape.

Cybercrime 138

Cybercrime Social Engineering Accountability Government 138

Heimadal Security

MARCH 20, 2025

In early 2024, background checking service National Public Data was hit by a massive cyberattack that potentially compromised the sensitive, personal information of millions, or possibly even billions, of people around the world, including U.S. residents. A year later, new security threats have gained traction.

Data breaches 103

Data breaches Artificial Intelligence Accountability Cybersecurity 103

Krebs on Security

FEBRUARY 26, 2025

At the end of 2023, malicious hackers learned that many companies had uploaded sensitive customer records to accounts at the cloud data storage service Snowflake that were protected with little more than a username and password (no multi-factor authentication needed). AT&T reportedly paid a hacker $370,000 to delete stolen phone records.

Hacking 236

Hacking Government Identity Theft Accountability 236

Malwarebytes

APRIL 1, 2025

This update must be completed by 2025-03-16 to avoid any potential penalties or disruptions to your account. Once logged in, follow the prompts to review and confirm your tax information. Perhaps they’ll sell the details on the dark web, or use them for themselves to get access to your Microsoft accounts.

Scams 138

Scams Phishing Artificial Intelligence Social Engineering 138

Security Affairs

APRIL 9, 2025

The US Office of the Comptroller of the Currency (OCC) disclosed a major email breach compromising 100 accounts, undetected for over a year. The cybersecurity incident involved unauthorized access to emails via a compromised admin account. Affected accounts were disabled. The breach was confirmed on Feb. OCC on Feb.

Accountability 122

Accountability Banking Information Security Hacking 122

Malwarebytes

APRIL 9, 2025

The lawsuit claims that this gave Bathula login credentials for the victims’ personal accounts and systems, including bank accounts, emails, home surveillance systems, Dropbox accounts, Google Drives, dating applications, Google Nests, and iCloud accounts. This is not a good idea. Use multi-factor authentication.

Accountability 88

Accountability Spyware Passwords Password Management 88

Security Affairs

OCTOBER 14, 2024

US-based financial services company Fidelity Investments warns 77,000 individuals of a data breach that exposed their personal information. based financial services company Fidelity Investments is notifying 77,099 individuals that their personal information was compromised in an August cyberattack.

Data breaches 132

Data breaches Financial Services Accountability Hacking 132

Security Affairs

NOVEMBER 24, 2024

Stolen information offered for sale on the carding website included bank account, credit card, and debit card numbers and associated information for conducting transactions. seized $283,000 in cryptocurrency from an account linked to Sami as part of actions against the illicit activities of PopeyeTools.

Cybercrime 129

Cybercrime Cryptocurrency Banking Accountability 129

Krebs on Security

NOVEMBER 21, 2024

That Joeleoli moniker registered on the cybercrime forum OGusers in 2018 with the email address joelebruh@gmail.com , which also was used to register accounts at several websites for a Joel Evans from North Carolina. Click to enlarge.

Identity Theft 250

Identity Theft Phishing Cryptocurrency Accountability 250

Security Affairs

OCTOBER 28, 2024

French internet service provider (ISP) Free disclosed a cyber attack, threat actors allegedly had access to customer personal information. The seller listed two databases for sale one containing 19,192,948 customer accounts and another including 5.11 ” “Thus, this information should be taken cautiously until confirmed.

Cyber Attacks 124

Cyber Attacks Telecommunications Data breaches Banking 124

Security Affairs

APRIL 22, 2025

Japan s Financial Services Agency (FSA) warns of hundreds of millions in unauthorized trades linked to hacked brokerage accounts. billion yen Typically, attackers hijack victim accounts, sell held stocks, and use the proceeds to buy assets like Chinese stocks, which remain in the account post-attack.

Financial Services 119

Financial Services Passwords Accountability Antivirus 119

Krebs on Security

DECEMBER 19, 2024

The cracked software is being resold as a cloud-based attack tool by at least two different services, one of which KrebsOnSecurity traced to an information technology firm based in Turkey. “We have been playing cat and mouse for a while with these guys,” said Matt Sciberras , chief information security officer at Invicti.

Hacking 230

Hacking Cybercrime Advertising Data breaches 230

Security Affairs

DECEMBER 7, 2024

The 8Base ransomware group attacked Croatia’s Port of Rijeka, stealing sensitive data, including contracts and accounting info. The ransomware gang claims to have stolen sensitive data including accounting info and contracts. The Port of Rijeka (Luka Rijeka d.d.),

Ransomware 123

Ransomware Hacking Accountability Cyber Attacks 123

Schneier on Security

FEBRUARY 13, 2025

Meanwhile, only partially redacted names of CIA employees were sent over an unclassified email account. Next, the Office of Personnel Management—which holds detailed personal data on millions of federal employees, including those with security clearances— was compromised. After that, Medicaid and Medicare records were compromised.

Government 363

Government Artificial Intelligence Banking Software 363

Security Affairs

NOVEMBER 4, 2024

for phishing scams that stole millions by hacking email accounts. A Nigerian national was sentenced to 26 years in prison in the US for stealing millions by compromising the email accounts of real estate businesses. for phishing scams that resulted in the compromise of millions of email accounts.

Scams 123

Scams Phishing Identity Theft Accountability 123

Malwarebytes

OCTOBER 15, 2024

Broadly, Malwarebytes found that: 74% of people “consider US election season a risky time for personal information.” Distrust in political ads is broad—62% said they “disagree” or “strongly disagree” that the information they receive in US election-related ads is trustworthy. The reasons could be obvious.

Scams 138

Scams Identity Theft Cybercrime Accountability 138

The Last Watchdog

NOVEMBER 12, 2024

But the SEC’s latest actions underscore that failing to inform stakeholders about material risks and breaches is not an option. Stuart McClure, CEO, Qwiet AI McClure The SEC’s goal appears to be to hold these companies accountable to investors for any successful cyberattacks and expose the company’s lack of preparation and prevention.

CISO 263

CISO CSO Risk Cyber threats 263

Malwarebytes

NOVEMBER 12, 2024

All the company’s social media accounts haven’t been updated since 2023 at the latest. In 2023, cybercriminals put up information belonging to as many as seven million 23andMe customers for sale on criminal forums following a credential stuffing attack against the genomics company.

Insurance 145

Insurance Accountability Risk Data breaches 145

Krebs on Security

FEBRUARY 4, 2025

The email address used for those accounts was f.grimpe@gmail.com. — is registered at an address in Gan-Ner, Israel, but there is no ownership information about this entity. Constella says that email address is tied to a Twitter/X account for Shoppy Ecommerce in Israel. lol and nulled[.]it.

eCommerce 200

eCommerce Cybercrime Accountability Passwords 200

eSecurity Planet

MARCH 31, 2025

Fraudsters use increasingly sophisticated tactics from fake texts to deceptive emails and websites to steal Netflix users personal and financial information. One of the most common methods is smishing, which involves sending fraudulent text messages claiming your Netflix account has been locked due to suspicious activity.

Scams 108

Scams Artificial Intelligence Phishing Passwords 108

Security Affairs

DECEMBER 6, 2024

These tools, designed to enhance user experience, may have transmitted personal information to third-party vendors like Google and Meta (formerly Facebook). Impacts vary depending on users’ browsers, cookies, and third-party account activity. added Atrium Health. Affected individuals were notified in September.

Data breaches 110

Data breaches Identity Theft Accountability Technology 110

SecureWorld News

NOVEMBER 22, 2024

From the DOJ press release: "We allege that this group of cybercriminals perpetrated a sophisticated scheme to steal intellectual property and proprietary information worth tens of millions of dollars and steal personal information belonging to hundreds of thousands of individuals," said United States Attorney Martin Estrada. "As

Phishing 108

Phishing Identity Theft Cryptocurrency Cybercrime 108

Malwarebytes

MARCH 12, 2025

Google is spying on Android users, starting from even before they have logged in to their Google account. The researchers found that multiple identifiers are used to track the user of an Android handset, even before they have opened a Google app or signed in to their Google account.

Advertising 139

Advertising Accountability Marketing Engineering 139

Troy Hunt

NOVEMBER 13, 2024

I am interested in finding how my information ended up in your database. That last one seems perfectly reasonable, and fortunately, DemandScience does have a link on their website to Do Not Sell My Information : Dammit! So, he asked them: I seem to have found my email in your data breach. If, like me, you're part of the 99.5%

Data breaches 323

Data breaches Passwords B2B Technology 323

Krebs on Security

AUGUST 19, 2024

According to the breach tracking service Constella Intelligence , the passwords included in the source code archive are identical to credentials exposed in previous data breaches that involved email accounts belonging to NPD’s founder, an actor and retired sheriff’s deputy from Florida named Salvatore “Sal” Verini.

Passwords 355

Passwords Data breaches Accountability Data privacy 355

Krebs on Security

JANUARY 31, 2025

“Those payments would instead be redirected to a financial account the perpetrators controlled, resulting in significant losses to victims,” the DOJ wrote. “These tools were also used to acquire victim user credentials and utilize those credentials to further these fraudulent schemes.

Phishing 249

Phishing Cybercrime Advertising Malware 249

Security Affairs

OCTOBER 30, 2024

The malware allows operators to steal bank users’ sensitive information and money from their bank accounts. FakeCall is a banking trojan that uses voice phishing by impersonating banks in fraudulent calls to obtain sensitive information from victims.

Banking 130

Banking Malware Accountability Phishing 130

Malwarebytes

JANUARY 27, 2025

Stolen information The data breach at Change Healthcare is the largest healthcare data breach in US history. However, the exposed information may include: Contact information: Names, addresses, dates of birth, phone numbers, and email addresses. Consider not storing your card details. Set up identity monitoring.

Data breaches 124

Data breaches Healthcare Passwords Insurance 124

Malwarebytes

FEBRUARY 11, 2025

Another 4,800 could even read information from an Android devices Notifications bar to obtain the same info. With vigilance, safe behavior, and some extra support, you can avoid Android phishing apps and protect your accounts from cybercriminals. These Android phishing apps may sound high-tech, but they are not.

Phishing 127

Phishing Passwords Mobile Authentication 127