Modified Zyklon and plugins from India

IntroductionStreams of malicious emails Talos inspects every day usually consist of active spamming campaigns for various ransomware families, phishing campaigns and the common malware family suspects such as banking Trojans and bots.. It is however often more interesting to analyze campaigns...

Cyber Crime Gang Arrested for Infecting Over 1 Million Phones with Banking Trojan

The Russian Interior Ministry announced on Monday the arrest of 20 individuals from a major cybercriminal gang that had stolen nearly $900,000 from bank accounts after infecting over one million Android smartphones with a mobile Trojan called "CronBot." Russian Interior Ministry representative Ri...

HSBC Mobile Banking - Base64 encoded String, Customized SSL, Dangerous filesystem permissions vulnerabilities

HackApp vulnerability scanner discovered that application HSBC Mobile Banking published at the 'play' market has multiple vulnerabilities...

The Uber platform coming out of authentication vulnerabilities, exploit the vulnerability can reset any account password-loophole warning-the black bar safety net

Italian security expert Vincenzo C. Aka found the Uber platform authentication vulnerabilities, any account can use this vulnerability to reset the password, this discovery yesterday officially announced. In fact, the initiator of the“authentication crisis”the vulnerability is in the seven months...

Hang Seng Personal Banking - Customized SSL, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Hang Seng Personal Banking published at the 'play' market has multiple vulnerabilities...

Great Southern Bank Great Southern Mobile Banking app SSL Certificate Validation Vulnerability

The Great Southern Bank Great Southern Mobile Banking app allows you to conveniently complete financial transactions from your mobile device: check balances, transfer funds, pay bills, find branches and ATMs. A security vulnerability exists in the Great Southern Bank Great Southern Mobile Banking...

Cyber Espionage is Alive and Well: APT32 and the Threat to Global Corporations

Cyber espionage actors, now designated by FireEye as APT32 OceanLotus Group, are carrying out intrusions into private sector companies across multiple industries and have also targeted foreign governments, dissidents, and journalists. FireEye assesses that APT32 leverages a unique suite of...

CVE-2016-4838

The CVE-2016-4838 issue affects Money Forward Android apps and related variants, including Money Forward for The Gunma Bank, SHIGA Bank, SHIZUOKA Bank, SBI Sumishin Net Bank, Tokai Tokyo Securities, THE TOHO Bank, YMFG, and related AppPass/au SMARTPASS/Chou Houdai, provided by Money Forward, Inc....

Stealing Voice Prints

This article feels like hyperbole: The scam has arrived in Australia after being used in the United States and Britain. The scammer may ask several times "can you hear me?", to which people would usually reply "yes." The scammer is then believed to record the "yes" response and end the call. That...

America's First Federal Credit Union Mobile Banking app for iOS Security Bypass Vulnerability

America's First Federal Credit Union Mobile Banking app for iOS is a mobile app for iOS from America's First Federal Credit Union FCU Bank, featuring quick access to manage bank accounts, manage balances, manage balances, pay bills, send money, and more. A security bypass vulnerability exists in...

Google said in the release“of the Android O”the new version will not fix the screen hijacking vulnerability-vulnerability warning-the black bar safety net

Millions of Android smartphones are suffering from a serious“screen hijacking”vulnerabilities, a hacker could steal user passwords, Bank details and help ransomware app to steal money. Google is claiming that publishing the“Android O”version does not fix the vulnerability The worst thing is that...

VÚB Mobile Banking - Customized SSL, Dangerous filesystem permissions vulnerabilities

HackApp vulnerability scanner discovered that application VÚB Mobile Banking published at the 'play' market has multiple vulnerabilities...

Google Won't Patch A Critical Android Flaw Before ‘Android O’ Release

Millions of Android smartphones are at serious risk of "screen hijack" vulnerability that allows hackers to steal your passwords, bank details, as well as helps ransomware apps extort money from victims. The worse thing is that Google says it won't be patched until the release of 'Android O'...

Touch 24 Banking BCR - Customized SSL, Dangerous filesystem permissions vulnerabilities

HackApp vulnerability scanner discovered that application Touch 24 Banking BCR published at the 'play' market has multiple vulnerabilities...

CVE-2017-3213

The Think Mutual Bank Mobile Banking app 3.1.5 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2017-5916

The America's First Federal Credit Union FCU Mobile Banking app 3.1.0 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2017-3213

The Think Mutual Bank Mobile Banking app 3.1.5 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Information disclosure

The Think Mutual Bank Mobile Banking app 3.1.5 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Information disclosure

The Great Southern Bank Great Southern Mobile Banking app before 4.0.4 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2017-5916

The America's First Federal Credit Union FCU Mobile Banking app 3.1.0 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...