First million breached Ticketmaster records released for free

The cybercriminal acting under the name "Sp1d3r" gave away the first 1 million records that are part of the data set that they claimed to have stolen from Ticketmaster/Live Nation. The files were released without a price, for free. When Malwarebytes Labs first learned about this data breach, it...

Military-themed Email Scam Spreads Malware to Infect Pakistani Users

Cybersecurity researchers have shed light on a new phishing campaign that has been identified as targeting people in Pakistan using a custom backdoor. Dubbed PHANTOMSPIKE by Securonix, the unknown threat actors behind the activity have leveraged military-related phishing documents to activate the...

Was T-Mobile compromised by a zero-day in Jira?

A moderator of the notorious data breach trading platform BreachForums is offering data for sale they claim comes from a data breach at T-Mobile. The moderator, going by the name of IntelBroker, describes the data as containing source code, SQL files, images, Terraform data, t-mobile.com...

Exploit for CVE-2024-30270

This script is designed to exploit vulnerabilities in a Mailcow...

TVS Motor TVS Connect Security Breach

TVS Motor TVS Connect is an application for TVS motorcycle owners from TVS Motor India. A security vulnerability exists in TVS Motor TVS Connect v4.6.0, IOS v5.0.0, which originates from insecure handling of RSA key pairs. An attacker could exploit the vulnerability to access sensitive informatio...

AdminerEvo Security Breach

AdminerEvo is an open source database management tool in a single PHP file from AdminerEvo. A security vulnerability exists in AdminerEvo that originates from allowing an attacker to upload a table name "..." file to the root of the Adminer directory. An attacker exploiting this vulnerability cou...

Kostal PIKO security breach

Kostal PIKO is a series of solar inverter programs from Kostal. A security vulnerability exists in Kostal PIKO that stems from susceptibility to stored cross-site scripting XSS attacks that allow an attacker to inject HTML or JavaScript on a page...

UK Health Club Chain ‘Total Fitness’ Data Leak Exposes KYC and Card Data

UK-based health and fitness chain Total Fitness suffered a significant data breach leaving member photos, names, and even bank details vulnerable online. Learn how to protect yourself and what went wrong at Total Fitness...

Hacker Leaks Data of 33,000 Accenture Employees in Third-Party Breach

A hacker claims to have obtained contact details of 33,000 current and former employees of IT giant Accenture in a breach involving a third-party firm...

TikTok facing fresh lawsuit in US over children’s privacy

The Federal Trade Commission FTC has announced its referred a complaint against TikTok and parent company ByteDance to the Department of Justice. The investigation originally focused on Musical.ly which was acquired by ByteDance on November 10, 2017, and merged it into TikTok. The FTC started a...

TotalCloud Insights: Protect Your AWS Environment by Managing Access Keys Securely

Introduction With the average cost of a data breach coming in at $4.45M in 2023, safeguarding sensitive information and maintaining the security of cloud environments is more critical than ever. Instances of compromised access keys, not exclusive to AWS Amazon Web Services but prevalent across...

New Case Study: Unmanaged GTM Tags Become a Security Nightmare

Are your tags really safe with Google Tag Manager? If you've been thinking that using GTM means that your tracking tags and pixels are safely managed, then it might be time to think again. In this article we look at how a big-ticket seller that does business on every continent came unstuck when i...

IntelBroker Hacker Claims Apple Breach, Steals Source Code for Internal Tools

Notorious hacker IntelBroker claims to have breached Apple, stealing source code for internal tools. Learn about the alleged breach and IntelBroker's history of targeting major companies and government entities...

PrestaShop Security Breach

PrestaShop is an open source e-commerce solution from the American company PrestaShop. The solution provides multiple payment methods, short message alerts and product image zoom. PrestaShop Bulk Export products to Google Merchant - A security vulnerability exists in Google Shopping version 1.0.2...

PrestaShop Security Breach

PrestaShop is an open source e-commerce solution from the American company PrestaShop. The solution offers multiple payment methods, SMS alerts, and product image zoom, among other features. A security vulnerability exists in PrestaShop Help Desk - Customer Support Management System version 2.4.0...

AMD Data Breach: IntelBroker Claims Theft of Employee and Product Info

Advanced Micro Devices, Inc. AMD has apparently been breached by IntelBroker, a notorious hacker from the Breach Forums --- AMD has not yet confirmed the breach...

Insurance Giant ‘Globe Life’ Data Breach Impacting Consumers and Policyholders

Globe Life investigating data breach! Potential exposure of consumer information. Learn what data may be compromised, steps to take to protect yourself, and what to expect from Globe Life...

CVE-2024-6055

Improper removal of sensitive information in data source export feature in Devolutions Remote Desktop Manager 2024.1.32.0 and earlier on Windows allows an attacker that obtains the exported settings to recover powershell credentials configured on the data source via stealing the configuration fil...

Hackers Detail How They Allegedly Stole Ticketmaster Data From Snowflake

A ShinyHunters hacker tells WIRED that they gained access to Ticketmaster’s Snowflake cloud account—and others—by first breaching a third-party contractor...

A week in security (June 10 – June 16)

Last week on Malwarebytes Labs: Truist bank confirms data breach Update now! Google Pixel vulnerability is under active exploitation Adobe clarifies Terms of Service change, says it doesn’t train AI on customer content 23andMe data breach under joint investigation in two countries When things go...