New Google Chrome mobile phishing scam can steal private data

By Uzair Amir Google Chrome’s mobile browser has been targeted with a relatively simple phishing technique by developer Jim Fisher. According to Fisher, the exploit involves tricking victims into handing over their private information by manipulating the trusted websites of the user. By using a...

Fake Jason Statham Bilks a Fan Out of Serious Money

English actor Jason Statham – a.k.a. “the Transporter” – is cozying up to people who like his Facebook page – or at least, someone purporting to be him is. A fraudster managed to bilk a vulnerable and unsuspecting Statham fan out of a “significant amount” of money after approaching her while she...

TomTom: Reflected XSS on www.tomtom.com

Summary: XSS on www.tomtom.com is very dangerous, if this vulnerability misused by Attacker to steal cookie it will be fatal for other users. Proof of Concept: - I tried to visit https://www.tomtom.com/enau/search/ - Then, search using keyword: TEST" - I realized double quote " is reflected - So,...

Wall Street Market reported to have exit scammed

Around April 20, many users reported that Wall Street Market, a broadly known dark net market, had executed an exit scam, and that any pending orders were unlikely to be completed. Scamming with enterprises involving Bitcoin is not unheard of, and dark net markets with centralized escrow are...

GoDaddy Shutters 15,000 Subdomains Tied to 'Snake Oil' Scams

Researchers at the security firm Palo Alto Networks worked with domain registrar and web hosting firm GoDaddy to shut down 15,000 subdomains pitching ‘snake oil’ products and other scams. The takedowns are linked to affiliate marketing campaigns peddling everything from weight-loss solutions and...

Wall Street market exit scam? Admins steal $30 million worth of crypto

By Uzair Amir Wall Street market vendors on the dark web are urging others not to deposit their coins. As you may know, a majority of the dark web users are migrating to the Wall Street marketplace after the closure of the Dream market. Initially, this migration was successful but now a significa...

A week in security (April 15 – 21)

Last week, Malwarebytes Labs revealed multiple giveaway online scam campaigns banking on the popularity and generosity of Ellen DeGeneres, weighed in on the hack that compromised legacy Microsoft email service accounts like Hotmail and MSN, explained what “like-farming” means and how to spot it o...

Ellen DeGeneres giveaway scam spreading on social media

Scammers are pushing multiple fake Facebook profiles of Ellen DeGeneres, popular US TV show host and producer, with the goal of tricking people into jumping through a few money-making hoops. This isn’t a sophisticated scam. It isn’t hacking the Gibson. It won’t be the focus of a cutting edge...

Romanian Duo Convicted of Malware Scheme Infecting 400,000 Computers

A Romanian duo has been convicted for infecting hundreds of thousands of computers with malware that scooped up credentials and financial information, and scamming victims out of millions of dollars. The two, Bogdan Nicolescu, 36, and Radu Miclaus, 37, were convicted by a federal jury in Ohio on...

How to identify & protect yourself from online dating scams

By Waqas The Internet is an addictive world due to its unlimited and lucrative opportunities for people from almost every facet of life. Some use the Internet to make money, some use it to keep in touch with their loved ones, and some to find love - and then there are those who use it for nefario...

A week in security (March 25 – 31)

Last week, we looked at plugin vulnerabilities, location tracking app problems, and talked about plain text password woes. We also looked at federal data privacy regulation and took a deep dive into BatMobi Adware. Other cybersecurity news Poisoned software update headache for ASUS Source: The...

WordPress Plugin WireFunnel Open Redirect Vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. An open redirection vulnerability exists in the WordPress plugin WireFunnel. An attacker can exploit the vulnerability to...

On the Trail of the Robocall King

An investigator set out to discover the source of one scammy robocall. Turns out, his target made them by the millions...

vBulletin 4.2.5 Member Map 1.1.2 Open Redirection

Exploit Title : vBulletin 4.2.5 Member Map 1.1.2 Open Redirection Author Discovered By : KingSkrupellos Team : Cyberizm Digital Security Army Date : 04/03/2019 Vendor Homepage : vbulletin.com dragonbyte-tech.com Software Information Link : dragonbyte-tech.com/store/member-map.229/ Software Affect...

Phishing Scam Cloaks Malware With Fake Google reCAPTCHA

A recently-discovered phishing scam was found peddling malware, using a new technique to mask its malicious landing page: A fake Google reCAPTCHA system. The campaign targeted a Polish bank and its users with emails, said researchers with Sucuri. These emails contained a link to a malicious PHP...

Crack hunting: not all it’s cracked up to be

People sometimes ask us in the forums if a keygen or software crack is safe to use. Sometimes, these programs do what they say on the tin. Other times, they’re not what they say they are. In this post, I’ll describe what happened when I went crack hunting, and why it is often unsafe to carry out...

Coffee Meets Bagel Dating App Warns Users of Breach

Popular dating app Coffee Meets Bagel has sent its users an email notifying them that their data may have been “acquired by an unauthorized party.” The news comes days after a massive database containing the information of around 6.2 million Coffee Meets Bagel users showed up on the Dark Web. Use...

Don’t Blame Employees who fall for a BEC scam!

The BBC reports that a media company based in Scotland is now suing a former employee who fell for a Business Email Compromise BEC scam. In the scam, the employee received emails which appeared to be from the managing director and requested wire transfers. The employee worked with her line manage...

Sextortion Bitcoin scam makes unwelcome return

Heads up: a particularly nasty sextortion Bitcoin scam from at least the middle of 2018 is making the rounds once again. The scam involves making use of old breach dumps, then emailing someone from the list and reminding them of their old password. When something lands in your mailbox with “Hey,...

Movie stream ebooks gun for John Wick 3 on Kindle store

We discovered a novel spam campaign over the weekend, targeting fans of John Wick on the Amazon Kindle store. The scam itself involves paying for what appears to be the upcoming third movie, turns into a bogus ebook, and goes on to hyperlink potential victims to a collection of third-party...