'Minecraft Mods' Attack More Than 1 Million Android Devices

Scammers are taking advantage of the Minecraft sandbox video game’s wild success by developing Google Play apps which appear to be Minecraft modpacks, but instead deliver abusive ads, according to researchers. Since July, Kaspersky researchers have found more than 20 of these apps and determined...

Attackers Target Porn Site Goers in ‘Malsmoke’ Zloader Attack

Cybercriminals are tricking adult website visitors – including sites such as bravoporn.com and xhamster.com – in malvertising attacks that redirect victims to malicious websites serving up malware. The campaign, which is part of a larger malvertising effort dubbed “malsmoke”, has been tracked...

Exposed Database Reveals 100K+ Compromised Facebook Accounts

Researchers have uncovered a wide-ranging global scam targeting Facebook users, after finding an unsecured database used by fraudsters to store the usernames and passwords of at least 100,000 victims. Researchers said that the cybercriminals behind the scam were tricking Facebook victims into...

New skimmer attack uses fake credit card form to steal data

By Sudais Asif The unique aspect of this attack is that WebSockets is used instead of other methods such as HTML tags to extract the information needed. This is a post from HackRead.com Read the original post: New skimmer attack uses fake credit card form to steal data...

Watch out: Fake celebrity endorsements advertising Bitcoin scam

By Waqas Bitcoin is on the rise once again, and investors are anxious to see just how high it will go. Scammers are doing whatever it takes to steal it from you. This is a post from HackRead.com Read the original post: Watch out: Fake celebrity endorsements advertising Bitcoin scam...

Over 2800 e-Shops Running Outdated Magento Software Hit by Credit Card Hackers

A wave of cyberattacks against retailers running the Magento 1.x e-commerce platform earlier this September has been attributed to one single group, according to the latest research. "This group has carried out a large number of diverse Magecart attacks that often compromise large numbers of...

CVE-2020-28055

A vulnerability in the TCL Android Smart TV series V8-R851T02-LF1 V295 and below and V8-T658T01-LF1 V373 and below by TCL Technology Group Corporation allows a local unprivileged attacker, such as a malicious App, to read & write to the /data/vendor/tcl, /data/vendor/upgrade, and...

Design/Logic Flaw

A vulnerability in the TCL Android Smart TV series V8-R851T02-LF1 V295 and below and V8-T658T01-LF1 V373 and below by TCL Technology Group Corporation allows a local unprivileged attacker, such as a malicious App, to read & write to the /data/vendor/tcl, /data/vendor/upgrade, and...

A new skimmer uses WebSockets and a fake credit card form to steal sensitive data

A new skimmer attack was discovered this week, targeting various online e-commerce sites built with different frameworks. As of the writing of this blog post, the attack is still active and exfiltrating data. Attackers are exploiting an expanding in-browser attack surface and continually evolving...

A New Skimmer Uses WebSockets and a Fake Credit Card Form to Steal Sensitive Data

A new skimmer attack was discovered this week, targeting various online e-commerce sites built with different frameworks. As I write this blog post, the attack is still active and exfiltrating data...

PT-2020-16915

Name of the Vulnerable Software and Affected Versions TCL Android Smart TV series V8-R851T02-LF1 versions V295 and below TCL Android Smart TV series V8-T658T01-LF1 versions V373 and below Description A local unprivileged attacker, such as a malicious App, can read and write to the /data/vendor/tc...

North Korean Hackers Used 'Torisma' Spyware in Job Offers-based Attacks

A cyberespionage campaign aimed at aerospace and defense sectors in order to install data gathering implants on victims' machines for purposes of surveillance and data exfiltration may have been more sophisticated than previously thought. The attacks, which targeted IP-addresses belonging to...

A week in security (October 26 – November 1)

We had a very busy week at Malwarebytes Labs. We offered advice on Googles patch for an actively exploited zero-day bug that affects Chrome users, our podcast talked about finding consumer value in Cybersecurity Awareness Month with Jamie Court, we provided guidance about keeping ransomware cash...

A week in security (October 12 – October 18)

Last week on Malwarebytes Labs, we looked at journalism’s role in cybersecurity on our Lock and Code podcast, gave tips for safer shopping on Amazon Prime day, and discussed an APT attack springing into life as Academia returned to the real and virtual campus environment. We also dug into potenti...

Information disclosure

The information disclosure vulnerability present in B&R GateManager 4260 and 9250 versions 9.0.20262 and GateManager 8250 versions 9.2.620236042 allows authenticated users to generate fake audit log messages...

CVE-2020-11644

CVE-2020-11644 affects B&R GateManager 4260/9250 (pre-9.0.20262 and pre-9.2.620236042 respectively) and GateManager 8250 (pre-9.2.620236042). The vulnerability arises from improper authentication that allows an authenticated attacker to generate fake audit log messages, enabling information expos...

BugPoC: LFI from bypassing image parser and faking HEAD response with redirection

Summary: add summary of the vulnerability By specially crafted request, a fake python3 http server and exploit.py we can read any files from the server Supporting Material/References: list any additional material e.g. screenshots, logs, etc. Bugpoc id: bp-HdMxEwwr bp-HdMxEwwr Bugpoc pass:...

fake-true.com Cross Site Scripting vulnerability OBB-1379137

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

Attacks Aimed at Disrupting the Trickbot Botnet

Over the past 10 days, someone has been launching a series of coordinated attacks designed to disrupt Trickbot, an enormous collection of more than two million malware-infected Windows PCs that are constantly being harvested for financial data and are often used as the entry point for deploying...

Beware: New Android Spyware Found Posing as Telegram and Threema Apps

A hacking group known for its attacks in the Middle East, at least since 2017, has recently been found impersonating legitimate messaging apps such as Telegram and Threema to infect Android devices with a new, previously undocumented malware. "Compared to the versions documented in 2017,...