A week in security (June 27 – July 3)

Last week on Malwarebytes Labs: Ransomware review: June 2022 AstraLocker 2.0 ransomware isn’t going to give you your files back YTStealer targets YouTube content creators ZuoRAT is a sophisticated malware that mainly targets SOHO routers Amazon Photos vulnerability could have given attackers acce...

Instagram introduces new ways for users to verify their age

If Instagram suspects you are fibbing about your age, youll currently see the following message: “You must be at least 13 years old to have an Instagram account. We disabled your account because you are not old enough yet. If you believe we made a mistake, please verify your age by submitting a...

CVE-2017-20087

A vulnerability, which was classified as problematic, has been found in Alpine PhotoTile for Instagram Plugin 1.2.7.7. Affected by this issue is some unknown functionality. The manipulation leads to basic cross site scripting. The attack may be launched remotely...

Cross site scripting

A vulnerability, which was classified as problematic, has been found in Alpine PhotoTile for Instagram Plugin 1.2.7.7. Affected by this issue is some unknown functionality. The manipulation leads to basic cross site scripting. The attack may be launched remotely...

CVE-2017-20087

CVE-2017-20087 affects Alpine PhotoTile for Instagram Plugin 1.2.7.7. The issue is a basic cross-site scripting vulnerability in unknown functionality, potentially exploitable remotely. CVSSv3.1 base score 6.1 (NETWORK, LOW complexity, NONE privileges, UI=REQUIRED, scope changed; Confidentiality/...

CVE-2017-20087 Alpine PhotoTile for Instagram Plugin cross site scriting

A vulnerability, which was classified as problematic, has been found in Alpine PhotoTile for Instagram Plugin 1.2.7.7. Affected by this issue is some unknown functionality. The manipulation leads to basic cross site scripting. The attack may be launched remotely...

CVE-2017-20087 Alpine PhotoTile for Instagram Plugin cross site scriting

A vulnerability, which was classified as problematic, has been found in Alpine PhotoTile for Instagram Plugin 1.2.7.7. Affected by this issue is some unknown functionality. The manipulation leads to basic cross site scripting. The attack may be launched remotely...

WordPress Plugin Alpine PhotoTile for Instagram 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin ... A cross-site scripting...

Malicious code in @instagram/fetlife-assets (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fe4b9e5aa6f6f4f26f1e83805287a2ddb9704764cb0a30ec137371bbb1df47e9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-359 Malicious code in @instagram/fetlife-assets (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fe4b9e5aa6f6f4f26f1e83805287a2ddb9704764cb0a30ec137371bbb1df47e9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Instagram scam steals your selfies to trick your friends

What would you do if a friend of yours set up a NSFW account, and then used it to follow you on Instagram? Would you check it out? We recently learned of a group of friends who had to ask themselves exactly that. Fortunately, they realised that something was off. The account wasnt the real owners...

Socialhunter - Crawls The Website And Finds Broken Social Media Links That Can Be Hijacked

Crawls the given URL and finds broken social media links that can be hijacked. Broken social links may allow an attacker to conduct phishing attacks. It also can cost a loss of the company's reputation. Broken social media hijack issues are usually accepted on the bug bounty programs. Currently, ...

GHSA-GCV6-2V9C-RJ48 Cosenary Instagram-PHP-API contains reflected XSS vulnerability

cosenary Instagram-PHP-API aka Instagram PHP API V2, used in the UserPro plugin through 4.9.32 for WordPress, is vulnerable to cross-site scripting via the example/success.php errordescription parameter. Vulnerable code: php if isset$GET'error' echo 'An error occurred: ' . $GET'errordescription';...

Cosenary Instagram-PHP-API contains reflected XSS vulnerability

cosenary Instagram-PHP-API aka Instagram PHP API V2, used in the UserPro plugin through 4.9.32 for WordPress, is vulnerable to cross-site scripting via the example/success.php errordescription parameter. Vulnerable code: php if isset$GET'error' echo 'An error occurred: ' . $GET'errordescription';...

Instagram verification services: What are the dangers?

Instagram, like other social platforms, has a verification system for high profile accounts. A verified badge means Instagram has confirmed that the account is the authentic presence of a public figure, celebrity or brand. Have you ever wanted to get your own account verified? We noticed a large...

A week in security (May 2 – 8)

Last week on Malwarebytes Labs: Google, Apple, and Microsoft step hand in hand into a passwordless future OpenSea warns of Discord channel compromise Avoid these Instagram “Get rich with Bitcoin” scams Steer clear of fake premium mobile app unlockers How Instagram scammers talk users out of their...

Steer clear of these Instagram “Get rich with Bitcoin” scams

I don’t know about you, but I open Instagram to look at cool photos of pets, not to make a fortune via suspicious claims of riches by strangers. Despite this, following someone whose photos I liked resulted in a very peculiar message. It’s possible I waved goodbye to a path to untold riches. Mayb...

How Instagram scammers talk users out of their accounts

If youve dealt with a scammer, youll know that making up stories is their bread and butter. Think about it: Just when you thought youd heard all the infamous 419 scam backstories, scammers surprise you with a "stuck astronaut" scam, something so utterly hilarious, nonsensical, and otherworldly th...

Osinteye - Username Enumeration And Reconnaisance Suite

Username Enumeration And Reconnaisance Suite Supported sites PyPI Github TestPypi About.me Instagram DockerHub Installation Clone project: $ git clone https://github.com/rly0nheart/osinteye.git $ cd osinteye $ pip install -r requirements.txt Usage $ python osinteye --SITENAME USERNAME Or give...

Warning! Instagram Stories hides a scam in plain sight

When someone finds their social media account compromised, they first think about letting their followers know. And they do. They warn others from reading any strange posts, usually containing a rogue link, before they sort out the matter behind the scenes. Some curious followers who missed these...