CVE-2018-20071

Insufficiently strict origin checks during JIT payment app installation in Payments in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to install a service worker for a domain that can host attacker controled files via a crafted HTML page...

Design/Logic Flaw

Insufficiently strict origin checks during JIT payment app installation in Payments in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to install a service worker for a domain that can host attacker controled files via a crafted HTML page...

Shipping operators, what you need to know about phishing and CEO fraud

Maybe second only to ransomware, the most likely type of attack a shipping operator will experience will be a phishing scam. Usually this will be carried out by email, or social media, or even messaging apps. It will likely include a link to what seems a plausible website, and/or have an...

Town of Salem Data Breach Exposes 7.6 Million Gamers' Accounts

A massive data breach at the popular online role-playing game 'Town of Salem' has reportedly impacted more than 7.6 million players, the game owner BlankMediaGames BMG confirmed Wednesday on its online forum. With the user base of more than 8 million players, Town of Salem is a browser-based game...

Town of Salem Data Breach Exposes 7.6 Million Gamers' Accounts

A massive data breach at the popular online role-playing game 'Town of Salem' has reportedly impacted more than 7.6 million players, the game owner BlankMediaGames BMG confirmed Wednesday on its online forum. With the user base of more than 8 million players, Town of Salem is a browser-based game...

Marriott Revises Breach Scope to 383M Records

Marriott has revised downward its estimate on the number of guests whose passport numbers and payment card data were impacted in its recent data breach. After the hospitality giant confirmed in November that there had been unauthorized access to its Starwood guest reservations database from 2014 ...

payment-processing-software.com XSS vulnerability

Open Bug Bounty ID: OBB-715060 Description| Value ---|--- Affected Website:| payment-processing-software.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3...

FTC Warns of Netflix Phishing Scam Making Rounds

The Federal Trade Commission FTC is warning of a new phishing scam reeling in Netflix customers and stealing their payment information. According to a post published by the FTC, Wednesday, the spotted scam purports to be an email from Netflix. The email claims that the victim’s account was put on...

Caribou Coffee, Bruegger’s Bagels Bitten by Breach

Hundreds of Caribou Coffee and Bruegger’s Bagels stores have been targeted in a point-of-sale POS system data breach that attempted to steal customers’ payment cards. Hackers gained unauthorized access to the company’s POS systems, exposing some customers’ data – including name and credit-card...

New email extortion scam warns “Pay $4,000 or a hitman is coming for you”

By Carolina In a new extortion scam, a cybercriminal is sending threatening emails to unsuspecting users asking them to pay a whopping $4,000 in Bitcoin or wait to be executed by a hitman. The email extortion scam surfaced on the Internet a few days ago and is currently arriving in victim's inbox...

Script Src Integrity Check

The remote host may be vulnerable to payment entry data exfiltration due to javascript included from potentially untrusted and unverified third parties script src. If the host is controlled by a 3rd party, ensure that the 3rd party is PCI DSS compliant. C Tenable Network Security, Inc...

Patched Click2Gov Flaw Still Afflicting Local Govs

A vulnerability in a popular municipality payment software, Click2Gov, has left hundreds of thousands of civilian payment cards compromised – and the hacks are ongoing, a new report found. Continual breaches of the vulnerable software have led to the compromise of at least 294,929 payment cards...

Fake Bomb Threat Emails Demanding Bitcoins Sparked Chaos Across US, Canada

"Pay $20,000 worth of bitcoin, or a bomb will detonate in your building" A massive number of businesses, schools, government offices and individuals across the US, New Zealand and Canada on Thursday received bomb threats via emails that caused nationwide chaos, forcing widespread evacuations and...

Fake Bomb Threat Emails Demanding Bitcoins Sparked Chaos Across US, Canada

"Pay $20,000 worth of bitcoin, or a bomb will detonate in your building" A massive number of businesses, schools, government offices and individuals across the US, New Zealand and Canada on Thursday received bomb threats via emails that caused nationwide chaos, forcing widespread evacuations and...

Security Bulletin: Financial Transaction Manager for Corporate Payment Services v2.1.1 is affected by a potential cross-site scripting (XSS) vulnerability (CVE-2018-1871)

Summary IBM Financial Transaction Manager for Corporate Payment Services FTM CPS for Multi-Platform v2.1.1 has addressed the following vulnerability. A potential cross-site scripting vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionali...

Security Bulletin: Financial Transaction Manager for Corporate Payment Services for Multi-Platform v2.1.1 is affected by vulnerabilities in IBM Java Runtime

Summary Financial Transaction Manager for Corporate Payment Services for Multi-Platform FTM CPS v2.1.1 has addressed the following vulnerability. There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version 7 that has addressed the applicable CVEs. Vulnerability Details CVEID:...

Bitcoin Bomb Scare Associated with Sextortion Scammers

This blog was written by Jaeson Schultz. Organizations across the country are on edge today after a flurry of phony bomb threats hit several public entities Thursday, such as universities, schools and news outlets, among others. The attackers distributed malicious emails claiming to have placed...

A week in security (December 3 – 9)

Last week on Malwarebytes Labs, we gave readers an FYI on multiple breaches that affected Humble Bundle, Quora, and Dunkin' Donuts, to name a few. This follows the announcement from Marriott about a four-year-long breach that impacted half a billion of its patrons. We also pushed out the report,...

What Happens When Victims Pay Ransomware Attackers?

For many hackers around the globe, ransomware infections have become a lucrative business. Although these types of malware samples have been around for years now, they continue to spur success - and high monetary profits - for attackers. In fact, according to a statement from U.S. Deputy Attorney...

Weak Password Vulnerability in Chengdu Zhihui Campus Security Payment Platform

Campus Secure Payment Platform is an internet and mobile internet financial application platform for domestic universities. A weak password vulnerability exists in the Campus Pay platform. An attacker can exploit the vulnerability to obtain sensitive information and also perform unauthorized...