A week in security (May 31 – June 6)

Last week on Malwarebytes Labs, we looked at an interesting trend in facial recognition technology—hint: its a slow fade, the latest ransomware attacks on JBS and Steamship Authority, Cobalt Strike, a Coronavirus phishing campaign, WhatsApp’s decision to not limit app functionalities for...

Cybercrime, fraud, and insider threats increased in 2020 in the UK, report says

Since the initial lockdown, we have seen the rise of certain types of cybercrime, including scams and fraud campaigns that either bank on the global COVID-19 pandemic or take advantage of potential victims that adhere to work-from-home measures. In the UK, the National Crime Agency NCA has...

A UK recruitment firm exposed sensitive applicants data for months

By Habiba Rashid The company was informed about the exposed data in December 2020 but it only responded and secured the data in March 2021. This is a post from HackRead.com Read the original post: A UK recruitment firm exposed sensitive applicants data for months...

Watch out! Android Flubot spyware is spreading fast

Using a proven method of text messages about missed deliveries, an old player on the Android malware stage has returned for an encore. This time it seems to be very active, especially in the UK where Android users are being targeted by text messages containing a link to a particularly nasty piece...

Don't Risk Getting Caught by Kr3pto Phishing Kits

Akamai's threat research team recently published a report showing that a new phishing toolkit named Kr3pto was targeting UK banking customers. A phishing kit is an all-in-one software package that lets just about anyone create and launch phishing attacks designed to steal user data by posing as a...

We’re Hiring!

Were growing and we need to fill these 5 UK based roles: PHP Full-Stack Developer Pen Testing Consultant Red Team Support Digital Forensic Analyst IT Support Technician You can find all the details here. We think were a good bunch and there are some really good perks. If you have the skills and...

US Sanctions Russia and Expels 10 Diplomats Over SolarWinds Cyberattack

The U.S. and U.K. on Thursday formally attributed the supply chain attack of IT infrastructure management company SolarWinds with "high confidence" to government operatives working for Russia's Foreign Intelligence Service SVR. "Russia's pattern of malign behaviour around the world – whether in...

The UK Is Trying to Stop Facebook's End-to-End Encryption

The government's latest attack is aimed at discouraging the company from following through with its planned rollout across platforms...

The UK Is Secretly Testing a Controversial Web Snooping Tool

The country passed its Investigatory Powers Act in 2016. Now, its building what could be the most powerful data collection system used by any democratic nation...

Is MFA a Security Illusion?

A recent Akamai Security blog post, Massive Campaign Targeting UK Banks Bypassing 2FA, written by my colleague Or Katz, is a great insight into how attackers used very simple techniques to bypass two-factor 2FA authentication security to obtain access to U.K. consumers' bank accounts...

Microsoft's Dream of Decentralized IDs Enters the Real World

The company will launch a public preview of its identification platform this spring—and has already tested it at the UK's National Health Service...

The state of stalkerware in 2020

The state of stalkerware in 2020 PDF Main findings Kasperskys data shows that the scale of the stalkerware issue has not improved much in 2020 compared to the last year: The number of people affected is still high. In total, 53,870 of our mobile users were affected globally by stalkerware in 2020...

Massive Campaign Targeting UK Banks Bypassing 2FA

On 14 July, 2020, Oliver Hough, a security researcher from Cyjax, published a report centered on a phishing campaign targeting banking customers in the United Kingdom, which evades two-factor authentication 2FA...

Annoyingly Believable Tax Refund Scam Targets Mobile

A text message-based tax scam is making the rounds in the U.K., in a probable harbinger of things to come as the U.S. tax season gets underway in earnest. SMS messages are going out to unsuspecting U.K. citizens claiming to be from Her Majesty’s Revenue and Customs HMRC, the country’s...

SquaredUp Cross-Site Request Forgery Vulnerability

Squaredup is a web service from Squaredup UK that provides data monitoring capabilities for cloud environments. A cross-site request forgery vulnerability exists in SquaredUp versions prior to 4.6.0, which can be exploited by an attacker to execute arbitrary code...

Squaredup has an unspecified vulnerability

Squaredup, a Web service from Squaredup UK that provides data monitoring capabilities for cloud environments, has a security vulnerability that could be exploited by attackers to guess a valid user name...

Star Computer Star Practice Management Web Access Control Error Vulnerability (CNVD-2021-56826)

Star Computer Star Practice Management Web is a web service from Star Computer UK that applies billing based on time.An access control error vulnerability exists in Star Practice Management Web version 2019.2.0.6, which could be exploited by an unauthorized The vulnerability can be exploited by a...

Star Computer Star Practice Management Web Access Control Error Vulnerability (CNVD-2021-56824)

Star Computer Star Practice Management Web is a web service used for time-based billing by Star Computer UK.An access control error vulnerability exists in Star Practice Management Web version 2019.2.0.6, which could be exploited by an attacker to The vulnerability can be exploited to change the...

Star Computer Star Practice Management Web Access Control Error Vulnerability (CNVD-2021-56823)

Star Computer Star Practice Management Web is a web service used for time-based billing by Star Computer UK.An access control error vulnerability exists in Star Practice Management Web version 2019.2.0.6, which could be exploited by an attacker to The vulnerability accesses details of unauthorize...

Star Computer Star Practice Management Web Access Control Error Vulnerability

Star Computer Star Practice Management Web is a web service used for time-based billing by Star Computer, a UK-based company. The vulnerability can be exploited to access the WIP details of unauthorized jobs...