CISA and FBI issue alert about Zeppelin ransomware

The Federal Bureau of Investigation FBI and the Cybersecurity and Infrastructure Security Agency CISA have released a joint Cybersecurity Advisory CSA about Zeppelin ransomware. The advisory contains indicators of compromise IOCs and tactics, techniques, and procedures TTPs associated with...

Phishy calls and emails play on energy cost increase fears

Gas and electricity price concerns are rife at the moment, with spiralling costs and bigger increases waiting down the line. Sadly this makes the subject valuable material for fraudsters, playing into peoples fears with a dash of social engineering to make them worse off than they were previously...

Elden Ring maker Bandai Namco hit by ransomware and data leaks

Its not been a great couple of months for gaming giant Bandai Namco. The name behind smash hit titles like Elden Ring and Dark Souls has endured a long run of cheats and hacks. Hacking concerns led to Remote Code Execution issues, and multiplayer features in Souls titles were disabled for months...

Europe threatens to ban Facebook over data transfers to the US

If regulators have their way, data transfers from Facebook and Instagram between Europe and the United States could stop this summer. WhatsApp, another Meta service, will not be affected by the decision as it has a different data controller within Meta. This could force Meta, Facebooks parent...

HackerOne insider fired for trying to claim other people’s bounties

The vulnerability disclosure platform HackerOne has revealed that one of their staff members had improperly accessed security reports for personal gain. The—now former—staff member approached HackerOne customers with vulnerabilities that belonged to users of the platform. HackerOne HackerOne acts...

When good-faith hacking gets people arrested, with Harley Geiger: Lock and Code S03E14

When Lock and Code host David Ruiz talks to hackers—especially good-faith hackers who want to dutifully report any vulnerabilities they uncover in their day-to-day work—he often hears about one specific law in hushed tones of fear: the Computer Fraud and Abuse Act. The Computer Fraud and Abuse Ac...

AstraLocker 2.0 ransomware isn’t going to give you your files back

Reversing Labs reports that the latest verison of AstraLocker ransomware is engaged in a a so-called "smash and grab" ransomware operation. Smash and grab is all about maxing out profit in the fastest time. It works on the assumption by malware authors that security software or victims will find...

Amazon Photos vulnerability could have given attackers access to user files and data

Amazon has patched a flaw in the Amazon Photos app which could have allowed an attacker to steal and use a users unique access token that verifies their identity across multiple Amazon APIs. That would give attackers access to a trove of information, since many of these APIs contain personal data...

Internet Safety Month: Everything you need to know about Omegle

Omegle reached the heady heights of fame when everyone least expected it. Thanks to TikTok influencers, children flocked to this 13-year-old platform during the pandemic, unaware of the dangers already there. The concept of talking to strangers online is Omegles main selling point, but its not ne...

It’s official, today you can say goodbye to Internet Explorer. Or can you?

Today, the Internet Explorer IE 11 desktop application goes out of support and will be retired for certain versions of Windows 10. The retirement consists of two phases. During the first phase—the redirection phase—devices will be progressively redirected from IE to Microsoft Edge over the...

Taking down the IP2Scam tech support campaign

Tech support scams follow a simple business model that has not changed much over the years. After all, why change a recipe that continues to yield large profits. We see countless such campaigns and block them indiscriminately to protect our customers from being defrauded by a fraudulent tech...

A week in security (June 6 – June 12)

Last week on Malwarebytes Labs: FBI warns of scammers soliciting donations for Ukraine Microsoft autopatch is here…but can you use it? Prometheus ransomwares flaws inspired researchers to try to build a near-universal decryption tool Rotten apples banned from App store Hackers can take over...

Rotten apples banned from the App store

Apple’s App Review process may have received ill wishes from many benevolent developers, but Apple has now revealed how effective it is and why it is so stringent. According to its review of the year 2021, Apple protected customers from nearly $1.5 billion in potentially fraudulent transactions,...

Phishing mail claims a 3D Secure upgrade is required

Today we took a look at a phishing mail pinning its hopes on a QR code linking to a bogus website. Scammers claim that your mail address has "not been registered for the 3D Secure Security Update". 3D Secure phishing mail The mail reads as follows: Dear Sir / Madam, Our administration has shown...

WhatsApp accounts hijacked by call forwarding

In a short post on LinkedIn Rahul Sasi, founder and CEO of CloudSEK, explains how WhatsApp account takeovers are possible. The methods consists of several steps and it takes some social engineering skills, but it’s good to be aware of the possibility and how it works. It starts with the threat...

How the Saitama backdoor uses DNS tunnelling

Thanks to the Malwarebytes Threat Intelligence Team for the information they provided for this article. Understandably, a lot of cybersecurity research and commentary focuses on the act of breaking into computers undetected. But threat actors are often just as concerned with the act of breaking o...

Custom PowerShell RAT targets Germans seeking information about the Ukraine crisis

This blog post was authored by Hossein Jazi and Jérôme Segura Populations around the world—and in Europe in particular—are following the crisis in Ukraine very closely, and with events unfolding on a daily basis, people are hungry for information. Although all countries have reasons to be...

Russia continues digital onslaught against Ukrainian systems

According to Microsoft, at least six Kremlin-backed hacking groups have been attacking Ukraine in the digital space in an onslaught that began before the invasion in late February. The company counted more than 237 cyberattack operations against Ukrainian systems and critical infrastructure. Thes...

Fake USA for UNHCR site wants your Ukraine donations in Bitcoin

Since Russia began invading Ukraine in late February, many organizations have set up donation pages to aid the most heavily affected: Families who were forced out of their homes due to bombings and children separated from grown-ups who decided to stay and take arms. Weve also seen a considerable...

Stalkerware-type detections hit record high in 2021, but fell in second half

After having tracked stalkerware for years, Malwarebytes can reveal that in 2021, detections for apps that can non-consensually monitor another persons activity reached their highest peak ever, but that, amidst the record-setting numbers, the volume of detections actually began to significantly...

Steer clear of this “TestNTrace” SMS spam

Yesterday I received an SMS from “TestNTrace”, with the message resembling an official NHS communication: The text reads as follows: NHS: You’ve been in close contact with a person who has contracted the Omicron variant. Please order a test kit via: URL redacted Well, that’s an alarming thing to...

USPS “Your package could not be delivered” text is a smishing scam

A scam is doing the rounds which begins with a text from what claims to be the US Postal Service. The SMS reads as follows: "U.S. Postal Service We’re sorry to let you know that your package could not be delivered. To reschedule a delivery please visit bitdotly" I’ve never received an SMS from th...

Why identity management matters

Today is Identity Management Day, which aims to inform the public about the dangers of casually or improperly managing and securing digital identities. The day was started in 2021 and is hosted by the Identity Defined Security Alliance IDSA and National Cybersecurity Alliance. Digital identity A...

Update now! Google launches Chrome version 100 and fixes 28 vulnerabilities

Google has launched Chrome version 100 which, among other things, fixes 28 vulnerabilities. Other new security features include Safety Check, Enhanced Safe Browsing, and the ability to control website access to your location and device. Of the 28 vulnerabilities, none have been marked as critical...

Online Safety Bill’s provisions for “legal but harmful” content described as “censor’s charter”

The UKs Online Safety Bill, a landmark piece of legislation that that aims to regulate the countrys online content, has just been introduced into Parliament after undergoing significant revisions. The bill has been in progress for about five years and its main objective is to regulate online...

DDoS barrage against Israel described as the “largest ever” cyberattack its faced

Several government websites in Israel—those using the .gov.il domain—were inaccessible after a distributed denial of service DDoS attack hit Israels telecommunication provider, Cellcom. NetBlocks, a network disruption watchdog, initially detected "a significant disruption" aimed at the provider,...

Biden wants stronger privacy protections, no targeted ads for children

On March 1, US President Joe Biden gave his first State of the Union Address SOTU speech to Congress. In it, Biden highlighted the dire need to get help for teens with mental health issues. He demanded tech companies implement more robust privacy protections for kids and teens using their online...

How to speed up your computer or laptop

Why do machines always throw a tantrum when you are in a hurry? It’s called Murphy’s Law which some people may know as the butter side down rule. Anything that can go wrong will go wrong. And usually at a time when it is most inconvenient. That being said, there are ways to speed things up. Let’s...

Big Mother is watching: What parents REALLY think about tracking their kids

Every year on Data Privacy Day, we’re greeted with countless arguments about the absolute merits of data privacy protections good, invasions bad, but we rarely see a faithful, factual accounting for the biggest data privacy conundrum facing billions of people every single day: Should parents inva...

A week in security (January 17 — 23)

Last week on Malwarebytes Labs: CISA calls for urgent action against critical threats Red Cross begs attackers to “Do the right thing” after family reunion service compromised Update now! Chrome patches critical RCE vulnerability in Safe Browsing Combatting SMS and phone fraud: UK government issu...

Google and Facebook fined $240 million for making cookies hard to refuse

French privacy watchdog, the Commission Nationale de lInformatique et des Libertés CNIL, has hit Google with a 150 million euro fine and Facebook with a 60 million euro fine, because their websites—google.fr, youtube.com, and facebook.com—dont make refusing cookies as easy as accepting them. The...

The Internet is not safe enough for women, and Sue Krautbauer has some ideas about why: Lock and Code S02E22

Decades ago, the promise of the Internet was clear: No one, depending on their age, gender, race, income, or place of birth, would be unwelcome from expressing their thoughts and ideas. Today, that promise has been largely unfulfilled. As Malwarebytes discovered earlier this year, the Internet is...

Patch now to bypass Firefox add-ons that abuse the proxy API to deny updates

In a Firefox security announcement, Mozilla said 455,000 users have downloaded Firefox add-ons that interfere with how they connect to the internet. The interference in itself was not the deciding factor, however. The add-ons abused the proxy API to prevent users who had installed them from...

Google to auto-enrol users, YouTubers into 2SV

Googles announced some changes to how its helping millions of its users stay safe and secure. The biggest of those changes is that it plans to auto-enrol its users in to two-step verification, or 2SV. 2SV adds an extra layer when logging into your account and the additional step happens after you...

Facebook shoots own foot, hits Instagram and WhatsApp too

Mark Zuckerberg was left counting the personal cost of bad PR yesterday about $6 billion, according to Bloomberg on a day when his company couldnt get out of the news headlines, for all the wrong reasons. The billionaire Facebook CEOs bad day at the office started with whistleblower Frances Hauge...

Parts of the Dark Web “awash” with school children’s personal data

NBC News has collected and analyzed a trove of childrens personal information it discovered on the Dark Web. Even though this information may not be as useful to cybercriminals as credit card details or login credentials, the information is still out there, where we don’t want it. So what is it,...

Why backups aren’t a “silver bullet” against ransomware, with Matt Crape: Lock and Code S02E17

A recent spate of ransomware attacks in the US and abroad have derailed major corporations, spurring a fuel shortage on the US East Coast, shuttering grocery stores in Sweden, and sending students home from grade schools. The solution, so many cybersecurity experts say, is to implement backups,...

Sextortion on the rise, warns FBI

The pandemic saw a surge in sextortion cases in 2020. Fast forward 12 months, and the numbers continue to rise significantly. This revelation came from the FBI Internet Crime Complaint Center IC3. Until 31 July 2021, it had received over 16,000 sextortion complaints, with victims losing a combine...

Alleviating ransomware’s legal headaches with Jake Bernstein: Lock and Code S02E08

This week on Lock and Code, we speak to cybersecurity and privacy attorney Jake Bernstein about ransomware attacks that dont just derail a companys reputation and productivity, but also throw them into potential legal peril. In 2020, the cybersecurity community noticed a worrying trend from...

HP printer issue on Mac: What happened?

Apple holds the keys to nearly all recent Mac software. This is a story of those keys, and how a Hewlett Packard HP error caused problems for a lot of people. Code signing and certificates First, its important to understand that when I say "keys," what I really mean is "certificates." These...

Lock and Code S1Ep13: Monitoring the safety of parental monitoring apps with Emory Roane

This week on Lock and Code, we discuss the top security headlines generated right here on Labs and around the Internet. In addition, we talk to Emory Roane, policy counsel at Privacy Rights Clearinghouse, about parental monitoring apps. These tools offer parents the capabilities to spot where the...

Stalkerware developer dealt new blow by FTC

Last week, the US Federal Trade Commission FTC interpreted its broad consumer protection mandate to file a first-of-its-kind enforcement action against the developer of three mobile stalkerware applications. The developer was banned from further selling the apps unless significant changes were ma...

As Internet turns 50, more risks and possibilities emerge

This op-ed originally appeared in the San Francisco Chronicle on October 28, 2019. We occupy a richly-connected world. On the Internet, we collapse distance and shift time. But this Internet that delivers mail, connects us with friends, lets us work anywhere, and shop from the palm of the hand, i...

Labs CTNT report shows shift in threat landscape to cryptomining

It's that time again! Time for the quarterly Malwarebytes Labs Cybercrime Tactics and Techniques report aka the Labs CTNT report. To get a more complete picture of what's been going on in cybercrime this quarter, the Labs team has combined intel and statistics gathered from January through March...

Of princes and perpetrators: Beware of getting ensnared in 419 scams

We've mentioned before that 419 scams don't always originate from Nigeria. It's a very simple and popular scam that can be attempted by pretty much anyone with a flair for social engineering. Indeed, 419 scams are so associated with the region that many scammers in non-Nigerian countries know the...

Cheers to a successful time at Infosec Europe 2017

With over 350 exhibitors, well over 10,000 visitors, and many widely respected speakers, Infosec Europe is one of Europe's biggest security events. The Malwarebytes stand attracted a lot of interested people, even without our robot Zero, who had obligations elsewhere. The new EMEA Channel...

More than 100,000 fake stores are out to steal your card details

Researchers at German cybersecurity company Nebty have identified “DoppelCart,” a cluster of almost 119,000 domains linked to copied online stores. The researchers describe it as the largest publicly documented fake-shop network by associated domain count. They found 118,787 .shop domains in the...

GTA 6 leak hunt could expose data belonging to thousands of Discord users

Someone leaked footage of the upcoming game Grand Theft Auto GTA 6 this month, and the game's publisher badly wants to know who. It's after a range of data about members of three Discord servers going back to June 1 this year in a bid to nail the perpetrator. Take-Two Interactive, the publisher...

A week in security (August 17 – August 23)

Last week on Malwarebytes Labs: Zombie Card: An expired Visa credit card can be used for purchases Medical records, SSNs, and bank details exposed in CareCloud data breach ChatGPT for Teens tackles risky chats and homework shortcuts Twitch wants your content for Amazon AI training. Here’s how to...

Medical records, SSNs, and bank details exposed in CareCloud data breach

Healthcare technology giant CareCloud has confirmed that a data breach earlier this year impacted more than 3.75 million people, making it one of the largest healthcare data incidents disclosed this year. The New Jersey-based company, which provides electronic health record EHR and practice...