Court rules webcam monitoring of remote employee was an invasion of privacy

A Dutch court has ruled that the decision to fire a remote employee because he refused to keep his webcam on during working hours was unjustified. The employee worked remotely for a Florida-based software development company with a Dutch office. The court ruled that the request to keep the webcam...

Vulnerable children's identities used in tax fraud scheme

Fraudster Ariel "Melo" Jimenez has been sentenced to 12 years in prison for leading a "tax fraud and identity theft conspiracy" that resulted in the fraudulent claiming of tax credits, earning him millions of dollars. "Ariel Jimenez was the leader of a long-running fraudulent tax business that...

Warning issued about Vice Society ransomware targeting the education sector

The Federal Bureau of Investigation FBI, the Cybersecurity and Infrastructure Security Agency CISA, and the Multi-State Information Sharing and Analysis Center MS-ISAC have released a joint Cybersecurity Advisory CSA after observing Vice Society threat actors disproportionately targeting the...

Instagram receives record fine of $400M for abuse of children's data

Ireland's Data Protection Commissioner DPC, the lead regulator in Europe for Meta and other tech giants, has slapped Instagram with a fine of €405M--roughly equivalent to $402M--following an investigation on how the company handled children's data. In the investigation that started in 2020, the D...

Summer of exploitation leads to healthcare under fire

May 2021 was a tough month for the Healthcare and Medical sector-the most notable threat trend at the time was the heavy use of a new popular exploit against Dell systems, leading to immense effort by attackers to utilize the exploit before it became less effective due to patching. During this...

Bank fraud scammers trick victims with claims of bogus Zelle transfers

It pays to be careful where cold calls from someone claiming to work for your bank are concerned. Scam callers are impersonating bank staff, with suggestions of dubious payments made to your account. One unfortunate individual has already lost around $1,000 to this slice of telephone-banking base...

How to protect yourself and your kids against device theft

In no time at all, kids will be going back to school or starting college. And while gearing up for this, it’s very important to be aware of the threat from device loss in the school environment. Maybe you are away at university for the first time and have a new place to live, or maybe your kids...

Google delays Chrome third party cookie sunsetting…again

Weve seen many examples of third-party cookies being tackled by browsers recently. Its not so long ago that Firefox effectively locked down third-party tracking by isolating cookies into so-called jars. By doing so, their "Total Cookie Protection" seeks to prevent all those cookies on your PC...

In post-Roe US, experts share how to keep your data private

In the weeks since the Supreme Court of the United States removed a nationwide right to choose to have an abortion, millions of Americans have been forced to relearn what is and isn’t safe to do online, as their actions, words, and choices—many of which are tracked digitally—could potentially be...

Fraudulent cryptocurrency investment apps are duping investors

Together with the Department of Homeland Security DHS and the Cybersecurity and Infrastructure Security Agency CISA, the FBI has released a warning about cybercriminals creating fraudulent cryptocurrency investment apps in order to defraud cryptocurrency investors. The threat actors convince...

How the FBI quietly added itself to criminals’ instant message conversations

Motherboard has disclosed some information about Operation Trojan Shield, in which the FBI intercepted messages from thousands of encrypted phones around the world. These messages are now used in courts across the world as corroborating evidence. Operation Trojan Shield The US Federal Bureau of...

Ransomware review: June 2022

Malwarebytes Threat Intelligence builds a monthly picture of ransomware activity by monitoring the information published by ransomware gangs on their Dark Web leak sites. This information represents victims who were successfully attacked but opted not to pay a ransom. In June, LockBit was the mos...

ZuoRAT is a sophisticated malware that mainly targets SOHO routers

Researchers have analysed a campaign leveraging infected SOHO routers to target predominantly North American and European networks of interest. The so-called ZuoRAT campaign, which very likely started in 2020, is so sophisticated that the researchers suspect that there is a state sponsored threat...

Amazon Photos vulnerability could have given attackers access to user files and data

Amazon has patched a flaw in the Amazon Photos app which could have allowed an attacker to steal and use a users unique access token that verifies their identity across multiple Amazon APIs. That would give attackers access to a trove of information, since many of these APIs contain personal data...

Raccoon Stealer returns with a new bag of tricks

The popular malware Raccoon stealer, which suspended operations after a developer allegedly died in the Ukraine invasion, has returned. Raccoon stealer is malware as a service, with the developers selling it to would-be users. The operation is a tightly-run ship, to the extent that customers have...

A week in security (June 13 – June 19)

Last week on Malwarebytes Labs: Serious vulnerabilities found in ITarian software, patches available for SaaS products Update Chrome now: Four high risk vulnerabilities found Taking down the IP2Scam tech support campaign Don’t panic! “Unpatchable” Mac vulnerability discovered Introducing...

Stealthy Symbiote Linux malware is after financial institutions

Symbiote, a new "nearly impossible to detect" Linux malware, targeted financial sectors in Latin America—and the threat actors behind it might have links to Brazil. These findings were revealed in a recent report, a joint effort between the Blackberry Research Team and Dr. Joakim Kennedy, a...

It’s official, today you can say goodbye to Internet Explorer. Or can you?

Today, the Internet Explorer IE 11 desktop application goes out of support and will be retired for certain versions of Windows 10. The retirement consists of two phases. During the first phase—the redirection phase—devices will be progressively redirected from IE to Microsoft Edge over the...

Coffee app in hot water for constant tracking of user location

A mobile app violated Canadas privacy laws via some pretty significant overreach with its tracking of device owners. The violation will apparently not bring the app owners, Tim Hortons, any form of punishment. However, the fallout from this incident may hopefully serve as a warning to others with...

FBI warns of education sector credentials on dark web forums

The FBI is warning academics to be on their guard, as an embattled education sector continues to experience attacks and breaches, with data spilling onto the so-called dark web. The government agencys Private Industry Notification PDF cites US academic credentials up for grabs from a variety of...

Chicago students lose data to ransomware attackers

Chicago Public Schools CPS disclosed on Friday that students may have had their data taken in a ransomware incident involving one of its vendors. The ransomware attack happened last December at Battelle for Kids BfK, based in Columbus Ohio, which develops services to provide innovation in schools...

Cyberattacks on SATCOM networks attributed to Russian threat actors

The Cybersecurity & Infrastructure Security Agency CISA and the Federal Bureau of Investigation FBI have updated their joint cybersecurity advisory, Strengthening Cybersecurity of SATCOM Network Providers and Customers, originally released March 17, 2022, with US government attribution to Russian...

OpenSea warns of Discord channel compromise

OpenSea, the primary marketplace for buyers and sellers of non-fungible tokens NFTs, has reported major problems with its Discord support channel. How major? Well, theres a "potential vulnerability" which allowed spambots to post phishing links to other users. A problem that lead OpenSea Support ...

Unfixed vulnerability in popular library puts IoT products at risk

Researchers have found a vulnerability in a popular C standard library in IoT products that could allow attackers to perform DNS poisoning attacks against a target device. The library is known to be used by major vendors such as Linksys, Netgear, and Axis, but also by Linux distributions such as...

8 security tips for small businesses

Small businesses and startups are known to face some extra challenges when it comes to cybersecurity. Because they don’t have the size or budget to have a fully-fledged dedicated security team, it often comes down to a smaller staff that doesn’t have the time to do everything that is recommended ...

Fake USA for UNHCR site wants your Ukraine donations in Bitcoin

Since Russia began invading Ukraine in late February, many organizations have set up donation pages to aid the most heavily affected: Families who were forced out of their homes due to bombings and children separated from grown-ups who decided to stay and take arms. Weve also seen a considerable...

Emotet fixes bug in code, resumes spam campaign

Emotet threat actors resumed their email spam campaign on Monday after stopping it late last week to fix a bug. The bug—a flaw in how Emotet is installed onto a system after a victim opens a malicious email attachment—forced the actors to prematurely halt their campaign. Sample email of an Emotet...

Why identity management matters

Today is Identity Management Day, which aims to inform the public about the dangers of casually or improperly managing and securing digital identities. The day was started in 2021 and is hosted by the Identity Defined Security Alliance IDSA and National Cybersecurity Alliance. Digital identity A...

Old Play Store apps served notice by upcoming API level changes

Starting very soon, old and outdated apps on the Google Play Store will no longer be available to download. A major clearout is coming, and if you’re an app developer it may be time to overhaul your product or face Android-centric oblivion. What’s happening? Android makes use of APIs application...

White House urges US businesses: Protect against potential Russian cyberattacks

On Monday, the White House told US business leaders to toughen up their cybersecurity defenses against a potential cyberattack from Russia. "The Biden-Harris Administration has warned repeatedly about the potential for Russia to engage in malicious cyber activity against the United States in...

A week in security (March 7 – March 13)

Last week on Malwarebytes Labs: The struggle to reduce bug-fixing time is real Update now! Mozilla patches two actively exploited vulnerabilities Google takes on Docs notification spammers When fake dating profiles try the military approach Azure AutoWarp brings automation headaches RagnarLocker...

A week in security (February 28 – March 6)

Last week on Malwarebytes Labs: Beware of malware offering “Warm greetings from Saudi Aramco” Update now! Cisco fixes several vulnerabilities HermeticWiper: A detailed analysis of the destructive malware that targeted Ukraine Tips to protect your data, security, and privacy from a hands-on expert...

Deepfake study suggests fakes can run but not hide

I have long said that Deepfakes missed the boat on being stealthy, believable pieces of footage able to turn the tide of elections or other major events. We’ve seen time and again how suggested examples of use during important happenings have been terrible, whereas the smart use has tended to be...

Watch out for this bump in LinkedIn phishing

LinkedIn is sometimes forgotten about in more general coverage of phishing attacks. Social media sites such as Facebook, Twitter, and Instagram receive regular attention. Cryptowallet customer support scams run wild in the replies to any cryptocurrency themed tweet. Facebook users can often be...

Apple accidentally kept some Siri recordings from iPhones, even for opted-out users

Apple’s release of iOS 15.4 beta 2 completes the fix for a bug that may have recorded interactions with Siri without permission on some devices. Apple has fixed this bug that was introduced in iOS 15 and accidentally kept some recordings, regardless of whether you opted out or not. The bug was...

A week in security (January 17 — 23)

Last week on Malwarebytes Labs: CISA calls for urgent action against critical threats Red Cross begs attackers to “Do the right thing” after family reunion service compromised Update now! Chrome patches critical RCE vulnerability in Safe Browsing Combatting SMS and phone fraud: UK government issu...

Intimate photo hacker spared from jail, said he “liked the detective work”

Michael Grime, a British games programmer, has escaped jail after using stolen credentials to access several womens personal email accounts and social media accounts in order to steal their private and intimate photos. Grime was caught by the National Crime Agency NCA as part of an operation...

What is facial recognition?

Facebook recently announced it would give up on its facial recognition system. Facebook, or Meta, was using software to automatically identify people in images posted to its social network. Since facial recognition has become an increasingly toxic concept in many circles and Facebook was having...

The FCC moves to curb SIM swap attacks

The Federal Communications Commission FCC is going to set new rules to curb the rising threat of SIM swapping, also known as SIMjacking. SIM swapping and the very similar port-out fraud is the unlawful use of someones personal information to steal their phone number and swap or transfer it to...

Phone screenshots accidentally leaked online by stalkerware-type company

pcTattleTale hasnt been very careful about securing the screenshots it sneakily takes from its victims phones. pcTattleTale markets itself as "employee and child monitoring software" that is undetectable by the device user, but it can also be used to spy on spouses and partners. It allows its...

Why backups aren’t a “silver bullet” against ransomware, with Matt Crape: Lock and Code S02E17

A recent spate of ransomware attacks in the US and abroad have derailed major corporations, spurring a fuel shortage on the US East Coast, shuttering grocery stores in Sweden, and sending students home from grade schools. The solution, so many cybersecurity experts say, is to implement backups,...

A week in security (August 30 – September 5)

Last week on Malwarebytes Labs ProxyToken: another nail-biter from Microsoft Exchange Macs turn on apps signed by Symantec, treat them as malware Google Play sign-ins can be abused to track another person’s movements FTC bans SpyFone and its CEO from continuing to sell stalkerware BrakTooth...

Facebook bans Signal ads that reveal the depth of what it knows about you

Most of our readers are well aware of the fact that the big tech corporations, especially those that run social media know a great deal about us and our behavior. But it rarely hits home how much personal data they have about us and how they can guess, quite correctly, even more. Lots more. Signa...

HP printer issue on Mac: What happened?

Apple holds the keys to nearly all recent Mac software. This is a story of those keys, and how a Hewlett Packard HP error caused problems for a lot of people. Code signing and certificates First, its important to understand that when I say "keys," what I really mean is "certificates." These...

Stalkerware developer dealt new blow by FTC

Last week, the US Federal Trade Commission FTC interpreted its broad consumer protection mandate to file a first-of-its-kind enforcement action against the developer of three mobile stalkerware applications. The developer was banned from further selling the apps unless significant changes were ma...

Bring your own security (BYOS): good idea or not?

We've talked about the concept of Bring Your Own Device, or BYOD, on the blog before. BYOD is a popular policy whereby employees can bring personally-owned devices, such as laptops, tablets, or smartphones, to work and use them to access data and applications. It helps to cut costs and can increa...

Tech support scammer tries to sell free software

AmericaGeeks is your typical tech support scam company, but with an extra warming glow of attitude, greed, and complete all-around rudeness. Most scams will gladly take your money by buttering up the victim while simultaneously scaring them into thinking that they are in a dangerous situation wit...

A week in security (December 04 – December 10)

Last week on the blog, we looked at a RIG EK malware campaign, explored how children are being tangled up in money mule antics, took a walk through the world of Blockchain, and gave a rundown of what's involved when securing web applications. We also laid out the trials and tribulations of the...

Phishes, pseudophishes, and bad email

Everyone knows about phishing. We’ve all heard that the solution to phishing is to educate the user as, after all, it must be the user’s fault for stupidly clicking on the thing. But what about when perverse incentives make clicking the phish seem logical? What about the enterprise pseudophish—wh...

Tackling the myths surrounding cyberbullying

Cyberbullying is an act most of us are familiar with. Knowing what it is, who're involved, and its harmful effects to targets are easy enough to identify; but do you know that cyberbullying is surrounded by misconceptions, too? In this post, we have identified six of these myths, explained why...