Instagram’s memorialize feature abused to memorialize…Instagram’s boss

The mechanisms for memorialising the social network accounts of people who’ve died haven’t really suffered a lot of scrutiny up until now. I’ve done a fair amount of research on the processes and perils we face in the digitally deceased age. Traditionally, the biggest issues in this space tended ...

A week in security (Nov 8 – Nov 14)

Last week on Malwarebytes Labs Multiple video games break after domain name snafu How to remove adware on an Android phone Smart TV adverts put a wrinkle in your programming Are cybercriminals turning away from the US and targeting Europe instead? Patch now! Microsoft plugs actively exploited...

A multi-stage PowerShell based attack targets Kazakhstan

This blog post was authored by Hossein Jazi. On November 10 we identified a multi-stage PowerShell attack using a document lure impersonating the Kazakh Ministry of Health Care, leading us to believe it targets Kazakhstan. A threat actor under the user name of DangerSklif perhaps in reference to...

The importance of backing up

What does backing up something mean? Backing up is the act of making a copy or copies of a file. These files are stored somewhere other than where the originals are located. You may only need to back up a few files, or it might be a much bigger effort. Requirements may differ greatly depending on...

Could Apple’s new MacBooks signal a change in direction on security?

Apple recently announced a new line of completely overhauled MacBook Pros. Much has been written about their new design, new chips, new displays, new keyboards etc, but I thought I detected something else that might be new about these MacBooks too: A new approach. The updated laptops may be the...

Murder-for-hire, money laundering, and more: How organised criminals work online

Europol has released an extensive report into serious and organized crime, including how these groups use the internet to aid in their criminal behaviour. Europol is the European Union’s EU law enforcement agency and it assists the EU Member States in their fight against serious international cri...

Playstation 5 hacked—twice!

Over the weekend, hackers revealed that the Playstation 5 PS5, Sony’s latest darling, has been broken into—not just once but twice. Fail0verflow, the hacking group notorious for breaking Playstation consoles, and Andy "TheFlow" Nguyen, a security engineer at Google and widely known in the...

[updated] Patch now! Microsoft plugs actively exploited zero-days and other updates

On what might seem a relatively calm Patch Tuesday with 55 vulnerabilities being patched, the fact that six of them were rated “Critical” and two of them actively exploited spoils the Zen factor somewhat. Publicly disclosed computer security flaws are listed in the Common Vulnerabilities and...

Are cybercriminals turning away from the US and targeting Europe instead?

Significant cyberattacks against critical targets in Europe have doubled in the past year, according to EU figures obtained by CNN. And with the announced pressure from the US against major ransomware gangs we can expect these figures to go up even more. Its also clear from recent attacks that th...

Smart TV adverts put a wrinkle in your programming

Smart TVs are back in the news due to the potential pitfalls of embedded advertising. It may come as a surprise to some, but these devices aren’t particularly new. As far back as 2013, security researchers were already exploring the issues related to internet connected televisions in a home...

How to remove adware on an Android phone

It shouldn’t be surprising that Android devices are the targets of threats like adware and other Potentially Unwanted Programs PUPs. After all, there are millions of apps on the Google Play Store, servicing billions of monthly active users globally. And, as we have noted with Mac virus trends,...

Multiple video games break after domain name snafu

We’ve seen quite a few complaints from gamers this past weekend, unable to load up and play games on the Steam platform. The problem wasn’t hackers, or DDoS attacks, or anything else. Rather, the issue is something bundled with the game by default designed to keep titles “secure” from tampering...

Why we fail at getting the cybersecurity basics right, with Jess Dodson: Lock and Code S02E21

The cybersecurity basics should be just that—basic. Easy to do, agreed-upon, and adopted at a near 100 percent rate by companies and organizations everywhere, right? Youd hope. But the reality is that basic cybersecurity blunders continue to affect businesses of all sizes, which has led to...

A week in security (Nov 1 – Nov 7)

Last week on Malwarebytes Labs Celebrity jewelry house Graff falls victim to ransomware Lessons from a real-life ransomware attack Is Apples Safari browser the last, best hope for web privacy? What is Twitch? Google patches zero-day vulnerability, and others, in Android Zuckerbergs Metaverse, and...

Wanted! US offers $10m bounty for ransomware kingpins

The US State Department is offering a massive $10 million reward if you can help bring DarkSide to justice. The U.S. Department of State announces a reward offer of up to $10,000,000 for information leading to the identification or location of any individuals who holds a key leadership position i...

CISA sets two week window for patching serious vulnerabilities

The Cybersecurity and Infrastructure Security Agency CISA has issued binding directive 22-01 titled Reducing the Significant Risk of Known Exploited Vulnerabilities. This directive applies to all software and hardware found on federal information systems managed on agency premises or hosted by...

Credit card skimmer evades Virtual Machines

This blog post was authored by Jérôme Segura There are many techniques threat actors use to slow down analysis or, even better, evade detection. Perhaps the most popular method is to detect virtual machines commonly used by security researchers and sandboxing solutions. Reverse engineers are...

Update now! Mozilla fixes security vulnerabilities in Firefox 94

In a security advisory, Mozillas announced that several security issues in its Firefox browser have been fixed. Several of these vulnerabilities were listed as having a high impact. Publicly disclosed computer security flaws are listed in the Common Vulnerabilities and Exposures CVE database. Its...

Trojan Source: Hiding malicious code in plain sight

Researchers at the University of Cambridge, UK, have released details of a cunning and insidious new class of software vulnerability that allows attackers to hide code in plain sight, within the source code of computer programs. The techniques demonstrated by the researchers could be used to pois...

BlackMatter ransomware group announces shutdown. But for how long?

The BlackMatter ransomware gang has announced they are going to shut down their operation, citing pressure from local authorities. And pressure there is. Only two weeks ago, we wrote about a warning that the Federal Bureau of Investigation FBI, the Cybersecurity and Infrastructure Security Agency...

This Steam phish baits you with free Discord Nitro

Weeks ago, we talked about the one effective lure that could get a Discord user to consider clicking on a scam link they were generously given, either by a random user or a legitimate contact who also happened to have fallen for the same ploy: free Discord Nitro subscriptions. And similar to how...

Zuckerberg’s Metaverse, and the possible privacy and security concerns

The news is currently jam-packed with tales of Facebooks Meta project. Of particular interest to me is Facebook’s long-stated desire to introduce adverts into the VR space, and what this may mean for Meta too. I’ve talked about the privacy and legal aspects of adverts in gaming and other tech...

Google patches zero-day vulnerability, and others, in Android

Google has issued security patches for the Android Operating System. In total, the patches address 39 vulnerabilities. There are indications that one of the patched vulnerabilities may be under limited, targeted exploitation. The most severe of these issues is a critical security vulnerability in...

What is Twitch?

Twitch is primarily a site dedicated to live streaming content. It also offers the ability to chat with others in the Stream you happen to be in via text. The primary draw of Twitch streams is video games and e-sports, leading to the rise of many big name streamers and content creators. Is Twitch...

Is Apple’s Safari browser the last, best hope for web privacy?

What browser do you use? Theres a good chance—roughly one in seven—that its Google Chrome. And even if you prefer a different browser, theres a good chance that youre using something thats based on Google Chrome, such as Edge, Vivaldi, Chromium, Brave, or Opera. After a decade and and a half of...

Lessons from a real-life ransomware attack

Ransomware attacks, despite dramatically increasing in frequency this summer, remain opaque for many potential victims. It isn’t anyone’s fault, necessarily, since news articles about ransomware attacks often focus on the attack, the suspected threat actors, the ransomware type, and, well, not mu...

Celebrity jewelry house Graff falls victim to ransomware

Data on countless celebrities, including politicians, is apparently now in the hands of ransomware attackers after a group using the Conti variant compromised systems of one of the world’s most exclusive jewelry houses, Graff. Despite what mathematicians like to think, there is an exception to...

A week in security (Oct 25 – Oct 31)

Last week on Malwarebytes Labs Beyond the VPN: Ultimate online privacy with the Tor Project’s Isabela Bagueros: Lock and Code S02E20 Patch now to bypass Firefox add-ons that abuse the proxy API to deny updates How social media mistakes can impact cybersecurity Update now! Apple patches bugs in iO...

The return of the Malwarebytes CrackMe

This blog post was authored by Hasherezade Update: Malwarebytes Crackme : we already have the winners in the category "the fastest solve", congratulations! 1st: @nazywam 2nd: Suvaditya Sur @x0r19x91 3rd:@evandrix But we are still waiting for your submissions! -- Malwarebytes Threat Intelligence...

Update your OptinMonster WordPress plugin immediately

WordPress, the incredibly popular content management platform, is currently dealing with a nasty plugin bug which allows redirects. What is a WordPress plugin? Like most blogging platforms, WordPress allows you to change up its default functionality. This is done by adding bits of kit called...

Shrootless: Microsoft finds Apple macOS vulnerability

Microsoft researchers have discovered a vulnerability in macOS, dubbed Shrootless, that can allow attackers to bypass System Integrity Protection SIP and perform malicious activities, such as gaining root privileges and installing rootkits on vulnerable devices. Microsoft reported the Shrootless...

Threat profile: Ranzy Locker ransomware

Ranzy Locker ransomware emerged in late 2020, when the variant began to target victims in the United States. According to a flash alert issued by the FBI, unknown cyber criminals using Ranzy Locker ransomware had compromised more than 30 US businesses as of July 2021, including victims in the...

What is fileless malware?

Unlike traditional malware, which relies on a file being written to a disk, fileless malware is intended to be memory resident only, ideally leaving no trace after its execution. The malicious payload exists in the computer’s memory, which means nothing is ever written directly to the hard drive...

Watch out for the Steam skin “free knife” scam

Have you ever had someone run up to you in the street and insist you take their free knife? I hope not, because that’s a good way to wind up in a 60-minute police procedural drama. In video game land, however, anything goes. A certain type of scam is showing signs of activity at the moment and it...

Update now! Apple patches bugs in iOS and iPadOS

On two consecutive days Apple has released a few important patches. iOS 14.8.1 comes just a month after releasing iOS 14.8 for those who didn’t want to update their iPhones to iOS 15. This update also came as a sort of surprise as it was not beta-tested beforehand. Earlier this year Apple announc...

How social media mistakes can impact cybersecurity

We talked to members of our Malware Removal Support team and asked them what kind of problems they get asked to solve for our customers. To understand why they get to handle these questions, it is also necessary to know that the Malwarebytes software is unable to resolve the problems users are...

Patch now to bypass Firefox add-ons that abuse the proxy API to deny updates

In a Firefox security announcement, Mozilla said 455,000 users have downloaded Firefox add-ons that interfere with how they connect to the internet. The interference in itself was not the deciding factor, however. The add-ons abused the proxy API to prevent users who had installed them from...

Beyond the VPN: Ultimate online privacy, with The Tor Project’s Isabela Bagueros: Lock and Code S02E20

"What does online privacy mean to you?" This beguilingly simply question can produce dozens of overlapping and distinct answers, all depending on who you ask. A VPN service might tell you that online privacy means obscuring your IP address and hiding your Internet activity from your Internet...

A week in security (Oct 18 – Oct 24)

Last week on Malwarebytes Labs Multiple vulnerabilities in popular WordPress plugin WP Fastest Cache. “Killware”: Is it just as bad as it sounds? REvil ransomware disappears after Tor services hijacked. Protect yourself from BlackMatter ransomware: Advice issued. q-logger skimmer keeps Magecart...

Ransomware: Why do backups fail when you need them most?

Its widely known, and endlessly repeated, that the last, best line of defence against the potentially devastating effects of a ransomware attack is your backups. So why do we keep hearing things like this: Were also feeling relatively confident, we have a very good backup system … and then we fin...

We dig into the Game Players Code

Gaming security is getting a lot of attention at the moment. Rightly so; it’s a huge target for scammers and malware authors. Malicious ads, fake games, survey scams, phishing attacks…whatever you can think of, it’s in use. Some target kids and steal their accounts, selling them on. Others go aft...

A bug is about to confuse a lot of computers by turning back time 20 years

For those of you that remember the fuss about the Y2K bug, this story may sound familiar. The Cybersecurity & Infrastructure Security Agency CISA has issued a warning to Critical Infrastructure CI owners and operators, and other users who get the time from GPS, about a GPS Daemon GPSD bug in GPSD...

Update now! Chrome fixes more security issues

For the third time in a month Google has issued an update to patch for several security issues. This time the update patches 19 vulnerabilities, of which 5 are classified as “high” risk vulnerabilities. In an update announcement for Chrome 95.0.4638.54, Google specifies the 16 vulnerabilities tha...

Chrome targeted by Magnitude exploit kit

Exploit kits EK are not as widespread as they used to be. One of the reasons is likely that most exploit kits targeted software that is hardly ever used anymore. Internet Explorer, Silverlight, and Flash Player to name a few, have been deprecated, replaced, and quickly lost their user-base. So,...

High school student rickrolls entire school district, and gets praised

A student at a high school in Cook County successfully hacked into the Internet-of-Things IoT devices of one of the largest school districts in Illinois, and gave everyone a surprise. Minh aka @WhiteHoodHacker on Twitter who attends Elk Grove—a name that curiously resembles the home town of...

How to delete your Snapchat account

Snapchat is an instant messaging app popular with youngsters that allows users to send pictures and videos that are only viewable for short periods. But while hundreds of millions of daily active users consume and create content with Snapchat, not everyone is pleased with the mobile app. One of t...

q-logger skimmer keeps Magecart attacks going

This blog post was authored by Jérôme Segura Although global e-commerce is continuing to grow rapidly, it seems as though Magecart attacks via digital skimmers have not followed the same trend. This is certainly true if we only look at recent newsworthy attacks; indeed when a victim is a large...

Protect yourself from BlackMatter ransomware: Advice issued

Despite promises made by the BlackMatter ransomware gang about which organizations and business types they would avoid, multiple US critical infrastructure entities have been targeted. Now, the Federal Bureau of Investigation FBI, in conjunction with the Cybersecurity and Infrastructure Security...

[updated]REvil ransomware disappears after Tor services hijacked

With some pests you hope they never recover from a blow. It’s almost too good to be true, but one can hope. This is one of them. The REvil ransomware group has shut down their operation for the second time this year after losing control over their Tor-based domains. Shutdown number 1 REvils first...

“Killware”: Is it just as bad as it sounds?

On October 12, after interviewing US Secretary of Homeland Security Alejandro Mayorkas, USA TODAY’s editorial board warned its readers about a dangerous new form of cyberattack under this eye-catching headline: “The next big cyberthreat isnt ransomware. Its killware. And its just as bad as it...