California Bans Deepfakes in Elections, Porn

California has passed a law that bans the use of deepfake technology in political speech, and for non-consensual use in adult content. Deepfakes are a manipulation of images and recordings, created by artificial intelligence technology, that make it appear as if an individual is doing or saying...

Magecart Hits 80 Major eCommerce Sites in Card-Skimming Bonanza

UPDATE More than 80 global eCommerce sites have been uncovered that were actively compromised by Magecart groups. Magecart, a loose affiliation of attack groups responsible for the payment-card attacks on Ticketmaster, Forbes, British Airways, Newegg and others, typically insert virtual credit-ca...

Adwind Spyware-as-a-Service Attacks Utility Grid Operators

A phishing campaign that spoofs a PDF attachment to deliver Adwind spyware has been taking aim at national grid utilities infrastructure. Adwind, a.k.a. JRAT or SockRat, is being used in a malware-as-a-service model in this campaign, researchers said. It offers a full cadre of info-gathering...

Energy Sector Phish Swims Past Microsoft Email Security via Google Drive

A targeted spearphishing campaign has hit an organization in the energy sector – after using a savvy trick to get around the company’s Microsoft email security stack. According to Aaron Riley, a researcher from Cofense, the campaign impersonated the CEO of the targeted company, sending email via...

Ransomware Sees Triple-Digit Spike in Corporate Detections

LAS VEGAS — As cybercriminals continue to chase the most lucrative attack vectors they can find, ransomware attacks are migrating from consumer targets to organizations, businesses, municipalities and beyond. For the first time, consumer detections have fallen below organizational infections, as ...

Critical Flaw in Cisco Elastic Services Controller Allows Full System Takeover

A critical vulnerability in the Cisco Elastic Services Controller could allow an unauthenticated, remote attacker to take full control of impacted systems – merely by sending a crafted request. Cisco Elastic Services Controller is a virtual network functions manager, which enables businesses to...

Facial Recognition is Here: But Are We Ready?

When MacKenzie Fegan was boarding her morning flight to Mexico City last Wednesday, she noticed something odd at her gate at the JFK International Airport. Instead of a JetBlue employee scanning her boarding pass or taking a look at her passport, she – and other passengers at the gate – was...

Google Warns of Growing Android Attack Vector: Backdoored SDKs and Pre-Installed Apps

Google is reporting an uptick in efforts by bad actors to plant potentially harmful applications PHAs on Android devices via pre-installed apps and by bundling them with system updates delivered over the air. The technique is especially troubling, Google said, because PHAs are often malicious and...

Citrix Falls Prey to Password-Spraying Attack

Citrix is warning that its internal network has been hit by international cybercriminals. The digital workspace and enterprise networks vendor said in a website notice that the FBI contacted it on Wednesday, saying that there was evidence of a successful cyberattack on its network. While details...

Stealthy Malware Disguises Itself as a WordPress License Key

UPDATE A spam-injecting malware is targeting WordPress site owners by disguising itself as a legitimate license key for a WordPress design theme. According to analysis from Sucuri, a customer opened a malware removal ticket reporting “some weird spam URLs injected onto their WordPress website.”...

New APT Could Signal Reemergence of Notorious Comment Crew

A recently observed APT campaign, dubbed Operation Oceansalt, could herald the return of the infamous China-linked hacking group known as Comment Crew or APT1. Attacks are cunning and are defined by their their deep targeting and use of an innovative multi-wave attack methodology. Operation...

Lenovo Warns Critical WiFi Vulnerability Impacts Dozens of ThinkPad Models

Lenovo warned customers on Friday that two critical Broadcom vulnerabilities impacts 25 models of its popular ThinkPad brand. The vulnerabilities were first revealed in September and originally they were only reported to impact specific Broadcom chipsets used in Apple iPhones, Apple TV and Androi...

APT Groups Exploiting Patch Microsoft Office Flaw CVE-2015-2545

A Microsoft Office vulnerability patched six months ago continues to be a valuable tool for APT gangs operating primarily in Southeast Asia and the Far East. Researchers at Kaspersky Lab today published a report describing how attackers continue to flourish exploiting CVE-2015-2545, a remote code...

Vulnerabilities in Android Apps That Allow Intercept of Messages, Photos Outlined

Researchers from the University of New Haven have taken to Youtube this week to publicize vulnerabilities in a dozen Android apps, including Instagram, Vine and OKCupid. Researchers at the University of New Haven’s Cyber Forensics Research and Education Group UNHcFREG have chosen to disclose the...

Supermicro IPMI BMCs plaintext passwords exposed

Much has been written about the insecurity of the IPMI protocol present inside embedded baseboard management controllers BMCs. Serious vulnerabilities can be exploited to gain remote control over big servers running BMCs, in particular in hosting environments where the controllers help admins wit...

April 2014 Oracle Critical Patch Update

Software maker and database management company Oracle yesterday released its quarterly Critical Patch Update. The release resolves more than 100 security vulnerabilities, many of which received high common vulnerability scoring system base scores and should be applied as soon as possible. Product...

August 2013 Microsoft Patch Tuesday Security Updates

Another month, another set of Microsoft Patch Tuesday security updates for Internet Explorer. For what seems to be the umpteenth month in a row, Microsoft will patch its browser, one of three critical updates expected to be shipped on Tuesday among eight bulletins. While IE patches remain a...

Apple Fixes Serious Flaws in iOS 5.1.1

Apple has patched several serious security bugs in iOS with the release of version 5.1.1 of the mobile operating system. The most serious of the security vulnerabilities could be used for remote code execution. The highest severity vulnerability that’s fixed in iOS 5.1.1 is a WebKit flaw that can...

Blowback: Microsoft, OnStar Pump the Brakes on Location Tracking

Redmond, Washington software giant, Microsoft, and Detroit based GM subsidiary, OnStar backtracked on policies widely seen as egregious privacy violations following lawsuits and public outcry. Here’s the news: Windows Phone Update Requires User Consent For Tracking Microsoft released their “Mango...

Microsoft Defends Secure Boot in Windows 8

Microsoft officials are seeking to assuage concerns that its implementation of UEFI in Windows 8 will prevent users from loading non-Microsoft operating systems or applications on their machines. Despite concerns raised by security researchers and open-source advocates about vendor lock-in and...

Phishing Costs Nearly Quadrupled Over 6 Years

Research shows that the cost of phishing attacks has nearly quadrupled over the past six years: Large U.S. companies are now losing, on average, $14.8 million annually, or $1,500 per employee. That’s up sharply from 2015’s figure of $3.8 million, according to a new study from Ponemon Institute th...

Google PPC Ads Used to Deliver Infostealers

Researchers have tracked down the origins of several increasingly prevalent info-stealers – including Redline, Taurus, Tesla and Amadey – that threat actors are delivering via pay-per-click PPC ads in Google’s search results. On Wednesday, breach prevention firm Morphisec posted an advisory in...

Exchange Servers Targeted by ‘Epsilon Red’ Malware

Threat actors have deployed new ransomware on the back of a set of PowerShell scripts developed for making encryption, exploiting flaws in unpatched Exchange Servers to attack the corporate network, according to recent research. Researchers from security firm Sophos detected the new ransomware,...

Azure Functions Weakness Allows Privilege Escalation

A privilege-escalation vulnerability Microsoft’s Azure Functions cloud container feature could ultimately allow a user to escape the container, according to researchers. Intezer researchers dubbed the bug “Royal Flush” after a flush-to-disk limitation that an exploit would need to evade. Flushing...

SolarWinds Orion Bug Allows Easy Remote-Code Execution and Takeover

Three serious vulnerabilities have been found in SolarWinds products: Two in the Orion User Device Tracker and one in the Serv-U FTP for Windows product. The most severe of these could allow trivial remote code execution with high privileges. The SolarWinds Orion platform is the network managemen...

Facebook: Malicious Chrome Extension Developers Scraped Profile Data

Facebook has filed legal action against two Chrome extension developers that the company said was scraping user profile data – including names and profile IDs – as well as other browser-related information. The two unnamed developers under the business name Oink and Stuff, developed Chrome...

Security Issues in PoS Terminals Open Consumers to Fraud

Researchers are detailing widespread security issues in point-of-sale PoS terminals – specifically, three terminal device families manufactured by vendors Verifone and Ingenico. Click to register. The issues, which have been disclosed to the vendors and since patched, open several popular PoS...

Microsoft Teams Users Under Attack in 'FakeUpdates' Malware Campaign

Attackers are using ads for fake Microsoft Teams updates to deploy backdoors, which use Cobalt Strike to infect companies’ networks with malware. Microsoft is warning its customers about the so-called “FakeUpdates” campaigns in a non-public security advisory, according to a report in Bleeping...

Fileless Malware Tops Critical Endpoint Threats for 1H 2020

In the first half of 2020, the most common critical-severity cybersecurity threat to endpoints was fileless malware, according to a recent analysis of telemetry data from Cisco. Fileless threats consist of malicious code that runs in memory after initial infection, instead of files being stored o...

Cryptobugs Found in Numerous Google Play Store Apps

Researchers have discovered more than 300 apps on the Google Play Store breaking basic cryptography code using a new tool they developed to dynamically analyze it. Academics from Columbia University developed a custom tool, CRYLOGGER, that analyzes Android applications for unsafe use of...

Apple Knocked Off Perch as Most Imitated Brand for Phishing Attacks

Google and Amazon overtook Apple in the second quarter Q2 of 2020 as the brand most spoofed by attackers to lure people into falling for phishing attacks. The leaderboard change is likely due to activity related to the COVID-19 pandemic, according to new research. While the number of so-called...

Understanding the Payload-Less Email Attacks Evading Your Security Team

The traditional image of a successful email attack is that of a naive employee clicking the link in a crudely crafted spam email bent on phishing. But times have changed, and employees are much more security-educated than they used to be. So, today’s threat actors are creating increasingly...

ACLU Sues Clearview AI Over Faceprint Collection, Sale

The American Civil Liberties Union ACLU has sued a New York-based startup for amassing a database of biometric face-identification data of billions of people and selling it to third parties without their consent or knowledge The U.S. citizens’-rights watchdog organization has filed suit in the...

Podcast: Shifting Cloud Security Left With Infrastructure-as-Code

Companies are increasingly dealing with a slew of security and compliance issues across cloud services and containers – from AWS to Azure to Google Cloud. Infrastructure-as-Code IaC security capabilities can help companies shift their cloud security “left” to improve developer productivity, avoid...

Zoom Beefs Up End-to-End Encryption to Thwart 'Zoombombers'

Video calling platform Zoom is boosting its security profile via the acquisition of a small startup called Keybase. The 25-person, New York-based company will provide more robust encryption for Zoom calls on paid subscriptions by implementing an end-to-end architecture. “Logged-in users will...

WHO, CDC and Bill and Melinda Gates Foundation Victims of Credential Dump, Report

Unknown threat actors have allegedly dumped nearly 25,000 email addresses and passwords from notable organizations involved in the fight against the COVID-19 pandemic, including credentials from prominent health organizations. Hackers have been using information belonging to groups such as World...

What is the Best Defense Against Phishing Attacks?

Whether the subject line was “You’re account will be closed!” or the email address was [email protected], we have all received and rolled our eyes at a poorly disguised phishing attempt. While many view phishing as a small annoyance, this attack method has maintained longevity for a reason and...

Critical Netgear Bug Impacts Flagship Nighthawk Router

Netgear is warning users of a critical remote code execution bug that could allow an unauthenticated attacker to take control of its Wireless AC Router Nighthawk R7800 hardware running firmware versions prior to 1.0.2.68. The warnings, posted Tuesday, also include two high-severity bugs impacting...

Google’s War on Android App Permissions, 60 Percent Successful

Overzealous Android apps that needlessly ask for permissions to handset resources such as contact lists and location data are not only obnoxious, but also potential privacy threats. To address this hot-button issue with Android users Google implemented a strict permission policy designed to curb...

News Wrap: Valentine's Day Scams and Emotet's Wi-Fi Hack

Threatpost editors Tara Seals and Lindsey O’Donnell-Welch break down the top stories for this week, ended Feb. 14, including: Recent phishing scams – including ones with a romance hook – continue to trick victims, showing that phishing tactics still work in stealing millions from individuals,...

Threatpost Poll: Are Published PoC Exploits a Good or Bad Idea?

The practice of disclosing proof-of-concept PoC exploits has long caused a debate in the security community. As the name suggests, these outline steps used to exploit a vulnerability in a system to show how it can be done — and are used to test networks and pinpoint vulnerable aspects of a system...

Satan Ransomware Reborn to Torment Businesses

A ransomware with the un-snappy moniker of “5ss5c” has emerged on the scene and appears to be in active development. According to independent researcher Bart Blaze, the malware is the successor to the Satan ransomware, and its authors are still experimenting with focused targeting China, for now...

ThreatList: 90% SMBs Believe Nation-State Actors Are Targeting Them

While APT activity is generally considered to be aimed at large enterprises housing valuable intellectual property, military-industrial entities, dissidents and civil society, and organizations of strategic importance to governments, the vast majority of small- and medium-sized businesses SMBs ar...

Fake Voicemail/Office 365 Attack Targets Enterprise Execs

A phishing campaign is making the rounds that uses fake voicemail messages to lure victims into revealing their Office 365 email credentials. The targets are “high-profile companies,” according to researchers, mainly in the tourism, entertainment and real-estate industries. A wide range of...

Phorpiex Botnet Shifts Gears From Ransomware to Sextortion

A recent wide-scale campaign indicates that a decade-old botnet is shifting gears from distributing ransomware to delivering millions of sextortion threats to innocent recipients. Worse, researchers say that the botnet’s spam campaign can affect up to 27 million potential victims. The botnet,...

Cybercrooks Target U.S. Veterans with Fake Hiring Website

Researchers are warning that a fake website – purporting to help U.S. military veterans search for jobs — actually links to installers that download malware onto victims’ systems. The website spoofs a legitimate website for U.S. military veterans offered by the U.S. Chamber of Commerce...

Forcepoint VPN Client is Vulnerable to Privilege Escalation Attacks

A vulnerability has been discovered in the Forcepoint VPN Client software for Windows. The flaw could enable an attacker – with an existing foothold on a system – to achieve an escalation of privilege, persistence and in some cases defense evasion. The vulnerability CVE-2019-6145 stems from an...

News Wrap: Dentist Offices Hit By Ransomware, Venmo Faces Privacy Firestorm

In this week’s news wrap podcast, editor Lindsey O’Donnell and Tara Seals break down the top news of the week – from ransomware attacks to companies responding to outcry over privacy issues. Top stories include: Ring announced it is working with more than 400 US police departments to streamline...

Coordinated Ransomware Attack Hits 23 Texas Government Agencies

UPDATE Up to 22 Texas entities – the majority of which are local governments – were hit by a ransomware attack on Friday that Texas officials say is part of a targeted attack launched by a single threat actor. Details remain scant about the specific agencies hit by the ransomware attacks, which...

Easter Attack Affects Half a Billion Apple iOS Users via Chrome Bug

UPDATE About a half a billion Apple iOS users and counting have been hit by session-hijacking cybercriminals bent on serving up malware. They’re exploiting an unpatched flaw in the Chrome for iOS browser, to bypass sandboxing and hijack user sessions, targeting iPhone and iPad users. The attacks...