Category Archives: A Little Sunshine

Hacker Charged With Extorting Online Psychotherapy Service

Posted on by

A 25-year-old Finnish man has been charged with extorting a once popular and now-bankrupt online psychotherapy company and its patients. Finnish authorities rarely name suspects in an investigation, but they were willing to make an exception for Julius “Zeekill” Kivimaki, a notorious hacker who — at the tender age of 17 — had been convicted of more than 50,000 cybercrimes, including data breaches, payment fraud, operating botnets, and calling in bomb threats. Continue reading Hacker Charged With Extorting Online Psychotherapy Service→

Accused ‘Raccoon’ Malware Developer Fled Ukraine After Russian Invasion

Posted on by

A 26-year-old Ukrainian man is awaiting extradition to the United States on charges that he acted as a core developer for Raccoon, a “malware-as-a-service” offering that helped paying customers steal passwords and financial data from millions of cybercrime victims. KrebsOnSecurity has learned that the defendant was busted in March 2022, after fleeing mandatory military service in Ukraine in the weeks following the Russian invasion. Continue reading Accused ‘Raccoon’ Malware Developer Fled Ukraine After Russian Invasion→

Battle with Bots Prompts Mass Purge of Amazon, Apple Employee Accounts on LinkedIn

Posted on by

On October 10, 2022, there were 576,562 LinkedIn accounts that listed their current employer as Apple Inc. The next day, half of those profiles no longer existed. A similarly dramatic drop in the number of LinkedIn profiles claiming employment at Amazon comes as LinkedIn is struggling to combat a significant uptick in the creation of fake employee accounts that pair AI-generated profile photos with text lifted from legitimate users. Continue reading Battle with Bots Prompts Mass Purge of Amazon, Apple Employee Accounts on LinkedIn→

Anti-Money Laundering Service AMLBot Cleans House

Posted on by

AMLBot, a service that helps businesses avoid transacting with cryptocurrency wallets that have been sanctioned for cybercrime activity, said an investigation published by KrebsOnSecurity last year helped it shut down three dark web services that secretly resold its technology to help cybercrooks avoid detection by anti-money laundering systems. Continue reading Anti-Money Laundering Service AMLBot Cleans House→

Report: Big U.S. Banks Are Stiffing Account Takeover Victims

Posted on by

When U.S. consumers have their online bank accounts hijacked and plundered by hackers, U.S. financial institutions are legally obligated to reverse any unauthorized transactions as long as the victim reports the fraud in a timely manner. But new data released this week suggests that for some of the nation’s largest banks, reimbursing account takeover victims has become more the exception than the rule. Continue reading Report: Big U.S. Banks Are Stiffing Account Takeover Victims→

Glut of Fake LinkedIn Profiles Pits HR Against the Bots

Posted on by

A recent proliferation of phony executive profiles on LinkedIn is creating something of an identity crisis for the business networking site, and for companies that rely on it to hire and screen prospective employees. The fabricated LinkedIn identities — which pair AI-generated profile photos with text lifted from legitimate accounts — are creating major headaches for corporate HR departments and for those managing invite-only LinkedIn groups. Continue reading Glut of Fake LinkedIn Profiles Pits HR Against the Bots→

Fake CISO Profiles on LinkedIn Target Fortune 500s

Posted on by

Someone has recently created a large number of fake LinkedIn profiles for Chief Information Security Officer (CISO) roles at some of the world’s largest corporations. It’s not clear who’s behind this network of fake CISOs or what their intentions may be. But the fabricated LinkedIn identities are confusing search engine results for CISO roles at major companies, and they are being indexed as gospel by various downstream data-scraping sources. Continue reading Fake CISO Profiles on LinkedIn Target Fortune 500s→

Violence-as-a-Service: Brickings, Firebombings & Shootings for Hire

Posted on by

A 21-year-old New Jersey man has been arrested and charged with stalking in connection with a federal investigation into groups of cybercriminals who are settling scores by hiring people to carry out physical attacks on their rivals. Prosecutors say the defendant recently participated in several of these schemes — including firing a handgun into a Pennsylvania home and torching a residence in another part of the state with a Molotov Cocktail. Continue reading Violence-as-a-Service: Brickings, Firebombings & Shootings for Hire→

PayPal Phishing Scam Uses Invoices Sent Via PayPal

Posted on by

Scammers are using invoices sent through PayPal.com to trick recipients into calling a number to dispute a pending charge. The missives — which come from Paypal.com and include a link at Paypal.com that displays an invoice for the supposed transaction — state that the user’s account is about to be charged hundreds of dollars. Recipients who call the supplied toll-free number to contest the transaction are soon asked to download software that lets the scammers assume remote control over their computer. Continue reading PayPal Phishing Scam Uses Invoices Sent Via PayPal→

When Efforts to Contain a Data Breach Backfire

Posted on by

Earlier this month, the administrator of the cybercrime forum Breached received a cease-and-desist letter from a cybersecurity firm. The missive alleged that an auction on the site for data stolen from 10 million customers of Mexico’s second-largest bank was fake news and harming the bank’s reputation. The administrator responded to this empty threat by purchasing the stolen banking data and leaking it on the forum for everyone to download. Continue reading When Efforts to Contain a Data Breach Backfire→