Collaborate Disseminate
~30 crypto companies were affected, including BlockFi, Swan Bitcoin and NYDIG, providing an uncomfortable reminder about how much data CRM systems snarf up.
Continue reading HubSpot Data Breach Ripples Through Crytocurrency Industry
The data-extortion gang got at Microsoft’s Azure DevOps server. Meanwhile, fellow Lapsus$ victim and authentication firm Okta said 2.5 percent of customers were affected in its own Lapsus$ attack. Continue reading Microsoft: Lapsus$ Used Employee Account to Steal Source Code
Lapsus$ shared screenshots of internal Okta systems and 40Gb of purportedly stolen Microsoft data on Bing, Bing Maps and Cortana. Continue reading Lapsus$ Data Kidnappers Claim Snatches From Microsoft, Okta
An unusual attack using an open-source Python package installer called Chocolatey, steganography and Scheduled Tasks is stealthily delivering spyware to companies. Continue reading Serpent Backdoor Slithers into Orgs Using Chocolatey Installer
Can we trust web browsers to protect us, even if they say “https?” Not with the novel BitB attack, which fakes popup SSO windows to phish away credentials for Google, Facebook and Microsoft, et al.
Continue reading Browser-in-the-Browser Attack Makes Phishing Nearly Invisible
The trojanized Craftsart Cartoon Photo Tools app is available in the official Android app store, but it’s actually spyware capable of stealing any and all information from victims’ social-media accounts. Continue reading Facestealer Trojan Hidden in Google Play Plunders Facebook Accounts
A DarkHotel phishing campaign breached luxe hotel networks, including Wynn Palace and the Grand Coloane Resort in Macao, a new report says. Continue reading DarkHotel APT Targets Wynn, Macao Hotels to Rip Off Guest Data
Researchers have exposed the work of Exotic Lily, a full-time cybercriminal initial-access group that uses phishing to infiltrate organizations’ networks for further malicious activity. Continue reading Google Blows Lid Off Conti, Diavol Ransomware Access-Broker Ops
The phishing scam tried to steal login credentials by threatening account shutdown, due to users having purportedly shared “fake content.”
Continue reading Phony Instagram ‘Support Staff’ Emails Hit Insurance Company
The China-affiliated state-sponsored threat actor used Log4j and zero-day bugs in the USAHerds animal-tracking software to hack into multiple government networks.
Continue reading APT41 Spies Broke Into 6 US State Networks via a Livestock App