Collaborate Disseminate
IBM X-Force recently analyzed a new Android banking Trojan dubbed “Banker.BR” that appears to be targeting users in Spain, Portugal, Brazil and other parts of Latin America.
The post New Android Banking Trojan Targets Spanish, Portuguese Speaking Users appeared first on Security Intelligence.
Continue reading New Android Banking Trojan Targets Spanish, Portuguese Speaking Users
It may be open season for coronavirus scammers, but tax frauds aren’t letting up, either. Attackers tried obtaining large tax refunds by posing as clients of Weber and Company, the California-based accounting firm revealed last week. The scammers apparently accessed clients’ personal data — including, perhaps, Social Security numbers and bank account information — and used that to file fraudulent returns, Weber and Company said in a notification to California’s attorney general. The IRS and the FBI are investigating the matter, the company said. The number of attempted IRS scams tends to increase every year in March and April in the U.S., as legions of crooks try to steal Americans’ refunds. Earlier this month, the IRS said attackers exploiting the COVID-19 crisis could use stolen data to commit tax fraud. In 2016, the IRS said attackers had attempted to breach its online filing portal and steal Social Security numbers. For years, lawmakers have debated the proper response to incidents of this kind. It was not immediately clear […]
The post Hackers file fake tax returns in scheme to steal IRS refunds appeared first on CyberScoop.
Continue reading Hackers file fake tax returns in scheme to steal IRS refunds
Connecting remotely is about more than a strong Wi-Fi password and VPN. Be sure to understand and manage the risks of smart devices in your home to bolster personal and enterprise IoT security.
The post Lock Down Personal Smart Devices to Improve Enterprise IoT Security appeared first on Security Intelligence.
Continue reading Lock Down Personal Smart Devices to Improve Enterprise IoT Security
Our team is closely monitoring TrickBot’s developing capabilities, including its new cross-channel attacks using the TrickMo component.
The post TrickBot Pushing a 2FA Bypass App to Bank Customers in Germany appeared first on Security Intelligence.
Continue reading TrickBot Pushing a 2FA Bypass App to Bank Customers in Germany
As employers rapidly respond to the need to protect their workforce from potential exposure and spread of the novel coronavirus and the disease known as COVID-19, many of your organizations are making the very difficult decision to pivot to a work-from-home model. That means employees will be connecting to the corporate network from whichever device […]
The post 9 Best Practices from X-Force Red for Organizations and Employees appeared first on Security Intelligence.
Continue reading 9 Best Practices from X-Force Red for Organizations and Employees
Recent CamuBot activity resurfaced exactly one year after IBM X-Force researchers made the initial discovery of this malware in September 2018.
The post CamuBot Resurfaces With Cross-Channel, Targeted Attacks in Brazil appeared first on Security Intelligence.
Continue reading CamuBot Resurfaces With Cross-Channel, Targeted Attacks in Brazil
Google users can now use an iPhone or Android device as a security key to sign into their accounts, utilizing a technique that improves their defense against phishing attacks, the company announced Wednesday. In a blog post, a product manager for Google’s Advanced Protection Program wrote that people who exclusively use security keys when logging in to their accounts “never fell victim to targeted phishing attacks.” Yet security keys, which are more secure than text-based authentication, typically are available in the form of a standalone physical device, an inconvenience that may discourage adoption. Google’s update Wednesday is a significant step toward solving that problem. Instead of plugging a key into a USB slot, users just need to have their phones close to their machines. “Everything becomes much simpler when the things we’re already carrying around — our smartphones — have a built-in security key,” Shuvo Chatterjee said in the post. “That’s been the […]
The post Google makes safe logins more convenient by allowing smartphones to be security keys appeared first on CyberScoop.
Boing Boing, a popular blog and news aggregator with deep roots on the internet, said Monday that an unknown attacker had used a hacked account of one of its team members to spread malicious code. The hacker was able to get around two-factor authentication — an extra security measure — to log into the Boing Boing content management system (CMS) software. From there, the attacker installed a widget that redirected Boing Boing visitors to a malicious web page, the publication said in a statement under the tagline, “We Wuz Hacked.” Founded three decades ago as a zine, Boing Boing is an irreverent and wide-ranging news site that embraced blogging long before it became popular. Contributors to the self-styled “Directory of Wonderful Things” have long promoted sound security practices. In May 2019, for example, co-editor Cory Doctorow blogged about a Google study touting the benefits of 2FA. Boing Boing said the breach occurred around midday Friday and that, once the issue […]
The post Boing Boing says hacker got around 2FA in breaching its content management system appeared first on CyberScoop.
Continue reading Boing Boing says hacker got around 2FA in breaching its content management system
The Republican National Committee is relying on authentication tools and careful social media behavior in order to avoid a devastating data breach like the kind that derailed its Democratic counterparts in 2016. The RNC, which develops and promotes the party’s platform and currently supports President Donald Trump’s re-election campaign, is banking on Duo Security, which specializes in multi-factor authentication, to keep state-sponsored hackers out of party accounts, according to recent Federal Election Commission filings. Even if a user’s password credentials are stolen, an extra layer of authentication can ensure that only the legitimate account holder could access his or her communications. Since March of this year, the RNC has paid just over $1,000 per month to Duo, according to FEC filings. The RNC started using Duo in 2016, just days before the election. And it’s not just email account access the RNC is trying to protect — the RNC uses multiple layers of authentication to protect other […]
The post RNC, DNC bank on Duo authentication ahead 2020 election appeared first on CyberScoop.
Continue reading RNC, DNC bank on Duo authentication ahead 2020 election
Email security remains a top priority in 2019 and into the new year. Your best bet to fend off phishing attacks is to layer up with dynamic, data-driven protection.
The post Layer Up With a Layered Approach to Email Security This Winter appeared first on Security Intelligence.
Continue reading Layer Up With a Layered Approach to Email Security This Winter