Collaborate Disseminate
By Deeba Ahmed
Another day, another NPM typosquatting attack.
This is a post from HackRead.com Read the original post: NPM Typosquatting Attack Deploys r77 Rootkit via Legitimate Package
Continue reading NPM Typosquatting Attack Deploys r77 Rootkit via Legitimate Package
We’ve covered a lot of sketchy USB devices over the years. And surely you know by now, if you find a USB drive, don’t plug it in to your computer. …read more Continue reading This Week in Security: USB Boom! Acropalypse, and a Bitcoin Heist
By Deeba Ahmed
Aabquerys use the typosquatting technique to encourage downloading malicious components, as it has been cleverly named to make it sound like the legitimate NPM module Abquery.
This is a post from HackRead.com Read the original post: Typ… Continue reading Typosquatting: Legit Abquery Package Duped with Malicious Aabquerys
PyPI, the official third-party software repository for Python packages, is warning about a phishing campaign targeting its users. “We have additionally determined that some maintainers of legitimate projects have been compromised, and malware pub… Continue reading Phishing PyPI users: Attackers compromise legitimate projects to push malware
I accidentally sent an email with typo in the domain. It went to xxxxxxx@utlook.com instead of xxxxxx@outlook.com, will that email go anywhere?
I ran a scan on utlook.com and it says medium security risk.
Continue reading Sending email to an unintended domain [closed]
For every very clever security protocol that keeps people safe, there’s a stupid hack that defeats it in an unexpected way. Take OAuth for instance. It’s the technology that sites …read more Continue reading This Week in Security: Browser in the Browser, Mass Typo-squatting, and /dev/random Upgrades
One big threat out there is typosquat domains. For example instead of:
steamcommunity.com some malicious actor will register the domain stearncornmunity.com and set up his fake steam login.
Why do companies not buy these "fake domains… Continue reading Why don’t bigger companies buy similar domains to their main domain to prevent typosquatting?
It has become a mantra for businesses targeted by hackers to describe the incident as a “sophisticated cyber-attack”. Although true in some instances, the reality is that most cyber-attacks involve the use of easily preventable tactics including phishi… Continue reading Defeating typosquatters: Staying ahead of phishing and digital fraud
A Nigerian national, Obinwanne Okeke, has been sentenced to 10 years in prison for allegedly coordinating an international spearphishing campaign that has cost victims approximately $11 million in losses. The scheme, which lasted from 2015 to 2019, targeted Unatrac Holding Limited, a British firm that acted as the export sales office for Caterpillar, with fake invoices and wire transfer requests. The FBI opened an investigation into the alleged scam in 2018 after Unatrac raised alarm about an email compromise operation that had targeted the firm, according to court documents. The scheme collected the credentials of hundreds of victims over the course of the operation, according to the FBI press release on the matter. It’s the kind of business email compromise scam that plagues businesses around the world. There were $1.7 billion worth of losses caused by BEC scams in 2019 alone, the most recent year the FBI has published data […]
The post Nigerian man sentenced 10 years for $11 million phishing scam appeared first on CyberScoop.
Continue reading Nigerian man sentenced 10 years for $11 million phishing scam
Proofpoint has filed a lawsuit against Facebook arguing that it should be allowed to use domains that imitate the Facebook and Instagram brands to test customers’ ability to avoid online scams. Cybercriminals often imitate popular brands’ sites, including Facebook and Instagram, to dupe unsuspecting users, then pilfer their credentials or distribute malware. Proofpoint is one of several security companies that provides customers with phishing training that includes look-alike domains of popular brands in order to test clients’ wits on avoiding common cons. By sending messages that appear to be from “Instagrarn” rather than “Instagram,” for instance, Proofpoint and other email security firms test clients’ ability to detect attacks. Social media sites, particularly Facebook and Instagram, are typically among the top most imitated in criminals’ so-called typo-squatting schemes, according to Palo Alto Networks research published in September. The suit, filed Tuesday in an Arizona district court, is a countersuit to Facebook’s […]
The post Proofpoint sues Facebook over dummy sites used for anti-phishing training appeared first on CyberScoop.
Continue reading Proofpoint sues Facebook over dummy sites used for anti-phishing training