Security Affairs

DECEMBER 21, 2023

Threat actors are exploiting an old Microsoft Office vulnerability, tracked as CVE-2017-11882, to spread the Agent Tesla malware. Threat actors are exploiting an old Microsoft Office vulnerability, tracked as CVE-2017-11882 (CVSS score: 7.8), as part of phishing campaigns to spread the Agent Tesla malware.

Malware 96

Malware Phishing Spyware Cyber threats 96

Security Boulevard

AUGUST 17, 2023

You've probably never heard of "16Shop," but there's a good chance someone using it has tried to phish you. The post Karma Catches Up to Global Phishing Service 16Shop appeared first on Security Boulevard.

Phishing 52

Phishing Scams Web Fraud 52

The Hacker News

NOVEMBER 17, 2022

A China-based financially motivated group is leveraging the trust associated with popular international brands to orchestrate a large-scale phishing campaign dating back as far as 2019. The threat actor, dubbed Fangxiao by Cyjax, is said to have registered over 42,000 imposter domains, with initial activity observed in 2017. "It

Phishing 91

Phishing Retail Banking 91

Krebs on Security

JANUARY 7, 2020

Late last year saw the re-emergence of a nasty phishing tactic that allows the attacker to gain full access to a user’s data stored in the cloud without actually stealing the account password. The phishing lure starts with a link that leads to the real login page for a cloud email and/or file storage service.

Phishing 241

Phishing Passwords Accountability Authentication 241

Security Affairs

NOVEMBER 17, 2022

A China-based financially motivated group, tracked as Fangxiao, is behind a large-scale phishing campaign dating back as far as 2019. Researchers from Cyjax reported that a China-based financially motivated group, dubbed Fangxiao, orchestrated a large-scale phishing campaign since 2017. SecurityAffairs – hacking, phishing).

Phishing 107

Phishing Adware Retail Malware 107

Security Boulevard

APRIL 17, 2023

Executive Summary On February 09, 2023, EclecticIQ analysts identified a spear phishing campaign targeting Ukrainian government entities like the Foreign Intelligence Service of Ukraine (SZRU) and Security Service of Ukraine (SSU). The SMTP server contained a web panel designed to create and distribute spear phishing emails.

Phishing 84

Phishing Social Engineering Malware Government 84

Malwarebytes

JANUARY 6, 2022

As early as 2017, cybercriminals have been incorporating capabilities to defeat 2FA into their kits. Academics from Stony Brook University and Palo Alto Networks—namely Brian Kondracki, Babak Amin Azad, Nick Nikiforakis, and Oleksii Starov—have found at least 1,200 phishing kits online capable of capturing or intercepting 2FA security codes.

Phishing 121

Phishing Authentication Accountability Data breaches 121

Security Boulevard

JANUARY 11, 2024

These findings shed light on […] The post Cloud Atlas Phishing Attacks: Russian Companies Beware appeared first on TuxCare. The post Cloud Atlas Phishing Attacks: Russian Companies Beware appeared first on Security Boulevard.

Phishing 59

Phishing Cybersecurity Cyber Attacks Cyber threats 59

Security Affairs

FEBRUARY 25, 2022

The CERT of Ukraine (CERT-UA) warned of a spear-phishing campaign targeting Ukrainian armed forces personnel. The Computer Emergency Response Team of Ukraine (CERT-UA) is warning of an ongoing spear-phishing campaign targeting private email accounts belonging to Ukrainian armed forces personnel. ua-passport[.]space space and id[.]bigmir[.]space.

Phishing 108

Phishing Social Engineering Government Accountability 108

Krebs on Security

JULY 23, 2018

Google has not had any of its 85,000+ employees successfully phished on their work-related accounts since early 2017, when it began requiring all employees to use physical Security Keys in place of passwords and one-time codes, the company told KrebsOnSecurity. A YubiKey Security Key made by Yubico. a mobile device). .”

Phishing 224

Phishing Authentication Mobile Passwords 224

Security Affairs

AUGUST 17, 2020

The KONNI RAT was first discovered in May 2017 by researchers from the Cisco Talos team after it was employed in attacks aimed at organizations linked to North Korea. The KONNI malware also employed in at least two campaigns in 2017. The post CISA warns of phishing attacks delivering KONNI RAT appeared first on Security Affairs.

Phishing 121

Phishing Malware Advertising Architecture 121

SecureList

FEBRUARY 16, 2023

Short-lived phishing sites often offered to see the premieres before the eagerly awaited movie or television show was scheduled to hit the screen. At the beginning of that year, we still observed phishing attacks that used the themes of infection and prevention as the bait.

Phishing 89

Phishing Scams Accountability Energy and Utilities 89

Security Affairs

JULY 2, 2019

US Cyber Command posted on Twitter an alert about cyber attacks exploiting the CVE-2017-11774 vulnerability in Outlook. Yesterday I was using Twitter when I noticed the following alert issued by the account managed by the US Cyber Command : USCYBERCOM has discovered active malicious use of CVE-2017-11774 and recommends immediate #patching.

Energy and Utilities 81

Energy and Utilities Malware Advertising InfoSec 81

Security Affairs

AUGUST 15, 2022

Microsoft has disrupted activity by SEABORGIUM, a Russia-based actor launching persistent phishing, credential and data theft, intrusions, and hack-and-leak campaigns tied to espionage. Microsoft confirmed it has taken action to disrupt SEABORGIUM’s operations by disabling accounts used for surveillance, phishing, and email collection.

Phishing 89

Phishing Accountability Hacking Surveillance 89

SecureList

FEBRUARY 15, 2021

The Kaspersky Anti-Phishing component blocked 434,898,635 attempts at accessing scam sites. The most frequent targets of phishing attacks were online stores (18.12 The contact phone trick was heavily used both in email messages and on phishing pages. The link opened a phishing page disguised as the Outlook web interface.

Phishing 135

Phishing Malware Scams Accountability 135

Security Affairs

APRIL 25, 2019

Experts at Proofpoint discovered that free code repositories on GitHub have been abused since at least 2017 to host phishing websites. Researchers at Proofpoint reported that crooks are abusing free code repositories on GitHub to host phishing websites and bypass security defenses. ” reads the post published by Proofpoint.

Phishing 86

Phishing Advertising Accountability Cybercrime 86

Krebs on Security

FEBRUARY 26, 2023

But it’s worth revisiting how this group typically got in to targeted companies: By calling employees and tricking them into navigating to a phishing website. But we do know the March 2020 attack was precipitated by a spear-phishing attack against a GoDaddy employee. In a filing with the U.S.

Hacking 268

Hacking Social Engineering Phishing Scams 268

Tech Republic Security

FEBRUARY 15, 2022

Dubbed TA2541 by Proofpoint researchers, the group has been attacking targets in several critical industries since 2017 with phishing emails and cloud-hosted malware droppers. The post Researchers discover common threat actor behind aviation and defense malware campaigns appeared first on TechRepublic.

Malware 140

Malware Phishing 140

Security Affairs

JANUARY 26, 2023

National Cyber Security Centre (NCSC) is warning of targeted phishing attacks conducted by threat actors based in Russia and Iran. The UK agency reported ongoing spear-phishing campaigns carried out by Russia-based group SEABORGIUM and Iran-based group TA453 to gather intelligence on the victims.

Phishing 76

Phishing Media Hacking Education 76

SecureList

FEBRUARY 9, 2022

Our Anti-Phishing system blocked 253 365 212 phishing links. Safe Messaging blocked 341 954 attempts to follow phishing links in messengers. Hurry up and lose your account: phishing in the corporate sector. Another noticeable phishing trend targeting the corporate sector was to exploit popular cloud services as bait.

Phishing 64

Phishing Scams Accountability Banking 64

The Hacker News

DECEMBER 20, 2023

Attackers are weaponizing an old Microsoft Office vulnerability as part of phishing campaigns to distribute a strain of malware called Agent Tesla.

Malware 89

Malware Phishing 89

Malwarebytes

MARCH 29, 2022

These methods include using documents that exploit CVE-2017-0199 and CVE-2021-40444, macro-embedded documents, and executables. The spear phishing emails are warning people that use websites, social networks, instant messengers and VPN services that have been banned by the Russian Government and that criminal charges will be laid.

Phishing 74

Phishing Education Telecommunications Technology 74

Identity IQ

MAY 10, 2024

Scammers can use names and physical addresses to mail phishing letters with harmful packages. Bleeping Computer reported on the data breach and provided two strong examples of convincing phishing attempts involving malware-loaded devices made with minimal information about the targets. How Did This Data Breach Happen?

Data breaches 111

Data breaches Phishing Scams Risk 111

Malwarebytes

MAY 10, 2024

A cybercriminal called Menelik posted the following message on the “Breach Forums” site: “The data includes 49 million customer and other information of systems purchased from Dell between 2017-2024. Some forms of two-factor authentication (2FA) can be phished just as easily as a password. I am the only person who has the data.”

Data breaches 136

Data breaches Passwords Phishing Big data 136

The Hacker News

FEBRUARY 4, 2021

Phishing and Malware Among the major cyber threats, the malware remains a significant danger. The 2017 WannaCry outbreak that cost businesses worldwide up to $4 billion is still in recent memory, and other new strains of malware are discovered on a daily basis.

Scams 137

Scams Cyber threats Phishing Malware 137

Digital Shadows

AUGUST 17, 2021

What is Phish(ing)? But, never mind the dozens of other reports and white papers about phishing that come out every year from security industry leaders, let’s take a look at the 2021 Verizon DBIR. Going back a bit, it was also the top attack vector in 2020, 2019, 2018, 2017, 2016, and well, hopefully, you get the picture.

Phishing 52

Phishing Accountability Social Engineering Mobile 52

Elie

NOVEMBER 9, 2017

Over the course of March, 2016–March, 2017, we identify 788,000 potential victims of off-theshelf keyloggers; 12.4 million potential victims of phishing kits; and 1.9 We observe a remarkable lack of external pressure on bad actors, with phishing kit playbooks and keylogger capabilities remaining largely unchanged since the mid-2000s.

Data breaches 112

Data breaches Phishing Risk Malware 112

Spinone

JANUARY 13, 2018

As the security threat landscape evolves, enterprise organizations continuously invest into data protection solutions aimed at preventing massive data breaches, Ransomware, phishing scams and other sophisticated cyber attacks. Looking back at 2017 Spinbackup has made it a priority to offer state-of-the-art solutions to the problems above.

Backups 40

Backups Scams Data breaches Education 40

CSO Magazine

JANUARY 11, 2023

The security incident was the latest to affect the service in recent times in the wake of unauthorized access to its development environment in August last year , serious vulnerabilities in 2017 , a phishing attack in 2016 , and a data breach in 2015. To read this article in full, please click here

Data breaches 110

Data breaches Password Management Passwords Encryption 110

CSO Magazine

SEPTEMBER 13, 2021

A widely known vulnerability that hadn’t yet been patched was the entry point for the 2017 Equifax attack. And a bitcoin scam on Twitter started with spear phishing attacks on Twitter employees. Hackers used a compromised password to access the company network via a virtual private network in the May 2021 Colonial Pipeline attack.

Scams 138

Scams Phishing Passwords 138

Krebs on Security

AUGUST 19, 2020

The COVID-19 epidemic has brought a wave of email phishing attacks that try to trick work-at-home employees into giving away credentials needed to remotely access their employers’ networks. The employee phishing page bofaticket[.]com. Image: urlscan.io.

Phishing 357

Phishing VPN Social Engineering Media 357

Krebs on Security

AUGUST 14, 2020

Defray was first spotted in 2017, and its purveyors have a history of specifically targeting companies in the healthcare space. “The phishing emails the authors use are well-crafted,” Trend Micro wrote. . “The phishing emails the authors use are well-crafted,” Trend Micro wrote.

Ransomware 361

Ransomware Healthcare Insurance Phishing 361

Schneier on Security

NOVEMBER 13, 2017

From March 2016 to March 2017, we analyzed several black markets to see how hijackers steal passwords and other sensitive data. [.]. Our research tracked several black markets that traded third-party password breaches, as well as 25,000 blackhat tools used for phishing and keylogging. The report.

Phishing 161

Phishing Marketing Passwords Accountability 161

The Hacker News

FEBRUARY 15, 2022

Entities in the aviation, aerospace, transportation, manufacturing, and defense industries have been targeted by a persistent threat group since at least 2017 as part of a string of spear-phishing campaigns mounted to deliver a variety of remote access trojans (RATs) on compromised systems.

Manufacturing 101

Manufacturing Hacking Phishing Malware 101

Krebs on Security

AUGUST 25, 2023

And there are indications that fraudsters may already be exploiting the stolen data in phishing attacks. SIM-swapping groups will often call employees on their mobile devices, pretend to be someone from the company’s IT department, and then try to get the employee to visit a phishing website that mimics the company’s login page.

Mobile 198

Mobile Cyber Risk Cryptocurrency Data breaches 198

Anton on Security

JUNE 17, 2022

For example, in my analyst days, I built a maturity model for a SOC (2018) , a SIEM deployment (2018) and vulnerability management (2017). Take care of the assumptions and check for where you are starting up (Dealing with phishing? My favorite approach has been a maturity model, vaguely modeled on the CMM approach. The one for SOAR!

Architecture 246

Architecture Technology Phishing 246

Security Affairs

MARCH 18, 2019

million phishing ads for violation of its policies. million phishing ads. phishing ads appeared first on Security Affairs. Google recently shared details about its efforts against malicious advertisement, the giant took down 2.3 billion bad ads last year. Google revealed that it took down 2.3 “We took down 2.3

Phishing 81

Phishing Advertising Scams Cryptocurrency 81