Krebs on Security

OCTOBER 18, 2023

In August 2023, security researcher Randy McEoin blogged about a scam he dubbed ClearFake , which uses hacked WordPress sites to serve visitors with a page that claims you need to update your browser before you can view the content. Previously, the group had stored its malicious update files on Cloudflare, Guard.io

Scams 269

Scams Malware Cryptocurrency Hacking 269

Troy Hunt

NOVEMBER 11, 2023

Even just this morning, 2 days after recording this live stream, I ended up on nation TV talking about the DP World security incident and whilst we don't have any confirmation yet, it has all the hallmarks of another ransomware case. References Sponsored by: Webinar: 'How to Defend Against the Evilginx2.

Ransomware 242

Ransomware 242

Schneier on Security

JULY 27, 2023

World of Warcraft players wrote about a fictional game element, “Glorbo,” on a subreddit for the game, trying to entice an AI bot to write an article about it. All the authors listed as having bylines on the site are fake. It worked : And it…worked. ” […] That is…all essentially nonsense.

Social Engineering 197

Social Engineering Artificial Intelligence Engineering 197

Krebs on Security

MARCH 25, 2020

government Web sites now carry a message prominently at the top of their home pages meant to help visitors better distinguish between official U.S. Unfortunately, part of that message is misleading and may help perpetuate a popular misunderstanding about Web site security and trust that phishers have been exploiting for years now.

Government 271

Government Phishing Encryption Scams 271

Krebs on Security

APRIL 27, 2023

A researcher found DC Health had five Salesforce Community sites exposing data. This misconfigured Salesforce Community site from the state of Vermont was leaking pandemic assistance loan application data, including names, SSNs, email address and bank account information.

Banking 278

Banking Government Information Security Authentication 278

Krebs on Security

OCTOBER 9, 2023

After collecting your address information, the fake USPS site goes on to request additional personal and financial data. Check out the bottom portion of the screenshot below, and you’ll notice that this phishing site fails to load some external resources, including an image from a link called fly.linkcdn[.]to. com postreceive[.]com

Phishing 263

Phishing Scams Passwords Web Fraud 263

Krebs on Security

NOVEMBER 17, 2020

In many cases these notifications are benign, but several dodgy firms are paying site owners to install their notification scripts and then selling that communications pathway to scammers and online hucksters. The company’s site currently is ranked by Alexa.com as among the top 2,000 sites in terms of Internet traffic globally.

Antivirus 331

Antivirus Advertising Internet Internet 331

Krebs on Security

SEPTEMBER 18, 2023

The site lists hundreds of victim organizations and companies — all allegedly hacking victims that refused to pay a ransom to keep their stolen data from being published. The 8Base darknet site also has a built-in chat feature, presumably so that 8Base victims can communicate and negotiate with their extortionists.

Ransomware 229

Ransomware Accountability Encryption Internet 229

Krebs on Security

AUGUST 9, 2021

I was preparing to knock off work for the week on a recent Friday evening when a curious and annoying email came in via the contact form on this site: “Hello I go by the username Nuclear27 on your site Briansclub[.]com “I made a deposit to my wallet on the site but nothing has shown up yet and I would like to know why.”

Phishing 349

Phishing Cybercrime Accountability Advertising 349

Krebs on Security

AUGUST 18, 2022

The missives — which come from Paypal.com and include a link at Paypal.com that displays an invoice for the supposed transaction — state that the user’s account is about to be charged hundreds of dollars. Very quickly into the conversation he suggested visiting a site called globalquicksupport[.]com

Scams 312

Scams Phishing Accountability Banking 312

Troy Hunt

FEBRUARY 4, 2024

Right from the beginning, it was pretty obvious what "MOAB" was probably going to be and sure enough, this tweet came true: Interesting find by @MayhemDayOne , wonder if it was from a shady breach search service (we’ve seen a bunch shut down over the years)? and been shut down by law enforcement agencies.

Marketing 223

Marketing 223

Krebs on Security

FEBRUARY 17, 2020

A new email-based extortion scheme apparently is making the rounds, targeting Web site owners serving banner ads through Google’s AdSense program. Earlier this month, KrebsOnSecurity heard from a reader who maintains several sites that receive a fair amount of traffic.

Scams 321

Scams Advertising Accountability Web Fraud 321

Security Affairs

APRIL 18, 2024

UNDP did not share details about the attack, however, on March 27, 2024, the ransomware group 8base added the agency to its Tor leak site (the Tor leak site is unavailable at the time of this writing). . “UNDP takes this incident extremely seriously and we reiterate our dedication to data security.

Data breaches 112

Data breaches Cyber Attacks Ransomware Hacking 112

Krebs on Security

NOVEMBER 4, 2021

The holiday shopping season always means big business for phishers, who tend to find increased success this time of year with a lure about a wayward package that needs redelivery. One of dozens of FedEx-themed phishing sites currently being advertised via SMS spam. com, g001bfedeex[.]com, com, and so on.

Phishing 299

Phishing Scams Mobile DNS 299

Krebs on Security

FEBRUARY 3, 2022

The LinkedIn redirect links allow customers to track the performance of ad campaigns, while promoting off-site resources. 31 that uses Linkedin.com links to redirect anyone who clicks to a site that spoofs Adobe , and then prompts users to log in to their Microsoft email account to view a shared document. Image: Urlscan.io.

Phishing 313

Phishing Marketing Scams Accountability 313

Malwarebytes

MARCH 7, 2024

Take this example: User of Site A uses the same email and password to login to Site B. Site A gets compromised and those login details are exposed. People with access to the credentials from Site A try them on Site B, often via automation, and gain access to the user’s account.

Passwords 119

Passwords Identity Theft Accountability Data breaches 119

Penetration Testing

MARCH 11, 2024

Wordfence, a leading authority in WordPress security warns about a serious vulnerability in the widely used WP Statistics plugin.

Penetration Testing 112

Penetration Testing 112

Krebs on Security

SEPTEMBER 30, 2022

If one searches LinkedIn for the CISO of the energy giant Chevron , one might find the profile for a Victor Sites , who says he’s from Westerville, Ohio and is a graduate of Texas A&M University. The LinkedIn profile for Victor Sites, who is most certainly NOT the CISO of Chevron.

CISO 297

CISO Cybercrime Accountability Cryptocurrency 297

Krebs on Security

SEPTEMBER 10, 2021

Cloudflare recently wrote about its attack , which clocked in at 17.2 While last night’s Meris attack on this site was far smaller than the recent Cloudflare DDoS, it was far larger than the Mirai DDoS attack in 2016 that held KrebsOnSecurity offline for nearly four days. million bogus requests-per-second. Image: Qrator.

IoT 276

IoT DDOS Internet Internet 276

Krebs on Security

APRIL 10, 2024

The domain setwitter.com, which Twitter/X until very recently rendered as “sex.com,” redirects to this blog post warning about the recent changes and their potential use for phishing. On April 9, Twitter/X began automatically modifying links that mention “twitter.com” to read “x.com” instead.

Phishing 306

Phishing Media Engineering Technology 306

Krebs on Security

MARCH 22, 2024

The nonprofit organization that supports the Firefox web browser said today it is winding down its new partnership with Onerep , an identity protection service recently bundled with Firefox that offers to remove users from hundreds of people-search sites. Mozilla Monitor. . ” The full statement is available here (PDF). .”

Media 245

Media Government Data breaches Marketing 245

SecureWorld News

MARCH 12, 2024

Discovering your WordPress site has been compromised is a daunting experience for any website owner. of all sites using WordPress. of all sites using WordPress. So, instead of panicking, relax and focus on fixing your hacked WordPress site. This situation demands immediate action to mitigate damage and restore security.

Hacking 87

Hacking Passwords Backups Firewall 87

Malwarebytes

APRIL 22, 2024

At first sight there doesn’t seem to be much that is illegal about it. However, it turns out the site did disregard some laws: more on that later. To get this amount of data the platform gathered information from 14,201 servers about 627,914,396 users. It’s available for anyone on the regular web.

Cryptocurrency 120

Cryptocurrency Internet Internet Accountability 120

Krebs on Security

FEBRUARY 20, 2024

Instead of listing data stolen from ransomware victims who didn’t pay, LockBit’s victim shaming website now offers free recovery tools, as well as news about arrests and criminal charges involving LockBit affiliates. This prompted several XSS members to start posting memes taunting the group about the security failure.

Ransomware 259

Ransomware Cybercrime Encryption Insurance 259

Malwarebytes

APRIL 9, 2024

ThreatDown users that have DNS Filtering can enable ad blocking in their console to prevent such malvertising attacks: Step 2: Directing users to lookalike sites The malvertising infrastructure deployed by Nitrogen threat actors uses a cloaking page that can either redirect to a decoy site or the infamous Rick Astley video. org puuty[.]org

System Administration 106

System Administration DNS Engineering Social Engineering 106

SecureBlitz

MARCH 1, 2024

That way, you can prevent and protect your site against them. billion websites are on the internet, and about 455 million are on […] The post 11 Most Common WordPress Attacks [MUST READ] appeared first on SecureBlitz Cybersecurity. In this post, we will reveal the most common WordPress attacks. It is estimated that over 1.3

Internet 93

Internet Internet Software Cybersecurity 93

SecureList

MARCH 13, 2024

“Malvertising” is a popular way of attracting victims to malicious sites: an advertisement block is placed at the top of the search results, increasing the likelihood of users clicking the link. Sites at the top of search results also tend to be more trusted by users. transferusee[.]com/onl/mac/<md5_hash>

DNS 95

DNS Advertising Engineering Internet 95

Duo's Security Blog

FEBRUARY 21, 2024

For the curious, the original Duo Labs was a team of amazing security researchers, tinkerers, and thinkers that published their findings, experiments, and explorations on the Duo Labs site. There are still many other examples of cool security research or contributions to the security community live on the Duo Labs site.

Authentication 89

Authentication Engineering Mobile Internet 89

Malwarebytes

JANUARY 16, 2024

When you follow the posted link, which is a Facebook permalink to a post made by what is probably a compromised account, you’ll see a fake BBC news item about a fatal road accident. The scammers do this to make sure you are redirected to a site that is likely to generate the most profit from people fitting your profile.

Scams 134

Scams Adware Accountability VPN 134

Malwarebytes

FEBRUARY 23, 2024

posted details about four vulnerabilities it had fixed in its Content Management System (CMS), and one in the Joomla! The extended long term support (elts) versions can be found on the dedicated elts site. XSS is a type of vulnerability that allows an attacker to inject malicious code into a site’s content. elts, 4.4.3

Authentication 106

Authentication Firewall Risk Marketing 106

Malwarebytes

FEBRUARY 8, 2024

The group used SQL injection and cross-site scripting (XSS) attacks—both common techniques— to extract the sensitive information from the websites. The attacks primarily focused on the Asia-Pacific (APAC) region, targeting sites in Australia, Taiwan, China, Thailand, India, and Vietnam.

Identity Theft 122

Identity Theft Retail Risk Cybersecurity 122

Malwarebytes

MAY 4, 2023

A recent study by NewsGuard, trackers of online misinformation, makes some alarming discoveries about the role of artificial intelligence (AI) in content farm generation. Take a large collection of likely underpaid writers, set up a bunch of similar looking sites, and then plaster them with adverts. I share your pain.

Artificial Intelligence 92

Artificial Intelligence Advertising Engineering Phishing 92

Malwarebytes

OCTOBER 18, 2023

The malicious actors registered a copycat internationalized domain name that uses Punycode, a special character encoding, to masquerade as the real KeePass site. The difference between the two sites is visually so subtle it will undoubtably fool many people. site Fake KeePass site xn--eepass-vbb[.]info info to ķeepass[.]info

Password Management 135

Password Management Malware Passwords Advertising 135

Malwarebytes

MARCH 21, 2024

One of the researchers told BleepingComputer that most of the sites also had write enabled (meaning anyone can change it) which is bad, and one of them was a bank. Only 1% of the site owners replied, but about a quarter of them did fix the misconfiguration.

Passwords 117

Passwords Banking Internet Internet 117

Tech Republic Security

MAY 10, 2022

Read more about this threat and how to detect it on merchant sites. Credit card skimming just became much easier for cybercriminals, who can now buy ready-to-go skimming services online. The post Credit card skimming services make it easy for low-level cybercriminals to join the game appeared first on TechRepublic.

140

140

Malwarebytes

JULY 27, 2022

An anti-vax dating site has been revealed as shockingly easy to compromise by security researchers. Many major aspects of the site, from membership subscriptions to support tickets, were found to be vulnerable. The site, called Unjected, has been around since last year. Site back ups? Downloadable. $15 When the fix fails.

Accountability 119

Accountability Media Authentication Risk 119

Malwarebytes

FEBRUARY 20, 2024

In an act of exquisite trolling, the UK’s National Crime Agency (NCA) has announced further details about its disruption of the LockBit ransomware group by using the group’s own dark web website. Watch our video and read on to learn more about Lockbit and why this is a huge step in our collective fight against cyber crime.

Ransomware 100

Ransomware Backups Malware Cryptocurrency 100