Krebs on Security

DECEMBER 18, 2024

A scammer called using a real Google phone number to warn his Gmail account was being hacked, sent email security alerts directly from google.com, and ultimately seized control over the account by convincing him to click “yes” to a Google prompt on his mobile device.

Cryptocurrency 363

Cryptocurrency Accountability Authentication Phishing 363

Krebs on Security

MARCH 10, 2020

FBI officials last week arrested a Russian computer security researcher on suspicion of operating deer.io , a vast marketplace for buying and selling stolen account credentials for thousands of popular online services and stores. Kennedy Airport, according to court documents unsealed Monday. Firsov was arrested Mar.

Accountability 355

Accountability Advertising Hacking Cybercrime 355

Schneier on Security

JANUARY 29, 2024

The investigation indicates they were initially targeting email accounts for information related to Midnight Blizzard itself. The investigation indicates they were initially targeting email accounts for information related to Midnight Blizzard itself.

Hacking 326

Hacking Accountability Passwords Cybersecurity 326

Krebs on Security

MARCH 14, 2025

In this scam, dubbed “ ClickFix ,” the visitor to a hacked or malicious website is asked to distinguish themselves from bots by pressing a combination of keyboard keys that causes Microsoft Windows to download password-stealing malware. Some of those lures worked, and allowed thieves to gain control over booking.com accounts.

Phishing 285

Phishing Malware Scams Passwords 285

Krebs on Security

JULY 13, 2020

Data Viper , a security startup that provides access to some 15 billion usernames, passwords and other information exposed in more than 8,000 website breaches, has itself been hacked and its user database posted online. An online post by the attackers who broke into Data Viper. But on Aug.

Hacking 363

Hacking Marketing Cybercrime Accountability 363

Security Affairs

FEBRUARY 2, 2025

The hacking campaign targeted 90 users and was disrupted in December, WhatsApp already alerted them of a possible compromise of their devices. WhatsApp linked the hacking campaign to Paragon, an Israeli commercial surveillance vendor acquired by AE Industrial Partners for $900 million in December 2024. reads the court document.

Spyware 110

Spyware Hacking Surveillance Malware 110

Krebs on Security

FEBRUARY 4, 2025

The FBI joined authorities across Europe last week in seizing domain names for Cracked and Nulled , English-language cybercrime forums with millions of users that trafficked in stolen data, hacking tools and malware. The email address used for those accounts was f.grimpe@gmail.com. lol and nulled[.]it.

eCommerce 218

eCommerce Cybercrime Accountability Hacking 218

Krebs on Security

OCTOBER 28, 2020

In August, Gunnebo said it had successfully thwarted a ransomware attack, but this week it emerged that the intruders stole and published online tens of thousands of sensitive documents — including schematics of client bank vaults and surveillance systems. What’s more, Syrén seemed to downplay the severity of the exposure.

Hacking 358

Hacking Ransomware Banking Accountability 358

Security Affairs

APRIL 6, 2025

The document is realistic enough to bypass automated Know Your Customer (KYC) checks, the expert states. Musielak warned of the rising threat of mass identity theft, fraudulent credit applications, and fake account creation, which are now more scalable with generative AI. “You can now generate fake passports with GPT-4o.

Identity Theft 145

Identity Theft Insurance Banking Authentication 145

Security Affairs

SEPTEMBER 16, 2022

Uber on Thursday disclosed a security breach, threat actors gained access to its network, and stole internal documents. Uber on Thursday suffered a cyberattack, the attackers were able to penetrate its internal network and access internal documents, including vulnerability reports. SecurityAffairs – hacking, Uber).

Hacking 144

Hacking Data breaches Information Security Engineering 144

Security Affairs

NOVEMBER 4, 2024

for phishing scams that stole millions by hacking email accounts. A Nigerian national was sentenced to 26 years in prison in the US for stealing millions by compromising the email accounts of real estate businesses. for phishing scams that resulted in the compromise of millions of email accounts. million in restitution.

Scams 126

Scams Phishing Identity Theft Accountability 126

Security Affairs

OCTOBER 14, 2024

“Between August 17 and August 19, a third party accessed and obtained certain information without authorization using two customer accounts that they had recently established. Please note that this incident did not involve any access to your Fidelity account(s).”

Data breaches 135

Data breaches Financial Services Accountability Hacking 135

Krebs on Security

AUGUST 29, 2023

According to recent figures from the managed security firm Reliaquest , QakBot is by far the most prevalent malware “loader” — malicious software used to secure access to a hacked network and help drop additional malware payloads. ” The DOJ said it also recovered more than 6.5

Hacking 315

Hacking Malware Ransomware Government 315

Security Affairs

JUNE 11, 2025

After the operation, the authorities alerted over 216,000 victims to help them quickly secure their accounts and prevent further unauthorized access. ” As part of Operation Secure, Vietnamese police arrested 18 suspects and seized cash, SIMs, and documents tied to a scheme selling corporate accounts. .

Cybercrime 112

Cybercrime Data collection Scams Cyber threats 112

Security Affairs

APRIL 7, 2025

Cybercriminals exploit compromised accounts for EDR-as-a-Service (Emergency Data Requests – EDR), targeting major platforms According to a detailed analysis conducted by Meridian Group, an increasingly complex and structured phenomenon, commonly referred to as EDR-as-a-Service, is taking hold in the cybersecurity landscape.

Cybercrime 140

Cybercrime Social Engineering Accountability Government 140

Krebs on Security

NOVEMBER 14, 2024

But not long after KrebsOnSecurity reported in April that Shefel/Rescator also was behind the theft of Social Security and tax information from a majority of South Carolina residents in 2012, Mr. Shefel began contacting this author with the pretense of setting the record straight on his alleged criminal hacking activities.

Retail 274

Retail Advertising Cryptocurrency Cybercrime 274

Security Affairs

JANUARY 21, 2025

On October 17, 2024, Rahman stole and leaked Top-Secret documents on a U.S. The CIA analyst photographed the classified documents and transmitted them to individuals he knew were not authorized to view them. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini ( SecurityAffairs hacking,CIA analyst)

Media 69

Media Mobile Internet Internet 69

Krebs on Security

APRIL 30, 2025

prosecutors allege Tyler Robert Buchanan and co-conspirators hacked into dozens of companies in the United States and abroad, and that he personally controlled more than $26 million stolen from victims. Internet address was used to operate a Discord account that specified a cryptocurrency wallet when asking another user to send funds.

Identity Theft 195

Identity Theft Phishing Cryptocurrency Cybercrime 195

Security Affairs

JUNE 9, 2025

OpenAI banned ChatGPT accounts tied to Russian and Chinese hackers using the tool for malware, social media abuse, and U.S. OpenAI banned ChatGPT accounts that were used by Russian-speaking threat actors and two Chinese nation-state actors. We banned the OpenAI accounts used by this adversary.” satellite tech research.

Accountability 74

Accountability Social Engineering Media Authentication 74

Security Affairs

JUNE 17, 2025

State-sponsored hackers compromised the email accounts of several journalists working at the Washington Post. A cyberattack, likely carried out by state-sponsored hackers, compromised the Microsoft email accounts of Washington Post journalists, including reporters covering China and national security.

Accountability 67

Accountability Cyber Attacks Media Hacking 67

Security Affairs

DECEMBER 6, 2024

. “The attacks continued intensively including on election day and the night after elections,” the Romanian Intelligence reported in a declassified document. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini ( SecurityAffairs hacking,Romania election)

Government 140

Government Cybercrime Cyber Attacks Hacking 140

Security Affairs

DECEMBER 23, 2024

Will Cathcart of WhatsApp called the ruling a major privacy victory, emphasizing accountability for spyware firms after a five-year legal battle. ” reads the court document. NSO Group continued using WhatsApp exploits, including spyware called Erised, even after being sued for violating anti-hacking laws. ” The U.S.

Spyware 110

Spyware Surveillance Software Hacking 110

Krebs on Security

AUGUST 26, 2020

Ngo got his treasure trove of consumer data by hacking and social engineering his way into a string of major data brokers. Ngo’s businesses enabled an entire generation of cybercriminals to commit an estimated $1 billion worth of new account fraud , and to sully the credit histories of countless Americans in the process.

Identity Theft 355

Identity Theft Computers and Electronics Hacking Accountability 355

Krebs on Security

JANUARY 7, 2021

The ongoing breach affecting thousands of organizations that relied on backdoored products by network software firm SolarWinds may have jeopardized the privacy of countless sealed court documents on file with the U.S. federal court system, according to a memo released Wednesday by the Administrative Office (AO) of the U.S.

Computers and Electronics 363

Computers and Electronics Software Engineering Technology 363

Security Affairs

DECEMBER 18, 2024

The Irish Data Protection Commission (DPC) fined Meta 251 million ($263M) for a 2018 data breach impacting 29 million Facebook accounts. “This data breach impacted approximately 29 million Facebook accounts globally, of which approximately 3 million were based in the EU/EEA. ” reads the press release published by DPC.

Data breaches 106

Data breaches Accountability Risk Advertising 106

Security Affairs

FEBRUARY 26, 2024

Recently the leak of a collection of files apparently stolen from the Chinese government hacking contractor, I-Soon, exposed Chinese hacking capabilities. Recently someone has leaked on GitHub [ 1 , 2 ] a collection of files apparently stolen from the Chinese hacking firm, I-Soon.

Hacking 135

Hacking Government Spyware Marketing 135

Security Affairs

OCTOBER 24, 2023

The ex-NSA employee had Top Secret clearance that give him access to top secret documents. All three documents from which the excerpts were taken contain NDI, are classified as Top Secret//Sensitive Compartmented Information (SCI) and were obtained by Dalke during his employment with the NSA.”

Encryption 130

Encryption Hacking Accountability Information Security 130

Krebs on Security

AUGUST 12, 2020

Several stories here have highlighted the importance of creating accounts online tied to your various identity, financial and communications services before identity thieves do it for you. From that story: “The reasoning behind this strategy is as simple as it is alluring: What’s not put online can’t be hacked.

Accountability 357

Accountability Mobile Banking Passwords 357

Krebs on Security

FEBRUARY 19, 2020

The disclosure comes almost a year after Citrix acknowledged that digital intruders had broken in by probing its employee accounts for weak passwords. Iranian hackers recently have been blamed for hacking VPN servers around the world in a bid to plant backdoors in large corporate networks.

VPN 363

VPN Passwords Software Telecommunications 363

Krebs on Security

SEPTEMBER 17, 2020

Justice Department this week indicted seven Chinese nationals for a decade-long hacking spree that targeted more than 100 high-tech and online gaming companies. ” Once inside of a target organization, the hackers stole source code, software code signing certificates, customer account data and other information they could use or resell.

Antivirus 363

Antivirus Hacking Government Software 363

The Last Watchdog

NOVEMBER 12, 2024

Security and Exchange Commission (SEC) recently laid down the hammer charging and fining four prominent cybersecurity vendors for making misleading claims in connection with the SolarWinds hack. SEC investigators gathered evidence that Unisys Corp., 1 million for a company the size of Checkpoint is but a slap on the wrist.

CISO 263

CISO CSO Risk Cyber threats 263

Krebs on Security

JUNE 21, 2021

While documenting each device that needs protection is a necessary first step, a number of recent cyberattacks on water treatment systems have been blamed on a failure to properly secure water treatment employee accounts that can be used for remote access. and briefly increased the amount of sodium hydroxide (a.k.a. Image: WaterISAC.

Hacking 362

Hacking Accountability Cybersecurity Technology 362

Security Affairs

MAY 1, 2024

NSA employee has been sentenced to nearly 22 years in prison for attempting to sell classified documents to Russia. Dalke pleaded guilty to six counts of attempting to transmit classified documents to a foreign agent while he was working at the NSA. A former U.S.

Accountability 132

Accountability Encryption Government Hacking 132

Krebs on Security

MAY 5, 2021

Also, the apps will persist in a user’s Office 365 account indefinitely until removed, and will survive even after an account password reset. “Now, they’re compromising accounts in credible tenants first,” Proofpoint explains. A cybercriminal service advertising the sale of access to hacked Office365 accounts.

Accountability 350

Accountability Passwords Advertising Phishing 350

Security Affairs

MARCH 3, 2025

In the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format This can lead to out of bounds writes since frames of this type were not taken into account when calculating the size of the frames buffer in uvc_parse_streaming. reads the advisory.

Hacking 69

Hacking Spyware Technology Surveillance 69

Krebs on Security

FEBRUARY 22, 2024

A new data leak that appears to have come from one of China’s top private cybersecurity firms provides a rare glimpse into the commercial side of China’s many state-sponsored hacking groups. APT stands for Advanced Persistent Threat, a term that generally refers to state-sponsored hacking groups.

Government 335

Government Hacking Cyber threats Mobile 335

Security Affairs

MAY 15, 2025

Exposed data included contact details, partial SSNs and bank info, ID images, account history, and limited internal documents. Compromised data includes: Name, address, phone, and email; Masked Social Security (last 4 digits only); Masked bank-account numbers and some bank account identifiers; GovernmentID images (e.g.,

Data breaches 87

Data breaches Banking Accountability Retail 87