Krebs on Security

AUGUST 30, 2022

A recent spate of SMS phishing attacks from one cybercriminal group has spawned a flurry of breach disclosures from affected companies, which are all struggling to combat the same lingering security threat: The ability of scammers to interact directly with employees through their mobile devices. Image: Cloudflare.com. 2, and Aug.

Mobile 284

Mobile Phishing Authentication Accountability 284

Krebs on Security

MAY 5, 2021

After a user logs in, the link prompts them to install a malicious but innocuously-named app that gives the attacker persistent, password-free access to any of the user’s emails and files, both of which are then plundered to launch malware and phishing scams against others. Image: Proofpoint.

Accountability 322

Accountability Passwords Advertising Phishing 322

Krebs on Security

NOVEMBER 3, 2020

Two young men from the eastern United States have been hit with identity theft and conspiracy charges for allegedly stealing bitcoin and social media accounts by tricking employees at wireless phone companies into giving away credentials needed to remotely access and modify customer account information. Prosecutors say Jordan K.

Scams 297

Scams Wireless Identity Theft Mobile 297

Krebs on Security

FEBRUARY 28, 2024

The profile also linked to Mr. Lee’s Twitter/X account , which features the same profile image. Doug then messaged the Mr. Lee account on Telegram, who said there was some kind of technology issue with the video platform, and that their IT people suggested using a different meeting link. ” Image: SlowMist.

Malware 261

Malware Cryptocurrency Software Scams 261

Krebs on Security

NOVEMBER 16, 2022

A financial cybercrime group calling itself the Disneyland Team has been making liberal use of visually confusing phishing domains that spoof popular bank brands using Punycode , an Internet standard that allows web browsers to render domain names with non-Latin alphabets like Cyrillic. com — which was created to phish U.S.

Malware 265

Malware Banking Phishing DDOS 265

Krebs on Security

NOVEMBER 21, 2020

In March, a voice phishing scam targeting GoDaddy support employees allowed attackers to assume control over at least a half-dozen domain names, including transaction brokering site escrow.com. “This gave the actor the ability to change DNS records and in turn, take control of a number of internal email accounts. PST on Nov.

Cryptocurrency 363

Cryptocurrency VPN Scams Social Engineering 363

Krebs on Security

APRIL 14, 2019

Scammers who make a living swindling Airbnb.com customers have a powerful new tool at their disposal: A software-as-a-service offering called “ Land Lordz ,” which helps automate the creation and management of fake Airbnb Web sites and the sending of messages to advertise the fraudulent listings. co.uk , airbnb.pt-anuncio[.]com

Scams 239

Scams Advertising Accountability Phishing 239

Krebs on Security

NOVEMBER 23, 2018

I later received an email from the seller, who said his Amazon account had been hacked and abused by scammers to create fake sales. But this assurance may ring hollow if you wake up one morning to find your checking accounts emptied by card thieves after shopping at a breached merchant with a debit card. CHCEK THE SHIPPING.

Scams 270

Scams Wireless Phishing Banking 270

Malwarebytes

JUNE 8, 2022

You run the risk of being targeted for spear phishing, or having your personal information used for fraudulent applications. Password reuse is one big reason for credential stuffing (using stolen data across additional sites) being so popular. Criminals will make use of it however they can to make money.

DDOS 105

DDOS Cryptocurrency Scams Data breaches 105

Krebs on Security

JANUARY 22, 2019

In July 2018, email users around the world began complaining of receiving spam which began with a password the recipient used at some point in the past and threatened to release embarrassing videos of the recipient unless a bitcoin ransom was paid. domaincontrol.com and ns18.domaincontrol.com). domaincontrol.com). SPAMMY BEAR.

DNS 231

DNS Internet Internet Computers and Electronics 231

Krebs on Security

JULY 29, 2021

Every time there is another data breach, we are asked to change our password at the breached entity. Our continued reliance on passwords for authentication has contributed to one toxic data spill or hack after another.

Passwords 354

Passwords Password Management Phishing Scams 354

Krebs on Security

NOVEMBER 19, 2021

One of the more common ways cybercriminals cash out access to bank accounts involves draining the victim’s funds via Zelle , a “peer-to-peer” (P2P) payment service used by many financial institutions that allows customers to quickly send cash to friends and family.

Scams 353

Scams Banking Passwords Authentication 353

Krebs on Security

FEBRUARY 28, 2023

In each case, the goal of the attackers was the same: Phish T-Mobile employees for access to internal company tools, and then convert that access into a cybercrime service that could be hired to divert any T-Mobile user’s text messages and phone calls to another device.

Mobile 307

Mobile Phishing Authentication Advertising 307

Krebs on Security

SEPTEMBER 2, 2021

For the past three years, the source — we’ll call him “Bill” to preserve his requested anonymity — has been watching one group of threat actors that is mass-testing millions of usernames and passwords against the world’s major email providers each day. Why go after hotel or airline rewards?

Accountability 284

Accountability Authentication Passwords Hacking 284

Krebs on Security

NOVEMBER 6, 2018

that has been tracking down individuals engaged in unauthorized “SIM swaps” — a complex form of mobile phone fraud that is often used to steal large amounts of cryptocurrencies and other items of value from victims. OG accounts typically can be resold for thousands of dollars. ” FAKE IDs AND PHONY NOTES.

Mobile 233

Mobile Cryptocurrency Accountability Passwords 233

Krebs on Security

FEBRUARY 2, 2021

SPR claims his site lost access to a significant inventory — more than 600,000 unsold stolen payment card accounts. “We don’t know users’ balances, or your account logins or passwords, or the [credit cards] you purchased, or anything else! “We don’t know anything!,” ” SPR pleaded.

Cybercrime 203

Cybercrime Media Accountability Hacking 203

Krebs on Security

MARCH 28, 2024

They happen when someone you know has their email account compromised, and you are suddenly dropped into an existing conversation between the sender and someone else. Here’s the story of a recent thread hijacking attack in which a journalist was copied on a phishing email from the unwilling subject of a recent scoop.

Phishing 246

Phishing Scams Accountability Passwords 246