Krebs on Security

NOVEMBER 17, 2020

This is evident by the apparent scale of the infrastructure behind a relatively new company based in Montenegro called PushWelcome , which advertises the ability for site owners to monetize traffic from their visitors. An ad from PushWelcome touting the money that websites can make for embedding their dodgy push notifications scripts.

Antivirus 337

Antivirus Advertising Internet Internet 337

Krebs on Security

FEBRUARY 24, 2023

BHProxies sells access to “residential proxy” networks, which allow someone to rent a residential IP address to use as a relay for their Internet communications, providing anonymity and the advantage of being perceived as a residential user surfing the web. WHO’S BEHIND BHPROXIES? The website BHProxies[.]com

Accountability 224

Accountability Advertising Marketing Malware 224

Krebs on Security

SEPTEMBER 1, 2021

The first mention of VIP72 in the cybercrime underground came in 2006 when someone using the handle “ Revive ” advertised the service on Exploit, a Russian language hacking forum. And it stands to reason that VIP72 was launched with the help of systems already infected with Corpse’s trojan malware.

Malware 283

Malware Cybercrime Internet Internet 283

Krebs on Security

NOVEMBER 2, 2023

The “ drops ” are people who have responded to work-at-home package reshipping jobs advertised on craigslist.com and job search sites. Services like SWAT are known as “Drops for stuff” on cybercrime forums. Most reshipping scams promise employees a monthly salary and even cash bonuses.

Cybercrime 266

Cybercrime Marketing Scams Retail 266

Krebs on Security

APRIL 4, 2024

Privnote’s ease-of-use and popularity among cryptocurrency enthusiasts has made it a perennial target of phishers , who erect Privnote clones that function more or less as advertised but also quietly inject their own cryptocurrency payment addresses when a note is created that contains crypto wallets.

Phishing 212

Phishing Cryptocurrency DDOS Internet 212

Krebs on Security

NOVEMBER 4, 2021

One of dozens of FedEx-themed phishing sites currently being advertised via SMS spam. com — from a desktop web browser redirects the visitor to a harmless page with ads for car insurance quotes. “It is a nearly perfect attack vector at this time of year,” Morton said.

Phishing 307

Phishing Scams Mobile DNS 307

Krebs on Security

AUGUST 9, 2021

Also, this greenhorn criminal clearly had bought into BriansClub’s advertising, which uses my name and likeness in a series of ads that run on all the top cybercrime forums. com via DomainTools (an advertiser on this site), we can see it was registered in November 2015 — several months after the real BriansClub came online.

Phishing 353

Phishing Cybercrime Accountability Advertising 353

Krebs on Security

JUNE 28, 2022

Google took aim at Glupteba in part because its owners were using the botnet to divert and steal vast sums in online advertising revenue. Full disclosure: Constella is currently an advertiser on this website]. ru , an extremely popular Russian-language pay-per-install network that has been in operation for at least a decade.

Passwords 237

Passwords Malware Internet Internet 237

Krebs on Security

APRIL 14, 2019

Scammers who make a living swindling Airbnb.com customers have a powerful new tool at their disposal: A software-as-a-service offering called “ Land Lordz ,” which helps automate the creation and management of fake Airbnb Web sites and the sending of messages to advertise the fraudulent listings.

Scams 240

Scams Advertising Accountability Phishing 240

Security Boulevard

JULY 25, 2023

Researchers this month uncovered a two-year-old Linux-based remote access trojan dubbed AVrecon that enslaves Internet routers into botnet that bilks online advertisers and performs password-spraying attacks.

Malware 52

Malware Small Business Internet Internet 52

Security Boulevard

APRIL 18, 2023

For less than a dollar per day, Faceless customers can route their malicious traffic through tens of thousands of compromised systems advertised on the service. For the past seven years, a malware-based proxy service known as "Faceless" has sold anonymity to countless cybercriminals.

Malware 59

Malware Advertising Web Fraud 59

Krebs on Security

JULY 25, 2023

Researchers this month uncovered a two-year-old Linux-based remote access trojan dubbed AVrecon that enslaves Internet routers into botnet that bilks online advertisers and performs password-spraying attacks. Another domain with the Google Analytics code US-2665744 was sscompany[.]net.

Malware 199

Malware VPN Internet Internet 199

Krebs on Security

AUGUST 2, 2022

That is a far cry from the proxy inventory advertised by 911, which stood at more than 200,000 IP addresses for rent just a few days ago. According to Constella Intelligence [currently an advertiser on KrebsOnSecurity], Oleg used the same password from his iboss32@ro.ru Image: Spur.us. Cached copies of angrycoders[.]net

Malware 251

Malware Cybercrime Internet Internet 251

Krebs on Security

FEBRUARY 4, 2021

Facebook said it targeted a number of accounts tied to key sellers on OGUsers, as well as those who advertise the ability to broker stolen account sales. THE MIDDLEMEN. Like most cybercrime forums, OGUsers is overrun with shady characters who are there mainly to rip off other members.

Accountability 298

Accountability Hacking Media Mobile 298

Krebs on Security

MAY 21, 2021

Siegel said the “recruiter” sent her a list of screening questions that all seemed relevant to the position being advertised. On Monday, someone claiming to work with Gwin contacted Siegel and asked her to set up an online interview with Geosyntec.

Scams 363

Scams Accountability Advertising Engineering 363

Krebs on Security

SEPTEMBER 29, 2021

agency — advertised a web-based bot designed to trick targets into giving up OTP tokens. The idea is that even if the user’s password gets stolen, the attacker still can’t access the user’s account without that second factor — i.e. without access to the victim’s mobile device or phone number.

Passwords 318

Passwords Mobile Authentication Banking 318

Krebs on Security

MARCH 23, 2020

One from May 2011 at onlineprnews.com sings the praises of Weblistingsinc.info , weblistingsinc.org and web-listings.net in the same release, and lists the point of contact simply as “Mark.” ” Historic WHOIS registration records from Domaintools [an advertiser on this blog] say Weblistingsinc.org was registered in Nov.

Scams 256

Scams Marketing Internet Internet 256

Krebs on Security

DECEMBER 11, 2019

Historic WHOIS records from domaintools.com [a former advertiser on this site] indicate Byaruhanga was the registrant of two domain names tied to this company — ipv4leasing.org and.net — back in 2013. Spamhaus says it ultimately traced the domains advertised in those spam emails back to Adconion Direct , a U.S.

Internet 175

Internet Internet Marketing Government 175

Krebs on Security

NOVEMBER 13, 2018

But the site is noticeably devoid of any SSL certificate (the entire site is [link] not [link] and the products for sale are all advertised for roughly half their normal cost. It’s now advertising running shoes. So what’s going here?

Accountability 216

Accountability eCommerce Cybercrime Advertising 216

Krebs on Security

JUNE 21, 2023

But Intel 471 finds that after his critical review of VIP Crypt, Kerens did not post publicly on Exploit again for another four years until October 2016, when they suddenly began advertising Cryptor[.]biz.

Malware 215

Malware Antivirus Cybercrime Hacking 215

Krebs on Security

NOVEMBER 23, 2018

Adopting a shopping strategy of simply buying from the online merchant with the lowest advertised prices can be a bit like playing Russian Roulette with your wallet, for the simple reason that there are tons of completely fake e-commerce sites out there looking to separate the unwary from their credit card details. CHCEK THE SHIPPING.

Scams 271

Scams Wireless Phishing Banking 271

Krebs on Security

AUGUST 30, 2019

One source who had at least two employees fall for the scheme forwarded KrebsOnSecurity a response from UR’s privacy division, which blamed the incident on a third-party advertising partner. “The phishing email contained links to a purported invoice that, if clicked on, could deliver malware to the recipient’s system.

Phishing 212

Phishing Marketing Accountability DNS 212

Malwarebytes

JUNE 8, 2022

SSNDOB advertised its services on dark web forums and offered customer support for buyers. DDoS attacks from rivals are common, so several domains working together keeps things ticking over. Shutdowns generally via abuse reports or law enforcement raids are also less of a threat as a result. The Bitcoin boon.

DDOS 103

DDOS Cryptocurrency Scams Data breaches 103

Krebs on Security

APRIL 30, 2020

.” Brian’s Club — one of the underground’s largest bazaars for selling stolen credit card data and one that has misappropriated this author’s likeness and name in its advertising — recently began offering “pandemic support” in the form of discounts for its most loyal customers.

Cybercrime 305

Cybercrime Computers and Electronics Marketing Scams 305

Krebs on Security

APRIL 28, 2020

The request for the last four of the customer’s credit card number was consistent with my own testing, which relied upon on a caller ID spoofing service advertised in the cybercrime underground and aimed at a Citi account controlled by this author.

Scams 358

Scams Banking Accountability Financial Services 358

Krebs on Security

MARCH 22, 2022

Among the escapades recounted in the ChronoPay founder’s diaries are multiple stories involving the self-proclaimed “King of Fraud!”

Banking 190

Banking Marketing DDOS Risk 190

Krebs on Security

OCTOBER 15, 2019

” Flashpoint’s Nixon said a spot check comparison between the stolen card database and the card data advertised at BriansClub suggests the administrator is not being truthful in his claims of having removed the leaked stolen card data from his online shop.

Hacking 208

Hacking Cybercrime Marketing Banking 208

Krebs on Security

FEBRUARY 28, 2023

Each advertises their claimed access to T-Mobile systems in a similar way. The prices advertised for a SIM-swap against T-Mobile customers in the latter half of 2022 ranged between USD $1,000 and $1,500, while SIM-swaps offered against AT&T and Verizon customers often cost well more than twice that amount.

Mobile 308

Mobile Phishing Authentication Advertising 308

Krebs on Security

JUNE 6, 2023

In May, KrebsOnSecurity interviewed a Russian spammer named “ Quotpw “ who was mass-registering accounts on the social media network Mastodon in order to conduct a series of huge spam campaigns advertising scam cryptocurrency investment platforms.

Accountability 208

Accountability Scams Cryptocurrency Advertising 208

Krebs on Security

SEPTEMBER 4, 2022

And now many of these same individuals are finding that communities like Telegram can be leveraged to hire physical harassment and intimidation of their rivals and competitors.

Government 55

Government Accountability Cryptocurrency Web Fraud 55

Krebs on Security

MARCH 29, 2022

Everlynn advertising a warrant/subpoena service based on fake EDRs. ” which advertised the ability to send email from a federal agency within the government of Argentina. .” On April 5, 2021, Everlynn posted a new sales thread to the cybercrime forum cracked[.]to ” The price: $100 to $250 per request.

Accountability 273

Accountability Government Hacking Social Engineering 273

Krebs on Security

OCTOBER 8, 2020

In a series of recent advertisements, Dr. Samuil says he’s eagerly hiring experienced people who are familiar with tools used by legitimate pentesters for exploiting access once inside of a target company — specifically, post-exploit frameworks like the closely-guarded Cobalt Strike. The domain registration records for ruskod[.]net

Cybercrime 303

Cybercrime VPN Malware Penetration Testing 303

Krebs on Security

APRIL 16, 2020

. “Since March 20th, the number of risky domains registered per day has been decreasing, with a notable spike around March 30th,” wrote John Conwell , principal data scientist at DomainTools [an advertiser on this site].

Cyber threats 284

Cyber threats Phishing Data collection Government 284

Krebs on Security

APRIL 27, 2022

A fake EDR service advertised on a hacker forum in 2021. An individual who’s part of the community of crooks that are abusing fake EDR told KrebsOnSecurity the schemes often involve hacking into police department emails by first compromising the agency’s website.

Mobile 182

Mobile Government Media Technology 182

Krebs on Security

MARCH 11, 2020

Ryan Barnett at Akamai penned a comprehensive blog post on these approaches not long ago that is well worth reading [full disclosure: Akamai is an advertiser on this site]. These offer mitigation options to prevent your site from being used in these card skimming attacks.

Retail 281

Retail Hacking Advertising Web Fraud 281

Krebs on Security

APRIL 11, 2022

The complaint alleges the advertisements, which endorsed investment in cryptocurrency or money-making schemes, could have misled Facebook users into believing they were promoted by famous Australians. In many ways, the crypto giveaway scam is a natural extension of perhaps the oldest cyber fraud in the book: Advanced-fee fraud.

Scams 189

Scams Cryptocurrency Media Hacking 189

Krebs on Security

JULY 16, 2019

Sure enough, I found that Yalishanda was actively advertising on cybercrime forums, and that his infrastructure was being used to host hundreds of dodgy sites. Here’s a snippet from one of Yalishanda’s advertisements to a cybercrime forum in 2011, when he was running a bulletproof service under the domain real-hosting[.]biz:

Cybercrime 180

Cybercrime Phishing Banking Malware 180