Krebs on Security

JANUARY 30, 2024

.” Group-IB dubbed the gang by a different name — 0ktapus — which was a nod to how the criminal group phished employees for credentials. The missives asked users to click a link and log in at a phishing page that mimicked their employer’s Okta authentication page. On July 28 and again on Aug.

Social Engineering 311

Social Engineering Mobile Cybercrime Passwords 311

Krebs on Security

NOVEMBER 16, 2022

A financial cybercrime group calling itself the Disneyland Team has been making liberal use of visually confusing phishing domains that spoof popular bank brands using Punycode , an Internet standard that allows web browsers to render domain names with non-Latin alphabets like Cyrillic. com — which was created to phish U.S.

Malware 264

Malware Banking Phishing DDOS 264

Krebs on Security

SEPTEMBER 29, 2021

In February, KrebsOnSecurity wrote about a novel cybercrime service that helped attackers intercept the one-time passwords (OTPs) that many websites require as a second authentication factor in addition to passwords. That is true two-factor authentication: Something you have, and something you know (and maybe also even something you are).

Passwords 316

Passwords Mobile Authentication Banking 316

Krebs on Security

MAY 5, 2021

After a user logs in, the link prompts them to install a malicious but innocuously-named app that gives the attacker persistent, password-free access to any of the user’s emails and files, both of which are then plundered to launch malware and phishing scams against others.

Accountability 321

Accountability Passwords Advertising Phishing 321

Krebs on Security

NOVEMBER 21, 2020

In March, a voice phishing scam targeting GoDaddy support employees allowed attackers to assume control over at least a half-dozen domain names, including transaction brokering site escrow.com. authenticate the phone call before sensitive information can be discussed. 2019 that wasn’t discovered until April 2020.

Cryptocurrency 363

Cryptocurrency VPN Scams Social Engineering 363

Krebs on Security

AUGUST 30, 2019

But when accounts at those CRM providers get hacked or phished, the results can be damaging for both the client’s brand and their customers. Here’s a look at a recent CRM-based phishing campaign that targeted customers of Fortune 500 construction equipment vendor United Rentals. Stamford, Ct. . Image: APWG.

Phishing 211

Phishing Marketing Accountability DNS 211

Security Boulevard

SEPTEMBER 29, 2021

In February, KrebsOnSecurity wrote about a novel cybercrime service that helped attackers intercept the one-time passwords (OTPs) that many websites require as a second authentication factor in addition to passwords. The post The Rise of One-Time Password Interception Bots appeared first on Security Boulevard.

Passwords 96

Passwords Cybercrime Phishing Authentication 96

Krebs on Security

APRIL 14, 2019

But when the interested party inquires about the listing, they are sent a link to a site that looks like Airbnb.com but which is actually a phishing page. Airbnb could help by adding some type of robust multi-factor authentication, such as Security Keys — which would defeat these Airbnb phishing pages.

Scams 239

Scams Advertising Accountability Phishing 239

Krebs on Security

MAY 30, 2023

Scavuzzo said the administrator’s account was hijacked even though she had multi-factor authentication turned on. Scavuzzo, who is based in Maine, said the attackers waited until around midnight in his timezone time before using the administrator’s account to send out an unauthorized message about a new Ocean airdrop.

Hacking 278

Hacking Scams Accountability Cryptocurrency 278

Krebs on Security

NOVEMBER 23, 2018

Even so, anti-phishing company PhishLabs found in a survey last year that more than 80% of respondents believed the green lock indicated that a website was either legitimate and/or safe. Now that anyone can get SSL certificates for free , phishers and other scammers that ply their trade via fake Web sites are starting to up their game.

Scams 270

Scams Wireless Phishing Banking 270

Krebs on Security

FEBRUARY 28, 2023

In each case, the goal of the attackers was the same: Phish T-Mobile employees for access to internal company tools, and then convert that access into a cybercrime service that could be hired to divert any T-Mobile user’s text messages and phone calls to another device. ” TMO UP!

Mobile 306

Mobile Phishing Authentication Advertising 306

Krebs on Security

JANUARY 22, 2019

Contacted by KrebsOnSecurity, GoDaddy acknowledged the authentication weakness documented by Guilmette. “After investigating the matter, our team confirmed that a threat actor(s) abused our DNS setup process,” the company said in an emailed statement.

DNS 230

DNS Internet Internet Computers and Electronics 230

Krebs on Security

NOVEMBER 19, 2021

Naturally, a great deal of phishing schemes that precede these bank account takeovers begin with a spoofed text message from the target’s bank warning about a suspicious Zelle transfer. What follows is a deep dive into how this increasingly clever Zelle fraud scam typically works, and what victims can do about it.

Scams 353

Scams Banking Passwords Authentication 353

Krebs on Security

JULY 29, 2021

Our continued reliance on passwords for authentication has contributed to one toxic data spill or hack after another. TARGETED PHISHING. The targeted phishing message that went out to classicfootballshirts.co.uk In essence, you effectively get to use the same password across all Web sites. customers this month.

Passwords 353

Passwords Password Management Phishing Scams 353

Krebs on Security

SEPTEMBER 2, 2021

Bill said this criminal group averages between five and ten million email authentication attempts daily, and comes away with anywhere from 50,000 to 100,000 of working inbox credentials. “For context, our research indicates that multi-factor authentication prevents more than 99.9%

Accountability 284

Accountability Authentication Passwords Hacking 284

Krebs on Security

NOVEMBER 6, 2018

” Rose said mobile phone stores could cut down on these crimes in much the same way that potential victims can combat SIM swapping: By relying on dual authentication. He advises people instead use a mobile app like Authy or Google Authenticator to generate the one-time code. ” TWO-FACTOR BREAKDOWN. ” Lt.

Mobile 233

Mobile Cryptocurrency Accountability Passwords 233

Krebs on Security

NOVEMBER 26, 2019

One way fraudsters might make a fake.gov domain even more convincing would be to equip the site with an SSL certificate so that the phony domain displays the green padlock icon in a user’s Web browser. “It turns out that the GSA is pretty good at doing boring clerical stuff,” he said. ”

Government 323

Government Internet Internet Web Fraud 323