Security Affairs

NOVEMBER 30, 2022

Google’s Threat Analysis Group (TAG) linked three exploitation frameworks to a Spanish surveillance spyware vendor named Variston. While tracking the activities of commercial spyware vendors, Threat Analysis Group (TAG) spotted an exploitation framework likely linked Variston IT, a Spanish firm. ” TAG concludes.

Spyware 99

Spyware Surveillance Risk Internet 99

Security Affairs

JUNE 16, 2023

An updated version of the Android remote access trojan GravityRAT can steal WhatsApp backup files and can delete files ESET researchers discovered an updated version of Android GravityRAT spyware that steals WhatsApp backup files and can delete files. The malware is distributed as the messaging apps BingeChat and Chatico.

Backups 90

Backups Spyware Malware Accountability 90

Security Affairs

AUGUST 30, 2023

The domain was registered on February 15 th , 2022, and provides a link to download the malicious Signal Plus Messenger application either from Google Play or directly from the website” continues the report. Signal Plus Messenger can collect device data and sensitive information, and spy on the victim’s Signal communications.

Spyware 111

Spyware Accountability Malware Hacking 111

Security Affairs

MARCH 27, 2021

Researchers spotted a sophisticated Android spyware that implements exfiltration capabilities and surveillance features, including recording audio and phone calls. Experts from security firm Zimperium have spotted a new sophisticated Android spyware that masquerades itself as a System Update application. Pierluigi Paganini.

Spyware 101

Spyware Malware Surveillance Mobile 101

Security Affairs

AUGUST 1, 2022

An Australian national has been charged for the creation and sale of the Imminent Monitor (IM) spyware, which was also used for criminal purposes. The 24-year-old Australian national Jacob Wayne John Keen has been charged for his alleged role in the development and sale of spyware known as Imminent Monitor (IM). Pierluigi Paganini.

Spyware 100

Spyware Malware Cybercrime Hacking 100

Security Affairs

NOVEMBER 26, 2021

A threat actor, tracked as APT C-23, is using new powerful Android spyware in attacks aimed at targets in the Middle East. The APT C-23 cyberespionage group (also known as GnatSpy, FrozenCell, or VAMP) continues to target entities in the Middle East with enhanced Android spyware masqueraded as seemingly harmless app updates (i.e.

Spyware 91

Spyware Social Engineering Surveillance Engineering 91

Security Affairs

FEBRUARY 24, 2021

The threat actors used by spyware to take over the target systems, spy on the victims, and exfiltrate data. ” The attack chain begins with spear-phishing messages that include a link to an alleged important document to download. The link points to files containing spyware that could infect both Mac OS or Windows systems.

Spyware 87

Spyware Surveillance Government Phishing 87

Security Affairs

NOVEMBER 11, 2022

Researchers from mobile security firm Lookout uncovered two long-running surveillance campaigns targeting the Uyghurs minority. The threat actors behind the campaigns used two Android spyware to spy on the victims and steal sensitive information. List of installed packages. Pierluigi Paganini.

Surveillance 89

Surveillance Spyware Malware Mobile 89

Security Affairs

OCTOBER 11, 2021

A Togolese human rights advocate was hit by mobile spyware that has been allegedly developed by an Indian firm called Innefu Labs. Experts believe the attackers used a spyware developed by an Indian company called Innefu Labs. In the past, the Donot Team spyware was found in attacks outside of South Asia. Pierluigi Paganini.

Spyware 81

Spyware Surveillance Accountability Mobile 81

Security Affairs

FEBRUARY 11, 2021

Lookout researchers provided details about two Android spyware families employed by an APT group tracked as Confucius. Researchers at mobile security firm Lookout have provided details about two recently discovered Android spyware families, dubbed Hornbill and SunBird, used by an APT group named Confucius. Pierluigi Paganini.

Spyware 107

Spyware Surveillance Malware Mobile 107

Security Affairs

JUNE 2, 2022

The victim downloads and opens the malicious app that installs FluBot. FluBot downloads a list of new contacts to target. The post An international police operation dismantled FluBot spyware appeared first on Security Affairs. The victim received an SMS message that includes a link to a malicious URL. Pierluigi Paganini.

Spyware 85

Spyware Malware Banking Cybercrime 85

Security Affairs

JULY 21, 2021

FormBook is a data-stealing malware that is used in cyber espionage campaigns, like other spyware it is capable of extracting data from HTTP sessions, keystroke logging, stealing clipboard contents. The post XLoader, a $49 spyware that could target both Windows and macOS devices appeared first on Security Affairs.

Spyware 98

Spyware Malware Cybercrime Advertising 98

Security Affairs

SEPTEMBER 8, 2019

Security experts at Google have removed from Google Play 24 apps because they were infected with a new spyware tracked as “the Joker.” ” Google has removed from Google Play 24 apps because they were infected with a new spyware tracked as “the Joker.” ” states the analysis. The C&C URL 6.

Spyware 93

Spyware Advertising Malware Cryptocurrency 93

Security Affairs

OCTOBER 16, 2023

Threat actors are targeting Israeli Android users with a malicious version of the ‘RedAlert – Rocket Alerts’ that hide spyware. A threat actor is targeting Israeli Android users with a spyware-laced version of the ‘RedAlert – Rocket Alerts’ app, Cloudflare warns. The website hxxps://redalerts[.]me

Malware 102

Malware Spyware Mobile Hacking 102

Security Affairs

JUNE 15, 2020

The Earth Empusa threat group is distributing new Android spyware, dubbed ActionSpy, through watering hole attacks to targets Turkic minority group. Attackers injected the malicious code to deploy the spyware in websites, some of them were actually fake. The server, in turn, may send some commands to the compromised device.

Spyware 65

Spyware Advertising Encryption Phishing 65

Security Affairs

SEPTEMBER 10, 2023

Researchers from Kaspersky discovered several Telegram mods on the Google Play Store that contained spyware, the campaign was tracked as Evil Telegram. One of the apps was downloaded more than ten million times before it was removed from Google Play. “Attacks employing various unofficial Telegram mods are on the rise of late.

Spyware 120

Spyware Advertising Encryption Hacking 120

Security Affairs

MAY 18, 2020

Security experts discovered a highly sophisticated Android spyware platform, dubbed Mandrake, that remained undetected for four years. Researchers from Bitdefender discovered a high-sophisticated Android spyware platform dubbed Mandrake, it was involved in highly targeted attacks against specific devices. Pierluigi Paganini.

Spyware 88

Spyware Malware Advertising Banking 88

Security Affairs

JULY 1, 2019

Experts at Kaspersky have uncovered a spyware campaign dubbed ViceLeaker that spreads in the Middle East to spy on Android users. . Kaspersky spotted a spyware campaign, tracked as ViceLeaker, that spreads in the Middle East to steal device and communications data from Android users. . Pierluigi Paganini.

Spyware 73

Spyware Mobile Advertising Malware 73

Security Affairs

JULY 18, 2019

The researchers attribute the spyware to the Russia-linked and Gamaredon Group. The modules used by EvilGnome are reminiscent of the Windows tools used by the Gamaredon Group, other analogies include the use of SFX, persistence with task scheduler and the deployment of information stealers. Pierluigi Paganini.

Spyware 83

Spyware Malware Advertising Cyber Attacks 83

Security Affairs

SEPTEMBER 17, 2023

TikTok fined €345M by Irish DPC for violating children’s privacy Iranian Peach Sandstorm group behind recent password spray attacks Dariy Pankov, the NLBrute malware author, pleads guilty Dangerous permissions detected in top Android health apps Caesars Entertainment paid a ransom to avoid stolen data leaks Free Download Manager backdoored to serve (..)

Spyware 90

Spyware DDOS Cybercrime Ransomware 90

Security Affairs

NOVEMBER 2, 2022

Threat actors are using previously undocumented Android spyware, dubbed SandStrike, to spy on a Persian-speaking religion minority. In Q3 2022, Kaspersky researchers uncovered a previously undocumented Android spyware, dubbed SandStrike, employed in an espionage campaign targeting the Persian-speaking religion minority, Bahá?í.

Spyware 100

Spyware Malware VPN Accountability 100

Security Affairs

JUNE 24, 2022

Google’s Threat Analysis Group (TAG) revealed that the Italian spyware vendor RCS Labs was supported by ISPs to spy on users. Once clicked the link, the victim is redirected to a page designed to trick users into downloading and installing a malicious application on either Android or iOS. Pierluigi Paganini.

Surveillance 108

Surveillance Mobile Spyware Telecommunications 108

Security Affairs

SEPTEMBER 27, 2020

Experts from Amnesty International uncovered a surveillance campaign that targeted Egyptian civil society organizations with a new version of FinSpy spyware. “While continuing research into this group’s activity, we discovered it has distributed samples of FinSpy for Microsoft Windows through a fake Adobe Flash Player download website.

Spyware 137

Spyware Surveillance Mobile Advertising 137

Security Affairs

JUNE 22, 2023

Kaspersky researchers dug into Operation Triangulation and discovered more details about the exploit chain employed to deliver the spyware to iOS devices. Kaspersky initially reported that the exploit used in the attack downloads multiple subsequent stages from the C2 server, including additional exploits for privilege escalation.

Spyware 91

Spyware Malware Mobile Encryption 91

Security Affairs

MAY 1, 2023

Researchers at the Lookout Threat Lab have discovered a new Android surveillance spyware, dubbed BouldSpy, that was used by the Law Enforcement Command of the Islamic Republic of Iran (FARAJA). The researchers are tracking the spyware since March 2020, starting in 2023, multiple security experts [ 1 , 2 ] started monitoring its activity.

Surveillance 76

Surveillance Malware Spyware Education 76

Security Affairs

JULY 19, 2022

The spyware is able to steal SMS messages, contact lists, and device information and to sign victims up for premium service subscriptions. The apps have been installed by 100.000+ users, according to the security firm. The malware was designed to steal Facebook users’ logins and passwords and authentication tokens.

Malware 118

Malware Spyware Banking Mobile 118

Security Affairs

SEPTEMBER 27, 2023

The issue made the headline under another CVEs because it was actively exploited to deploy surveillance spyware, and it was tracked separately as CVE-2023-41064 and CVE-2023-4863. Rezilion researchers reported that the scope of this vulnerability is much wider than initially assumed. ” reads the analysis published by Rezilion.

Spyware 117

Spyware Surveillance Software Hacking 117

Security Affairs

AUGUST 21, 2022

In October 2021, a report released by the Amnesty International revealed that the Donot Team group employed Android applications posing as secure chat application and malicious emails in attacks aimed at a prominent Togolese human rights defender. In the past, the Donot Team spyware was found in attacks outside of South Asia.

Malware 93

Malware Spyware Phishing Government 93

Security Affairs

JUNE 4, 2023

Xplain hack impacted the Swiss cantonal police and Fedpol Zyxel published guidance for protecting devices from ongoing attacks Kimsuky APT poses as journalists and broadcast writers in its attacks New Linux Ransomware BlackSuit is similar to Royal ransomware CISA adds Progress MOVEit Transfer zero-day to its Known Exploited Vulnerabilities catalog (..)

Spyware 85

Spyware Hacking Malware Social Engineering 85

Security Affairs

APRIL 11, 2021

More than 500,000 Huawei users have been infected with the Joker malware after downloading apps from the company’s official Android store. More than 500,000 Huawei users were infected with the Joker malware after they have downloaded tainted apps from the company’s official Android store. ltd, the remaining 2 by the developer ??.

Malware 138

Malware Spyware Mobile Antivirus 138

Security Affairs

JANUARY 1, 2024

TWO SPYWARE SENDING DATA OF MORE THAN 1.5M million downloads have been discovered spying on users and sending data to China. TWO FLAWS IN LINUX UBUNTU AFFECT 40% OF UBUNTU USERS Wiz researchers discovered two Linux vulnerabilities in the Ubuntu kernel that can allow an unprivileged local user to gain elevated privileges.

Cybersecurity 104

Cybersecurity Spyware Data breaches Passwords 104

Security Affairs

DECEMBER 28, 2023

Kaspersky initially reported that the exploit used in the attack downloads multiple subsequent stages from the C2 server, including additional exploits for privilege escalation. The final payload is downloaded from the same C2 and is described by Kaspersky as a fully-featured APT platform. However, attackers can extend this period.

Spyware 117

Spyware Firmware Mobile Malware 117

Security Affairs

OCTOBER 5, 2022

Users in China often attempt to download the Tor browser from third-party websites. The experts also discovered that the libraries bundled with the malicious Tor Browser is infected with spyware. The spyware also provides the functionality to execute shell commands on the victim machine, giving the attacker control over it.”

Spyware 85

Spyware Accountability Software Passwords 85

Security Affairs

SEPTEMBER 24, 2023

In 2016, researchers from the non-profit organization CitizenLab published a report that describes a campaign of targeted spyware attacks carried out by the Stealth Falcon. “Additionally, our investigation led us to the discovery of a compelling multistage shellcode downloader chain on VirusTotal.”

Spyware 113

Spyware Malware Architecture Encryption 113

Security Affairs

JUNE 19, 2023

The malware can be instructed to extract systems information, run specific commands This includes gathering system information, running encoded as base64 commands, downloading and executing routines, and killing itself. The files connect to the C2 server to receive additional commands to execute.

Spyware 97

Spyware Architecture Malware Hacking 97

Security Affairs

FEBRUARY 3, 2023

Russia-linked threat actor Gamaredon employed new spyware in cyber attacks aimed at public authorities and critical information infrastructure in Ukraine. The former is a VBScript used to download next-stage VBScript from a remote server. shop/09.01_otck/quicker[.]rtf.

Malware 87

Malware Spyware DNS Government 87

Security Affairs

DECEMBER 3, 2022

Google fixed the ninth actively exploited Chrome zeroday this year A new Linux flaw can be chained with other two bugs to gain full root privileges Attack of drones: airborne cybersecurity nightmare Cuba Ransomware received over $60M in Ransom payments as of August 2022 Android Keyboard Apps with 2 Million downloads can remotely hack your device New (..)

Spyware 91

Spyware Data breaches VPN Hacking 91