Cyber Security Informer

“I’ll miss him so much” Facebook scam uses BBC branding to lure victims

Malwarebytes

JANUARY 16, 2024

I’ll miss him so much” In all the posts I’ve seen, one of my Facebook friends was tagged. We found several variations of that URL. How to avoid Facebook scams In this case I was able to spot the scam because it made me suspicious that two unrelated friends might be tagged in a similar post. Scrutinize URLs closely.

Scams

Scams Adware Accountability VPN

Humans are Bad at URLs and Fonts Don’t Matter

Troy Hunt

OCTOBER 28, 2020

If I'm completely honest, I had no idea what the correct answer would be because frankly, I'm bad at reading URLs. That's what happens already once the URL appears in the browser's address bar: Wait, don't browsers always do.toLowerCase() on URLs in the navbar, after they are resolved & loaded? — Bartek ?

Phishing

Phishing Password Management Passwords Internet

SAP Patch Day: January 2024

Security Boulevard

JANUARY 9, 2024

SAP HotNews Security Note #3411067 , tagged with a CVSS score of 9.1, SAP Security Note #3413475 , tagged with a CVSS score of 9.1, SAP Security Note #3412456 , tagged with a CVSS score of 9.1, The HotPriority Notes in Detail SAP Security Note #3411869 , tagged with a CVSS score of 8.4, HTTP/1 is not affected.

Internet

Internet Internet Marketing Technology

Webinars

Reimagining Cybersecurity Training: Driving Real Impact on Security Culture

MORE WEBINARS

What Your (Website) Style Says About You

SiteLock

MARCH 10, 2022

In terms of an HTML page, a “stylesheet” is any <link> tags with the rel=”stylesheet” attribute and any text between <style> and </style> tags within the page. The function begins by taking the browser UserAgent and converting it to all lowercase characters before checking for the presence of three strings.

Malware

Malware System Administration Internet Internet

JavaScript Malware Injected Into WordPress Themes

SiteLock

AUGUST 27, 2021

The infection consists of two lines of identical JavaScript injected into the header file, targeting the closing tag. The script builds a URL and saves it to a variable named n_url. This variable, named f_url , is the source URL used in the resultant injected JavaScript. Sample Infection. How The Injected JavaScript Works.

Malware

Malware Adware Media

SAP Patch Day: November 2022

Security Boulevard

NOVEMBER 8, 2022

The second HotNews Note that has been updated since October’s Patch Day is SAP Security Note #3239152 , tagged with a CVSS score of 9.6. High Priority Note #3226411 , tagged with a CVSS score of 8.1, SAP Security Note #3243924 , tagged with a CVSS score of 9.9, The second SAP vulnerability is tagged with a CVSS score of 7.5

Mobile

Mobile Accountability Banking Engineering

SAP Patch Day: December 2023

Security Boulevard

DECEMBER 12, 2023

SAP Security Note #3350297 , tagged with a CVSS score of 9.1, The New HotNews Note in Detail SAP Security Note #3411067 , tagged with a CVSS score of 9.1, High Priority SAP Security Notes SAP Security Notes #3394567 , tagged with a CVSS score of 8.1, SAP Security Notes #3382353 , tagged with a CVSS score of 7.5,

Passwords

Passwords Technology Mobile Government

Facebook fatal accident scam still rages on

Malwarebytes

FEBRUARY 7, 2024

An example of a redirect URL shows some of the elements that were fingerprinted. Malwarebytes Premium blocks the subdomain oyglk.altairaquilae.top How to recover from a Facebook scam You can recognize this type of scam because they usually tag several friends of the victim. Check for unknown and unused Facebook apps.

Scams

Scams Passwords Identity Theft Accountability

Ingenious Phishing Tactics in the Modern Scammer's Toolbox

SecureWorld News

OCTOBER 30, 2023

Morse code cloaking dubious materials In a clever move first spotted in February 2021, malicious actors used meaningful combinations of dots and dashes (known as Morse code) to obfuscate harmful URLs in a file attached to an email. If you can't help clicking on a link received over email, check the URL for typos and other inaccuracies first.

Phishing

Phishing Scams Passwords Wireless

Why you shouldn’t automate your VirusTotal uploads

Malwarebytes

APRIL 18, 2022

VirusTotal is now part of Google Cloud and its goal is to help analyze suspicious files, URLs, domains, and IP addresses to detect cybersecurity threats. But in the context of this article it is even more important to realize that VirusTotal was not designed to check whether an attachment is malicious. VirusTotal.

Malware

Malware Engineering Technology Cybersecurity

How to Prevent Web Attacks Using Input Sanitization

eSecurity Planet

APRIL 13, 2022

Sanitizing consists of removing any unsafe character from user inputs, and validating will check if the data is in the expected format and type. Some websites don’t bother with checking user inputs, which exposes the app to the maximum level of danger. If the codebase includes an image tag such as <img src=”/getImages?filename=image12.png”>

Accountability

Accountability Firewall Cybersecurity Security Awareness

Tor Project released Tor Browser 8.5.1 for Windows, Mac, Linux, and Android

Security Affairs

JUNE 6, 2019

Bwloe the full changelog since Tor Browser 8.5: All platforms Update Torbutton to 2.1.10 Bug 30565 : Sync nocertdb with privatebrowsing.autostart at startup Bug 30464 : Add WebGL to safer descriptions Translations update Update NoScript to 10.6.2 Bug 29969 : Remove workaround for Mozilla’s bug 1532530 Update HTTPS Everywhere to 2019.5.13

Advertising

Advertising Mobile Information Security

What Is Sender Policy Framework? SPF Email Explained

eSecurity Planet

MAY 23, 2023

Email-receiving servers check the email header for the sending domain and then perform a DNS lookup to see if an SPF file exists that matches the sending domain. When the SPF Record’s sending domain matches the Email Header’s sending domain, the email passes the SPF check and may be delivered to the recipient.

DNS

DNS Phishing Authentication Internet

Web skimmer found on website of Liquor Control Board of Ontario

Malwarebytes

JANUARY 16, 2023

The malicious code injected was inside a Google Tag Manager (GTM) snippet encoded as Base64. Malwarebytes’ Director of Threat Intelligence Jérôme Segura commented: The attack on LCBO's online portal follows a trend we've seen before of injecting malicious code disguised as legitimate snippets such as Google Tag Manager.

Retail

Retail Passwords Accountability Risk

A malvertising campaign targets iPhone users with Krampus-3PC

Security Affairs

DECEMBER 14, 2019

Once a reader visited a site and the compromised ad’s creative tag was loaded, Krampus-3PC unpacked th e code that is used to check (1) whether the ad was hosted by Adtechstack and (2) whether the ad was running on a targeted publisher. The URL would continue to open and load onto a new tab the redirection succeeded.”

Backups

Backups Advertising Malware Media

VASTFLUX ad fraud massively affected millions of iOS devices, dismantled

Malwarebytes

JANUARY 23, 2023

The URL of the VAST players are encoded in base64," the researchers said. When decoded, they show that each player has its own 'playlist' of ads to cycle through, each with its own URL with tracking code attached. The takedown VASTFLUX's takedown didn't happen in one go.

Adware

Adware Advertising Marketing Encryption

Malware Decoded: How SiteLock Cleans Infected Websites

SiteLock

AUGUST 27, 2021

Likely an automated process, the code was injected before the closing <body> tag. This reveals the resultant PHP code which has, right at the top, the URL to the beginning of the end goal, injecting pharma, or pharmacy, spam links. The URL leads to a list file, 13.list,

Malware

Malware Firewall Hacking Cybersecurity

Hundreds of thousands of websites hacked as part of redirection campaign

Security Affairs

MARCH 3, 2023

Once obtained access to the target website, the attackers modified existing web pages by adding a single line of HTML code, in the form of a script tag referencing a remotely hosted JavaScript script. The redirection logic implemented in the JavaScript script checks for a set of certain conditions. ”continues the analysis.

Hacking

Hacking Passwords Cybersecurity Information Security

Google WordPress Site Kit plugin grants attacker Search Console Access

Security Affairs

MAY 14, 2020

Search Console, Analytics, Tag Manager, PageSpeed Insights, Optimize, and AdSense), giving users authoritative and up-to-date advice on how to succeed on the web, it has over 300,000 active installations. The Site Kit WordPress plugin makes it easy to set up and configure key Google products (i.e.

Authentication

Authentication Advertising Engineering Hacking

Joomla! Releases 3.8.9 Including Security Updates

SiteLock

AUGUST 27, 2021

autoload feature checks classnames for validity. Because some languages contain unescaped HTML special characters, attackers may have been able to use this to inject malicious content into the current page URL. Tag indexing improvement. Developers found that the Joomla! In addition to these vulnerabilities, Joomla!

Google addressed an XSS flaw in Gmail

Security Affairs

NOVEMBER 18, 2019

Even if AMP4Email implements a strong validator that only allows a list of tags and attributes in dynamic mails, it doesn’t implement a validation system to prevent cross-site scripting (XSS) attacks. “AMP tries to get a property of AMP_MODE to put it in the URL,” the continues the researcher. testLocation.

Advertising

Advertising Information Security Hacking

Tech Support Scams improved with adoption of Call Optimization Service

Security Affairs

AUGUST 5, 2018

Crooks used a script in the call optimization services to check a specific tag in the scam URL, then the script retrieves the scammer’s phone number from the service’s servers. “localized” to provide a different number based on the victim’s country. .

Scams

Scams Advertising Malware Cybercrime

Visa warns of new sophisticated credit card skimmer dubbed Baka

Security Affairs

SEPTEMBER 6, 2020

The Baka loader works by dynamically adding a script tag to the current page that loads a remote JavaScript file. The JavaScript URL is hardcoded in the loader script in encrypted format, experts observed that the attackers can change the URL for each victim. ” continues the alert.

eCommerce

eCommerce Malware Encryption Advertising

Dynamic Approaches seen in AveMaria’s Distribution Strategy

Security Boulevard

FEBRUARY 4, 2023

Upon executing the attached.vhdx file, researchers observed the creation of a new system drive (see Tag 1 in Fig. 3 below) containing a malicious.lnk file, a decoy file, and other system related files (see Tag 2 in Fig. Triggering the malicious shortcut file downloads another payload via curl command (see Tag 3 & 4 in Fig.

Phishing

Phishing Malware Scams Government

New macOS Trojan-Proxy piggybacking on cracked software

SecureList

DECEMBER 6, 2023

TCP and UDP connection code (MD5: 063d956b55da0d18f3f732c2bbd4bc28) As mentioned earlier, we have discovered several versions of the Trojan, with a number of distinguishing features: Unlike its predecessors, the latest of the versions we know of cannot check its own version or update. apk fb3c42ca1ff0ba96ac146c1672357994 — Swipis_v2.6.1[Mobile].apk

Software

Software DNS Malware Mobile

Black Friday Scams: 4 Emerging Skimming Attacks to Watch for This Holiday Season

Security Boulevard

NOVEMBER 21, 2022

This CC Skimmer is hosted at the URL: hxxps://modersecure[.]com/sources.200x/google-analytics.js. Uses the setInterval() function to check every 1.5 seconds whether the current URL contains the string "/checkout/#payment". This information will be base64-encoded and sent to the attacker's data exfiltration URL.

Scams

Scams Banking Software

Trickbot module descriptions

SecureList

OCTOBER 19, 2021

Here is an example of the URL to download the pwgrab64 module: https[:]//87.97.178[.]92:447/asdasdasd/asdasdasd_asdasdasd.asdasdasd/5/pwgrab64/. another Trickbot module or third-party malware) by hardcoded URL and executes it. To do so, it creates a URL by adding subdomains (‘webmail.’, aexecDll32. anubisDll32.

Banking

Banking Passwords VPN Internet

Angular + React: Vulnerability Cheatsheet

Security Boulevard

MARCH 1, 2022

Before directing users to sensitive routes in the application, you should check whether the user has been authenticated and authorized to access that resource. One common mistake that developers make is to perform authorization checks on the client side. This is not secure since client-side checks can be overridden by an attacker.

Authentication

Authentication Banking Phishing Passwords

Canon printer owners: Be careful of bogus driver download sites

Malwarebytes

MAY 11, 2022

We decided to check one of the few remaining sites and see how hard it leans into error messages after a driver search. I’m not saying the odds are stacked against you when using this site, but look at the destination URL in the bottom left hand corner when hovering over the download driver button: Yes, that does say /error.html.

Scams

Scams Internet Internet Cryptocurrency

Firefox stops advertisers tracking you as you browse, calls itself the most “private and secure major browser”

Malwarebytes

JUNE 15, 2022

Depending on what’s being collected, you may end up with a huge slice of identifiable data tagged to your identity without you ever even seeing it yourself. As a result, tracking/advertising services can no longer watch from afar as you move from URL to URL. The cookie controversy. A cookie clean up.

Advertising

Advertising Internet Internet Mobile

Ferocious Kitten: 6 years of covert surveillance in Iran

SecureList

JUNE 16, 2021

The internal name of the implant, as becomes apparent from PDB paths in the executable binaries, is ‘mklg’ This name perhaps stands for ‘Mark KeyLogGer’, where ‘Mark’ is an internal HTML tag used by the implant. hxxp://C2/ech/client.php? hxxp://C2/ech/client.php?u=[computername]_[username]&k=[AV_value].

Surveillance

Surveillance Malware Password Management Passwords

How to Implement Microsegmentation

eSecurity Planet

MARCH 15, 2021

Success in implementing microsegmentation for your organization means tagging traffic, servicing regular business communications, adapting to threats , and denying all other anomalies. . Major endpoint security vendors include BitDefender, Check Point, CrowdStrike, Sophos, Symantec, Trend Micro, and VMWare. . Tag Your Workloads.

Firewall

Firewall Architecture Technology Software

Lab Walkthrough?—?Lucee Server Arbitrary File Write [CVE-2021–21307]

Pentester Academy

APRIL 13, 2023

Technical difficulty: Beginner Introduction Lucee Server is a dynamic, Java-based (JSR-223), tag and scripting language used for rapid web application development. Step 2: Check if the provided machine/domain is reachable. Step 3: Check open ports on the provided machine. In Lucee Admin, before versions 5.3.7.47, 5.3.6.68

Risk

Risk Software InfoSec Cybersecurity

The Telegram phishing market

SecureList

APRIL 5, 2023

For instance, before generating phishing links, one particular bot offers to select a service to mimic and enter a URL the victim will be redirected to after trying to log in. Once a URL is entered, the bot will generate several scam links targeting users of the service. Some scripts may lack the URL field.

Phishing

Phishing Marketing Scams Accountability

q-logger skimmer keeps Magecart attacks going

Malwarebytes

OCTOBER 19, 2021

It is injected inline within the DOM right before the text/x-magento-init tag or separated by copious amounts of white space. It is best to either use an already compromised site or bypass the check for the address bar (onestepcheckout). Skimmer URLs. world/tag-2.7.js casa/tags-3.0.7.js Skimmer URLs.

Mobile

Mobile Small Business

Experts found Joker Spyware in 24 apps in the Google Play store

Security Affairs

SEPTEMBER 8, 2019

The Joker spyware checks for SIM cards associated with one of the above countries. The malicious code implements notably evasion technique to bypass Google Play’s checks, the expert explained that the malware was hiding malicious code within the advertisement frameworks. The C&C URL 6.

Spyware

Spyware Advertising Malware Cryptocurrency

ALPHV/BlackCat ransomware gang claims to have stolen data from Creos Luxembourg S.A.

Security Affairs

AUGUST 1, 2022

Despite the fact Blackcat and Alpha have completely different URLs in TOR Network, the scripting scenarios used on their pages are identical, and likely developed by the same actors. The group was the pioneer of search in the indexed stolen data – allowing customers and employees of the affected companies to check exposed data.

Ransomware

Ransomware Passwords Cyber Attacks Hacking

4 things you should know about testing AV software with VirusTotal’s free online multiscanner

Malwarebytes

MAY 18, 2021

It offers a free service that lets you upload suspicious files and URLs for, where it inspects them and checks for viruses using 70+ third-party antivirus products, URL/domain blocklisting services, and other tools. Naturally, the price tag for analyzing malware (free) is appealing to SMBs on a limited budget.

Software

Software Antivirus Malware Banking

A deep dive into Saint Bot, a new downloader

Malwarebytes

APRIL 6, 2021

Observing the network traffic we will find the URL of the malware’s C2 queried repeatedly: http[:]//update-0019992[.]ru/testcp1/gate.php. Following this URL we can see the related C2 panel, which looks typical for the Saint Bot: Internals. Sample result: API calls tagged with TinyTracer. Defensive checks.

Malware

Malware Phishing Passwords Architecture

Robots at HIS Group are vulnerable to hack

Security Affairs

OCTOBER 23, 2019

The robots use facial recognition to perform check-in operations before access to their rooms and assist them during their stay at the hotel. The expert discovered an “unsigned code” that could allow an attacker to access video footage via the streaming app of their choice by tapping an NFC tag to the back of robot’s head.

Hacking

Hacking Advertising Manufacturing Risk

BlackCat (aka ALPHV) Ransomware is Increasing Stakes up to $2,5M in Demands

Security Affairs

JULY 11, 2022

Despite the fact Blackcat and Alpha have completely different URLs in TOR Network, the scripting scenarios used on their pages are identical, and likely developed by the same actors. The group was the pioneer of search in the indexed stolen data – allowing customers and employees of the affected companies to check exposed data.

Ransomware

Ransomware Passwords Data breaches Technology

Lab Walkthrough?—?The WannaCry Ransomware

Pentester Academy

FEBRUARY 23, 2023

cp -rf /root/Desktop/tools/html-templates/* /var/www/html/ls /var/www/html/ Modify the index.html file and paste the below code under the HTML <body> tag. <script> Check the IP address with: The IP Address of the attacker (Kali Machine) is 10.10.15.2 Command: Step 7: Start the apache webserver /etc/init.d/apache2

Ransomware

Ransomware Encryption Cryptocurrency Banking

Developing an incident response playbook

SecureList

MARCH 23, 2023

That done, the response team moves on to triage to perform incident prioritization, categorization, false positive checks, and searches for related incidents. If the incident data and rule/policy logic mismatch, the incident may be tagged as a false positive. Incident containment steps and recovery measures 4.

Accountability

Accountability Risk DDOS Malware

Expert discovered it was possible to delete all projects in the Microsoft Translator Hub

Security Affairs

JULY 21, 2018

“POST request with no content and parameter in the URL (its kinda weird isn’t it?) An attacker with the knowledge of the ProjectID of a logged user just needs to trick victims into clicking a specifically crafted URL that performs the delete action on behalf of the user. Attacker includes the URL in a page. (

Advertising

Advertising Hacking

“I’ll miss him so much” Facebook scam uses BBC branding to lure victims

Humans are Bad at URLs and Fonts Don’t Matter

Webinars

Trending Sources

SAP Patch Day: January 2024

Webinars

What Your (Website) Style Says About You

JavaScript Malware Injected Into WordPress Themes

SAP Patch Day: November 2022

SAP Patch Day: December 2023

Facebook fatal accident scam still rages on

Ingenious Phishing Tactics in the Modern Scammer's Toolbox

Why you shouldn’t automate your VirusTotal uploads

How to Prevent Web Attacks Using Input Sanitization

Tor Project released Tor Browser 8.5.1 for Windows, Mac, Linux, and Android

What Is Sender Policy Framework? SPF Email Explained

Web skimmer found on website of Liquor Control Board of Ontario

A malvertising campaign targets iPhone users with Krampus-3PC

VASTFLUX ad fraud massively affected millions of iOS devices, dismantled

Malware Decoded: How SiteLock Cleans Infected Websites

Hundreds of thousands of websites hacked as part of redirection campaign

Google WordPress Site Kit plugin grants attacker Search Console Access

Joomla! Releases 3.8.9 Including Security Updates

Google addressed an XSS flaw in Gmail

Tech Support Scams improved with adoption of Call Optimization Service

Visa warns of new sophisticated credit card skimmer dubbed Baka

Dynamic Approaches seen in AveMaria’s Distribution Strategy

New macOS Trojan-Proxy piggybacking on cracked software

Black Friday Scams: 4 Emerging Skimming Attacks to Watch for This Holiday Season

Trickbot module descriptions

Angular + React: Vulnerability Cheatsheet

Canon printer owners: Be careful of bogus driver download sites

Firefox stops advertisers tracking you as you browse, calls itself the most “private and secure major browser”

Ferocious Kitten: 6 years of covert surveillance in Iran

How to Implement Microsegmentation

Lab Walkthrough?—?Lucee Server Arbitrary File Write [CVE-2021–21307]

The Telegram phishing market

q-logger skimmer keeps Magecart attacks going

Experts found Joker Spyware in 24 apps in the Google Play store

ALPHV/BlackCat ransomware gang claims to have stolen data from Creos Luxembourg S.A.

4 things you should know about testing AV software with VirusTotal’s free online multiscanner

A deep dive into Saint Bot, a new downloader

Robots at HIS Group are vulnerable to hack

BlackCat (aka ALPHV) Ransomware is Increasing Stakes up to $2,5M in Demands

Lab Walkthrough?—?The WannaCry Ransomware

Developing an incident response playbook

Expert discovered it was possible to delete all projects in the Microsoft Translator Hub

Stay Connected