InterPlanetary Storm Botnet Infects 13K Mac, Android Devices
In addition to Windows and Linux machines, a new variant of the malware now targets Mac and Android devices.
OAuth Consent Phishing Ramps Up with Microsoft Office 365 Attacks
Attackers gain read-only permissions to snoop around Office 365 accounts, including emails, contacts and more.
Android Spyware Variant Snoops on WhatsApp, Telegram Messages
The Android malware comes from threat group APT-C-23, also known as Two-Tailed Scorpion and Desert Scorpion.
Facebook Small Business Grants Spark Identity-Theft Scam
The cybercrooks spread the COVID-19 relief scam via Telegram and WhatsApp, and ultimately harvest account credentials and even pics of IDs.
Microsoft Exchange Servers Still Open to Actively Exploited Flaw
Despite Microsoft issuing patches almost eight months ago, 61 percent of Exchange servers are still vulnerable.
Why Web Browser Padlocks Shouldn’t Be Trusted
Popular ‘safe browsing’ padlocks are now passe as a majority of bad guys also use them.
Zerologon Attacks Against Microsoft DCs Snowball in a Week
The attempted compromises, which could allow full control over Active Directory identity services, are flying thick and fast just a week after active exploits of CVE-2020-1472 were first flagged.
The Network Perimeter: This Time, It’s Personal
Botnets and IoT devices are forming a perfect storm for IT staff wrestling with WFH employee security.
Las Vegas Students’ Personal Data Leaked, Post-Ransomware Attack
A researcher said he discovered an open data cache with names, grades, birthdates and more, after the Clark County School District refused to pay the ransom.
Telehealth Poll: How Risky Are Remote Doctor Visits?
Threatpost's latest poll probes telehealth security risks and asks for IT cures.
Windows 7 ‘Upgrade’ Emails Steal Outlook Credentials
Researchers warn of emails pretending to help business employees upgrade to Windows 10 - and then stealing their Outlook emails and passwords.
Mac, Linux Users Now Targeted by FinSpy Variants
FinSpy has returned in new campaigns targeting dissident organizations in Egypt - and researchers uncovered new samples of the spyware targeting macOS and Linux users.
Universal Health Services Ransomware Attack Impacts Hospitals Nationwide
The Ryuk ransomware is suspected to be the culprit.
Joker Trojans Flood the Android Ecosystem
September saw dozens of Joker malware variants hitting Google Play and third-party app stores.
Twitter Warns Developers of API Bug That Exposed App Keys, Tokens
Twitter has fixed a caching issue that could have exposed developers' API keys and tokens.
Bug Bounty FAQ: Top Questions, Expert Answers
Four leading voices in the bug bounty community answer frequently asked questions from bounty hunters, companies and curious cybersecurity professionals.
FortiGate VPN Default Config Allows MitM Attacks
The client's default configuration for SSL-VPN has a certificate issue, researchers said.
Industrial Cyberattacks Get Rarer but More Complex
The first half of 2020 saw decreases in attacks on most ICS sectors, but oil/gas firms and building automation saw upticks.
Ring’s Flying In-Home Camera Drone Escalates Privacy Worries
Privacy fears are blasting off after Amazon's Ring division unveiled the new Always Home Cam, a smart home security camera drone.
Microsoft Kills 18 Azure Accounts Tied to Nation-State Attacks
An APT group has started heavily relying on cloud services like Azure Active Directory and OneDrive, as well as open-source tools, to obfuscate its attacks.
When Coffee Machines Demand Ransom, You Know IoT Is Screwed
A researcher reverse engineered an internet-connected coffee maker to see what kinds of hacks he could do with it. The answer: quite a lot.
Russian Gets 7 Years in Prison for Linkedin, Dropbox & Formspring Hacks
A Russian man received a seven-year prison sentence for having hacked into computers belonging to LinkedIn, Dropbox and Formspring. On September 30, Honorable William H. Alsup, U.S. District Judge for the Northern District of California, sentenced Yevgeniy Alexandrovich Nikulin,...
Detecting Deep Fakes with a Heartbeat
Researchers can detect deep fakes because they don’t convincingly mimic human blood circulation in the face:
In particular, video of a person’s face contains subtle shifts in color that result from pulses in blood circulation. You might imagine that these...
Anthem to Pay Nearly $40M Settlement Over 2015 Cyberattack
Health insurer Anthem has agreed to another multimillion-dollar settlement over a cyberattack on its technology that exposed the personal information of nearly 79 million people.
read more
#BeCyberSmart – why friends don’t let friends get scammed
Friends don't let friends get scammed. Because cybercrime hurts us all.
