A nasty bit of Android malware previously lurking on the Google Play Store has returned with additional capabilities. Known as SharkBot, the malware is designed to steal user login credentials, particularly credentials used to access financial applications. The malware has also been found to initiate money transfers...
Read more...
On September 2, 2022, Samsung reported that it had discovered a security breach of their U.S. systems. Unfortunately for some Samsung customers, this means that their personal information may have leaked out into the wild. The report states that the initial indication came in July, and by August it had established the...
Read more...
A new report by Microsoft details a vulnerability in the TikTok Android app that threat actors could have exploited to hijack user accounts with a single click. The vulnerability appears in the National Vulnerability Database with the Common Vulnerabilities and Exposures (CVE) identifier CVE-2022-28799 and a high...
Read more...
We frequently write about Android malware smuggled onto the Google Play Store in the form of what appear to be legitimate apps. However, the Play Store isn’t the only Google-run app store with a malware problem. A new report by McAfee Labs identifies five extensions on the Chrome Web Store that contain malicious...
Read more...
The James Webb Space Telescope (JWST) came online this year after more than 20 years of design and development. It's a real watershed moment for astronomy, and unfortunately, yet another way for internet ne'er-do-wells to distribute malware. Security researchers have identified a new malware campaign that has...
Read more...
Do you ever feel like company advertisers are doing more than listening to you? Let's face it, they probably are. You might be concerned to hear that your pocket smart device is also tracking where you are. This is not new information for most people. Many use GPS mapping apps, such as Google Maps, Waze, and Apple...
Read more...
The password manager LastPass has published a blog post notifying users of a recent data breach. According to the CEO, Karim Toubba, the breach affected parts of the company’s development environment but did not touch any databases containing user data or passwords. Rather than stealing user information, it seems that...
Read more...
A new report by cybersecurity firm Mandiant details an ongoing hacking campaign targeting Microsoft 365. The threat actor behind this campaign is an advanced persistent threat (APT) known as “Cozy Bear” or simply “APT29.” APT29 is thought to be a Russian hacking group sponsored by the Russian Foreign Intelligence...
Read more...
Plex, a company that provides media streaming solutions, sent out emails early this morning informing users of a data breach. According to the notice, Plex launched an investigation yesterday after discovering suspicious activity on one of its databases. The investigation revealed that a third-party actor managed to...
Read more...
Successful hacking involves more than just gaining unauthorized access to a system. Once inside, malicious actors like to cover their tracks not only to prevent getting caught, but also to maximize how much data they can extract. To this end, the Iranian-backed hacker group known as Charming Kitten has been discovered...
Read more...
Over the weekend, a ransomware attack hit a French hospital, forcing the facility to turn away patients. The staff of the affected hospital, the Centre Hospitalier Sud Francilien (CHSF), has had to return to using pen and paper to keep track of patients, as the main computer systems have been rendered inaccessible...
Read more...
Security researcher Michael Horowitz, not to be confused with the current United States Inspector General, has been updating a blog post titled "VPNs on iOS are a scam" ever since May 2022. The rather lengthy post goes into detail about data leaks that occur outside of a VPN tunnel on iOS. The issue was first reported...
Read more...
We wrote last week about research showing that Meta takes advantage of the in-app browser feature on mobile devices to inject JavaScript into web pages viewed in the Facebook, Instagram, and Messenger mobile apps. Now that same researcher has found that the TikTok in-app browser injects JavaScript which functions...
Read more...
Google has released a Chrome browser update which addresses a zero-day flaw that is currently under active attack. This is the fifth time this year that Google has put Chrome users in a situation where they should act swiftly to apply a patch to a critical security flaw. If you are a Chrome user, please check that you...
Read more...
Anyone with an iPhone in their pocket or a Mac on their desk should be hitting that update button today. Apple has announced an emergency patch for iPhones, iPads, and macOS computers, an increasingly common event. The update addresses a pair of zero-day vulnerabilities in Apple's software, meaning they are already...
Read more...
Threat intelligence firm Recorded Future has published a report concerning a long-term credential theft campaign targeting humanitarian, think tank, and government organizations. A hacking group known as RedAlpha is carrying out this ongoing campaign, and is known to have been active as far back as 2015. However, it...
Read more...
An Android banking Trojan with an already extensive toolkit recently gained a ransomware module. While banking malware is an all too prevalent a threat for mobile devices, ransomware isn’t a technique commonly deployed against mobile devices, making this particular piece of malware notable. Banking Trojans come in the...
Read more...
When you update your virtual meeting software, you usually don't expect some random software to install all on its own or run commands of its own volition. If you use Zoom on a Mac though, that is exactly what is possible. This is thanks to an exploit in the Zoom updater that was outlined by Objective-See security...
Read more...
Facebook’s collection and sale of user data for advertising purposes took a huge hit when Apple introduced its App Tracking Transparency (ATT) feature, with Facebook projecting that it will lose out on $10 billion in revenue this year. However, it appears that Meta, Facebook’s parent company, may still have some...
Read more...
It has been a long time coming, but the tech giant Meta has finally realized that its users might just want a little bit of privacy. As of August 11th, it has started testing end-to-end encryption for the Messenger portion of its popular social media platform, Facebook.
In a Messenger News blog post, Facebook has...
Read more...
Cloudflare says that it was hit by the same smishing (sms phishing) attack that recently resulted in a user data breach at Twilio. However, unlike Twilio, Cloudflare managed to prevent the attack from escalating to a data breach thanks to its strong security measures. While the attackers managed to steal login...
Read more...
Researchers have detailed the SQUIP attack, which is particularly worrisome for users of AMD Zen 1, Zen 2 and Zen 3 processors. Researchers were able measure the precise degree of Scheduler Queue Usage (i.e., occupancy) via Interference Probing, giving the attack its name. Using this technique, it was possible in...
Read more...
