8 Million Android Users Hit by SpyLoan Malware in Loan Apps on Google Play Over a dozen malicious Android apps identified on the Google Play Store that have been collectively downloaded over 8 million times contain malware known as SpyLoan, according to new findings from McAfee Labs. “These PUP (potentially Read more…
Phishing-as-a-Service "Rockstar 2FA" Targets Microsoft 365 Users with AiTM Attacks Cybersecurity researchers are warning about malicious email campaigns leveraging a phishing-as-a-service (PhaaS) toolkit called Rockstar 2FA with an aim to steal Microsoft 365 account credentials. “This campaign employs an AitM [adversary-in-the-middle] attack, allowing attackers to intercept user credentials and session Read more…
New GootLoader Campaign Targets Users Searching for Bengal Cat Laws in Australia In an unusually specific campaign, users searching about the legality of Bengal Cats in Australia are being targeted with the GootLoader malware. “In this case, we found the GootLoader actors using search results for information about a particular Read more…
Malicious NPM Packages Target Roblox Users with Data-Stealing Malware Nov 08, 2024Ravie LakshmananOpen Source / Malware A new campaign has targeted the npm package repository with malicious JavaScript libraries that are designed to infect Roblox users with open-source stealer malware such as Skuld and Blank-Grabber. “This incident highlights the alarming Read more…
Google Cloud to Enforce Multi-Factor Authentication by 2025 for All Users Nov 06, 2024Ravie LakshmananCloud Security / Phishing Protection Google’s cloud division has announced that it will enforce mandatory multi-factor authentication (MFA) for all users by the end of 2025 as part of its efforts to improve account security. “We Read more…
New Android Banking Malware ‘ToxicPanda’ Targets Users with Fraudulent Money Transfers Nov 05, 2024Ravie LakshmananMobile Security / Cyber Attack Over 1,500 Android devices have been infected by a new strain of Android banking malware called ToxicPanda that allows threat actors to conduct fraudulent banking transactions. “ToxicPanda’s main goal is to Read more…
New Phishing Kit Xiū gǒu Targets Users Across Five Countries With 2,000 Fake Sites Cybersecurity researchers have disclosed a new phishing kit that has been put to use in campaigns targeting Australia, Japan, Spain, the U.K., and the U.S. since at least September 2024. Netcraft said more than 2,000 phishing Read more…
Cybercriminals Use Webflow to Deceive Users into Sharing Sensitive Login Credentials Cybersecurity researchers have warned of a spike in phishing pages created using a website builder tool called Webflow, as threat actors continue to abuse legitimate services like Cloudflare and Microsoft Sway to their advantage. “The campaigns target sensitive information Read more…
AWS Cloud Development Kit Vulnerability Exposes Users to Potential Account Takeover Risks Cybersecurity researchers have disclosed a security flaw impacting Amazon Web Services (AWS) Cloud Development Kit (CDK) that could have resulted in an account takeover under specific circumstances. “The impact of this issue could, in certain scenarios, allow an Read more…
Millions of mobile app users at risk from hardcoded creds • The Register An analysis of widely used mobile apps offered on Google Play and the Apple App Store has found hardcoded and unencrypted cloud service credentials, exposing millions of users to major security problems. The problem stems from lazy Read more…