account hijacking - Security Ticks

Ransomware attackers hop from on-premises systems to cloud to compromise Microsoft 365 accounts

account hijacking, Cloud, credentials, Don't miss, Hot stuff, Microsoft, Microsoft Entra ID, News, privileged accounts, Ransomware / SecurityTicks

Ransomware attackers hop from on-premises systems to cloud to compromise Microsoft 365 accounts 2024-09-30 at 17:01 By Zeljka Zorz Storm-0501, an affiliate of several high-profile ransomware-as-a-service outfits, has been spotted compromising targets’ cloud environments and on-premises systems. “Storm-0501 is the latest threat actor observed to exploit weak credentials and over-privileged accounts to move from organizations’ […]

React to this headline:

Ransomware attackers hop from on-premises systems to cloud to compromise Microsoft 365 accounts Read More »

SYS01 info-stealer pushed via Facebook ads, LinkedIn and YouTube posts

account hijacking, Don't miss, Facebook, Hot stuff, LinkedIn, malvertising, Malware, News, Trustwave / SecurityTicks

SYS01 info-stealer pushed via Facebook ads, LinkedIn and YouTube posts 2024-07-16 at 13:16 By Zeljka Zorz Malicious Google ads are a well known threat, but malvertising can also be found on other popular online destinations such as Facebook, LinkedIn, and YouTube. Case in point: an enduring campaign that aims to infect Facebook users with the

React to this headline:

SYS01 info-stealer pushed via Facebook ads, LinkedIn and YouTube posts Read More »

Open-source Rafel RAT steals info, locks Android devices, asks for ransom

account hijacking, Android, Check Point, cyber espionage, Don't miss, Hot stuff, Malware, News, open source, Ransomware / SecurityTicks

Open-source Rafel RAT steals info, locks Android devices, asks for ransom 2024-06-24 at 14:46 By Zeljka Zorz The open-source Rafel RAT is being leveraged by multiple threat actors to compromise Android devices and, in some cases, to lock them, encrypt their contents, and demand money to restore the device to its original state. Check Point

React to this headline:

Open-source Rafel RAT steals info, locks Android devices, asks for ransom Read More »

361 million account credentials leaked on Telegram: Are yours among them?

account hijacking, consumer, credentials, Data leak, data theft, Don't miss, enterprise, HIBP, Hot stuff, Malware, News, passwords, Telegram, tips / SecurityTicks

361 million account credentials leaked on Telegram: Are yours among them? 2024-06-04 at 15:03 By Zeljka Zorz A new trove of 361 million email addresses has been added to Have I Been Pwned? (HIBP), the free online service through which users can check whether their account credentials and other data has been compromised in one

React to this headline:

361 million account credentials leaked on Telegram: Are yours among them? Read More »

How fraudsters stole $37 million from Coinbase Pro users

account hijacking, Coinbase, Don't miss, fraud, Hot stuff, News, phishing, remote access, social engineering, USA / SecurityTicks

How fraudsters stole $37 million from Coinbase Pro users 2024-05-29 at 13:46 By Zeljka Zorz A convincing phishing page and some over-the-phone social engineering allowed a group of crooks to steal over $37 million from unlucky Coinbase Pro users. One of them – Chirag Tomar, a 30-year-old citizen of the Republic of India – has

React to this headline:

How fraudsters stole $37 million from Coinbase Pro users Read More »

Okta warns customers about credential stuffing onslaught

account hijacking, account protection, attacks, credentials, Don't miss, Hot stuff, News, Okta / SecurityTicks

Okta warns customers about credential stuffing onslaught 2024-04-29 at 14:01 By Zeljka Zorz Credential stuffing attacks have exploded this April, Okta warns, and advises its customers to use available tools to block access requests originating from residential proxies before authentication takes place. Abuse of proxy networks “In credential stuffing attacks, adversaries attempt to sign-in to

React to this headline:

Okta warns customers about credential stuffing onslaught Read More »

Microsoft: Russian hackers accessed internal systems, code repositories

account hijacking, APT, brute-force, Don't miss, government-backed attacks, Hot stuff, IBM X-Force, Microsoft, News / SecurityTicks

Microsoft: Russian hackers accessed internal systems, code repositories 2024-03-11 at 14:14 By Zeljka Zorz Midnight Blizzard (aka APT29), a group of Russian hackers tied to the country’s Foreign Intelligence Service (SVR), has leveraged information stolen from Microsoft corporate email systems to burrow into the company’s source code repositories and internal systems. “It is apparent that

React to this headline:

Microsoft: Russian hackers accessed internal systems, code repositories Read More »

Spoutible API exposed encrypted password reset tokens, 2FA secrets of users

account hijacking, API security, data breach, Don't miss, Hot stuff, News, social media, Spoutible, vulnerability / SecurityTicks

Spoutible API exposed encrypted password reset tokens, 2FA secrets of users 2024-02-06 at 16:33 By Helga Labus A publicly exposed API of social media platform Spoutible may have allowed threat actors to scrape information that can be used to hijack user accounts. The problem with the Spoutible API Security consultant Troy Hunt has been tipped

React to this headline:

Spoutible API exposed encrypted password reset tokens, 2FA secrets of users Read More »

Lagging Mastodon admins urged to patch critical account takeover flaw (CVE-2024-23832)

account hijacking, Cure53, Don't miss, Hot stuff, Mastodon, News, security update, social media, vulnerability / SecurityTicks

Lagging Mastodon admins urged to patch critical account takeover flaw (CVE-2024-23832) 2024-02-06 at 12:02 By Zeljka Zorz Five days after Mastodon developers pushed out fixes for a remotely exploitable account takeover vulnerability (CVE-2024-23832), over 66% of Mastodon servers out there have been upgraded to close the hole. About Mastodon Mastodon is open-source (server) software for

React to this headline:

Lagging Mastodon admins urged to patch critical account takeover flaw (CVE-2024-23832) Read More »

Critical GitLab flaw allows account takeover without user interaction, patch quickly! (CVE-2023-7028)

account hijacking, Don't miss, GitLab, Hot stuff, News, security update, vulnerability / SecurityTicks

Critical GitLab flaw allows account takeover without user interaction, patch quickly! (CVE-2023-7028) 2024-01-12 at 13:16 By Zeljka Zorz A critical vulnerability in GitLab CE/EE (CVE-2023-7028) can be easily exploited by attackers to reset GitLab user account passwords. While also vulnerable, users who have two-factor authentication enabled on their account are safe from account takeover. “We

React to this headline:

Critical GitLab flaw allows account takeover without user interaction, patch quickly! (CVE-2023-7028) Read More »

SEC’s X account hacked to post fake news of Bitcoin ETF approval

account hijacking, account protection, Don't miss, Fake News, MFA, News, scams, Twitter / SecurityTicks

SEC’s X account hacked to post fake news of Bitcoin ETF approval 2024-01-10 at 15:47 By Zeljka Zorz Someone has hijacked the X (formerly Twitter) account of the US Securities and Exchange Commission (SEC), and posted an announcement saying the agency has decided to allow the listing of Bitcoin ETFs (exchange-traded funds) on registered national

React to this headline:

SEC’s X account hacked to post fake news of Bitcoin ETF approval Read More »

Attackers abuse OAuth apps to initiate large-scale cryptomining and spam campaigns

account hijacking, BEC scams, cryptojacking, Don't miss, Hot stuff, Microsoft, Microsoft 365, Microsoft Azure, Microsoft Entra ID, News, OAuth, phishing, spam / SecurityTicks

Attackers abuse OAuth apps to initiate large-scale cryptomining and spam campaigns 13/12/2023 at 16:46 By Helga Labus Attackers are compromising high-privilege Microsoft accounts and abusing OAuth applications to launch a variety of financially-motivated attacks. Abusing OAuth applications OAuth is an open standard authentication protocol that uses tokens to grant applications access to server resources without

React to this headline:

Attackers abuse OAuth apps to initiate large-scale cryptomining and spam campaigns Read More »

Booking.com customers targeted in hotel booking scam

account hijacking, Don't miss, hospitality industry, Hot stuff, Malware, News, Perception Point, scams, SecureWorks, social engineering / SecurityTicks

Booking.com customers targeted in hotel booking scam 04/12/2023 at 13:31 By Helga Labus Scammers are hijacking hotels’ Booking.com accounts and using them as part of a hotel booking scam aimed at tricking guests into sharing their payment card information. “Customers of multiple properties received email or in-app messages from Booking.com that purported to be from

React to this headline:

Booking.com customers targeted in hotel booking scam Read More »

Rise in automated attacks troubles ecommerce industry

account hijacking, API security, bot, cybercrime, cybercriminals, cybersecurity, data, DDoS, holidays, Imperva, News, online behavior, report, survey / SecurityTicks

Rise in automated attacks troubles ecommerce industry 17/11/2023 at 07:03 By Help Net Security Automated attacks on application business logic, carried out by sophisticated bad bots, were the leading threat for online retailers, according to Imperva. In addition, account takeover, DDoS, API abuse, and client-side attacks were significant risks. The ecommerce industry remains a lucrative

React to this headline:

Rise in automated attacks troubles ecommerce industry Read More »

Microsoft Authenticator suppresses suspicious MFA notifications

account hijacking, Don't miss, Hot stuff, MFA, Microsoft, News, social engineering / SecurityTicks

Microsoft Authenticator suppresses suspicious MFA notifications 08/11/2023 at 17:46 By Helga Labus Microsoft has quietly rolled out a new mechanism that shields users of its mobile Authenticator app from suspicious (and annoying) push notifications triggered by attackers. Preventing attacks relying on MFA fatigue When faced with MFA-protected accounts, threat actors repeatedly try to gain access

React to this headline:

Microsoft Authenticator suppresses suspicious MFA notifications Read More »

Okta breach post mortem reveals weaknesses exploited by attackers

1Password, account hijacking, BeyondTrust, Cloudflare, Don't miss, Hot stuff, Incident Response, News, Okta / SecurityTicks

Okta breach post mortem reveals weaknesses exploited by attackers 06/11/2023 at 17:18 By Zeljka Zorz The recent breach of the Okta Support system was carried out via a compromised service account with permissions to view and update customer support cases. “During our investigation into suspicious use of this account, Okta Security identified that an employee

React to this headline:

Okta breach post mortem reveals weaknesses exploited by attackers Read More »

Compromised Skype accounts deliver DarkGate malware to employees

account hijacking, Don't miss, enterprise, Hot stuff, Malware, Microsoft Teams, News, Skype, Trend Micro / SecurityTicks

Compromised Skype accounts deliver DarkGate malware to employees 16/10/2023 at 16:46 By Helga Labus A threat actor is using compromised Skype accounts to deliver the DarkGate malware to target organizations, Trend Micro researchers have warned. “Versions of DarkGate have been advertised on Russian language forum eCrime since May 2023. Since then, an increase in the

React to this headline:

Compromised Skype accounts deliver DarkGate malware to employees Read More »

Requests via Facebook Messenger lead to hijacked business accounts

account hijacking, Don't miss, Facebook, Facebook Messenger, Guardio, Hot stuff, Malware, News, phishing / SecurityTicks

Requests via Facebook Messenger lead to hijacked business accounts 12/09/2023 at 13:32 By Zeljka Zorz Hijackers of Facebook business accounts are relying on fake business inquiries and threats of page/account suspension to trick targets into downloading password-stealing malware. Examples of phishing messages. (Source: Guardio Labs) The campaign Hijacked Facebook business accounts a great way to

React to this headline:

Requests via Facebook Messenger lead to hijacked business accounts Read More »

How Ducktail capitalizes on compromised business, ad accounts

account hijacking, Don't miss, Facebook, Hot stuff, LinkedIn, Malware, News, phishing, social media, TikTok, Zscaler / SecurityTicks

How Ducktail capitalizes on compromised business, ad accounts 01/09/2023 at 12:04 By Helga Labus Quite some money can be made from selling compromised business and ad accounts on social media platforms, and the Ducktail threat actor has specialized in just that. “We observed that an account deemed ‘low-grade’ sells for around 350,000 Vietnamese dong (~$15

React to this headline:

How Ducktail capitalizes on compromised business, ad accounts Read More »

The removal of Qakbot from infected computers is just the first step

account hijacking, botnet, Don't miss, Europe, FBI, Hot stuff, Malware, News, remediation, Shadowserver, Spamhaus, USA / SecurityTicks

The removal of Qakbot from infected computers is just the first step 30/08/2023 at 14:46 By Zeljka Zorz The Qakbot botnet has been disrupted by an international law enforcement operation that culminated last weekend, when infected computers started getting untethered from it by specially crafted FBI software. Arranging a widespread Qakbot removal The Qakbot administrators

React to this headline:

The removal of Qakbot from infected computers is just the first step Read More »