All posts tagged: Malware

Microsoft Finds Major Security Flaw ‘Dirty Stream’ in Android Apps Totalling Billions of Downloads

Published by Webster

Microsoft discovered a major security vulnerability in multiple Android apps last week that could be exploited to gain unauthorised access to apps and sensitive data on the device. Interestingly, this security flaw does not come from the system codes, but an improper usage of a particular system by developers that can lead to loopholes prone to exploitation. Notably, the flaw has been highlighted to Google, and the tech giant has taken steps to make the Android app developer community aware of the issue. In a post on its Security Blog, the Microsoft Threat Intelligence team stated, “Microsoft discovered a path traversal-affiliated vulnerability pattern in multiple popular Android applications that could enable a malicious application to overwrite files in the vulnerable application’s home directory.” The researchers also highlighted that the vulnerability was spotted in several apps in the Google Play Store that had a combined total of more than four billion installations. This vulnerability emerges when a developer incorrectly uses Android’s content provider system, which is designed to secure data exchange between different apps on a …

Devices Infected With Data-Stealing Malware Increased by 7 Times Since 2020

Published by Webster

The number of devices infected with data-stealing malware in 2023 was 9.8 million, a sevenfold increase over the same figure for 2020, according to new research from Kaspersky Digital Footprint Intelligence. However, the researchers believe that the true figure could be as high as 16 million, as credentials from devices infected in 2023 may not be leaked onto the dark web until later this year (Figure A). Figure A: Number of infections of data-stealing malware from 2020 to 2023. Image: Kaspersky Digital Footprint Intelligence Cybercriminals stole an average of 50.9 credentials per compromised device, and 443,000 websites have had user information leaked in the past five years. The data was obtained from log files that record the activities of “infostealers.” Infostealers are a type of malware that covertly extracts data from infected devices without encrypting it. These logfiles are “actively traded in underground markets” and monitored by Kaspersky as part of its digital risk protection service. Sergey Shcherbel, expert at Kaspersky Digital Footprint Intelligence, said in a press release, “Leaked credentials carry a major threat, …

iPhone Devices Under Threat as New iOS Trojan That Targets Facial Recognition Data Reported

Published by Webster

iPhone devices are being targeted by a rare trojan called GoldDigger, a cybersecurity firm has reported. The malware is part of a cluster of aggressive banking trojans that have been affecting users in the Asia-Pacific (APAC) region. The earlier spotted malware group was only affecting Android users, but a new version has now been unearthed that specifically targets iOS and steals facial recognition data and other sensitive information from devices. This development is rare since Apple is known to be proactive in releasing security patches for its operating system. Cybersecurity firm Group-IB was behind the discovery of the iOS trojan. The group has been tracking it since October 2023, when it first found a new variant of Android malware and named it GoldDigger. The malicious programme was found to be a banking trojan that steals financial information and targets banking apps, e-wallets, and crypto-wallets. It was first spotted in Vietnam but later identified as a cluster that was affecting the entire APAC region. In its findings, the group noted that “a new sophisticated mobile Trojan …

Androxgh0st Malware Botnet Steals AWS, Microsoft Credentials and More

Published by Webster

The Federal Bureau of Investigation and Cybersecurity & Infrastructure Security Agency warned in a joint advisory about a threat actor deploying a botnet that makes use of the Androxgh0st malware. This malware is capable of collecting cloud credentials, such as those from AWS or Microsoft Azure and more, abusing the Simple Mail Transfer Protocol, and scanning for Amazon Simple Email Service parameters. What is the Androxgh0st malware? The Androxgh0st malware was exposed in December 2022 by Lacework, a cloud security company. The malware is written in Python and is primarily used to steal Laravel.env files, which contain secrets such as credentials for high-profile applications. For instance, organizations can integrate applications and platforms such as AWS, Microsoft Office 365, SendGrid or Twilio to the Laravel framework, with all of the applications’ secrets being stored in the .env file. The botnet hunts for websites using the Laravel web application framework before determining if the domain’s root level .env file is exposed and contains data for accessing additional services. The data in the .env file might be usernames, …

Get Elite Protection from Malware with Award Winning Antivirus

Published by Webster

Image: StackCommerce TL;DR: Protect your computer from common viruses and other forms of malware, including ransomware and rootkits, with the ESET NOD32 Antivirus 2024 Edition, on sale for just $24.99 through January 14. Cybercrime has long been a problem for businesses. Now that hackers have access to AI and machine learning tech, however, security analysts expect the growth rate to climb exponentially. Are your company’s computers adequately protected for the new year? If not, then consider upgrading to the ESET NOD32 Antivirus 2024 Edition — offered at a discounted price through January 14. ESET NOD32 Antivirus is award-winning software that was designed from the ground up to protect users from malware without impeding performance. It works great to safeguard your system while gaming, streaming movies or giving presentations online. And since the software was developed with functionality in mind, your PC won’t suffer any slowdowns for the sake of security. This is multilayered protection that no one should be without. It not only defends your computer from viruses but also ransomware, spyware, rootkits and worms. …

ChatGPT Name Abuses, Lumma Stealer Malware Increases, Android SpinOk SDK Spyware’s Prevalence

Published by Webster

Risk mitigation tips are provided for each of these cybersecurity threats. Cybersecurity company ESET released its H2 2023 threat report, and we’re highlighting three particularly interesting topics in it: the abuse of the ChatGPT name by cybercriminals, the rise of the Lumma Stealer malware and the Android SpinOk SDK spyware. Jump to: ChatGPT name is being abused by cybercriminals In the second half of 2023, ESET has blocked 650,000 attempts to access malicious domains whose names include “chatgpt” or similar string in an apparent reference to the ChatGPT chatbot. One of the frauds resides in the OpenAI API for ChatGPT. The API needs a private API key that must be carefully protected and never exposed by users, yet some apps ask users to provide their API keys so the applications can use ChatGPT. As written by ESET researchers, “if the app sends your key to the developer’s server, there may be little to no guarantee that your key will not be leaked or misused, even if the call to the OpenAI API is also made.” …

Proofpoint Exposes Sophisticated Social Engineering Attack on Recruiters That Infects Their Computers With Malware

Published by Webster

Recruiters and anyone else involved in hiring processes should be knowledgeable about this social engineering attack threat. A new report from U.S.-based cybersecurity company Proofpoint exposes a new attack campaign operated by a financially-oriented threat actor dubbed TA4557 with high financial data theft risks and possibly more risks such as intellectual property theft. In this social engineering campaign, the threat actor targets recruiters with benign content before infecting their machines with the More_Eggs malware. This threat actor takes extra care to avoid being detected. Jump to: How recruiters are targeted by threat actor TA4557 The latest attack campaign from threat actor TA4557, as exposed by Proofpoint, targets recruiters by sending them a direct email. The group pretends to be an individual interested in a job (Figure A). Figure A Sample email sent by TA4557 to a recruiter. Image: Proofpoint The email does not include any malicious content. Once the recruiter replies to the email, the attacker replies with a link leading to an attacker-controlled website posing as an individual’s resume (Figure B). Figure B The …

WhatsApp Parent Meta Allowed to Pursue Lawsuit Against NSO Group for Installing Pegasus Malware

Published by Webster

The US Supreme Court on Monday let Meta Platforms’s WhatsApp pursue a lawsuit accusing Israel’s NSO Group of exploiting a bug in the WhatsApp messaging app to install spy software allowing the surveillance of 1,400 people, including journalists, human rights activists and dissidents. The justices turned away NSO‘s appeal of a lower court’s decision that the lawsuit could move forward. NSO had argued that it is immune from being sued because it was acting as an agent for unidentified foreign governments when it installed the Pegasus spyware. President Joe Biden’s administration had urged the justices to reject NSO’s appeal, noting that the US State Department had never before recognized a private entity acting as an agent of a foreign state as being entitled to immunity. Meta, the parent company of both WhatsApp and Facebook, in a statement welcomed the court’s move to turn away NSO’s “baseless” appeal. “NSO’s spyware has enabled cyberattacks targeting human rights activists, journalists and government officials,” Meta said. “We firmly believe that their operations violate US law and they must be held to account …