Banking and financial credentials are the most common listings on darknet sites (Source: Digital Shadows)

5 Billion Unique Credentials Circulating on Darknet

Ishita Chigilli Palli • July 10, 2020

Five billion unique user credentials are circulating on darknet forums, with cybercriminals offering to sell access to bank accounts as well as domain administrator access to corporate networks, according to the security firm Digital Shadows.

Cybercrime

European Police Hack Encrypted Communication System

Latest

Cybercrime

Zoom-Themed Phishing Campaign Targets Office 365 Credentials

Prajeet Nair • July 10, 2020

A recently uncovered phishing campaign is using spoofed Zoom account alerts to steal Microsoft Office 365 credentials, according to a report from Abnormal Security. These attacks come as use of the platform soars due to work-from-home arrangements.

Cybercrime

Mac Malware Primarily Infostealer, Not Ransomware

Doug Olenick • July 10, 2020

The Mac malware originally labeled as "EvilQuest," which researchers initially identified as a poorly designed ransomware variant, apparently is primarily an information stealer with ransomware-like elements designed to confuse security tools, according to the security firm Malwarebytes.

Cybercrime

Updated Joker Android Malware Adds Evasion Techniques

Akshaya Asokan • July 10, 2020

Check Point Research reports that a new version of the Joker mobile malware that infects Android devices has emerged. The malware, hidden in apps in the Google Play store, has once again evaded Google's security tools.

COVID-19

Analysis: Monitoring the Risks Posed by Remote Workers

Nick Holland • July 10, 2020

The latest edition of the ISMG Security Report analyzes the surge in the use of employee monitoring tools for the increasingly remote workforce. Also featured: Discussions about IoT security guidelines and CCPA compliance requirements.

Cybercrime

Cybercrime Research: For the Greater Good, or Marketing?

Mathew J. Schwartz • July 10, 2020

U.S. prosecutors this week unsealed an indictment against the alleged hacker "Fxmsp" after his identity was revealed in a cybersecurity firm's report. That sequence of events has raised questions about information sharing and highlighted law enforcement's reliance on private cybersecurity researchers.

Cybercrime

APT Group Targets Fintech Companies

Akshaya Asokan • July 9, 2020

A little-known advanced persistent threat group dubbed Evilnum has been targeting fintech firms in the U.K. and Europe over the past two years, using spear-phishing emails and social engineering to start their attacks, according to the security firm ESET.

Account Takeover

Cereberus Banking Trojan Targeted Spanish Android Users

Prajeet Nair • July 9, 2020

The Cereberus banking Trojan and info stealer was found posing as a legitimate money converter app in the Google Play Store, where it was downloaded more than 10,000 times, according to Avast Mobile Threat Labs.

Account Takeover

Card Skimmer Found Hitting Vulnerable E-Commerce Sites

Doug Olenick • July 8, 2020

A credit card skimmer that has been operating since April is specifically targeting sites hosted on Microsoft IIS servers that are currently running an out-of-date version of ASP.NET, according to security firm Malwarebytes. About 27 million websites still use this now unsupported software.

Cybercrime

Feds Indict 'Fxmsp' for Hacking Multiple Firms

Ishita Chigilli Palli • July 8, 2020

The U.S. Justice Department has charged Kazakhstan national Andrey Turchin with being the hacker known as "Fxmsp," as well as running a hacking collective known by the same name that's been tied to 300 attacks worldwide, including against anti-virus vendors.

Governance & Risk Management

CCPA Enforcement: What to Expect Now

Anna Delaney • July 8, 2020

Attorney Sadia Mirza, offers an update on the July 1 California Consumer Privacy Act enforcement and what security and privacy professionals should expect over the next few months.

COVID-19

DIACC: Building a Fully Digital Canada

Anna Delaney • July 8, 2020

Joni Brennan, president of the Digital ID & Authentication Council of Canada (DIACC), says identity management is a core component to building a solid foundation for a socioeconomic safety net, particularly during a pandemic. However, engagement and education are also vital components to establishing a strong...

Electronic / Mobile Payments Fraud

'Keeper' Group Targeted Payment Card Data on 570 Sites

Akshaya Asokan • July 8, 2020

A hacking group known as "Keeper" has been using Magecart-like web skimmers to target the online checkout sites and portals of hundreds of e-commerce sites in order to steal the payment card data from about 184,000 customers, according to Gemini Advisory. The thefts are estimated to total in the millions.