Latest Cybersecurity News and Articles

---

Australian police arrest four BEC actors who stole $1.7 million

The losses for victims range between $2,500 and $500,000, which the syndicate laundered using a massive network of 180 bank accounts, many of which were opened in South African banks using stolen identities.

---

Nexus: New Feature-Rich Android Banking Trojan

Researchers at Cleafy uncovered a new Android banking trojan being tracked as Nexus. The malware has appeared on multiple hacking forums with the same name and is promoted via a Malware-as-a-Service (MaaS) subscription. Though the malware appears to be at a nascent stage, researchers confirmed several active campaigns using it already. It can perform account takeover attacks against apps of 450 banking portals and cryptocurrency services.

---

Vice Society Claims Attack on Puerto Rico Aqueduct and Sewer Authority

The attack was disclosed on March 19, and threat actors had access to customer and employee information. The agency is going to notify impacted customers and employees via breach notification letters.

---

Malicious PyPI Package Uses Unicode - Why?

Security experts found a malicious package, named onyxproxy, using leveraged Unicode support in Python to obfuscate an info-stealing malware. They said that the threat actor merely copy-pasted the code from various places and intermixed it with malicious code. The package onyxproxy was published on the platform on March 15 and it amassed 183 downloads before its removal on March 22.

---

Shining Light on Dark Power: Yet Another Ransomware Gang

Upon starting, the ransomware creates a randomized 64-character long lowercase ASCII string. The randomization ensures the key is unique each time the sample is executed, and therefore it is unique on each targeted machine.

---

Where SSO Falls Short in Protecting SaaS

Single sign-on (SSO) is an authentication method that allows users to authenticate their identity for multiple applications with just one set of credentials. From a security standpoint, SSO is the gold standard. It ensures access without forcing users to remember multiple passwords and can be further secured with MFA. Furthermore, an estimated 61% of attacks stem from stolen credentials. By

---

OpenAI Reveals Redis Bug Behind ChatGPT User Data Exposure Incident

OpenAI on Friday disclosed that a bug in the Redis open-source library was responsible for the exposure of other users' personal information and chat titles in the upstart's ChatGPT service earlier this week.

---

New MacStealer macOS Malware Steals iCloud Keychain Data and Passwords

A new information-stealing malware has set its sights on Apple's macOS operating system to siphon sensitive information from compromised devices. Dubbed MacStealer, it's the latest example of a threat that uses Telegram as a command-and-control (C2) platform to exfiltrate data. It primarily affects devices running macOS versions Catalina and later running on M1 and M2 CPUs. "MacStealer has the

---

Kids tech camp iD Tech still silent weeks after data breach

The hacker claimed to have stolen close to 1 million user records, including names, dates of birth, passwords stored in plaintext, and about 415,000 unique email addresses, which iD Tech did not dispute when TechCrunch reached by email.

---

ShellBot Targets Exposed Linux SSH Servers With Three New Variants

In a new campaign, the Perl-based DDoS bot malware ShellBot (also known as PerlBot), which was previously used in assaults alongside CoinMiner, targets poorly maintained Linux SSH servers. Threat actors use three new malware variants - LiGhT's Modded perlbot v2, DDoS PBot v2.0, and PowerBots (C) GohacK.  Administrators are suggested to implement strong password policies.

---

Microsoft Issues Patch for aCropalypse Privacy Flaw in Windows Screenshot Tools

Microsoft has released an out-of-band update to address a privacy-defeating flaw in its screenshot editing tool for Windows 10 and Windows 11. The issue, dubbed aCropalypse, could enable malicious actors to recover edited portions of screenshots, potentially revealing sensitive information that may have been cropped out. Tracked as CVE-2023-28303, the vulnerability is rated 3.3 on the CVSS

---

Okta Post-Exploitation Method Exposes User Passwords

Researchers from Mitiga discovered that the IAM system saves Okta user passwords to audit logs if a user accidentally types them in the "username" field when logging in, thereby allowing threat actors with access to a company system to harvest them.

---

MITRE Rolls Out Supply Chain Security Prototype

The so-called Risk Model Manager (RMM) platform is now available for organizations to assess supply chain risk and security, as well as to view, edit, and customize the SoT framework content, or export it for use as a subset framework.

---

CloudPanel installations use the same SSL certificate private key

Self-hosted web administration solution CloudPanel was found to have several security issues, including using the same SSL certificate private key across all installations and unintentional overwriting of firewall rules to default to weaker settings.

---

Collaboration Over Self-Preservation Highlighted in Latest Guide to Cyber Oversight

The fourth edition of the Director’s Handbook on Cyber-Risk Oversight, published by the National Association of Corporate Directors and the Internet Security Alliance, outlines six core principles “for board oversight of cybersecurity.”

---

BlackGuard stealer extends its capabilities in new variant

AT&T Alien Labs researchers have discovered a new variant of BlackGuard stealer in the wild, infecting using spear phishing attacks. The new variant is trying to propagate through removable media and shared devices.

---

Yes, it’s crazy to have TikTok on official phones. But it’s not good for any of us | John Naughton

Fears for data security lie behind recent government bans on the Chinese-owned app, but zombie scrolling has health dangers tooAs of this moment, government officials in 11 countries are forbidden to run TikTok on their government-issued phones. The countries include the US, Canada, Denmark, Belgium, the UK, New Zealand, Norway, France, the Netherlands and Poland. In addition, European Commission and European parliament staff were required to delete the app. This raises two questions.First, why were politicians and senior officials in democracies scrolling like zombies through dance crazes, daft pet videos, feeling “bonita” and things you can do with smudged lipstick? Continue reading...

---

Cyberattack hits Spanish pharmaceutical company Alliance Healthcare

The cyber incident began on March 17 and has led to a complete shutdown of the company’s website, billing systems, and ordering processes. During the first few days of the attack, the company remained at a standstill.

---

Malicious Python Package Uses Unicode Trickery to Evade Detection and Steal Data

The package in question, named onyxproxy, was uploaded to PyPI on March 15, 2023, and comes with capabilities to harvest and exfiltrate credentials and other valuable data. It has since been taken down, but not before attracting 183 downloads.

---

TikTok banned on London City Hall devices over security concerns

Move by Greater London authority comes after Chinese-owned app was blocked on UK parliamentary devicesLondon City Hall staff will no longer have TikTok on their devices in the latest ban imposed on the Chinese-owned social media app over security concerns.The Greater London authority (GLA) said the rule was implemented as it takes information security “extremely seriously”. Continue reading...