Search This Blog

Showing posts with label Cybersecurity. Show all posts

Google Playstore Removes 25 Android Apps that Stole User Login Credentials


In a recent cybersecurity incident, Google cleared 25 applications from its google play store as they were alleged to steal the users' FB credentials. According to Google, these applications were downloaded for around 2..35 million before the play store decided to shut them down. All these 25 applications were created by the same developer, even though they seemed to work differently and offer different features, they were all peas in a pod.


These apps showed themselves as a video editor, photo editor, wallpaper apps, file managing apps, mobile gaming apps, and flashlight apps., says Evina, a France based cybersecurity organization. When the firm came to know about the incident, it reported to Google, and precautionary measures were taken immediately to protect the end-users. The malware was also reverse-engineered so that no damage could take place. The 25 apps had malware embedded in them, which stole FB login credentials whenever the user launched the FB application.

Although the apps worked legally, they, however, had hidden malicious codes. The code could tell about the recently launched app in the user's device. If it were FB, these apps would create a fake login page that looked the same as the original to steal the user's login credentials. If the user entered his login credentials, the app would capture the data and transfer it to a remote server domain. When Google came to know about the issue after Evina's claims in May, it verified it before taking down these apps. Playstore removed these 25 apps earlier this month, some of which had been in use for more than a year.

"When an application is launched on your phone, the malware queries the application name. If it is a Facebook application, the malware will launch a browser that loads Facebook at the same time. The browser is displayed in the foreground, which makes you think that the application launched it. When you enter your credentials into this browser, the malware executes javascript to retrieve them. The malware then sends your account information to a server," said Evina in a blog post.

Cyberattacks in the U.S. Hit an All-Time High due to Covid-19, Says Black Hat Report.


Due to the coronavirus pandemic, cybersecurity experts suspect a rise in cyberattacks and cybercrimes, says a survey by Black Hat earlier this week. Around 275 cybersecurity professionals (respondents in the study) have expressed concerns about potential breaches in the U.S. infrastructure and the I.T. industry. More than 90% of these experts believe that due to coronavirus, there has been a jump in cyber threats in the U.S., resulting in data leaks and privacy breaches. Around 24% of experts believe that the current danger is very severe and critical.


Among the cybersecurity threats, work from vulnerabilities in the remote access systems tops the list, accounting for 57% of the attacks. Meanwhile, phishing scams and spam attacks account for a hefty 51%. Around 85% of these experts claim that there might be a targeted cyberattack on the U.S. infrastructure in the next two years. The threat figures went up from 69% in 2018 to 77% in 2019. Among these, around 15% of the respondents believe that the government and the private sector is ready to face these attacks. These percentage figures went down from about 20% in 2019.

The majority of the cybersecurity experts believe that their firms would have to take care of the upcoming cybersecurity challenges. More than half of these believe that they currently lack the required staff force to combat cyber threats. Besides this, the budget required to protect their organization's data from cyberattacks is also low. Besides the concerns about the lack of resources to defend against cybercriminals, experts also say that they lack proper technology. According to the survey results, only half of the technology tools could be termed effective.

"The survey results suggest that the world's top cybersecurity professionals are more concerned than ever about cybersecurity risk at the global, national, enterprise, and consumer levels. While cyber threats have been growing in volume and sophistication in recent years, most security professionals believe that the radical shift toward remote access creates unprecedented risk for sensitive data," says the 2020 Black Hat USA report.

Secondary Infektion: A Russian Disinformation Operation Agency You Need to Know About


The secret campaign was famous as "Secondary Infektion," and it worked separately from the IRA and GRU, staying hidden for many years. The IRA (Internet Research Agency) is known for its notorious disinformation campaigns, where it floods the social media platforms with false information and propaganda. Whereas the GRU, also known as the Main Intelligence Directorate in Russia, is infamous for planning cyberattacks and even strategic data leaks. But in recent times in Russia, it is suspected that there might be a third intelligence agency responsible for such cyberattacks and was able to penetrate even more in-depth. It is believed that this third party that worked distinctly from the former two managed to stay undercover for a long time in Russia and only recently came to public knowledge. Here's what we know.


Known as Secondary Infektion, cybersecurity experts found about the operation in 2019. As of now, a social media analyst firm named Graphika published a report on the intelligence group's activities, which seemed to have started in 2014. According to the report's analysis, this group is known to cover its tracks, and all Secondary Infektion operations online are protected by robust security, which uses hallmark accounts that disappear soon after publishing a comment or a post on social media.

"Secondary Infektion targeted countries across Europe and North America with fake stories and forged documents. Its focus and areas of interest were often of a diplomatic and foreign policy nature: it appeared primarily aimed at provoking tensions between Russia's perceived enemies, and its stories typically concerned relationships between governments and often specifically focused on government representatives. It is also notable for launching smear campaigns against Kremlin critics and for targeting presidential candidates in 2016 in the U.S., in 2017 in France, in Germany, Sweden, and elsewhere," says Graphika's executive summary.

Hence, Secondary Infektion's operations are quite the opposite of the IRA and GRU's way of working. The IRA and GRU believe in building an online presence and increase their reach that is aimed to leave a long-lasting impression, through their disinformation campaigns.

All You Need to Know About the Recent DDoS Attacks and Threats that have Surfaced in the U.S


Cybersecurity experts have denied incidents of any DDoS s attacks in recent times. However, the attacks on T-Mobile's services that resulted in an outage seems to tell a different story. In a recent incident, T-Mobile suffered a blackout, and the customers quickly realized it and registered their complaints about the cellular issue. Witnessing the problem, company president Neville Ray on his twitter account said that the employees were working on the problem and would soon resolve the issue. He further noted that the data and messaging service would be in work early and apologized for the inconvenience.


Similar incidents came from different cyber agencies, but the most surprising was an image shared by an account, which, according to officials, can be linked to activists "Anonymous." Anonymous published a Digital Attack Map, which showed various attacks on the U.S postal services. We don't have much information regarding the issue at hand, but the cybersecurity experts claim that no such incidents happened. The intriguing thing is the fact that T-Mobile had faced a similar problem. As of now, it seems that the U.S may be a potential target for a large scale DDoS (distributed denial-of-service) attack.

The DDoS attack might be capable of stuffing online services with traffic from various sources, making it useless. Media outlets from across the world have reported similar attacks in recent times. Netscout, a global cybersecurity organization, said 200 cyberattacks targeted towards the U.S. In another incident, an unknown online activist group named Anonymous shared a digital attack map that showed various attacks in the U.S and Brazil. It claimed on Twitter that the U.S was under a massive DDoS attack, and the tweet went viral.

"In light of this DDoS attack, your reminder that @realDonaldTrump eliminated the cybersecurity coordinator position at the NSC in 2018. And in 2019, at least a dozen high-level officials resigned from the cybersecurity mission established under Obama," tweeted Representative Ted Lieu. We haven't the official names, but a handful of anonymous politicians have also complained about the possibility of DDoS attacks. It should be noted that these DDoS attacks have surfaced when the U.S is battling the global pandemic, and the entire country is protesting for civil rights. All these things just do not seem ordinary, and one should give some thought about it.

Users Might be Under Risk of DNS Vulnerability


What is DNS?

It is an essential element in the network (online infrastructure) that allows users to watch or access content on the internet by building a link between an IP address and the respective website with the help of a database. Hackers can use it as an opportunity to disturb the service, which causes altering in the domain registrars. Also known as DNS hijacking, altering domain registrars can cause DDoS attacks, DNS Tunneling, cache position, etc.


About the DNS Risk 

  • In a recent incident, a cryptocurrency exchange Japanese company named Coincheck was a victim of DNS Hijacking. The attack costed the company exposure of around 200 clients' private information and e-mails. The hackers first altered the basic DNS entry by using the company's account and Oname.com- the company's domain registrar provider. After this, the hackers used a spear-phishing technique to steal information and e-mails from the 200 clients. 


  • In another DNS hijacking incident last month, a group of experts from Israel found an "NXNS Vulnerability." The vulnerability in the DNS servers can cause massive scale DDoS attacks if exploited by hackers. To lessen the impact of the attack, Microsoft recently issued a security advisory about the vulnerability. 
It is not all; the DNS vulnerability issue is just one thing. According to cyber experts, there is another DNS threat out in the wild, and the pressing issue is that very few people know about it.

Concerns regarding DNS 

In present times, the most pressing problem, according to cybersecurity experts, is the exploitation of unattended domains. In other words, domains that are no longer in use but still exist on the internet. It happens under the circumstances of dissolved firms, mergers, and partnerships, as the companies leave out their old domains because of the rebranding. If a domain is left out to expire, the following things can happen:

  • If the hackers re-register the expired domains and make a new e-mail server, they can have access to confidential organizational information.
  • Left out domains of stores can be re-built, and the hackers can use it to receive orders and steal the money.

Information Sharing can Strengthen the Cybersecurity Measures, says US Cyberspace Report


According to the US Cyberspace Solarium Commission report that came in March this year, there is an immediate requirement of securing the cybersecurity sector of the country for better prevention of the private companies and corporates. It highlights 70 critical guidelines that every C-Suite executive should follow to defend the cybersecurity measures. According to Dark Reading, "for the US public sector, the major threats are attacks on elections and other democratic institutions, espionage against both the military and its suppliers, targeting civilian agencies for surveillance, and US leadership in crucial technology R & D according to the commission."


It also says, "primary threats against the US private sector are cybercrime and malware, intellectual property theft, and risks to critical infrastructure. To protect against both public and private threats, the report proposes a three-level defense-in-depth encompassing six pillars of action." In the report, the essential guideline, according to the cybersecurity experts is, the enabling of information sharing among the cybersecurity experts that will help them protect organizations more efficiently. It will also allow experts to counter emerging cybersecurity challenges.

Another important highlight in the report is, coming up with more "robust cybersecurity policies and standards" to build a safer cyberspace infrastructure for different organizations. The report also highlights an important point, saying that allowing "information sharing" is a plus as it will help to develop better cybersecurity norms and collect common knowledge about critical areas and vulnerabilities. The gathered information will then allow the intelligence authorities to come up with countermeasures to these threats.

According to few cybersecurity experts, "information sharing" is the most helpful tool to find a cyber threat, vulnerability, or a cyberattack that is most likely to target sectors like healthcare, banking, government, and critical infrastructures. Currently, however, the cybersecurity norms and measures against cyberattacks are too weak and ineffective. Research and surveys on information gathering won't be enough to prevent data breaches and data exposure. There is a higher risk of sharing data of your organization's vulnerabilities, private info, consumer info, and other essential details compared to sharing critical penetrations.

Conduent's European Operations Hit by Maze Ransomware, Data Stolen


Conduent, a business process outsourcing organization confirms that their European operations were crippled by a ransomware attack on Friday, in an immediate response to the attack the IT services giant was able to restore most of the affected systems within eight hours of the incident.

The security software company, Emsisoft and cybersecurity research and threat intelligence firm Bad Packets, expressed a large probability of Conduent been attacked by Maze ransomware.

What is a Maze ransomware attack?

The maze is a sophisticated strain of Windows ransomware that not only encrypts individual systems but also proliferate across the whole network of computers infecting each one of it. Typically, Maze attacks organizations around the globe and demand a ransom in cryptocurrency for a safe recovery of the data encrypted by the attackers.

It's the same variant of ransomware that attacked IT services company, Cognizant on April 18 – although the New-Jersey headquartered company chose not to share many details about the security incident, it said that its services were disrupted and internal security teams were taking active measures to contain the impact. Reportedly, some of the company's employees were locked out of the mail systems as a result of the attack.

In Conduent's case, the threat actors have posted online two zip files that appear to contain data regarding the company's services in Germany, as per the evaluations made by Emsisoft. The documents were published on a website that leaks Maze ransomware attacks.

The company's operations witnessed a disruption around 12:45 AM CET on Friday, May 29th. It was by 10.00 AM CET that morning – the systems were restored and functional again. Meanwhile, the ransomware was identified by the systems and was later addressed by their cybersecurity protocols.

While commenting on the matter, Cognizant CFO Karen McLoughlin said, "While we have restored the majority of our services and we are moving quickly to complete the investigation, it is likely that costs related to the ransomware attack will continue to negatively impact our financial results beyond Q2."

As per the statements released by Conduent to confirm the attack that happened last week, “Conduent's European operations experienced a service interruption on Friday, May 29, 2020."

"Our system identified ransomware, which was then addressed by our cybersecurity protocols. This interruption began at 12.45 AM CET on May 29th with systems mostly back in production again by 10.00 AM CET that morning, and all systems have since then been restored. This resulted in a partial interruption to the services that we provide to some clients. As our investigation continues, we have on-going internal and external security forensics and anti-virus teams reviewing and monitoring our European infrastructure"

However, Conduent did not answer the questions regarding the loss of the data and the researches carried out by two cybersecurity companies indicating the same.

German Intelligence Warns Companies of Potential Hacking Threats from Russia


According to German intelligence agencies, a group of hackers from the Kremlin are targeting German infrastructures like energy, water, and power resources for a long time. The information came out the first time at the start of this year when investigating officers found evidence of cyberattacks on German companies. The names of the target companies are yet to be known. Still, a cyberattack has compromised them, says statements of German intelligence agencies that were sent to head of these infrastructures.


The group of hackers has been identified as "Berserk Bear." According to the investigation, the hackers are likely to be state-sponsored by the Russian FSB intelligence agency. The hackers are suspected of using the supply chain to infiltrate into German IT infrastructures, says various investigation agencies. According to the investigation, these hackers use openly available malware to permanently infiltrate the company's I.T. network and access sensitive information, along with having complete control over the company's server. The agencies didn't find any damaging evidence against the companies and have refused to offer any comment for the current situation.

The group Berserk Bear is infamous for stealing the U.S. energy companies' data in the year 2018. U.S. President Donald Trump had blamed Russia for the attack. According to cybersecurity experts, Berserk Bear is the group that Moscow is most likely to contact if there is a need to hack the industrial networks. Another hacking team called "Sandworm" was famous for the attack that shut down Ukraine's power supply in 2016 and 2018.

According to Cyberscoop, a cybersecurity website, "Sven Herpig, a cybersecurity expert with the German think tank SNV, welcomed the advisory and urged German companies to heed the warning. The memo has "concrete recommendations of how to spot and protect against an intrusion" from Berserk Bear, he said. The Russian Embassy in Washington, D.C., did not respond to a request for comment on the German agencies' report." Berserk Bear is responsible for various cyberattacks on American and German electrical utilities since 2018, say the cybersecurity experts. The group has been aggressive and attacked several companies.

Red Cross asks the Government to take Preventive Measures on Cyberattacks against Health Departments


Currently, while the whole world is struggling to fight against the coronavirus epidemic, cyberattacks have increased in numbers, targeting health departments like hospitals, research centers, and WHO. According to Reuters, "the Red Cross called for an end to cyberattacks on healthcare and medical research facilities during the coronavirus pandemic, in a letter published Tuesday and signed by a group of political and business figures."

Due to this, a group of 42 top world leaders have come together and requested the Government to take some immediate actions on the increasing attacks against the healthcare institutions. Among the members, there is Madeleine Albright, ex U.S Secretary of State and Brad Smith, president, Microsoft. Peter Maurer, President of International Red Cross Society, says the Government should take some swift measures and step-up to stop these attacks. He hopes that the Government is willing to commit to international obligations to prevent these attacks. He has asked for international cooperation from various health departments to combat this problem. It can be a severe problem for war-stricken countries where the conditions of healthcare departments are already deteriorating, and these cyberattacks will make things even worse.

The various leaders have asked the Government to work side by side with civil society. It comes after the news of cyberattacks on healthcare institutes came out. Ransomware was one of the attacks, that jammed the computers and infected the healthcare systems. It affected the healthcare institutes' functioning, like treating the patients, research, and various tests. Last month, incidents of the cyberattack on health institutes were reported by the Czech Republic government. Another event appeared where the DarkHotel hacking group attacked WHO.

News of various countries reporting attacks on healthcare systems also emerged, where the records of COVID-19 patients were stolen along with lab tests data. "Over the last several months, cybercriminals have targeted hospitals with computer viruses, usually in schemes to extort or hold their data ransom. More sophisticated hacking groups, such as those associated with governments, have also targeted medical research centers to steal valuable data about COVID-19 treatments," reports Reuters on its website.

New Spectra Attack that breaks the division between Wi-Fi and Bluetooth to be released at Black Hat Security Conference


The developers call it "Spectra." This assault neutralizes "combo chips," specific chips that handle various kinds of radio wave-based remote correspondences, for example, Wi-Fi, Bluetooth, LTE, and others. The attack system is set to release in August at the Black Hat Security Conference in a virtual session. The full academic paper with all details will also be published in August. The researchers teased a few details about the attack in an upcoming Black Hat talk, "Spectra, a new vulnerability class, relies on the fact that transmissions happen in the same spectrum, and wireless chips need to arbitrate the channel access."


The Spectra assault exploits the coexistence mechanism that chipset merchants incorporate within their devices. Combo chips utilize these systems to switch between wireless technologies at a quick pace. Specialists state that while this coexistence mechanism speeds execution, they likewise give a chance to attackers for side-channel assaults. Jiska Classen from Darmstadt Technical University and Francesco Gringoli researcher from the University of Brescia state that they are the first to explore such possibility of using the coexistence mechanism of Combo chips to break the barrier between Wireless.

"We specifically analyze Broadcom and Cypress combo chips, which are in hundreds of millions of devices, such as all iPhones, MacBooks, and the Samsung Galaxy S series," the two academics say. "We exploit coexistence in Broadcom and Cypress chips and break the separation between Wi-Fi and Bluetooth, which operate on separate ARM cores." Results change. However, the research group says that specific situations are possible after a Spectra assault. "In general, denial-of-service on spectrum access is possible.

The associated packet meta-information allows information disclosure, such as extracting Bluetooth keyboard press timings within the Wi-Fi D11 core," Gringoli and Classen said. "Moreover, we identify a shared RAM region, which allows code execution via Bluetooth in Wi-Fi. It makes Bluetooth remote code execution attacks equivalent to Wi-Fi remote code execution, thus, tremendously increasing the attack surface." Though the research used Broadcom and Cypress chips for Spectra attacks, the researchers Gringoli and Classen are sure that this attack will work on other chips.

Email Phishing Scam: Scammers Impersonate LogMeIn to Mine Users' Account Credentials


A Boston, Massachusetts based company, LogMeIn that provides software as a service and cloud-based remote connectivity services for collaboration, IT management and customer engagement has fallen prey to the scammers targeting companies' work from home schemes set up due to the ongoing pandemic, the campaign impersonates the remote access tool (RAT) LogMeIn and mines the unsuspecting users' account credentials.

As the number of people working from home increased rapidly, scammers saw it as a golden opportunity to carry out impersonations of remote tools such as Zoom and LogMeIn more blatantly than ever; the first incident being spotted in the month of May confirms the attributions made by the researchers in regard to COVID-19.

In this particular attack, the phishing email appears to be coming from LogMeIn, cautioning the user at the receiving end, of a zero-day exploit present in the LogMeIn Central and LogMeIn Pro- two of the company's products. It goes unsaid that in reality there exists no such vulnerability and victims' are made to follow a link that claims to be LogMein URL but takes the user to a phishing page where they would enter the credentials that would be obtained by the scammers behind the attack. Additionally, the threat actors are also exploiting the security issues that already existed in remote access platforms as a part of this phishing campaign.

While giving further insights, Abnormal Security said “Other collaboration platforms have been under scrutiny for their security as many have become dependent on them to continue their work given the current pandemic,”

“Because of this, frequent updates have become common as many platforms are attempting to remedy the situation. A recipient may be more inclined to update because they have a strong desire to secure their communications.”

In order to avoid being scammed by such phishing campaigns, Ken Liao, vice president of Cybersecurity Strategy at Abnormal, alerted users, "Many of the recent attacks have masqueraded as updates--even more specifically--security updates,"

"As always, users should default to updating applications via the application itself and not via links in emails to prevent not only credential loss but the potential introduction of malware onto their machines."

Israeli Security Company NSO Pretends to Be Facebook


As per several reports, Facebook was imitated by an Israeli security company that is known as the “NSO Group” to get the targets to install their “phone-hacking software”.

Per sources, a Facebook-like doppelganger domain was engineered to distribute the NSO’s “Pegasus” hacking contrivance. Allegedly, serves within the boundaries of the USA were employed for the spreading of it.

The Pegasus, as mentioned in reports, if installed once, can have access to text messages, device microphone, and camera as well as other user data on a device along with the GPS location tracking.

NSO has denied this but it still happens to be in a legal standoff with Facebook, which contends that NSO on purpose distributed its software on WhatsApp that led to the exploitation of countless devices. Another allegation on NSO is about having delivered the software to spy on journalist Jamal Khashoggi before his killing, to the government of Saudi Arabia, citing sources.

Facebook also claimed that NSO was also behind the operation of the spyware to which NSO appealed to the court to dismiss the case insisting that sovereign governments are the ones who use the spyware.

Per sources, NSO’s ex-employee, allegedly, furnished details of a sever which was fabricated to spread the spyware by deceiving targets into clicking on links. The server was connected with numerous internet addresses which happened to include the one that pretended to be Facebook’s. And Facebook had to buy it to stop the abuse of it.

As per reports, package tracking links from FedEx and other links for unsubscribing from emails were also employed on other such domains.

NSO still stand their ground about never using the software, themselves. In fact they are pretty proud of their contribution to fighting crime and terrorism, mention sources.

Security researchers say that it’s almost impossible for one of the servers to have helped in the distribution of the software to be within the borders of the USA. Additionally, reports mention, NSO maintains that its products could not be employed to conduct cyber-surveillance within the United States of America.

Facebook still holds that NSO is to blame for cyber-attacks. And NSO maintains that they don’t use their own software.

Hackers Use Backdoor to Infiltrate Governments and Companies, Motive, not Money.


According to findings by cybersecurity firms Avast and ESET, an APT (Advanced Persistent Threat) cyberattack targeted companies and government authorities in Central Asia, using backdoors to gain entry into company networks for a long period. The targets involved telecom companies, gas agencies, and one government body in Central Asia. APT attacks, unlike other cyberattacks, don't work for money profits but have different motives.


According to cybersecurity experts, APT attacks are state-sponsored, and their purpose is to get intel on politics and inside information, not money. According to research findings, the hackers responsible for the APT attack in Central Asia is a group from China that uses RAT (Remote Access Tools). The attack was not their first, as experts believe that the same group was responsible for the 2017 cyberattacks against the Russian military and the Belarusian government.

APT attacks remain lowkey 

Unlike ransomware attacks that are famous for infiltrating the company networks, involving some top IT companies, the APT actors like to stay out of the radar and remain unnoticed. The motive of these attacks is not blackmail by having sensitive information. These attacks aim to remain unnoticed for as long as possible, as it allows hackers to have access to the company's network and data. Experts say that they currently don't have substantial evidence about the data that was deleted or manipulated. After the attack, the hackers part away as to avoid any suspicion or identification. Confidential info like Espionage, government policies, and trade, is what these hackers are after.

The cyberattacks are on the rise due to people working from home, giving opportunities to hackers. It has been very tough to protect users from malware attacks in the current times, due to millions of malware. The reason is the COVID-19 pandemic, and the best chance to stay safe from hackers is to be on alert after the pandemic ends. Users should check every link they get, before opening it or passing it to someone else. People working from home should keep their systems and device updated, along with the applications.

Cybercriminals Spreading Node.js Trojan Promising Relief from the Outbreak of COVID-19


A java downloader going by the extension “Company PLP_Tax relief due to Covid-19 outbreak CI+PL.jar” has been recently detected. Drawing inferences from its name, researchers suspected it to be associated with COVID-19 themed phishing attacks.

Running this file led to the download of an undetected malware sample that is written in Node.js; Node.js is an open-source, cross-platform, Javascript runtime environment that executes Javascript code outside of a browser and as it is primarily designed for web server development, there's a very less probability of it being already installed onto systems.

The trojan that is suspected of employing the unconventional platform for bypassing detection has been labeled as 'QNodeService'. The malware has been designed to perform a number of malicious functions including uploading, downloading, and executing files.

It is also configured to steal credentials stored in web browsers and perform file management etc. Currently, the malware appears to be targeting Windows systems only, however, the code signifies a potential for 'cross-platform compatibility', researchers concluded a possibility of the same being a 'future goal' for cybercriminals.

Cybercriminals are devising new methods all the time to design malware such as trojans to infect as many machines as possible without getting noticed.

To stay on a safer side, users are recommended to block malware from acquiring access via all the possible doorways like endpoints, networks, and emails.

Users May Risk Losing their Passwords on Dark Web For Sale


In April, Zoom became one of the many victims of the companies that lost their user data to the hackers. Zoom, which is one of the top online video conference platforms, lost more than half a million of account logins on the dark web. The leaked passwords could be bought either for free or for a minimal amount of money. Understandably, the users are blaming the Zoom company for losing its accounts, and they have every right to do so. It is, however, a part of much bigger trouble that includes hackers, some criminal niches on the Internet, and the fault of our own to set very weak user passwords.


How passwords end up on the dark web? 

Every year, more than hundreds of millions of user accounts end up getting exposed to the dark web, either through malware or phishing attacks. According to a report by Privacy Rights Clearinghouse, a non for profit organization in California, around 11.6 Billion user accounts have been hacked since the year 2005. The hacked accounts are then either uploaded on hacker websites or posted on the dark web for sale.

These websites and dark web can be accessed only through a specific browser called Tor. "Then there's Tor, the darkest corner of the Internet. It's a collection of secret websites (ending in .onion) that require special software to access them. People use Tor so that their Web activity can't be traced -- it runs on a relay system that bounces signals among different Tor-enabled computers around the world," says Jose Pagliery from CNN Business.] The hackers use these purchased passwords and try logging in with them to several other websites until they are successful, a technique known as credential stuffing.

The hackers used credential stuffing to steal more than 500,000 Zoom user accounts and uploaded them later on the dark web. In response to this, Zoom spokesperson has confirmed that they suspect the hackers used credential stuffing to breach the accounts. "You can help prevent some of these attacks by banning the use of bad passwords, blocking legacy authentication, and training employees on phishing," says Microsoft's security website on "how to prevent your company from web attacks."

Hackers use the Fake Image Hosting Website as a Decoy to Launch E-Skimming Attacks


In what is said to be one of the most creative hacking technique to date, a group of hackers made a fake image hosting website to use it as a disguise for their web skimming operations. The aim is to deploy harmful codes that will steal payment card credentials from users via infected websites. The cybersecurity experts refer to this technique as e-skimming, web skimming, or Magecart attack. In this operation, the hackers attack a website, insert malicious codes in the webpages.


The malicious codes are responsible for stealing payment credentials when the users enter the details during the checkout form. The skimming attacks have been on the rise for the last four years. The cybersecurity experts have advanced in identifying the web skimming attacks, but so have been the hackers, as they are coming up with more sophisticated techniques.

Hackers used a fake image hosting website

According to a report published by Malwarebytes, a US-based cybersecurity firm, the experts have discovered a new group of hackers that have taken this technique to a whole different level. The group, according to Malwarebytes, was found while the experts were investigating a range of unfamiliar cyberattacks. In the investigation, the hackers noticed that only the Favicon was modified on the website, which is the logo icon displayed on browser tabs. "This latest case started with an image file displayed on the browser's tab often used for branding or identifying a website, also known as a favicon. While reviewing our crawler logs, we noticed requests to a domain called myicons[.]net hosting various icons and, in particular, favicons. Several e-commerce sites were loading a Magento favicon from this domain," says the report of Malwarebytes.

The hackers responsible behind this attack surely went some extra miles, as the codes were sophistically hidden. But, web skimming attacks, sooner or later, are bound to be found. "Given the decoy icons domain registration date, this particular scheme is about a week old but is part of a more significant number of ongoing skimming attacks. The goal remains to deceive online shoppers while staying under the radar from website administrators and security scanners," says Malwarebytes.

Hackers Exploit Ad Networks to Launch Phishing Attacks against Android Users


The hackers are exploiting mobile ad networks that take the android users to malicious websites. After this, hackers can either steal personal user information or attack the victim's Android device with spams. The Google play store has more than 400 apps that come with ads as a means to generate money for app developers. But recently, the hackers are exploiting these ad networks with the help of an SDK (Software Development Kit). The SDKs help app developers earn money, and the hackers are inserting code to attack the ad network.


According to the research done by Wandera, which is a mobile security firm, the hackers send domain and URLs to the users via the ads. The distribution systems are called Startapp, that allows the hackers to swamp the android device with spams and malicious websites. Startapp isn't responsible for any of the malicious content distributed. However, it is funded by a few agencies that distribute its malicious content. Startapp hasn't responded to the questions of its involvement in this cyberattack. "Our researchers wanted to explore a service that wasn't associated with a single well-known advertiser, such as Google or Facebook, so they took a closer look at the framework from StartApp, which would presumably provide app developers with ads from a wider variety of advertising networks," says Wandera' research report.

It also says that more than 90% of the distributed through the Startapp framework originate from a single ad provider.  Wandera, however, didn't identify the provider's name, but Cyberscoop has identified it as "AdSalsa." AdSalsa is a digital marketing firm that operates from Spain and is responsible for ads that direct users to these malicious websites.

"We help app publishers and developers turn their apps into successful businesses by using advanced data insights to identify relevant campaigns across direct and programmatic channels for each publisher's unique users. Over 400,000 apps have already integrated our lightweight, easy to incorporate advertising SDK. When combined with our mediation options, you can begin earning revenue from your apps in minutes," says StartApp on its website.  Experts at Wandera found 700 apps on Google play store using StartApp's SDK feature. Google, however, has removed 47% of these SDKs, according to Wandera. The exploitation of this advertising, which has now become malvertising, is creating problems for the app developers to secure their apps.

Miscreants Scamming Users into Buying Antivirus Software


Some independent security software affiliates are scamming people by sending emails with the false message that their antivirus is expiring and renew their license, whereby if the user does so, they can earn a commission. A software affiliate program is a marketing technique in which the affiliate recommends the software to customers or visitors and earns a commission on each purchase. Now, these programs have strict rules and guidelines to protect their software and customers from false advertising and being tricked into buying.


BleepingComputer discovered this scam last week when two of their seniors reported it. The mails tell the users that their Norton and McAfee antivirus software is expiring, the very day and to renew their license. The scam starts with emails containing a subject similar to "WARNING: Anti-Virus Can Expire " Sun, 26 Apr 2020", which includes a link stating, "Your Protection Can Expire TODAY!", writes BleepingComputer in their blog. If the link in the mail is clicked, it takes the user DigitalRiver affiliate network, and after dropping a tracking cookie, redirects the user to the purchase page of Norton or McAfee antivirus. If it goes smoothly and the user purchased the software, the affiliate party would get a $10 commission or 20% of the total sale. For this particular scam, they earned around $10 per transaction.

How to protect yourself from these scams 

Most antivirus usually notifies their customers of the expiry date via a notification from the software. If that's the case, you can rest assure that it is legitimate and go ahead with the renewal. But unfortunately, some companies email their users to remind the customer about the expiring article. A simple way to check their authenticity is to look for the name of your antivirus.

Since these rogue fake mails are sent in bulk they probably don't know which software you're using. The next step is to open your antivirus software and check when the software is expiring. Even if it is expiring, it's better to renew it from their website then to rely on these links from the mail.

Banking Sector suffered more Credential Stuffing than DDoS Attacks


According to F5's cybersecurity agency's report published recently, the financial sector has been a victim of severe credential stuffing attacks than the DDoS attacks in the last three years. The statistics included attacks against the financial industry as a whole. It recorded attacks against the banks, credit unions, insurance companies, broker agencies, and other services like Saas (Software as a Service) and payment processors.


The report's conclusion rejects the common belief that the financial sectors suffer the most from DDoS attacks, as other prominent threat actors are emerging. Reports say that in recent times, brute force attacks, ATO (Account Takeover) attacks, credential stuffing attacks have done more considerable damage on the financial sectors than DDoS, from the year 2017-19.
The ATO attacks include:

  • Credential Stuffing- When the hackers try to attacks by using leaked usernames and passwords they find on websites. 
  • Brute Force Attacks- Hackers use very common or weak passwords from a list to carry out brute attacks. 
  • Password Spraying- Hackers use the same passwords but against many individuals. 
Similarities between Credential Stuffing and DDoS attacks 
According to F5's reports, the DDoS attacks surged in the year 2019, but these figures cant be entirely accurate. Some credential-stuffing and brute force attacks are so fast and destructive that they are sometimes mistaken for DDoS attacks. The reason for the rapid rise of credential stuffing and brute force attacks is because the availability of leaked usernames and passwords is getting shorter and shorter. Due to scarcity in leaked passwords, the hackers are trying to get as much as they can from the attacks, hence the increase. 

Banks in North America a bigger target
According to the experts, North American banks have witnessed the highest number of brute force and credential stuffing attacks because of the availability of leaked passwords and credentials of the North American users on the websites since the last decade. "The combination of a global rise in DoS attacks and an increasing focus in North America on credential-based attacks suggests some ambivalence among attackers regarding the best strategies for extracting value from financial services targets," concludes F5 in its report.

24 Million Adware Attacks found on Windows


Avast, a security firm, discovered in their research the growing scale of adware. According to the report, around 72% of malware on android was adware. Another report by Malwarebytes reveals some shocking numbers with 24 million windows adware detections and 30 million on Macs. Nowadays, with good search engines and added internet security, we hardly consider adware as a severe threat. There was a time, around 2002 when adware attacks were at an all-time high. It was quite common to be faced with pop-ups and adds opening another window showing adverts. Only a few software provided essential protection against these pop-ups.


But in this digital-savvy decade, we hardly consider pop-ups as a security threat, but this report by Avast tells a different story. The numbers show that adware is still very much present and thriving. "Adware is unwanted software designed to throw advertisements up on your screen, most often within a web browser." This adware campaign can have malicious intents, especially using COVID-19, to fulfill their purposes.

Kaspersky released a report in which more than 120,000 malware and adware were impersonating meeting software like Zoom. Most evident were: DealPly and DownloadSponsor. This adware has evolved from their previous counterparts to a high capacity. Now they display that install and download other adware software. In some cases, the adware DealPly and ManageX can be installed automatically with the legitimate installer and other potentially unwanted applications (PUAs). Battling with adware is a hard war because of their large numbers. There are hundreds of apps developed every day and registered; many come laden with adware. To check every single one of them is more robust than finding a needle in a haystack.

In March, Google banned 56 malicious applications, but by then, they already had around a million downloads. It is effortless for these apps to pose as legitimate and carry adware along with them. Adware is often ignored in the shadows of more severe security threats, and even though it is less harmful, it nonetheless is far more ubiquitous. Hence, security teams must be cautious of adware and take preventive steps.