SquareX Discloses Browser-Native Ransomware that Puts Millions at Risk https://hackread.com/squarex-discloses-browser-native-ransomware-that-puts-millions-at-risk/ #BreachandAttack #PressRelease #Monitoring #Research #Malware #breach #Report #CISO #hack
No surprise here ...
#Malware is harder to find when written in obscure language https://www.theregister.com/2025/03/29/malware_obscure_languages/
P.S. I was under the impression that everything ultimately boils down to assembly, but OK... 
Experts warn of the new sophisticate #Crocodilus #mobile #banking #Trojan
https://securityaffairs.com/175976/malware/new-sophisticate-crocodilus-mobile-banking-trojan.html
#securityaffairs #hacking #malware
Malicious actors have taken notice of news about the US Social Security System. We've seen multiple spam campaigns that attempt to phish users or lure them to download malware.
Emails with subjects like "Social Security Administrator.", "Social Security Statement", and "ensure the accuracy of your earnings record" contain malicious links and attachments.
One example contained a disguised URL that redirected to user2ilogon[.]es in order to download the trojan file named SsaViewer1.7.exe.
Actors using social security lures are connected to malicious campaigns targeting major brands through their DNS records.
Block these:
user2ilogon[.]es
viewer-ssa-gov[.]es
wellsffrago[.]com
nf-prime[.]com
deilvery-us[.]com
wllesfrarqo-home[.]com
nahud[.]com.
#dns #lookalikes #lookalikeDomain #threatintel #cybercrime #threatintelligence #cybersecurity #infoblox #infobloxthreatintel #infosec #pdns #malware #scam #ssa
Whoa, things are heating up again in the Android world... Watch out for "Crocodilus," a nasty new banking trojan that's currently zeroing in on folks in Spain and Turkey. 
Now, it might sound like your standard-issue malware at first, but this one's got some particularly devious tricks. It's not *just* snagging login details – it's also after the seed phrases for crypto wallets. 
Here’s the kicker: it disguises itself as Google Chrome and tries to trick you into granting Accessibility Services permissions. If you give it that access, you've basically handed over the keys to your device. Seriously, it can then read everything on your screen, see every tap you make... and you wouldn't even know, because it can black out the screen while it does its dirty work. 
Total stealth mode.
As someone in penetration testing, I unfortunately run into this kind of threat all too often. Clients sometimes say, "But I have antivirus software!" The hard truth? Against sophisticated attacks like this, basic AV often won't cut it.
So, the usual advice is more critical than ever: Be super careful about the apps you install and *always* double-check the permissions they ask for! And please, use Multi-Factor Authentication (MFA) wherever you can! 
I'm curious – what security measures do you have running on your smartphone? Drop your tips below!
Our latest newsletter is out, get it while it's hot!
https://opalsec.io/daily-news-update-friday-march-28-2025-australia-melbourne-2/
Key stories:
Oracle's under fire: A breach at Oracle Health compromised patient data, with Oracle allegedly shifting responsibility to hospitals and avoiding documentation. This follows hot on the heels of denial regarding an alleged Oracle Cloud breach, raising serious questions about their security culture.
Clop's back in the headlines: Sam's Club - a Walmart subsidiary - is investigating claims of a Clop ransomware attack, potentially linked to the Cleo file transfer vulnerability that has already hit other organizations hard.
Don't miss this bizarre twist: Cable operator WideOpenWest (WOW!) is dealing with a breach claimed by Arkana Group, who are publicizing the stolen data (usernames, passwords, etc.) with a… Russian music video. The alleged attack vector? Infostealer malware.
Get up to speed with these stories and more: https://opalsec.io/daily-news-update-friday-march-28-2025-australia-melbourne-2/
If you'd like to get the latest Cyber Security news wrapped up and delivered to your inbox every day, subscribe to our newsletter here!
https://opalsec.io/daily-news-update-friday-march-28-2025-australia-melbourne-2/#/portal/signup
Our latest newsletter is out, get it while it's hot!
https://opalsec.io/daily-news-update-friday-march-28-2025-australia-melbourne-2/
Key stories:
Oracle's under fire: A breach at Oracle Health compromised patient data, with Oracle allegedly shifting responsibility to hospitals and avoiding documentation. This follows hot on the heels of denial regarding an alleged Oracle Cloud breach, raising serious questions about their security culture.
Clop's back in the headlines: Sam's Club - a Walmart subsidiary - is investigating claims of a Clop ransomware attack, potentially linked to the Cleo file transfer vulnerability that has already hit other organizations hard.
Don't miss this bizarre twist: Cable operator WideOpenWest (WOW!) is dealing with a breach claimed by Arkana Group, who are publicizing the stolen data (usernames, passwords, etc.) with a… Russian music video. The alleged attack vector? Infostealer malware.
Get up to speed with these stories and more: https://opalsec.io/daily-news-update-friday-march-28-2025-australia-melbourne-2/
If you'd like to get the latest Cyber Security news wrapped up and delivered to your inbox every day, subscribe to our newsletter here!
https://opalsec.io/daily-news-update-friday-march-28-2025-australia-melbourne-2/#/portal/signup
HowTF do I stop the damned Microsoft SharePoint.app from repeatedly adding itself to my Mac's Login Items??
How is this acceptable??
version preliminar
#Seguridad en #internet /en linea — Un tornquistense
https://write.as/un-tornquistense/seguridad-en-internet-en-linea
> Hecho por Un Tornquistense ¿Que es? Son las precauciones o medidas que tomamos para protegernos a nosotros y nuestra información personal. Lo podríamos comparar c...
Si les gusto retooteenlo por favor
it should be obvious by now that anything created by the #techbros behind this coup needs to be considered #malware
https://www.wired.com/story/doge-rebuild-social-security-administration-cobol-benefits/
and that includes the 2-3 years of #Palantir having free reign hacking everything related to not just #immigration but #passports
DOGE IS MORE THAN #MALWARE IT’S #RANSOMWARE
so who is putting up contingencies to use all the #OpenGOV tools we have had developed the last 20 years, to audit the White House’s acts of digital terrorism?
(cyfirma.com) Konni RAT Analysis: Multi-Stage Attack Process and Evasion Techniques https://www.cyfirma.com/research/analysis-of-konni-rat-stealth-persistence-and-anti-analysis-techniques/
Executive Summary:
This report provides a comprehensive analysis of Konni RAT, a sophisticated remote access Trojan linked to North Korean cyber espionage group APT37. The malware employs a multi-stage attack process involving batch files, PowerShell scripts, and VBScript to exfiltrate sensitive data and maintain persistence. The attack begins with a zip archive containing a malicious LNK file disguised as a document. The malware exploits Windows Explorer limitations to hide malicious commands and uses obfuscation techniques to evade detection. Key capabilities include data exfiltration from user directories, system information gathering, persistence through registry modifications, and communication with command-and-control servers. The report includes detailed technical analysis of the attack stages, from initial infection to data exfiltration, along with indicators of compromise and YARA detection rules.
Russian authorities arrest three suspects behind #Mamont #Android #banking trojan
https://securityaffairs.com/175935/cyber-crime/russian-authorities-arrest-three-suspects-behind-mamont-android-banking-trojan.html
#securityaffairs #hacking #malware
CoffeeLoader il malware che evade le difese sfruttando la GPU
https://gomoot.com/coffeeloader-il-malware-che-evade-le-difese-sfruttando-la-gpu/
In today's post, Interisle peeks at the cybercrime activity (for phishing, malware, and spam) for the month of February 2025. We’ll point out anything that strikes us as particularly interesting in overall numbers as well as significant changes in ranking for TLDs, Registrars, and Hosting Networks.
https://interisle.substack.com/p/cybercrime-reported-in-february-2025
VanHelsing ransomware: what you need to know - First reported earlier in March 2025, VanHelsing is a new ransomware-as-a-service operati... https://www.tripwire.com/state-of-security/vanhelsing-ransomware-what-you-need-know #ransomware #guestblog #malware
https://www.patreon.com/posts/write-settings-125363953
Your applications should be writing logs and preferences into a user-specific folder to which the user already has write access. Otherwise you force computer admins to break the model of secure access to application folders, and open up the computer to malware.
Last week, while reviewing detected lookalike domains, one in particular stood out: cdsi--simi[.]com. A quick search pointed him to a legitimate U.S. military contractor, CDSI, which specializes in electronic warfare and telemetry systems. It's legitimate domain cdsi-simi[.]com features a single hyphen, whereas the lookalike domain uses two hyphens.
Passive DNS revealed a goldmine: a cloud system in Las Vegas hosting Russian domains and other impersonations of major companies.
Here are a few samples of the domains:
- reag-br[.]com Lookalike for Reag Capital Holdings, Brazil.
- creo--ia[.]com Lookalike for an industrial fabrication firm in WA State.
- admiralsmetal[.]com Lookalike for US based metals provider.
- ustructuressinc[.]com Lookalike Colorado based Heavy Civil Contractor.
- elisontechnologies[.]com Typosquat for Ellison Technologies machine fabrication.
#dns #lookalikes #lookalikeDomain #threatintel #cybercrime #threatintelligence #cybersecurity #infoblox #infobloxthreatintel #infosec #pdns #phishing #malware #scam #dod
G◍M◍◍T 
