Authorities in the United States have charged two Russian nationals with carrying out widespread cyberattacks using Phobos ransomware. The suspects, Roman Berezhnoy (33) and Egor Nikolaevich Glebov (39), were arrested in Thailand for allegedly orchestrating more than a thousand attacks worldwide.  

Cybercriminals Behind the Phobos Ransomware Attacks 

According to the U.S. Department of Justice (DoJ), both men were actively involved in cybercrime from 2019 to 2024. They were linked to two hacking groups known as "8Base" and "Affiliate 2803," which were responsible for spreading Phobos ransomware.  

Their method of attack involved infiltrating computer networks, stealing important files, and encrypting them using ransomware. Victims were then left with no access to their own data unless they paid a ransom. If payments were not made, the attackers allegedly threatened to leak sensitive information to the public or to the organizations’ clients and partners.  

Legal Charges and Possible Consequences

The two men now face multiple serious charges, including:  

1. Fraud involving online transactions  

2. Hacking into protected systems  

3. Intentional damage to computer networks  

4. Extortion through cyber threats  

If found guilty, the penalties could be severe. Wire fraud charges alone could lead to a 20-year prison sentence, while hacking-related crimes carry additional penalties of up to 10 years.  

International Crackdown on Ransomware Operations

In a coordinated effort, Europol and other international agencies have shut down 27 servers used by the 8Base ransomware group. This action has significantly disrupted the cybercriminal network.  

Authorities also revealed that a previous arrest in Italy in 2023 helped law enforcement gather intelligence on Phobos ransomware operations. This intelligence allowed them to prevent over 400 potential cyberattacks and take down key infrastructure used by the hackers.  

What This Means for Cybersecurity

Phobos ransomware has been a major cyber threat since 2018, targeting businesses and organizations worldwide. While these arrests and crackdowns have weakened the group, it is uncertain whether this will fully eliminate their operations.  

This case highlights the growing efforts by global law enforcement agencies to combat cybercrime. Businesses and individuals are urged to remain cautious, implement strong security measures, and stay informed about evolving cyber threats.  

A 62-year-old retired bank manager from Pune became the victim of a massive cyber fraud, losing ₹2.22 crore over several months. Scammers posing as government officials tricked the individual into purchasing multiple insurance policies by promising high returns.  

How the Fraud Took Place

The scam began in late 2023 and continued for several months. The victim received calls from individuals claiming to be officials from reputed financial and government institutions, including the Ministry of Finance, the Insurance Regulatory and Development Authority of India (IRDAI), and the National Payments Corporation of India (NPCI).  

To appear trustworthy, the fraudsters used the names of well-known personalities and fake designations. They convinced the victim that these insurance policies would offer significant maturity benefits, leading them to invest large sums of money.  

Endless Requests for Additional Payments  

After the initial investment, the scammers demanded additional payments under various pretexts, including:  

• Taxes such as GST and TDS  
• Processing and transaction fees
• Verification and No Objection Certificate (NOC) charges

Every time the victim transferred money, the fraudsters came up with new reasons to demand more, making it seem necessary to complete the investment process.  

Deception Tactics

To maintain the illusion, the criminals operated under at least 19 different identities. Later, they told the victim that previous payments had been diverted to fraudulent accounts and persuaded them to send even more money to recover the lost funds.  

By the time the fraud was uncovered, the victim had lost ₹2.22 crore in total.  

How to Avoid Falling for Similar Scams

Cases like this highlight the need for extra caution when dealing with financial offers. Here are some ways to stay safe:  

1. Verify the caller’s identity: If someone claims to be a government or financial official, check their details on official websites before engaging.  

2. Never share sensitive financial details: Avoid disclosing your bank account number, OTPs, or policy details over the phone or via messages.  

3. Be cautious of guaranteed high returns: Legitimate investments do not promise unrealistic profits. If an offer sounds too good to be true, it probably is.  

4. Confirm payment requests with official sources: Before paying any additional fees, directly contact the relevant institution using official contact details.  

Investigation Underway

Authorities are currently investigating the case to trace the culprits. With the rise in financial scams, it is crucial to remain cautious and skeptical of unsolicited investment opportunities. Being informed and vigilant can prevent such devastating losses.

A new year marks the start of another tax season, bringing with it the usual challenges of navigating the complex US tax code and avoiding scams. One particularly concerning scam involves fraudsters filing a tax return in your name to claim a refund. Many victims only realize they've been targeted when they attempt to file their own return, uncovering a complicated issue that can take weeks or even months to resolve.

The risk of tax-related identity theft is elevated this year due to a series of high-profile data breaches in 2024. Personal information, including Social Security numbers, has become more accessible on the dark web, providing fraudsters with the tools they need to exploit unsuspecting taxpayers. As tax season progresses, this vulnerability becomes a significant concern for individuals and businesses alike.

How the IRS’s Identity Protection PIN Can Help

To combat this type of fraud, the IRS offers a proactive solution: the Identity Protection PIN (IP PIN). This six-digit PIN acts as a layer of authentication to ensure that only your legitimate tax return is accepted. If a return is filed without the correct IP PIN, it will be rejected, preventing unauthorized filings in your name.

Initially, the IP PIN program was limited to victims of identity theft or those flagged by the IRS as high-risk individuals. However, the program has now been expanded to all taxpayers who wish to voluntarily enroll. The process is straightforward and can be completed in three ways:

• Online: Use the government’s ID.me service to verify your identity. This option typically takes 15–20 minutes.
• By Mail: Submit a paper application to the IRS.
• In-Person: Schedule an appointment at an IRS office for identity verification.

Once enrolled, your IP PIN is valid for one year and cannot be reused. Each year, you can opt to receive a new PIN, providing an added layer of security. This feature prevents fraudsters from exploiting a stolen PIN even after its use in a prior tax season.

Best Practices for Taxpayers

For most taxpayers, opting for an annually renewed IP PIN is the ideal choice. This ensures you have updated protection each year without the need to manage multiple PINs simultaneously. If you ever misplace your PIN, you can retrieve it by logging into your IRS account using your ID.me credentials. To streamline this process, consider using a password manager to securely store your account credentials, including a strong, unique password for your government account.

By adopting these best practices, you can reduce the stress of tax season and protect yourself against fraud. For more information, visit the IRS’s FAQ page on the Identity Protection PIN program. This simple yet effective system offers much-needed peace of mind during the often overwhelming task of filing your US tax return.

Smartphone users are being urged to exercise caution when downloading apps as some may be designed to steal personal data and send it to fraudsters, leading to potential scams. This alert applies to both Android and iPhone users. Malicious apps often disguise themselves as legitimate but, once installed, request permissions that grant access to sensitive information, making users vulnerable to cybercrimes.

On January 18, the FBI issued a public warning, highlighting that these apps have already compromised numerous bank accounts. Despite ongoing efforts by Google and Apple to strengthen app regulations, scammers continue to exploit vulnerabilities. The FBI has labeled this threat as the "Phantom Hacker," underscoring the sophisticated techniques fraudsters use to infiltrate devices through deceptive applications.

Once malicious apps gain access to customer data, scammers often pose as bank officials, warning users of a fake security breach on their accounts. In the panic that follows, users may be coerced into transferring funds to a so-called "secure" account, falling prey to the scam. Additionally, fraudsters sometimes impersonate technical support representatives, tricking users into revealing even more personal information.

To protect yourself, always verify the authenticity of an app before downloading it. Research the developer thoroughly, read customer reviews, and scrutinize app ratings. For banking and financial apps, ensure you download only from official sources, such as scanning the QR code provided on your financial institution's website. Scammers frequently submit counterfeit apps to the Google Play Store and Apple App Store, which unsuspecting users might download, unknowingly exposing private data to hackers.

Cybersecurity experts emphasize the importance of vigilance when interacting with unfamiliar apps or unsolicited communications. Being aware of potential risks and taking proactive steps can help smartphone users avoid falling victim to these increasingly sophisticated scams.

As the government intensifies efforts to raise awareness about digital arrests and online financial fraud, fraudsters have shifted their strategies to stay ahead. A concerning trend has emerged where these individuals pose as representatives of the Telecom Regulatory Authority of India (TRAI). Exploiting the credibility associated with the regulatory body, they attempt to deceive unsuspecting users.

These fraudsters often initiate contact by mimicking official government alert messages that warn the public about scams. The tone and language of their communication are crafted to appear authoritative and urgent, persuading recipients to trust the information. In many cases, the messages aim to extract sensitive data, such as personal identification numbers, bank account details, or login credentials, under the guise of preventing fraud.

Such scams highlight the need for individuals to remain vigilant and verify the authenticity of any unsolicited messages or calls claiming to be from regulatory authorities. It is essential to cross-check the source of the communication, avoid sharing sensitive information over the phone or through unverified links, and report suspicious activities to the appropriate authorities.

By staying informed and adopting proactive measures, users can protect themselves from becoming victims of these evolving schemes, contributing to a safer digital environment for all.

Bengaluru emerges as the leading tech-enabled city for scams: Cyber fraud has been on an upward spiral during the period 2021 through September 2024, reports the police while citing the cumulative loss to this city as an amount of Rs 2,270 crore during the period and six major types of scams where the loss involved nearly Rs 1,788 crore.

Important Fraud Categories

The figures point to considerable losses in the following fraud types: 

Investment Frauds: Unrealistic returns promised by fraudsters led to a loss of ₹1,187.2 crore. 

Job Frauds: Losses due to fake job offers stood at ₹601.23 crore. 

Courier Scams: Well developed courier-related schemes accounted for ₹165.57 crore. 

Card Scams: Stolen card details used for fraudulent transactions resulted in losses of ₹116 crore.

Phishing Attacks: Emails and messages designed to steal personal data caused ₹96.98 crore in damages.  

Loan App Frauds: Fraudulent lending platforms resulted in ₹32.25 crore in losses.  

Challenges in Recovery

Recovery of stolen funds is still a challenge for the investigators. Police have identified two major hurdles:

Delayed Reporting: Victims mostly delay reporting frauds, and thus miss the most crucial "golden hour," when funds can be frozen.  

Lag in Banks' Response: Banks used to take up to eight days to provide account details, which adversely affected recovery operations. This is now reduced to 4-5 days, post meetings with RBI, but there is more to be achieved.

AI in Cybercrime

AI has been a gambler for scamsters in Bengaluru. Advanced technologies are being made use of to devise highly believable frauds: 

• Voice Cloning: AI produced voice replicas make the victim believe he is communicating with his trusted contact.  
• Improved Courier Scams: AI assists scammers to fabricate more convincing courier fraud scenarios.  
• Fake Investment Platforms: AI interfaces mimic authentic apps, to look incredibly real.  

Proposed Solutions

To counter these emergent threats, the authorities have stressed the requirement of public education and systemic reformation. The CEN wing has suggested that: 

1. There should be a campaign for citizen education about prevailing scams. 

2. There should be better coordination among banks, the police, and regulatory bodies so that the responses are faster. 

3. A specific cybercrime wing with special resources should be developed, as already announced by the government.

Although measures to improve response times and raise awareness have shown promise, experts stress that more robust systems are needed to tackle the growing paradigm of cybercriminals. With AI reshaping the way scams operate, staying informed and cautious is now more crucial than ever.

Cybersecurity experts are raising alarms about a new twist on the classic clickjacking attack technique. Paulos Yibelo, a security engineer at Amazon, has uncovered a variant called “double-clickjacking,” capable of disabling security settings, deleting accounts, or even taking over existing ones. This novel approach reignites concerns over online safety, urging users to be cautious when interacting with websites.

Clickjacking is a malicious tactic where hackers manipulate user clicks on one website to trigger unintended actions on another. For instance, a user might think they are clicking a button to navigate a site but inadvertently perform an action, such as making a purchase, on an entirely different platform.

Double-clickjacking takes this concept further by introducing an additional click. This adaptation helps attackers bypass modern browser protections that no longer deliver cross-site cookies. According to Yibelo, this seemingly minor tweak “opens the door to new UI manipulation attacks that bypass all known clickjacking protections.”

In documented cases, hackers lure victims to phishing websites, often disguised with a standard CAPTCHA verification process. Instead of typing text or identifying objects in images, users are prompted to double-click a button to prove they are human.

Here’s where the attack takes place:

• First Click: The user closes the top window, seemingly completing the CAPTCHA process.
• Second Click: This click is redirected to a sensitive page, such as an OAuth authorization or account settings page. The victim unknowingly confirms permissions, disables security features, or performs other critical actions.

Yibelo explains that this subtle manipulation is effective against many popular websites, allowing attackers to gain OAuth and API authorizations. The attack can also facilitate one-click account modifications, including disabling security settings, deleting accounts, authorizing money transfers, and verifying sensitive transactions. Even browser extensions are not immune to this method.

The Implications for Online Security

The resurgence of clickjacking attacks, now enhanced by the double-click variant, poses significant risks to both individual and organizational security. By exploiting common website interfaces and leveraging seemingly harmless CAPTCHA verifications, attackers can easily gain unauthorized access to sensitive information and functionalities.

Yibelo’s findings serve as a stark reminder of the evolving nature of cybersecurity threats. Websites must remain vigilant, regularly updating their defenses to counter these new manipulation techniques.

How to Stay Safe

Cybersecurity professionals recommend the following precautions to minimize the risk of falling victim to double-clickjacking:

• Verify Websites: Always ensure you are on a legitimate website before interacting with any CAPTCHA or button.
• Update Software: Keep browsers and extensions up-to-date with the latest security patches to reduce vulnerabilities.
• Use Anti-Phishing Tools: Enable browser settings or software designed to detect and block phishing sites.
• Be Skeptical: Avoid double-clicking buttons on unfamiliar sites, especially if prompted during unexpected verifications.

As cyber threats continue to evolve, user awareness remains a critical line of defense. The discovery of double-clickjacking highlights the importance of staying informed and cautious while navigating the digital world. By adopting secure browsing habits and staying vigilant, individuals and organizations can protect themselves against this emerging attack vector.

There is a new online scam, where cyber criminals trick people into downloading harmful software under the pretext of beta testing a game. This campaign targets people on platforms such as Discord, email, and even text messages, aiming at stealing personal information and compromising accounts online. 

How does this work?

The scam starts by sending a harmless message. In this case, a user on Discord or elsewhere receives a direct message from a purported game developer claiming to have sent them a new game to play. The user is asked whether they would want to try the supposed game. In most cases, these messages come from compromised accounts, so the request seems all the more real.

If the victim consents, the attacker shares a download link and password to the target so that they can actually access and start downloading the game file. These links are usually Dropbox or even Discord's network because most malware authors upload their creations to an existing, popular platform. But what users download aren't games-these are referred to as information stealers.

What Do These Malware Applications Do?

Once installed, these programs, such as Nova Stealer, Ageo Stealer, or Hexon Stealer, begin extracting sensitive data. This may include: 

1. Saved browser passwords

2. Session cookies for services like Discord or Steam

3. Wallet information for cryptocurrencies

4. Credit card information

6. Two-factor authentication (2FA) backup codes

The Nova Stealer and Ageo Stealer are the new wave called Malware-as-a-Service (MaaS). This enables cybercriminals to rent these tools to conduct attacks. Nova Stealer even leverages a feature called a Discord webhook, allowing it to send information directly to hackers so they could know right away how much data had been stolen and not have to manually check.

Another tool that is used in these scams is the Hexon Stealer. It is a highly dangerous tool since it can gather a wide variety of personal information. Using such information, it hacks into Discord accounts and enables the attackers to send similar fake messages to the contacts of the victim, thereby further spreading the malware. 

Why Do Hackers Target Discord?

The main focus of these attacks is the Discord credentials. When hackers get access to a person's account, they can pretend to be that person, deceive their friends, and expand their network of victims. This cycle of exploitation of trust makes the scam so effective. 

How to Identify Fake Game Websites

Fake download pages are usually built using common web templates. Such sites appear legitimate but host malware. Among them are the following:  

• dualcorps[.]fr
• leyamor[.]com 
• crystalsiege[.]com 
• mazenugame[.]blogspot.com

These sites are hosted on platforms that are resistant to takedown requests, making it difficult for researchers to shut them down. If one site is removed, attackers can quickly set up a new one. 

How Can You Protect Yourself? 

To keep yourself safe, follow these simple guidelines:

1. Be cautious with unsolicited messages: If someone you don’t know—or even a known contact—sends a download link, verify its authenticity through another platform.  

2. Avoid downloading unknown files: Don’t download or install anything unless you’re certain it’s legitimate.  

3. Use updated security software: An active anti-malware program can block known threats.

4. Be watchful of phony websites: Be on the lookout for amateurism or copy-and-paste designs when viewing suspicious sites.

In the end, this scamming attack is meant to reap a financial reward; it may come in the form of stolen cryptocurrency, credit card information, or other sensitive details. Knowing how this attack works can help you safeguard your data from cybercrime attacks.

Stay informed and be careful—your online safety depends on it.