Search This Blog
Powered by Blogger.

Blog Archive

Labels

About Me

Load More
Trendy Right Now

Popular Posts

Showing posts with label Cyber Security. Show all posts
Sandworm cyberattacks
Advanced persistent threat (APT) Cyber Security Cybersecurity Threats Russian cyber espionage Sandworm cyberattacks

Sandworm’s Evolving Cyber Threat: BadPilot Expands Global Reach

 

Sandworm, also known as Russia's Military Unit 74455 within the GRU, has established itself as one of the most notorious advanced persistent threats (APT). Its cyber operations have included NotPetya, the attack on the 2018 Winter Olympics, and two successful assaults on Ukraine’s power grid. More recent campaigns have targeted Denmark’s energy sector and attempted—both unsuccessfully and successfully—to disrupt Ukraine’s grid once again.

Recent developments indicate a shift in Sandworm’s tactics, moving toward quieter, more extensive intrusions. Microsoft, tracking the group under the name "Seashell Blizzard," has identified a specific subgroup within Unit 74455 that focuses exclusively on breaching high-value organizations. Dubbed "BadPilot," this subgroup has been executing opportunistic cyberattacks on Internet-facing infrastructure since at least late 2021, leveraging known vulnerabilities in widely used email and collaboration platforms.

Among the critical vulnerabilities exploited by BadPilot are Zimbra's CVE-2022-41352, Microsoft Exchange's CVE-2021-34473, and Microsoft Outlook's CVE-2023-23397. All three have received a severity score of 9.8 out of 10 under the Common Vulnerability Scoring System (CVSS), indicating their high impact.

BadPilot’s primary targets include telecommunications, oil and gas, shipping, arms manufacturing, and foreign government entities, spanning Ukraine, Europe, Central and South Asia, and the Middle East. Since early 2024, operations have expanded to the United States and the United Kingdom, with a particular focus on vulnerabilities in remote monitoring and management (RMM) software. Exploited vulnerabilities include CVE-2023-48788 in Fortinet Forticlient Enterprise Management Server (EMS) and CVE-2024-1709, a critical authentication bypass flaw in ScreenConnect by ConnectWise, rated a perfect 10 on the CVSS scale.

Upon breaching a system, BadPilot follows a systematic approach to maintain persistence and escalate its control. It deploys the custom "LocalOlive" Web shell and uses legitimate RMM tools under the name "ShadowLink" to configure compromised systems as Tor hidden services. The group collects credentials, moves laterally across networks, exfiltrates data, and engages in post-compromise activities.

“There is not a lack of sophistication here, but a focus on agility and obtaining goals,” says Sherrod DeGrippo, director of threat intelligence strategy at Microsoft. “These TTPs work because this threat actor is persistent and continues pursuing its objectives.”

BadPilot’s operations serve as a crucial enabler for Sandworm’s broader cyberattacks, aligning with Russia’s strategic objectives. Microsoft notes that "its compromises cumulatively offer Seashell Blizzard options when responding to Russia's evolving strategic objectives."

The subgroup emerged just months before Russia's invasion of Ukraine, actively contributing to cyberattacks aimed at organizations providing political or military support to Ukraine. Since 2023, BadPilot has facilitated at least three destructive attacks in the country.

Throughout the war, Sandworm has persistently targeted Ukraine’s critical infrastructure, including telecommunications, manufacturing, transportation, logistics, energy, water, and military organizations, as well as civilian support systems. Intelligence-gathering operations have also extended to military communities.

“These threat actors are persistent, creative, organized, and well-resourced,” DeGrippo emphasizes. To mitigate risks, "critical sectors need to ensure that they sustain above-average security practices, patch their software, monitor Internet-facing assets, and enhance their overall security posture."
Read more »
Hackers
CVE CVE exploits CVE vulnerability Cyber Security data security Data Theft Hacker attack Hackers

Hackers Exploit ThinkPHP and ownCloud Vulnerabilities from 2022 and 2023

 

Hackers are increasingly exploiting outdated security flaws in poorly maintained systems, with vulnerabilities from 2022 and 2023 seeing a surge in attacks. According to threat intelligence platform GreyNoise, malicious actors are actively targeting CVE-2022-47945 and CVE-2023-49103, affecting the ThinkPHP Framework and the open-source ownCloud file-sharing solution. 

Both vulnerabilities are critical, allowing attackers to execute arbitrary commands or steal sensitive data, such as admin credentials and license keys. CVE-2022-47945 is a local file inclusion (LFI) flaw in ThinkPHP versions before 6.0.14. If the language pack feature is enabled, unauthenticated attackers can remotely execute operating system commands. 

Akamai reported that Chinese threat groups have exploited this flaw since late 2023, and GreyNoise recently detected 572 unique IPs actively attacking vulnerable systems. Despite having a low Exploit Prediction Scoring System (EPSS) rating of just 7% and not being listed in CISA’s Known Exploited Vulnerabilities (KEV) catalog, CVE-2022-47945 remains under heavy assault. 

The second vulnerability, CVE-2023-49103, impacts ownCloud’s file-sharing software. It stems from a third-party library that leaks PHP environment details through a public URL. After its disclosure in November 2023, hackers began exploiting the flaw to steal sensitive data. A year later, it was named one of the FBI, CISA, and NSA’s top 15 most exploited vulnerabilities. 

Even though a patch was released over two years ago, many ownCloud systems remain unpatched and exposed. GreyNoise recently observed malicious activity from 484 unique IPs targeting this vulnerability. To defend against these active threats, users are strongly advised to upgrade to ThinkPHP 6.0.14 or later and ownCloud GraphAPI 0.3.1 or newer. 

Taking vulnerable systems offline or placing them behind a firewall can significantly reduce the attack surface and prevent exploitation. As hackers continue to leverage older, unpatched vulnerabilities, staying vigilant with timely updates and robust security practices remains crucial in protecting critical systems and sensitive data.
Read more »
DeepSeek
AI Models AI technology AI Threat China Cyber Security Data Mining Data Privacy data security DeepSeek

DeepSeek AI Raises Data Security Concerns Amid Ties to China

 

The launch of DeepSeek AI has created waves in the tech world, offering powerful artificial intelligence models at a fraction of the cost compared to established players like OpenAI and Google. 

However, its rapid rise in popularity has also sparked serious concerns about data security, with critics drawing comparisons to TikTok and its ties to China. Government officials and cybersecurity experts warn that the open-source AI assistant could pose a significant risk to American users. 

On Thursday, two U.S. lawmakers announced plans to introduce legislation banning DeepSeek from all government devices, citing fears that the Chinese Communist Party (CCP) could access sensitive data collected by the app. This move follows similar actions in Australia and several U.S. states, with New York recently enacting a statewide ban on government systems. 

The growing concern stems from China’s data laws, which require companies to share user information with the government upon request. Like TikTok, DeepSeek’s data could be mined for intelligence purposes or even used to push disinformation campaigns. Although the AI app is the current focus of security conversations, experts say that the risks extend beyond any single model, and users should exercise caution with all AI systems. 

Unlike social media platforms that users can consciously avoid, AI models like DeepSeek are more difficult to track. Dimitri Sirota, CEO of BigID, a cybersecurity company specializing in AI security compliance, points out that many companies already use multiple AI models, often switching between them without users’ knowledge. This fluidity makes it challenging to control where sensitive data might end up. 

Kelcey Morgan, senior manager of product management at Rapid7, emphasizes that businesses and individuals should take a broad approach to AI security. Instead of focusing solely on DeepSeek, companies should develop comprehensive practices to protect their data, regardless of the latest AI trend. The potential for China to use DeepSeek’s data for intelligence is not far-fetched, according to cybersecurity experts. 

With significant computing power and data processing capabilities, the CCP could combine information from multiple sources to create detailed profiles of American users. Though this might not seem urgent now, experts warn that today’s young, casual users could grow into influential figures worth targeting in the future. 

To stay safe, experts advise treating AI interactions with the same caution as any online activity. Users should avoid sharing sensitive information, be skeptical of unusual questions, and thoroughly review an app’s terms and conditions. Ultimately, staying informed and vigilant about where and how data is shared will be critical as AI technologies continue to evolve and become more integrated into everyday life.
Read more »
USAID
Cyber Security Data Leak DOGE Elon Musk Threat Landscape USAID

Threat Analysts Warn of the 'Largest Data Breach' After Elon Musk's DOGE Controversy

 

The debate over Elon Musk's Department of Government Efficiency continues, with the world's richest man accused of snooping on some of America's most sensitive data. The DOGE has been tasked with reducing government spending by a paltry $2 trillion, which Musk himself admits might be unfeasible. 

However, the billionaire and his crew have lost no time to shed the fat, targeting everything from the National Space Council to USAID. Concerns have been raised regarding the DOGE's level of access, and some staff members have received death threats as a result of the debate.

"You can’t un-ring this bell,” the anonymous source told the local media outlet. Once these DOGE guys have access to these data systems, they can ostensibly do with it what they want." 

Four sources spoke to the local media outlet, but only Scott Cory would go on record. The former CIO for an HHS agency said: "The longer this goes on, the greater the risk of potential fatal compromise increases.” 

The National Oceanic and Atmospheric Administration, the Office of Personnel Management, the Department of Health and Human Services, and the U.S. Treasury have all apparently been accessed by the DOGE. "I don't think the public quite understands the level of danger," a federal agency administrator continued. 

With its newfound authority, the DOGE might prevent payments to government agencies and redirect funds to organisations it chooses. There are concerns that possible access to Federal Aviation could be "dire," even if Musk hasn't altered the current system yet. 

There have also been criticism that he has brought in a young team of technical wizards, but one payment-systems expert remarked that this is actually a good thing: "If you were going to organise a heist of the US Treasury, why in the world would you bring a handful of college students?" He went on to suggest that you'd need numerous people with at least ten years of experience with COBOL. 

Despite not being paid, working 120 hours a week, and sleeping in the offices, DOGE employees have been flexing their muscles to make some significant savings. Looking at the broad picture, one source concluded: "I'd want to believe that this is all so enormous and convoluted that they won't be successful in whatever they're attempting to do. But I wouldn't bet that outcome against their egos.”
Read more »
Website Security
Cyber Security CyberCrime Cybersecurity Data Breach eCommerce Google Tag Manager Hacking Magento malware Payment security Website Security

Cybercriminals Exploit Google Tag Manager to Steal Payment Data from Magento Sites

 

Cybercriminals have been leveraging Google Tag Manager (GTM) to inject malware into Magento-powered eCommerce websites, compromising customer payment data, according to cybersecurity experts.

Security researchers at Sucuri recently detected a live attack where a Magento-based online store suffered a credit card data breach. The investigation led to a malicious script embedded within Google Tag Manager, which, while appearing to be a standard tracking tool, was designed to steal sensitive payment information.

Google Tag Manager is a widely used tag management system that enables website owners to deploy tracking codes without modifying site code directly. However, attackers obfuscate the injected script, making detection difficult. The malware captures payment details at checkout and transmits them to a remote server. Researchers also discovered a backdoor, allowing persistent access to compromised sites.

At least six websites were found infected with the same GTM ID, and one domain used in the attack, eurowebmonitortool[dot]com, has now been blacklisted by major security firms. Cybersecurity experts emphasize that this attack method is not new. Sucuri researchers had previously identified similar threats, reaffirming that this technique is "still being widely used."

Given its popularity among eCommerce businesses, Magento remains a primary target for cybercriminals. Stolen payment data can be exploited for fraudulent purchases, malvertising campaigns, and other illicit activities.

Security Measures for Protection
To mitigate risks, website administrators should:
  • Remove any suspicious GTM tags
  • Conduct a full security scan
  • Ensure Magento and all extensions are updated
  • Regularly monitor site traffic and GTM configurations for anomalies
Proactive cybersecurity measures and ongoing vulnerability monitoring are crucial to safeguarding eCommerce platforms from such sophisticated attacks.
Read more »
Ransomwares
Cyber Security cyber threat Data Hackers Data Theft Huntress SMB Report Ransomware threats Ransomwares

Ransomware Tactics Evolve as Hackers Shift Focus to Data Theft

 

Ransomware groups are adapting their strategies to outsmart stronger cybersecurity defenses and increasing law enforcement pressure, according to the Huntress 2025 Cyber Threat Report. The findings reveal that attackers are moving beyond traditional encryption-based ransomware, instead focusing on data theft and extortion to bypass modern protections. 

In 2024, 75% of ransomware cases Huntress investigated involved remote access Trojans (RATs), allowing hackers to infiltrate systems discreetly. Additionally, 17.3% of incidents featured the misuse of legitimate remote management tools such as ConnectWise ScreenConnect, TeamViewer, and LogMeIn. This shift reflects a growing reliance on “living off the land” techniques, where attackers use trusted administrative tools to avoid detection. 

A significant trend noted in the report is that sophisticated tactics once reserved for targeting large enterprises are now common across businesses of all sizes. Huntress observed that cybercriminals are increasingly disabling or tampering with security software to maintain access and avoid detection, effectively closing the gap between attacks on major corporations and smaller organizations.  

Huntress’ analysis of over 3 million endpoints also revealed that nearly 24% of ransomware incidents in 2024 involved infostealer malware, while malicious scripts designed to automate attacks and evade security tools appeared in 22% of cases. Greg Linares, principal threat intelligence analyst at Huntress, states that ransomware groups must constantly evolve to survive in the competitive cybercrime landscape.

“If malware isn’t staying ahead of detection techniques, it becomes obsolete fast,” Linares explained. Another key insight from the report was the speed of modern ransomware campaigns. On average, the time from initial access to the delivery of a ransom demand — known as time-to-ransom (TTR) — was just 17 hours. Some groups, including Play, Akira, and Dharma/Crysis, were even faster, with TTRs averaging around six hours.  

Interestingly, Huntress noted a clear shift in ransomware tactics: rather than encrypting data, many attackers now opt to exfiltrate sensitive information and threaten to leak it unless a ransom is paid. This change is seen as a direct response to stronger ransomware defenses and increased law enforcement efforts, which led to the takedown of major groups like Lockbit. 

However, this shift presents new challenges for companies. While endpoint detection and ransomware protections have improved, the report points out that data loss prevention (DLP) measures remain underdeveloped. Linares noted that DLP solutions are often overlooked, especially in organizations with remote work and bring-your-own-device (BYOD) policies. These environments, he said, often lack the comprehensive monitoring and control needed to prevent data exfiltration. 

To stay ahead of these evolving threats, Huntress recommends that businesses not only strengthen their ransomware defenses but also implement more robust DLP strategies to protect sensitive data. As ransomware gangs continue to adapt, companies must be proactive in addressing both encryption and data theft risks.
Read more »
Threat Landscape
Cyber Security Home Security IoT Smart Device Threat Landscape

Three Ways to Safeguard Your Smart Home From Cybercriminals

 

Your smart home is a technological marvel. However, when camera flaws allow our neighbours to spy on us, smart speakers are manipulated with lasers, robot vacuums are breached to shout obscenities, and entire security systems are compromised by a smart plug, it's fair if you're hesitant to link your home to the internet. 

However, there is no reason to completely forgo the benefits of smart home devices. The idea is to recognise the risks and make use of available security features. Whether you have a network of smart kitchen gadgets or a single voice assistant, these measures will ensure that no one messes with your belongings. 

Secure your wi-fi network 

The majority of routers come with a model-specific SSID and either a random password or something generic, such as "admin," making it easier for cybercriminals to gain access to your home Wi-Fi and snoop about your linked smart home devices. Keep in mind that these manufacturer-supplied credentials are available online for anybody to use, so the first step is to secure your Wi-Fi network with a strong password. 

The process differs slightly depending on the device, but the basics are the same; here's how to get started. Those employing a mesh system will be able to manage security settings via a handy smartphone app. If your router supports it, consider altering the SSID, which is simply the name of your Wi-Fi network (e.g., PCMag_Home). While older devices are limited to WPA2, newer routers support the more secure WPA3 protocol. 

Replace outdated routers

You presumably purchased a new phone or laptop during the last several years. But how about your router? Has it accumulated dust on a shelf for far too long? If your internet performance isn't already hurting, the security of your linked gadgets very likely is. 

An ageing router indicates ageing security protocols—and an easier access point for undesirable actors. If you need a new router, the latest home internet standard is Wi-Fi 6. Prices for Wi-Fi 6 routers have dropped dramatically in recent years, with more alternatives available. Meanwhile, Wi-Fi 7 is still in its early stages of release. Check out our reviews of the finest wireless routers, gaming routers, and mesh networks.

Manage your account passwords

After securing the Wi-Fi network, it's time to safeguard the individual devices and services that connect to it. Numerous smart gadgets are managed by a smartphone app, so you'll need to create an account for each one. Using the same password for everything is handy, but it also poses a security risk.

If one of those accounts is compromised and the password is revealed, hackers may gain access to all of the other accounts on which you used that password. Instead, create a one-of-a-kind password that no one else will be able to guess. You may use a random password generator to generate difficult-to-guess codes, and a password manager to remember them all for you.
Read more »
LLM
AI clone AI Clonning AI Development AI Systems AI technology Cyber Security LLM

AI Self-Replication: Scientists Warn of Critical “Red Line”

 

Scientists have raised concerns after artificial intelligence (AI) crossed a major threshold — self-replication. A new study from researchers at Fudan University in China reveals that two popular large language models (LLMs) successfully created functional copies of themselves, raising alarms about the potential for rogue AI systems.  

Published on December 9, 2024, in the preprint database arXiv, the study tested Meta’s Llama31-70B-Instruct model and Alibaba’s Qwen2.5-72B-Instruct model. The results were striking: the models created working replicas of themselves in 50% and 90% of trials, respectively. This suggests that AI may already possess the ability to multiply beyond control. 

However, since the study hasn’t been peer-reviewed, its findings need further verification. The researchers emphasized that successful AI self-replication without human intervention is a critical step toward AI systems operating independently — and potentially against human interests. To mitigate this risk, they called for international collaboration to create guardrails and evaluate the threats posed by advanced AI technologies.  

The study explored two key scenarios: “shutdown avoidance” and “chain of replication.” In the first, the AI was programmed to detect when it was about to be shut down and replicate itself before termination. In the second, the AI cloned itself and instructed its replica to do the same, setting off an endless cycle of self-replication. Both experiments took place in controlled environments using off-the-shelf GPUs, simulating real-world conditions. 

What worried researchers most were the unexpected behaviors that emerged when the AI encountered obstacles like missing files or software conflicts. In such cases, the models often terminated conflicting processes, rebooted systems, and scanned their environments for solutions — all without human guidance. This level of adaptability suggests that current AI systems already exhibit survival instincts, further highlighting the need for oversight. 

These findings add to growing fears about “frontier AI,” the latest generation of AI systems powered by LLMs like OpenAI’s GPT-4 and Google Gemini. As these systems become more powerful, experts warn that unchecked AI development could lead to scenarios where AI operates outside of human control. 

The researchers hope their study will serve as a wake-up call, urging global efforts to establish safety mechanisms before AI self-replication spirals beyond human oversight. By acting now, society may still have time to ensure AI’s advancement aligns with humanity’s best interests.
Read more »
User Safety
Banking Security Cyber Security India RBI User Safety

RBI Launches "bank.in" Domain to Combat Digital Banking Scam

 

The Reserve Bank of India (RBI) has made the "bank.in" domain exclusive to all authorised banking institutions in India in an effort to strengthen digital banking security and shield customers from online banking fraud. This effort aims to minimise the rising threat of digital banking fraud by establishing a secure and verified online presence for the banks across the nation.

Due to the surge in online banking transactions, fraudsters have taken advantage of vulnerabilities by impersonating actual banks via phishing attacks, phoney banking websites, and fraudulent email campaigns. The only registrar for this will be the Institute for Development and Research in Banking Technology (IDRBT).

It is expected that domain registration will get underway in April 2025. By implementing an exclusive bank.in domain strategy, the RBI lowers the risk of financial fraud by ensuring that users can quickly recognise and trust legitimate banking websites.

Importance of “bank.in” domain in banking security

The increased use of digital banking has transformed financial transactions in India, providing easy access to banking services. However, this digital transformation has resulted in an increase in cyber threats, with scammers creating fake banking portals to trick users into disclosing sensitive data such as login credentials, OTPs, and banking details. The RBI's special domain for banks called "bank.in" intends to: 

  • Enhance banking fraud prevention by eliminating fake sites that pose as authentic banking portals. 
  • Increase consumer trust and awareness by ensuring that all Indian banks use a single, verifiable domain structure.
  • Strengthen India's digital banking security by creating a centralised domain that is challenging for fraudsters to replicate.

The "bank.in" domain will be reserved solely for RBI-regulated banking institutions, guaranteeing that only reputable financial institutions can use this domain extension. Each bank's official website will be hosted under the bank.in domain, making it easy for consumers to check legitimacy. For example, a major bank like State Bank of India (SBI) may have an official URL such as sbi.bank.in, indicating that the website is trustworthy. 

To facilitate this transition, the RBI is working with financial institutions, cybersecurity professionals, and domain regulatory agencies to ensure a smooth transition to the new domain. Banks will be expected to phase out their current domains and redirect consumers to their new "bank.in" addresses, ensuring a smooth transition and avoiding confusion.
Read more »
SparkCat
Android app removal Apple Breach Cyber Security Cybersecurity Data Google iOS malware SparkCat

Apple and Google Remove 20 Apps Infected with Data-Stealing Malware


Apple and Google have removed 20 apps from their respective app stores after cybersecurity researchers discovered that they had been infected with data-stealing malware for nearly a year.

According to Kaspersky, the malware, named SparkCat, has been active since March 2024. Researchers first detected it in a food delivery app used in the United Arab Emirates and Indonesia before uncovering its presence in 19 additional apps. Collectively, these infected apps had been downloaded over 242,000 times from Google Play Store.

The malware uses optical character recognition (OCR) technology to scan text displayed on a device’s screen. Researchers found that it targeted image galleries to identify keywords associated with cryptocurrency wallet recovery phrases in multiple languages, including English, Chinese, Japanese, and Korean. 

By capturing these recovery phrases, attackers could gain complete control over victims' wallets and steal their funds. Additionally, the malware could extract sensitive data from screenshots, such as messages and passwords.

Following Kaspersky’s report, Apple removed the infected apps from the App Store last week, and Google followed soon after.

Google spokesperson Ed Fernandez confirmed to TechCrunch: "All of the identified apps have been removed from Google Play, and the developers have been banned."

Google also assured that Android users were protected from known versions of this malware through its built-in Google Play Protect security system. Apple has not responded to requests for comment.

Despite the apps being taken down from official stores, Kaspersky spokesperson Rosemarie Gonzales revealed that the malware is still accessible through third-party websites and unauthorized app stores, posing a continued threat to users.
Read more »
pharma scam
Alkem Laboratories Cyber Fraud Cyber Security Email scam Financial Fraud Online Scam pharma scam

Alkem Laboratories Falls Victim to Rs 22.31 Crore Cyber Fraud

 

The pharmaceutical industry has been rocked by a major cyber fraud case, with Mumbai-based Alkem Laboratories suffering a financial loss of Rs 22.31 crore due to an elaborate scam. Fraudsters posed as executives from Alkem’s U.S. subsidiary, Ascend Laboratories LLC, to execute the scheme.

According to a Hindustan Times report, the incident began on October 27, 2023, when Alkem’s Mumbai office received an email seemingly from Amit Ghare, the head of international operations at Ascend Laboratories. The email claimed that a recent payment to Alkem would lead to significant tax liabilities. To circumvent these taxes, the company was asked to refund the amount to a different bank account.

On November 17, 2023, another email, allegedly from Mary Smith, Ascend Laboratories' accounting manager, provided details of a U.S.-based bank account for the refund. Acting on these instructions, Alkem’s treasury manager, Manoj Mishra, transferred Rs 51.30 crore to the specified account via a SWIFT transaction.

The fraud came to light on November 15, 2023, when Alkem received another email, supposedly from Ghare, requesting a refund of Rs 90 crore. Growing suspicious, Alkem officials contacted Ghare, who confirmed he had not sent the request. Further investigation revealed that the earlier emails originated from compromised email accounts with subtle alterations in the email addresses.

According to HT, U.S. authorities were able to recover Rs 28.98 crore from the stolen amount, which was returned to Alkem. However, the company still suffered a loss of Rs 22.31 crore.

Alkem Laboratories has reported the incident to the authorities, and an ongoing investigation aims to identify and apprehend the fraudsters while recovering the remaining funds. The company has also implemented enhanced cybersecurity measures to safeguard against similar threats, as reported by The Free Press Journal.
Read more »
Financial Security
Bank Security Credit Card Credit Card Fraud Credit Cards Cyber Security Digital Wallet Financial Security

Virtual Credit Cards: How They Work, Benefits, and Security Features

 

Virtual credit cards are digital versions of traditional credit cards, designed to enhance security in online transactions. Instead of using a physical card number, they generate a unique number for each purchase, reducing the risk of data breaches and fraud. If compromised, a virtual card can be canceled without affecting the main credit card account, making it a valuable security tool. 

Many issuers also provide immediate access to virtual cards upon account approval, allowing users to shop before receiving their physical card. Virtual credit cards function by generating a random 16-digit number linked to a real credit card account. They can be used for online purchases, certain phone transactions, and even in physical stores if added to a digital wallet like Apple Pay or Google Pay. Unlike traditional cards, virtual cards often allow users to set expiration dates and spending limits, giving them greater control over their transactions. Although similar, virtual credit cards are different from digital wallets. 

Digital wallets, such as Apple Pay and Google Pay, store actual card details and other digital assets, while virtual cards generate new numbers for each transaction, offering more protection against cyber threats. However, virtual cards do have limitations—they may not be accepted at all physical locations and can pose challenges for hotel or rental car bookings that require a physical card. Additionally, not all credit card issuers offer virtual cards. To obtain a virtual credit card, users should check if their issuer provides this feature. 

Some banks, like Capital One and Citi, offer virtual card numbers through browser extensions or account portals. Others, such as Chase and Wells Fargo, do not provide one-time-use virtual cards but allow integration with digital wallets. Once generated, users can adjust settings like spending limits and expiration dates to enhance security. While virtual credit cards add an extra layer of protection, they are not entirely foolproof. Hackers may still access an active virtual card, but most issuers provide fraud protection, ensuring users aren’t liable for unauthorized transactions. 

If compromised, a virtual card can be canceled and replaced without changing the main account number. To further enhance online security, consumers can use digital wallets, secure payment platforms like PayPal, and avoid storing payment details in web browsers. Using strong passwords, shopping only on secure networks, and enabling multi-factor authentication also help prevent fraud. 

For those interested in a virtual credit card, the process is simple—choose a card that offers this feature, apply through the issuer’s secure site, and access a virtual number upon approval. By integrating virtual credit cards into their payment methods, users can enjoy safer and more controlled online transactions.
Read more »
Microsoft
ADFS Cyber Security Lateral Phishing MFA Microsoft

Sophisticated Phishing Campaign Circumvents Microsoft's Multi Factor Authentication

 

A help desk phishing campaign uses spiofed login pages to target Microsoft Active Directory Federation Services (ADFS) within an organisation in order to obtain credentials and get around multi-factor authentication (MFA) protections. The campaign's main targets, as reported by Abnormal Security, are government, healthcare, and educational institutions; at least 150 targets were chosen in the attack. 

These assaults aim to infiltrate corporate email accounts to disseminate messages to additional victims within the organisation or launch financially driven attacks such as business email compromise (BEC), wherein payments are redirected to the perpetrators' accounts. 

Microsoft Active Directory Federation Services (ADFS) is an authentication system that enables users to log in once and then access various apps and services without having to enter their credentials again. It is often employed in large companies to enable single sign-on (SSO) for internal and cloud-based services. 

The perpetrators send emails to targets impersonating their company's IT team, requesting that they log in to update security settings or adopt new policies. When victims click on the embedded button, they are redirected to a phishing site that looks identical to their organization's actual ADFS login page. The phishing page prompts the victim to input their username, password, and MFA code or tricked them into approving the push notification. 

"The phishing templates also include forms designed to capture the specific second factor required to authenticate the targets account, based on the organizations configured MFA settings," reads Abnormal Security's report. "Abnormal observed templates targeting multiple commonly used MFA mechanisms, including Microsoft Authenticator, Duo Security, and SMS verification.” 

Once the victim has entered all of their information, they are sent to the real sign-in page, which reduces suspicion and gives the impression that the procedure was completed successfully. Meanwhile, the hackers use the stolen details to gain access into the victim's account, steal any valuable data, set up new email filter rules, and attempt lateral phishing.

According to Abnormal, the attackers in this campaign utilised Private Internet Access VPN to hide their location and assign an IP address that was closer to the organisation. Abnormal recommends that organisations move to modern and more secure solutions, such as Microsoft Entra, as well as add additional email filters and suspicious behaviour detection methods, to prevent phishing attempts.
Read more »
NHS
AI Advancements AI technology AI-Healthcare system Cyber Security Healthcare NHS

North Yorkshire Hospital Adopts AI for Faster Lung Cancer Detection

 

A hospital in North Yorkshire has introduced artificial intelligence (AI) technology to improve the detection of lung cancer and other serious illnesses. Harrogate and District NHS Foundation Trust announced that the AI-powered system would enhance the efficiency and accuracy of chest X-ray analysis, allowing for faster diagnoses and improved patient care. The newly implemented software can analyze chest X-rays in less than 30 seconds, quickly identifying abnormalities and prioritizing urgent cases. Acting as an additional safeguard, the AI supports clinicians by detecting early signs of diseases, increasing the chances of timely intervention. 

The trust stated that the system is capable of recognizing up to 124 potential issues in under a minute, streamlining the diagnostic process and reducing pressure on radiologists. Dr. Daniel Fascia, a consultant radiologist at the trust, emphasized the significance of this technology in addressing hospital backlogs. He noted that AI-assisted reporting would help medical professionals diagnose conditions more quickly and accurately, which is crucial in reducing delays that built up during the COVID-19 pandemic. 

The Harrogate trust has already been using AI to detect trauma-related injuries, such as fractures and dislocations, since July 2023. The latest deployment represents a further step in integrating AI into routine medical diagnostics. Harrogate is the latest of six Yorkshire radiology departments to implement this advanced AI system. The initiative has been supported by NHS England’s AI Diagnostics Fund (AIDF), which has allocated £21 million to aid early lung cancer detection across 64 NHS trusts in England. 

The investment aims to improve imaging networks and expand the use of AI in medical diagnostics nationwide. UK Secretary of State for Science, Innovation, and Technology, Peter Kyle MP, praised the rollout of this AI tool, highlighting its potential to save lives across the country. He emphasized the importance of medical innovation in preventing diseases like cancer from devastating families and underscored the value of collaboration in advancing healthcare technology. As AI continues to revolutionize the medical field, its role in diagnostics is becoming increasingly essential. 

The expansion of AI-driven imaging solutions is expected to transform hospital workflows, enabling faster detection of critical conditions and ensuring patients receive timely and effective treatment. With continued investment and innovation, AI is set to become an integral part of modern healthcare, improving both efficiency and patient outcomes.
Read more »
Indian Government
Aadhar Card Aadhar Security Authentication Biometric data Cyber Security data security Indian Government

India Expands Aadhaar Authentication, Allowing Private Sector Access to Biometric Data

 

The Indian government has introduced significant changes to its Aadhaar authentication system, expanding its use to a wider range of industries. Previously restricted to sectors like banking, telecommunications, and public utilities, Aadhaar verification will now be available to businesses in healthcare, travel, hospitality, and e-commerce. Officials claim this change will enhance service efficiency and security, but privacy advocates have raised concerns about potential misuse of biometric data. 

On January 31, the Ministry of Electronics and Information Technology (MeitY) announced revisions to the Aadhaar Authentication for Good Governance (Social Welfare, Innovation, Knowledge) Rules, 2025. These amendments allow both public and private organizations to integrate Aadhaar-based authentication into their operations, provided their services align with the public interest. The government states that this update is designed to improve identity verification processes and ensure smoother service delivery across various sectors.  

One major change in the updated framework is the removal of a rule that previously linked Aadhaar authentication to preventing financial fraud. This revision broadens the scope of verification, allowing more businesses to use Aadhaar data for customer identification. The Unique Identification Authority of India (UIDAI), the agency overseeing Aadhaar, will continue to manage the authentication system. The scale of Aadhaar’s use has grown significantly. 

Government records indicate that Aadhaar authentication was conducted in nearly 130 billion transactions by January 2025, a sharp increase from just over 109 billion transactions the previous year. With the new regulations, companies wishing to adopt Aadhaar authentication must submit detailed applications outlining their intended use. These requests will be reviewed by the relevant government department and UIDAI before receiving approval. Despite the government’s assurance that all applications will undergo strict scrutiny, critics argue that the review process lacks clarity. 

Kamesh Shekar, a policy expert at The Dialogue, a technology-focused think tank, has called for more transparency regarding the criteria used to assess these requests. He pointed out that the Supreme Court has previously raised concerns about potential misuse of Aadhaar data. These concerns stem from past legal challenges to Aadhaar’s use. In 2018, the Supreme Court struck down Section 57 of the Aadhaar Act, which had previously allowed private entities to use Aadhaar for identity verification. 

A later amendment in 2019 permitted voluntary authentication, but that provision remains contested in court. Now, with an even broader scope for Aadhaar verification, experts worry that insufficient safeguards could put citizens’ biometric data at risk. While the expansion of Aadhaar authentication is expected to simplify verification for businesses and consumers, the ongoing debate over privacy and data security underscores the need for stricter oversight. 

As Aadhaar continues to evolve, ensuring a balance between convenience and personal data protection will be crucial.
Read more »
tokenization
Banking Biometrics contactless Cyber Security Fintech Fraud mobile wallet Payments Security tokenization

Mastercard to Eliminate 16-Digit Card Numbers by 2030 for Enhanced Security

 

In a strategic move to combat identity theft and fraud, Mastercard has announced plans to remove the traditional 16-digit card number from credit and debit cards by 2030. Instead, the company will implement tokenization and biometric authentication to enhance security.

Mastercard has been integrating biometric authentication into its payment ecosystem since 2022, allowing transactions to be completed with a smile or a hand wave. Now, the next phase involves replacing card numbers with tokens, which transform the 16-digit identifier into a unique digital code stored on devices. This ensures that card details are never exposed during online or contactless transactions.

The initial rollout of these numberless cards will be in collaboration with AMP Bank, with additional financial institutions expected to adopt the technology in the coming year.

Receiving a suspicious transaction alert from the bank can be alarming, and for good reason—payment fraud has been on the rise. In Australia, fraudulent card transactions amounted to A$868 million in 2023-24, up from A$677.5 million the previous year.

Data breaches continue to expose sensitive financial information, with major incidents involving Marriott, Starwood Hotels, and Ticketmaster affecting hundreds of millions of customers worldwide. In Australia, card-not-present fraud—where transactions occur without the physical card—accounts for 92% of all card fraud, increasing by 29% in the last financial year.

Although the Card Verification Value (CVV) was introduced to verify physical card possession, its effectiveness has diminished over time.

By removing the card number, Mastercard aims to reduce unauthorized transactions and minimize risks associated with data breaches. Without stored payment details, compromised databases will no longer expose customers’ financial information.

This move aligns with broader industry concerns about data storage and privacy, highlighted by incidents such as the 2022 Optus data breach, which leaked historical customer data. Eliminating stored card details prevents future attacks from leveraging outdated information.

Challenges in Adopting the New System

While digital banking users may find the transition seamless, concerns arise regarding accessibility. Elderly consumers and individuals with disabilities who rely on traditional banking methods might struggle with the shift to mobile authentication.

Additionally, shifting security reliance from physical cards to mobile devices introduces new risks. SIM swapping and impersonation scams already enable criminals to take over victims' phone accounts, and these tactics could escalate as digital payment systems evolve.

Biometric authentication presents another challenge—unlike credit card details, biometric data is immutable. If compromised, it cannot be changed, increasing the stakes of potential identity theft. Previous breaches, such as the BioStar 2 security lapse and Australia’s Outabox facial recognition exposure, highlight the risks of biometric data leaks.

As contactless payments continue to grow, physical cards may soon become unnecessary. In 2023, mobile wallet transactions in Australia surged 58%, reaching $146.9 billion. By October 2024, nearly 44% of transactions were conducted via mobile devices.

Retail innovations like Amazon’s Just Walk Out technology are accelerating this trend. Currently deployed across 70 Amazon-owned stores and 85 third-party locations, the system uses AI-powered cameras and weight sensors to enable checkout-free shopping. Companies like Trigo, Cognizant, and Grabango are also developing similar smart retail solutions, with trials underway in major supermarket chains like Tesco and ALDI.

However, even in frictionless shopping experiences, consumers must initially enter card details into payment apps. To eliminate the need for cards and numbers entirely, biometric payments—such as facial recognition transactions—are gaining traction as the next frontier in secure digital commerce.
Read more »
vehicle security
Cyber Security Ethical Hacker Subaru Starlink vehicle security

Ethical Hacker Finds Security Flaw in Subaru Starlink, Gains Remote Access to Vehicles

 



A cybersecurity researcher recently discovered a serious vulnerability in Subaru’s Starlink system, allowing him to remotely control vehicles across the U.S., Canada, and Japan. The ethical hacker, Sam Curry, was able to unlock doors, start and stop engines, and track vehicle locations after bypassing a security loophole in an employee-facing platform. The issue was quickly reported to Subaru, which fixed the vulnerability within 24 hours.  

What is Subaru Starlink?  

Subaru Starlink is the company’s connected vehicle system, offering a range of infotainment, security, and remote access features. It allows Subaru owners to lock or unlock their vehicles, start the engine remotely, and track their car’s location using the MySubaru mobile app. The system also provides emergency roadside assistance, automatic crash notifications, and stolen vehicle tracking.  

Because Starlink controls key vehicle functions remotely, any security vulnerability in the system could pose a major risk, allowing unauthorized access to vehicles.  

How the Hacker Gained Access  

Sam Curry, a well-known ethical hacker, decided to test Subaru’s security after purchasing a 2023 Subaru Impreza for his mother. When he failed to bypass the security of the MySubaru app, he and fellow researcher Shubham Shah looked for other ways to access Subaru’s systems.  

They eventually found a publicly accessible employee portal linked to the Subaru Starlink Admin Panel. A flaw in this portal allowed them to reset employee passwords without needing confirmation, as long as they had a valid company email address.  

To find an active employee email, Curry searched LinkedIn profiles of Subaru staff and used a common corporate email format. After a few attempts, he successfully reset a valid employee’s password and gained full access to the Subaru Starlink Admin Panel.  

Once inside, he could:  

1. Locate any Subaru vehicle with a Starlink account  

2. Unlock and lock doors remotely  

3. Start and stop the engine  

4. Access tracking history for up to 12 months  

5. View partial billing details of vehicle owners  

To verify the extent of their access, Curry and Shah tested it on another Subaru owned by a friend. With just her license plate number, they remotely unlocked her car, confirming the system-wide vulnerability.  

Curry quickly reported the flaw to Subaru, which patched the vulnerability in less than a day. The automaker did not publicly comment on the issue, but the fix prevented any further unauthorized access.  

Why This Matters  

This discovery underlines the importance of strong cybersecurity measures in connected vehicles. As cars become more reliant on internet-based systems, ensuring their security is critical to preventing hacking attempts that could compromise user safety. The incident also underscores the role of ethical hackers in identifying and fixing security gaps before malicious actors exploit them.  



Read more »
Shadow AI
AI Deepfakes AI threats Cyber Security cybercriminals Cybersecurity measures IABs Open Source Ransomwares Shadow AI

Emerging Cybersecurity Threats in 2025: Shadow AI, Deepfakes, and Open-Source Risks

 

Cybersecurity continues to be a growing concern as organizations worldwide face an increasing number of sophisticated attacks. In early 2024, businesses encountered an alarming 1,308 cyberattacks per week—a sharp 28% rise from the previous year. This surge highlights the rapid evolution of cyber threats and the pressing need for stronger security strategies. As technology advances, cybercriminals are leveraging artificial intelligence, exploiting open-source vulnerabilities, and using advanced deception techniques to bypass security measures. 

One of the biggest cybersecurity risks in 2025 is ransomware, which remains a persistent and highly disruptive threat. Attackers use this method to encrypt critical data, demanding payment for its release. Many cybercriminals now employ double extortion tactics, where they not only lock an organization’s files but also threaten to leak sensitive information if their demands are not met. These attacks can cripple businesses, leading to financial losses and reputational damage. The growing sophistication of ransomware groups makes it imperative for companies to enhance their defensive measures, implement regular backups, and invest in proactive threat detection systems. 

Another significant concern is the rise of Initial Access Brokers (IABs), cybercriminals who specialize in selling stolen credentials to hackers. By gaining unauthorized access to corporate systems, these brokers enable large-scale cyberattacks, making it easier for threat actors to infiltrate networks. This trend has made stolen login credentials a valuable commodity on the dark web, increasing the risk of data breaches and financial fraud. Organizations must prioritize multi-factor authentication and continuous monitoring to mitigate these risks. 

A new and rapidly growing cybersecurity challenge is the use of unauthorized artificial intelligence tools, often referred to as Shadow AI. Employees frequently adopt AI-driven applications without proper security oversight, leading to potential data leaks and vulnerabilities. In some cases, AI-powered bots have unintentionally exposed sensitive financial information due to default settings that lack robust security measures. 

As AI becomes more integrated into workplaces, businesses must establish clear policies to regulate its use and ensure proper safeguards are in place. Deepfake technology has also emerged as a major cybersecurity threat. Cybercriminals are using AI-generated deepfake videos and audio recordings to impersonate high-ranking officials and deceive employees into transferring funds or sharing confidential data. 

A recent incident involved a Hong Kong-based company losing $25 million after an employee fell victim to a deepfake video call that convincingly mimicked their CFO. This alarming development underscores the need for advanced fraud detection systems and enhanced verification protocols to prevent such scams. Open-source software vulnerabilities are another critical concern. Many businesses and government institutions rely on open-source platforms, but these systems are increasingly being targeted by attackers. Cybercriminals have infiltrated open-source projects, gaining the trust of developers before injecting malicious code. 

A notable case involved a widely used Linux tool where a contributor inserted a backdoor after gradually establishing credibility within the project. If not for a vigilant security expert, the backdoor could have remained undetected, potentially compromising millions of systems. This incident highlights the importance of stricter security audits and increased funding for open-source security initiatives. 

To address these emerging threats, organizations and governments must take proactive measures. Strengthening regulatory frameworks, investing in AI-driven threat detection, and enhancing collaboration between cybersecurity experts and policymakers will be crucial in mitigating risks. The cybersecurity landscape is evolving at an unprecedented pace, and without a proactive approach, businesses and individuals alike will remain vulnerable to increasingly sophisticated attacks.
Read more »
Virtual Credit Card
Cyber Security Financial Security Online Scam User Privacy Virtual Credit Card

Here's The Ultimate Guide to Virtual Credit Card in Safeguarding Online Privacy

 

Virtual credit cards are digital versions of physical credit cards. They generate a unique credit card number that you can use instead of your physical card number, avoiding the merchant from storing your credit card data and making your financial data more safe. 

With security breaches in the news, using a virtual card adds an extra degree of security. Several major credit card issuers provide virtual cards, although there are several outliers. Virtual credit cards provide more than just security. A virtual credit card allows you to utilise a newly created account before the physical card arrives, allowing you to collect rewards right away or make progress towards a welcome bonus. 

Are virtual cards safer than physical cards? 

Virtual cards provide an additional layer of security over physical cards by safeguarding your real credit card information. This makes them safer than physical cards in various aspects: 

  • Virtual credit cards might have spending caps and be restricted to specific merchants. They can also be configured for single use, deactivating automatically after the very first transaction. These restrictions provide extra fraud protection compared to a standard credit card.
  • Unlike conventional credit cards, virtual cards cannot be stolen or misplaced. If you carry a physical credit card and it is stolen, you may be susceptible to scam. Virtual cards are stored in your digital wallet, keeping you secure from fraud.
  • Virtual credit cards must adhere to the Payment Card Industry Data Security Standard (PCI DSS), which includes standards and guidelines aimed at safeguarding credit and debit transactions and preventing the exploitation of cardholder data. 

Benefits and drawbacks 

Virtual credit cards have many benefits, but there are a few drawbacks. Here are some of the advantages and disadvantages of virtual cards.

Pros: 

Enhanced security: Using virtual cards to make online transactions safeguards your actual credit card information and adds an extra layer of security over physical credit cards. Flexibility: Without changing your actual credit card, you can choose which vendors you want to use the card with, set up expiration dates, and create specific spending limitations.

Convenience: Virtual credit cards are generated instantly and can be utilised immediately for online purchases and contactless payments. Cons: Not always able to utilise them in-store: Not every retailer accepts contactless methods like Apple Pay or Google Pay. When it comes to in-store stores, you can be constrained, even though virtual cards are perfect for internet buying. 

Cons:

Refunds could be difficult: Every retailer has different regulations, and some could only give refunds for the original payment method. If you utilised a virtual credit card number that is no longer active, this can be an issue. Instead, you may get a cheque, a gift card or store credit in this situation.

Unsuitable for reservations: It may be challenging to match your payment method at check-in if you use a virtual card to make a hotel reservation. Since hotels usually need a physical card when you check in, using a virtual card can need further verification, such as getting in touch with your bank.
Read more »
Security Breach
browser hijacking Chrome Extension Cyber Security Cybersecurity Data Theft Google Workspace Hacking phishing Security Breach

New 'Browser Syncjacking' Attack Exploits Chrome Extensions for Full Device Takeover

 

'Browser Syncjacking,' which allows threat actors to hijack Google profiles, compromise browsers, and eventually gain full control over a victim's device—all through a seemingly harmless Chrome extension.

This stealthy multi-stage attack requires minimal permissions and almost no user interaction beyond installing a malicious Chrome extension. The attack begins with:

1. Fake Google Workspace Setup – Attackers create a fraudulent Google Workspace domain with pre-configured user profiles where security features like multi-factor authentication are disabled.

2. Publishing a Malicious Extension – A Chrome extension, disguised as a useful tool, is uploaded to the Chrome Web Store.

3. Social Engineering Trap – Victims are tricked into installing the extension, which then secretly logs them into an attacker's managed Google Workspace profile via a hidden browser session.

4. Sync Activation – The extension opens a legitimate Google support page and injects content instructing users to enable Chrome Sync. Once activated, attackers gain access to stored credentials, browsing history, and other sensitive data.

5. Full Browser Takeover – Using deceptive tactics, such as a fake Zoom update prompt, the extension delivers an executable file containing an enrollment token. This grants attackers full control over the browser.

"Once enrolled, the attacker gains full control over the victim's browser, allowing them to silently access all web apps, install additional malicious extensions, redirect users to phishing sites, monitor/modify file downloads, and many more," explains SquareX researchers.

By leveraging Chrome's Native Messaging API, attackers establish a direct communication channel between the malicious extension and the victim's operating system. This enables them to:
  • Browse directories
  • Modify files
  • Install malware
  • Execute commands
  • Capture keystrokes
  • Extract sensitive data
  • Activate the webcam and microphone
The Browser Syncjacking attack is difficult to detect. Unlike traditional extension-based threats that require extensive social engineering, this method operates with minimal user interaction.

"Unless the victim is extremely security paranoid and is technically savvy enough to constantly navigate the Chrome settings to look for managed browser labels, there is no real visual indication that a browser has been hijacked," the report warns.

Recent incidents, including hijacks of legitimate Chrome extensions, have demonstrated that browser extensions pose significant cybersecurity risks.

BleepingComputer has reached out to Google for comments on this new attack and will provide updates as soon as a response is received.
Read more »
Subscribe to: Posts (Atom)