Search This Blog
Powered by Blogger.

Blog Archive

Labels

About Me

Load More
Trendy Right Now

Popular Posts

Showing posts with label Spoofing. Show all posts
Windows
Cyberattacks CyberCrime Cyberhackers Cybersecurity CyberThreat Hacking WhatsApp MIME Spoofing Vulnerabilities and Exploits Windows

WhatsApp for Windows Exposed to Security Risk Through Spoofing Vulnerability

 


Whatsapp for Windows has been recently revealed to have a critical security vulnerability known as CVE-2025-30401. This vulnerability has raised serious concerns within the cybersecurity community since it has been identified. The high severity of this vulnerability affects desktop versions of the application released before 2.2450.6, which could lead to an exploitation attack. An issue resulting from inconsistencies in the handling of file metadata enables threat actors to manipulate these inconsistencies in order to circumvent security checks. 

By exploiting this vulnerability, malicious actors can execute arbitrary code on targeted systems without user awareness, resulting in the possibility of unauthorized access to sensitive information or data compromise. Several security experts have emphasized that in order to mitigate the risks associated with this vulnerability, you must update your WhatsApp version to the latest version. Organizations and users of WhatsApp for Windows are strongly advised to apply the necessary patches immediately so that they are protected from threats. 

In accordance with the official security advisory, there is a critical inconsistency in how WhatsApp's desktop application deals with file attachments. There is a fundamental difference between the way the application determines how to display attachments using its MIME type versus the way the operating system interprets the file extension to determine how it should be opened or executed as a result. This difference in interpretation has created a serious security vulnerability. An attacker can create a malicious file that appears benign but is actually dangerous.

For instance, the attacker might use an MIME type that is typically used for images, along with an executable file extension such as exe, to craft a malicious file. Although the application would visually present it as safe, as per its MIME type, the operating system would handle it based on what its actual extension is. As a result of such a mismatch, users may be misled into opening a file that appears harmless but in reality is executable and thus allowing the execution of arbitrary code unintentionally by the user. As a result of such an attack vector, the likelihood of successful social engineering attacks and system compromises increases significantly. 

There has been a significant amount of research conducted on the issue, and the findings indicate that if a deliberate discrepancy was made between the MIME type and the extension of the file, it could have led the recipient unintentionally to execute arbitrary code by manually accessing the attachment within WhatsApp's desktop application, instead of just viewing its contents. This behavior represented a considerable threat, particularly in scenarios involving the user initiating the interaction. 

Fortunately, an independent security researcher who discovered this vulnerability and disclosed it to Meta through the company's Bug Bounty Program has been credited with responsibly disclosing it to the company, but the company does not appear to have confirmed whether the vulnerability has been actively exploited in the real world. It is important to note that such a security issue has not occurred on the platform in the past. 

In July 2024, WhatsApp was able to resolve a related security issue, which allowed Python and PHP attachments to be run automatically by Windows systems with the corresponding interpreters installed—without prompting the user. In the same vein, an incident similar to that of the platform highlighted the risks associated with the handling and execution of files incorrectly. In the end, these cases emphasize the importance of rigorous input validation and consistent file interpretation across all applications and operating systems, regardless of the type of application.

Due to its vast user base and widespread adoption, WhatsApp remains a highly valuable target for cyber threat actors, whether they are motivated by financial gain or geopolitical interests. The platform has become a recurring target of malicious campaigns because of its deep integration into users' personal and professional lives, coupled with the trust it commands. There have been several incidents in which attackers have exploited security vulnerabilities within WhatsApp to gain access to users' data, exfiltrate sensitive data, and install sophisticated malware as a result. 

A zero-day vulnerability that affects WhatsApp is particularly lucrative in underground markets, sometimes commanding a price of over one million dollars. Not only does the WhatsApp user base have a large footprint, but attackers can also gain an advantage by unknowingly accessing private conversations, media files, and even device-level abilities to gain a strategic advantage. Graphite, a form of spyware developed by Paragon, had been exploited by active hackers in March 2025 as a zero-click, zero-day vulnerability which WhatsApp remedied in March 2025. 

Using this exploit, the targeted individuals could be monitored remotely, without the victim having to interact with the attacker - an example of an advanced persistent threat campaign. An investigation by a research group based at the University of Toronto uncovered this surveillance campaign, which targeted journalists and members of civil society. The Citizen Lab was conducting the investigation, which was the source of the information. 

Following their report, WhatsApp swiftly acted to neutralize the campaign. Meta confirmed that the vulnerability had been silently patched in December 2024 without a client-side update being required. Despite being resolved without a formal CVE identifier being assigned, the issue is still of great importance to the global community. In order to protect platforms of such importance from exploitation, proactive vulnerability management, continuous security auditing, and cross-sector cooperation must be adopted. 

In the wake of the successful implementation of server-side mitigations, WhatsApp sent out security notifications on January 31 to roughly 90 Android users across over two dozen countries that had been affected by the vulnerability. Journalists and human rights activists in Italy were among the individuals alerted. They were identified as the targets of an elaborate surveillance operation using Paragon Graphite spyware, which utilized the zero-click exploit of a computer system. 

An Israeli cybersecurity firm known as NSO Group has been accused of violating American anti-hacking statutes by distributing its Pegasus spyware utilizing WhatsApp zero-day vulnerabilities in December of 2016, following a pattern of highly targeted cyber intrusions utilizing advanced surveillance tools. This incident follows a broader pattern of highly targeted cyber intrusions. Several evidences were provided to the court which indicated that at least 1,400 mobile devices had been compromised as a result of these covert attacks.

According to court documents, NSO Group carried out zero-click surveillance operations by deploying multiple zero-day exploits to compromise WhatsApp's systems. As part of the spyware delivery process, malicious messages were sent that did not require the recipient to interact with them at all, exploiting vulnerabilities within the messaging platform. Aside from that, the documents also allege that NSO developers reverse engineered WhatsApp's source code to create custom tools that could deliver these payloads, conduct that was deemed to have been illegal under state and federal cybersecurity laws. 

Those cases emphasize the increasing sophistication of commercial surveillance vendors as well as the necessity for robust legal and technical defenses to protect digital communication platforms, as well as the individuals who rely upon them, from abuse. As a result of these incidents, user must remain vigilant, maintain timely security updates, and strengthen the security measures within widely used communication platforms to reduce the risk of cyber-attacks. 

There has been an increasing prevalence of threat actors using sophisticated techniques to exploit even small inconsistencies, which is why it is essential to maintain a proactive and collaborative approach to cybersecurity. To maintain a secure digital environment, platform providers and end users both need to be aware of and responsible for their role as well.
Read more »
telephone scams
Canada Cyber Crime RCMP Spoofing telephone scams

Scammers Impersonate Thunder Bay RCMP in New Phone Spoofing Scheme

 



Phone number of the RCMP used in scams across Thunder Bay. The local Royal Canadian Mounted Police detachment is warning residents of Thunder Bay about a phone scam. Scammers are spoofing the official RCMP number, 807-623-2791, which will have calls that appear to be from the police when they actually are not. The RCMP has issued a public alert to raise awareness and try to prevent potential fraud.

How the Spoofing Scam Works

Spoofing is a technique by which fraudsters mask their real phone numbers through technology, making it seem as though the call is coming from a trusted source. In this case, they are masquerading as the Thunder Bay RCMP in an attempt to intimidate or defraud unsuspecting victims. The fraudsters might use the RCMP's name to give their requests a semblance of legitimacy. These requests usually demand sensitive personal information or money.

The RCMP clears the air on its communication practices

As far as the spoofing cases are concerned, the RCMP states that neither them nor any government institution will ever ask for a fee in an odd manner such as Bitcoin, gift cards, or cash collections. In fact, police will never visit your home to collect money as a reason a family member is behind bars. According to the RCMP, it does not seek social insurance numbers, birthdays, or phone numbers via phone call.

How to Verify an RCMP Call 

 In case somebody is doubtful whether a call claiming that it is from her detachment is genuine or not, then she must hanger and call again at 807-623-2791 between 8 a.m. and 4 p.m. Therefore, he will know if that was the genuine call or an attempt by a scammer.

Role of RCMP in Ontario

Another thing the public should be aware of is that the RCMP does not deal with local law enforcement in Ontario but rather deals with issues involving federal law, such as national security, border integrity, organised crime, and financial crimes, including cybercrime and money laundering.

What to Do if You Suspect a Scam

If you believe you are a target, the best action is to hang up. Victims of telephone scams are advised to contact either their local police service or the Canadian Anti-Fraud Centre to report the incident, helping investigators to track and follow up on ongoing schemes.

By knowing how to validate government calls and remaining vigilant, the citizens will be able to guard themselves against spoofing scams and other fraudulent schemes.


Read more »
vigilance
Cyber Fraud Cyber Threats Cybersecurity Data Theft phishing Scams Sensitive Information Spear Phishing Spoofing vigilance

The Evolution of Phishing Emails: From Simple Scams to Sophisticated Cyber Threats

 

Phishing emails have undergone significant changes over the past few decades. Once simple and easy to detect, these scams have now evolved into a sophisticated cyber threat, targeting even the most tech-savvy individuals and organizations. Understanding the development of phishing attacks is key to protecting yourself from these ever-evolving cyber dangers.

In the late 1990s and early 2000s, phishing emails were quite basic and easily identifiable. One of the most well-known scams was the "Nigerian Prince" email. These messages claimed to be from foreign royalty or officials, offering large sums of money in return for a small processing fee. The common signs included poor language, unrealistic promises, and large financial rewards—elements that eventually made these scams easy for users to recognize and dismiss.

As people became aware of these early scams, phishing attacks shifted focus, aiming to steal sensitive financial information. By the mid-2000s, attackers began impersonating banks and financial institutions in their emails. These messages often used fear-inducing language, such as warnings of account breaches, to pressure recipients into handing over personal details like login credentials and credit card information. During this time, phishing attempts were still marked by clear warning signs: poorly written emails, generic greetings, and inaccurate logos. However, as technology advanced, so did the attackers' ability to produce more convincing content.

The evolution of phishing took a major step forward with the introduction of spear phishing. Unlike traditional phishing, which targets a broad audience, spear phishing focuses on specific individuals or companies. Attackers gather personal information through social media and public records to craft emails that appear highly legitimate, often addressing the victim by name and referencing workplace details. This tailored approach makes the scam more believable and increases the chances of success.

Phishing emails today have become highly sophisticated, utilizing advanced techniques such as email spoofing to mimic trusted sources. Attackers frequently impersonate colleagues, supervisors, or official entities, making it difficult for users to tell the difference between genuine and malicious messages. Modern phishing schemes often rely on psychological tactics, using fear or urgency to pressure recipients into clicking harmful links or downloading malware. This evolution reflects the growing complexity of cybercriminal activities, demanding greater awareness and stronger cybersecurity defenses.

In summary, phishing emails have evolved from basic scams to intricate, personalized attacks that are harder to detect. Being informed about these tactics and staying vigilant is critical in the digital age. If you're ever in doubt about an email’s legitimacy, contact your Information Security Team for verification.
Read more »
Spoofing
Cyber Attacks Ransomware Sensitive data SMBs Spoofing

Why SMBs Have Become Easy Prey for Cyber Criminals

 



The global phenomenon of cybercrime is emerging. And the soft targets in this regard are the small and medium-sized business enterprises. Day after day, while a few cyberattacks on big corporations capture the headlines in the news, many SMBs experience similar attacks, but these never gain much attention. However, the damage inflicted on them can be just as debilitating as those affecting the large corporations.

Actually, SMBs are so vulnerable to cyber attacks for several reasons. For instance, most SMBs cannot afford to pay for professional and effective cybersecurity solutions. As compared to large businesses that budget millions of money for cybersecurity, SMBs only spend a small amount on the protection systems hence becoming easy targets. Small businesses usually have just a few IT staff who are not as skilled in dealing with the sophisticated nature of contemporary cybersecurity threats.

Another reason is that most SMB owners do not treat cybersecurity issues seriously enough. Cybersecurity is rarely on their priority list, and owners give more attention to ready operational issues rather than long-term digital security. In this area of complacency, the wide open window to many cyber threats, including phishing attacks, malware, and ransomware attacks, counts in favour of SMBs.


Cyber Threats Amongst SMBs

Among other problems facing SMBs is ransomware. Attackers of ransomware attack by locking or exfiltrating the company's valuable data. They then send messages demanding payment for the access to the data again. In the absence of proper data backup, an SMB will be caught between a rock and a hard place-to pay the ransom or to lose all the data.

Besides the ransomware, phishing attacks targeting SMBs involve hackers impersonating legit sources for extracting sensitive information. Malware and spoofing attacks may alter or camouflage digital communications to deceive the users.

In addition, cybercriminals often use SMBs as stepping stones to access larger businesses that they associate themselves with. Therefore, hackers can leverage any security loopholes in an SMB to their bad books by using such information to act against larger attacks.


Why Cybercriminals Prefer Targeting SMBs

Cybercriminals focus on SMBs as these are comparatively softer targets. Small organisations are unlikely to be as advanced in cybersecurity matters as big ones. Although they are applying widely used tools like Microsoft Excel, Outlook or cloud services, SMBs often fail to secure those platforms properly.

Furthermore, cyber attackers know that vulnerabilities in SMB systems may eventually find a way into more harmful attacks. For example, if the attackers succeed in stealing all the client or customer data in SMBs, they can use the same stolen information at later dates to link it with other available stolen information in conducting even more devastating cyberattacks.


How Small and Medium Businesses Can Avoid Cyberattacks

Small and medium-sized organisations will need to be proactive in preventing cyberattacks. Although investment in cybersecurity software is important, it is more than this. A good starting point would be implementing some easy security protocols, such as email authentication and spam filters, but training employees on the warning signs and what to do can make all the difference.

For example, one important step that an SMB must take is the development of a cybersecurity plan. The plan should detail the procedures for maintaining access and properly handling sensitive data, including permission management and regularly backing up important files. The IT departments of the SMBs need to be very vigilant with the monitoring of access to cloud-based and locally stored data, protecting it from unauthorised access.

Since SMBs can no longer claim to be immune from cyber threats, in the digital world of today, the SMBs must crack down and invest in measures aimed at protecting their businesses against cyber threats. Make haste to ensure that appropriate security measures are put in place and guard themselves against potentially costly cyberattacks that could jeopardise their operations and reputation otherwise.


Read more »
Telecom Sector
Cyber Fraud cybercriminals DoT Fake Calls Fraud Calls Identity Fraud India Indian Government Spoofing Telecom Sector

Combatting International Spoofed Calls: India's New Measures to Protect Citizens

 

In recent times, fraudsters have increasingly used international spoofed calls displaying Indian mobile numbers to commit cybercrime and financial fraud. These calls, which appear to originate within India, are actually made by criminals abroad who manipulate the calling line identity (CLI). 

Such spoofed calls have been used in various scams, including fake digital arrests, FedEx frauds, narcotics in courier schemes, and impersonation of government and police officials. To combat this growing threat, the Department of Telecommunications (DoT) and Telecom Service Providers (TSPs) in India have developed a system to identify and block incoming international spoofed calls. 

This initiative aims to prevent such calls from reaching any Indian telecom subscriber. The Ministry of Communications announced that TSPs have been directed to block these calls and are already taking steps to prevent calls with spoofed Indian landline numbers. In addition to this, the DoT has launched the Sanchar Saathi portal, a citizen-centric platform designed to enhance user safety and security amid the rising threat of fraud and international call scams. This portal includes a feature called "Chakshu," which allows individuals to report suspicious calls and messages. 

Chakshu simplifies the process of flagging fraudulent communications, providing an extra layer of protection against cybercriminals. Chakshu serves as a backend repository for citizen-initiated requests on the Sanchar Saathi platform, facilitating real-time intelligence sharing among various stakeholders. The platform also provides information on cases where telecom resources have been misused, helping to coordinate actions among stakeholders. 

Union Minister Ashwini Vaishnaw has highlighted additional measures, including creating a grievance redressal platform for reporting unintended disconnections and a mechanism for returning money frozen due to fraud. These efforts aim to address the concerns of citizens who may have been inadvertently affected by the anti-fraud measures. Since its launch in May last year, the Sanchar Saathi portal has been instrumental in enhancing the security of telecom users. It has helped track or block over 700,000 lost mobile phones and detect more than 6.7 million suspicious communication attempts. 

These efforts underscore the government's commitment to safeguarding citizens from cyber threats and ensuring the integrity of telecom services. The DoT and TSPs' proactive measures, along with the Sanchar Saathi portal, represent significant steps towards protecting Indian citizens from international spoofed calls and other forms of cybercrime. By leveraging advanced technology and fostering collaboration among stakeholders, these initiatives aim to create a safer digital environment for all.
Read more »
Spoofing
Aviation Firms Data Breach Electronic Data GPS GPS Jamming Middle East Navigation Spoofing

The Menace of GPS Spoofing in Aviation

GPS spoofing has been an extraordinary difficulty for the aviation industry in recent years. A threat that looked like it would only exist in the future is now a grim reality, with malicious GPS signal tampering causing flights worldwide to be misdirected.

GPS spoofing is a phenomenon in which phony signals are transmitted to trick GPS receivers into displaying false information about the position and trajectory of the aircraft. This not only presents a serious concern about the security of air travel, but it also calls into question the resilience of our technologically advanced and globally interconnected society.

Numerous reports demonstrate the growing frequency of GPS spoofing instances, reported from India to the Middle East. India's Directorate General of Civil Aviation (DGCA) has revealed some startling information. It is an urgent advisory that airlines should follow to strengthen safety measures against signal spoofing.

The impact of GPS spoofing on aviation is far-reaching, reports shed light on how flights are being led astray, with potential consequences that extend beyond mere inconvenience. The very essence of precision in air navigation, a cornerstone of modern aviation, is under threat. Pilots and air traffic controllers, relying heavily on GPS for accurate positioning and route planning, face the daunting challenge of distinguishing between authentic signals and deceptive ones.

The Times of India emphasizes the urgency for airlines to prepare standard operating procedures (SOPs) specifically addressing signal spoofing. Regulatory bodies are recognizing the need for a proactive approach to mitigate the risks associated with GPS manipulation. The article suggests that having robust protocols in place is essential to ensure the safety of air travel in the face of this emerging threat.

Reports delve into the mysterious occurrences of GPS spoofing in the skies of the Middle East, ringing alarm bells for Indian airlines. The DGCA's advisory underscores the seriousness of the situation, urging airlines to take immediate measures to safeguard their operations and passengers.

The growing danger of GPS spoofing serves as a sharp reminder of the dangers that come with our dependence on networked systems as we commemorate one year since the dawn of this technology-driven era. To keep ahead of those looking to use the digital landscape for evil, the aviation sector must quickly adapt, put in place strong countermeasures, and work with technological specialists.

GPS spoofing is becoming an increasingly serious problem, and aviation safety needs to be addressed comprehensively to keep up. It is within the industry's power to overcome these obstacles and guarantee that everyone can fly safely with increased awareness, readiness, and technical innovation.











Read more »
Ukraine
aviation Bot Traffic Cyber Security Digital era Electronic Data GPS GPS Jamming Israel New York Spoofing Ukraine

GPS Warfare: Ukraine-Israel Tensions Raise Alarms

GPS is used for navigation in almost every device in this age of rapid technological development. Israel may have been involved in recent GPS jamming and spoofing occurrences in Ukraine, according to reports that have revealed a worrying trend. These accidents constitute a serious threat to the worldwide aviation sector and a topic of regional concern. 

The New York Times recently reported on the growing instances of GPS disruptions in Ukraine, shedding light on the potential involvement of Israeli technology. According to the report, Israel has been accused of jamming and spoofing GPS signals in the region, causing disruptions to navigation systems. The motives behind such actions remain unclear, raising questions about the broader implications of electronic warfare on international relations. 

The aviation sector heavily relies on GPS for precise navigation, making any interference with these systems potentially catastrophic. GPS jamming and spoofing not only endanger flight safety but also have the capacity to disrupt air traffic control systems, creating chaos in the skies.

The aviation industry relies heavily on GPS for precision navigation, and any interference with these systems can have dire consequences. GPS jamming and spoofing not only jeopardize the safety of flights but also can potentially disrupt air traffic control systems, leading to chaos in the skies.

The implications of these incidents extend beyond the borders of Ukraine and Israel. As the world becomes increasingly interconnected, disruptions in one region can reverberate globally. The international community must address the issue promptly to prevent further escalations and ensure the safe operation of air travel.

Governments, aviation authorities, and technology experts need to collaborate to develop countermeasures against GPS interference. Strengthening cybersecurity protocols and investing in advanced technologies to detect and mitigate electronic warfare threats should be a priority for nations worldwide.

Preserving vital infrastructure, like GPS systems, becomes crucial as we manoeuvre through the complexity of a networked world. The GPS jamming events between Israel and Ukraine serve as a sobering reminder of the gaps in our technology and the urgent necessity for global cooperation to counter new threats in the digital era.
Read more »
Spoofing
Cyber Security Data HTTP Attacks Safety Security Spoofing

Understanding HTTPS Spoofing: A Deceptive Online Threat

 

Online security is no longer a luxury but an absolute necessity in today's digital age. For the average internet user, spotting the reassuring green padlock symbol and the "https://" prefix in their browser's address bar has become a common sight, indicating a secure connection.

However, hidden beneath this facade of security lurks a menacing threat known as "HTTPS spoofing," which poses a significant risk to data integrity, user privacy, and the trust we place in our online interactions.

To protect from the perils of HTTPS spoofing, it's crucial to understand the various types of attacks, how they operate, and the potential consequences they entail.

Understanding HTTPS and HTTPS Spoofing

Before delving into the intricacies of HTTPS spoofing, it's essential to grasp the fundamentals of HTTPS itself. Hypertext Transfer Protocol Secure (HTTPS) is the secure version of HTTP, the protocol responsible for transmitting data between a user's web browser and a website's server. HTTPS employs encryption techniques, primarily SSL/TLS protocols, to guarantee data confidentiality, integrity, and authenticity during transmission.

When you come across the familiar green padlock icon and "https://" at the beginning of a website's URL, it signifies that your connection with the website is encrypted. This encryption serves as a safeguard against malicious actors attempting to intercept or manipulate the data being transmitted.

However, HTTPS spoofing is a malicious manipulation of the security features inherent in HTTPS. It involves cyber attackers creating deceptive websites that skillfully mimic the appearance of legitimate ones. These fraudulent sites proudly display the coveted green padlock and "https://" in the address bar, deceiving users into believing they are interacting with a secure and reputable website. In reality, any sensitive information shared on these platforms is at grave risk of being compromised.

Varieties of HTTPS Spoofing Attacks

The realm of HTTPS spoofing encompasses various attack vectors, each targeting specific facets of online security.

1. Phishing Attacks: Phishing attacks exploit users' psychological vulnerabilities, tricking them into divulging sensitive information. Attackers craft fake websites that closely resemble legitimate ones, often replicating logos, layouts, and content to create the illusion of authenticity. Victims are lured into sharing their personal and financial data, under the false belief that they are interacting with a trustworthy site.

2. Man-in-the-Middle Attacks: Man-in-the-Middle (MitM) attacks involve intercepting communications between a user's device and a website's server. Attackers position themselves invisibly between the two parties, enabling them to capture and potentially alter the data in transit. Through HTTPS spoofing, attackers can create a false sense of security, gaining access to sensitive data while remaining undetected.

3. SSL Stripping: SSL stripping is a cunning technique where intruders force a secure HTTPS connection to downgrade into an unencrypted HTTP connection. Users are often unaware of this transition, as attackers manipulate the communication between the user and the website. Victims believe they are on a secure site, while their data becomes susceptible to interception and manipulation.

How HTTPS Spoofing Operates

The mechanics of HTTPS spoofing involve exploiting vulnerabilities in the way browsers display security indicators and how users perceive them. Here are the steps that intruders take to execute HTTPS spoofing:

1. Crafting Deceptive Websites: Attackers design deceptive websites that mirror the appearance of legitimate ones, using similar domain names, logos, and content to create an illusion of authenticity.

2. Obtaining Fake Certificates: To deceive users, cyber attackers obtain counterfeit SSL/TLS certificates for their deceptive websites. These certificates are crucial in generating the green padlock icon and "https://" in the browser's address bar, fostering a false sense of security.

3. Manipulating Browser Behavior: Browsers are designed to prioritize displaying the green padlock and "https://" in the address bar, conveying a message of security to users. Attackers exploit this behavior to ensure their deceptive websites trigger these security indicators.

4. Luring Users: Cyber attackers entice users to their fraudulent websites through various means, including phishing emails, malicious links, or compromised advertisements. The presence of familiar security indicators can lead users to believe they are safe, encouraging them to share sensitive information.

5. Data Interception: Once users input their sensitive data, such as login credentials, credit card numbers, or personal details, attackers capture this information. Despite the appearance of security, the sensitive data falls into the hands of cybercriminals.

Risks and Consequences of HTTPS Spoofing
The risks associated with HTTPS spoofing are extensive and can lead to dire consequences:

1. Data Theft and Privacy Breaches: The foremost risk is the theft of sensitive data. Attackers can pilfer users' login credentials, financial information, and personal details, leading to identity theft and severe invasions of privacy.

2. Financial Loss: Stolen financial information can result in unauthorized transactions and financial losses. Victims may find themselves dealing with fraudulent credit card charges, unauthorized withdrawals, or drained bank accounts.

3. Reputation Damage: Businesses falling victim to HTTPS spoofing attacks may suffer substantial damage to their reputation. Customers who are victimized may lose trust in the business's ability to secure their information, potentially resulting in a loss of customer base.

4. Malware Infections: Attackers can exploit HTTPS spoofing to distribute malware. Unsuspecting users who interact with deceptive websites may inadvertently download malicious software onto their devices, endangering their digital environment.

5. Legal and Regulatory Consequences: For businesses, a failure to adequately protect user data can lead to legal repercussions and regulatory fines. Violations of data protection regulations, such as GDPR or HIPAA, can result in severe financial penalties.

Protecting Against HTTPS Spoofing

Mitigating the risks posed by HTTPS spoofing demands a proactive and multifaceted approach:

- Stay Vigilant: Educating users about the perils of phishing and the importance of verifying website domains is essential. Encourage users to scrutinize URLs, inspect SSL certificates, and exercise caution with unsolicited communications.

- Implement Multi-Factor Authentication: Adding an extra layer of security through multi-factor authentication can thwart attackers, even if they manage to steal credentials.

- Regular Monitoring: Regularly monitoring certificate transparency logs can help identify unauthorized SSL certificates issued for your domain, aiding in detecting potential spoofing attempts.

- Security Awareness Training: Businesses should provide regular security awareness training for employees to empower them to recognize phishing attempts and suspicious websites.

- Keep Software Updated: Keeping browsers and security software up to date ensures protection against emerging threats and vulnerabilities.

By adopting robust security practices, staying informed about emerging threats, and fostering a culture of cybersecurity awareness, individuals and organizations can effectively thwart cybercriminals seeking to compromise data, privacy, and the trust that underpins online interactions.
Read more »
Unauthorized access
Cyber Security Data Privacy Google Microsoft Phishing Attacks Protocol Spoofing TLS Unauthorized access

Microsoft and Google's Approach to Replace Obsolete TLS Protocols

Tech behemoths Microsoft and Google have teamed up to phase out outmoded TLS (Transport Layer Security) protocols in a decisive drive to strengthen online security. TLS protocols are essential for protecting internet connections because they guarantee that data is kept private and unchanged while in transit. Older TLS versions are now vulnerable to attacks as cyber threats advance, which has sparked a move toward more see-cure alternatives.

Microsoft, in a recent announcement, emphasized the importance of migrating away from TLS 1.0 and 1.1. As per their advisory, support for these outdated protocols will be disabled in the upcoming Windows updates. Jeff Jones, Senior Director at Microsoft, stated, "Continued use of these older protocols leaves systems open to numerous known vulnerabilities and attacks." This proactive measure is aimed at safeguarding users against potential security breaches.

Google has echoed this sentiment, highlighting the necessity for a collective industry effort to deprecate obsolete TLS versions. The company has already taken steps towards this goal, gradually phasing out support for TLS 1.0 and 1.1 across its products and services. A spokesperson from Google emphasized, "It's crucial for the entire ecosystem to move towards more secure protocols to ensure a safer online experience for everyone."

The move towards more advanced TLS protocols is a critical step in fortifying cybersecurity in an age of increasingly sophisticated cyber threats. TLS 1.0, introduced over two decades ago, and TLS 1.1, which followed shortly after, have shown their age. Security experts have identified vulnerabilities that make them susceptible to various attacks, including the notorious BEAST and POODLE exploits.

This joint effort by Microsoft and Google serves as a powerful catalyst for industry-wide change. It sends a clear message to developers, businesses, and users alike that embracing modern TLS protocols is essential for maintaining a secure online environment. As the transition gains momentum, organizations are encouraged to update their systems and applications to support TLS 1.2 and 1.3, which offer significantly improved security features.

Microsoft and Google's joint initiative to phase out antiquated TLS protocols represents a big step towards a more secure digital environment. This move not only improves the security of their individual ecosystems but also establishes an important standard for the larger tech community. The adoption of contemporary TLS protocols is a critical step in the direction of evolving defenses against cyber attacks to keep pace with the digital world.




Read more »
User Privacy
Data Breach Food Delivery Apps Hackers Phishing Attacks Private Data Scam Spoofing User Privacy

Hackers Target Chick-fil-A Customers Credentials

Chick-fil-A- is investigating concerns of suspicious transactions on its mobile app after multiple users claimed that hackers gained their personal data, including bank account details.

Customers at Chick-fil-A, a well-known chicken restaurant business, may be the latest targets of hackers. According to a recent article in Nation's Restaurant News, the fast food chain is investigating potential hacks of mobile apps that have exposed customers' sensitive information.

According to Krebs on Security, one bank claimed it had nearly 9,000 customer card details listed in an alert sent to various financial institutions regarding a breach at an anonymous retailer that occurred between December 2, 2013, and September 30, 2014, and that Chick-fil-A locations were the only common point-of-purchase. As per Krebs, "the majority of the fraud, according to a financial source, appeared to be centered at sites in Georgia, Maryland, Pennsylvania, Texas, and Virginia."

Customers are recommended to promptly change their passwords to new ones that are distinct, complex, and therefore not used for other online platforms or accounts if they detect anything unusual.

In regard to the reports, Chick-fil-A posted a statement on social media stating that the company is aware of the matter and is working quickly to resolve it. The business does point out that it has not discovered proof that its internal security has been infiltrated by hackers or otherwise compromised.

Customers who are impacted can find information on what to do if they see any suspicious activity on their accounts, can see mobile orders placed without their consent, or discover that their loyalty points were fraudulently redeemed or used to purchase gifts on a support page on Chick-fil-One A's Membership Program customer service website.

Read more »
User Privacy
Black Cat Data Breach Data theft extortion Ransomware Attacks. Spoofing User Privacy

Cybercriminals Stole Data by Spoofing Victim's Webpage

The BlackCat ransomware group is experimenting with a new method of threatening victims into paying extortion building a fake website on the open internet that displays the personal information that was stolen from the victim. 

ALPHV, commonly known as BlackCat ransomware, is notorious for experimenting with unique forms of extortion in an effort to coerce and shame its victims into making a payment. All of the information appears to be accessible on the fake website, which redirects to a domain name that is slightly misspelled compared to the domain of the consulting business.

Hackers Infiltrate a firm 

On December 26, the malicious actors disclosed to have infiltrated a financial services company on their data leak website, which was concealed on the Tor network.

BlackCat publicized all the obtained files as punishment because the victim did not comply with the threat actor's demands, being a common practice for ransomware operators. Instead of following the typical procedure, the hackers chose to publish the data on a website that closely resembles the victims in terms of both design and domain name.

A variety of materials are located on the cloned website, including payment forms, asset and expense information, employment information, notes to staff, financial information for partners, and passport scans. A file-sharing service was also used to distribute the 3.5GB of documents.

According to Brett Callow, a threat researcher at the security firm Emsisoft, published data on a typosquatting site might cause the target company more concern than disseminating it via a webpage on the Tor network, which is primarily used by the infosec community.

This approach might signify the beginning of a new trend that other ransomware gangs may embrace, notably since the costs to execute it are negligible. It includes disclosing the identity of the infiltrated firm, taking data, and threatening to disclose it unless a ransom is paid, as well as the DDoS threat.


Read more »
Spoofing
Cyber Fraud Email Fraud phishing Scam Security Spoofing

The Four Major Types of Spoofing Attacks and How to Avoid Them

 

Spoofing is the act of concealing a communication or identity so that it appears to be from a reliable, authorized source. Spoofing attacks can take many forms, ranging from the common email spoofing attacks used in phishing campaigns to caller ID spoofing attacks used to commit fraud. 

As part of a spoofing attack, attackers may also target more technical elements of an organization's network, such as an IP address, domain name system (DNS) server, or Address Resolution Protocol (ARP) service. 

Spoofing attacks typically prey on trusted relationships by impersonating a person or organization known to the victim. These messages may even be personalized to the victim in some cases, such as whale phishing attacks that use email spoofing or website spoofing. there are various types of spoofing attacks. Here are three of the most common.
  • IP spoofing attack
An IP spoofing attack occurs when an attacker attempts to impersonate an IP address in order to pretend to be another user. The attacker sends packets from a false source address during an IP address spoofing attack. These IP packets are sent to network devices and function similarly to a DoS attack. To overwhelm a device with too many packets, the attacker uses multiple packet addresses.
 
IP spoofing attacks, which are one of the more common types of spoofing attacks, can be detected using a network analyzer or bandwidth monitoring tool. Monitoring your network will allow you to monitor normal traffic usage and detect abnormal traffic. This alerts  that something isn't right and allows you to investigate further.

If looking for IP addresses and flow data in particular that can lead you to illegal internet traffic. Detecting IP spoofing attacks early is critical because they frequently occur as part of DDoS (Direct Denial of Service) attacks, which can bring the entire network down.
  • Email Spoofing Attacks
Email spoofing attacks occur when an attacker sends an email that appears to be from another sender. The sender field is spoofing in these attacks to display bogus contact information. The attacker pretends to be this entity and then sends you an email asking for information. These attacks are frequently used to impersonate administrators and request account information from other members of staff.
 
Email spoofing attacks are perhaps the most dangerous because they directly target employees. Responding to the wrong email can give an attacker access to sensitive information. If you receive a spoofed email, your first line of defense should be to be skeptical of email display names.

Attackers frequently spoof display names, so double-check the email address. If the email contains any links, you can open them in a new window to see if they are legitimate. It's also a good idea to look for spelling mistakes and other inaccuracies that could indicate the sender isn't legitimate.
  • DNS Spoofing Attacks
DNS, or domain name system, attacks jumble up the list of public IP addresses. DNS servers maintain a database of public IP addresses and hostnames that are used to aid in network navigation. When a DNS attack occurs, the attacker alters domain names, causing them to be rerouted to a new IP address.

One example is when you enter a website URL and are directed to a spoofed domain rather than the website you intended to visit. This is a common method for attackers to introduce worms and viruses into networks.

It is a good idea to use a tool like dnstraceroute to detect a DNS spoofing attack. DNS spoofing attacks rely on an attacker spoofing the DNS response. Using dnstraceroute, you can see where the DNS request was answered. You'll be able to see the DNS server's location and whether someone spoofed the DNS response.
Read more »
User Security
Cyber Attacks Malicious Mails Phishing Attacks Spoofing User Security

Hackers Mimic Google Translate to Launch Phishing Attacks

 

Threat analysts at Avanan, a Check Point Software firm, have unearthed a novel phishing campaign mimicking Google Translate in order to lure users. 

The hackers are employing the coding methodology to obfuscate phishing sites and make them look authentic to the victim as well as bypass security gateways. Threat actors also use social engineering techniques to convince users they need to respond immediately to an email or lose access to unread messages permanently. 

Subsequently, the victims are requested to click on a link incorporated in the email itself. Upon clicking on the link, the users are directed to an info stealer page that seems to be an authentic Google Translate page, with a pre-filled email field that requires only to fill login credentials. 

According to a blog post published last week, this is the standard modus operandi employed by hackers as it creates a sense of urgency and forces victims to act irrationally and recklessly by clicking on a malicious link or downloading a malicious attachment. Behind the scenes, the hackers are also employing a lot of JavaScript, including the Unescape command, to hide their true intentions. 

Unescape is a function in JavaScript that computes a new string as a single parameter and utilizes it to decode the string encoded by the escape function. The hexadecimal sequence in the string is replaced by the characters they represent when decoded through unescaped command. 

“This attack has a little bit of everything. It has unique social engineering at the front end. It leverages a legitimate site to help get into the inbox. It uses trickery and obfuscation to confuse security services,” Jeremy Fuchs, an Avanan cybersecurity threat analyst stated. 

To guard against these attacks, users need to be extra vigilant. The researchers recommended users scan the URLs found in messages before clicking on them to ensure the destination is legitimate.

Moreover, users can check the authenticity of emails by paying closer attention to grammar, spelling, and factual inconsistencies within an email. If the users are suspicious regarding where they're coming from or their intentions, they should just ask the original sender to be sure before taking further action.
Read more »
Spoofing Attack
Chinese Chinese Actors Cyber Security Fake Website fake websites Misinformation Spoofing Spoofing Attack

Smash and Grab: Meta Takes Down Disinformation Campaigns Run by China and Russia

 

Meta, Facebook’s parent company has confirmed that it has taken down two significant but unrelated ‘disinformation operations’ rolling out from China and Russia. 

The campaigns began at the beginning of May 2022, targeting media users in Germany, France, Italy, Ukraine, and the UK. The campaign attempted to influence public opinions by pushing fake narratives in the west, pertaining to US elections and the war in Ukraine. 

The campaign spoofed around 60 websites, impersonating legitimate news websites, such as The Guardian in the UK and Bild and Der Spiegel in Germany. The sites did not only imitate the format and design of the original news sites but also copied photos and bylines from the news reporters in some cases. 

“There, they would post original articles that criticized Ukraine and Ukrainian refugees, supported Russia, and argued that Western sanctions on Russia would backfire […] They would then promote these articles and also original memes and YouTube videos across many internet services, including Facebook, Instagram, Telegram, Twitter, petitions websites Change.org and Avaaz, and even LiveJournal” Meta stated in a blog post. 

In the wake of this security incident, Facebook and Instagram have reportedly removed nearly 2,000 accounts, more than 700 pages, and one group. Additionally, Meta detected around $105,000 in advertising. While Meta has been actively quashing fake websites, more spoofed websites continue to show up.  

However, “It presented an unusual combination of sophistication and brute force,” claims Meta’s Ben Nimmo and David Agranovich in a blog post announcing the takedowns. “The spoofed websites and the use of many languages demanded both technical and linguistic investment. The amplification on social media, on the other hand, relied primarily on crude ads and fake accounts.” 

“Together, these two approaches worked as an attempted ‘smash-and-grab’ against the information environment, rather than a serious effort to occupy it long term.” 

Both the operations are now taken down as the campaigns were a violation of Meta’s “coordinated inauthentic behaviour” rule, defined as “coordinated efforts to manipulate public debate for a strategic goal, in which fake accounts are central to the operation”. 

Addressing the situation of emerging fraud campaigns, Ben Nimmo further said, “We know that even small operations these days work across lots of different social media platforms. So the more we can share information about it, the more we can tell people how this is happening, the more we can all raise our defences.”
Read more »
Spoofing
Email Fraud PayPal Phishing Attacks Privacy Spoofing

PayPal Invoices Used for Data Theft

The past few months have seen an increase in the usage of convincing phishing emails made using an attack on PayPal's invoice system. Scammers are constantly seeking new ways to steal your personal information or money. 

Hackers send bogus invoices from PayPal's website using a free PayPal account they have registered. The emails' bodies contained spoof logos of companies like Norton to make their recipients believe they were authentic.

Emails from PayPal will likely be delivered to your inbox rather than your spam bin because they are not regarded as spam. Because it came from a real Paypal account, the email will appear to be trustworthy so users are advised to stay cautious and not fall for it. You won't receive a worthwhile service if you pay this charge, cybercriminals will receive your money and use it for their own gain. 

The PayPal invoices feature statements like "thank you for purchasing Norton Security Premium package, if you have not authorized this transaction, please call us with your credit card details." They resemble a related fraud that employed phony Quickbooks invoices and was disclosed earlier this month.

The scam, often known as a "double spear" assault, prompts users to call the number, at which point hackers attempt to get them to pay the invoice and steal their credit card information.

Phishing efforts are frequent and come in a variety of shapes, according to a written statement from PayPal.

PayPal stated that it has a zero-tolerance policy for attempted fraud on the platform and that its team is working relentlessly to protect its consumers.

"We are aware of this well-known phishing scheme and have added more measures to help mitigate this particular incidence," the company said. "Nevertheless, we advise clients to exercise constant vigilance online and to get in touch with Customer Service immediately if they believe they are a victim of a scam."

It's astonishing how well-adapted modern fraudsters are at using the very same technologies that financial institutions have long utilized to provide their consumers a sense of security while dealing online. 

Today's scamsters seem to be more interested in hacking your entire computer and online life with remote administration software than they are in stealing your PayPal password, which seems to be at the center of the majority of frauds these days.

Users are advised to follow the guidelines given below in order to safeguard themselves against the aforementioned scam. 
  • To prevent phishing emails from being sent to you, don't rely on email spam filters. Examine emails for warning signs, such as impending deadlines and scare tactics, to spot potential phishing frauds.
  • Use a recognized phone number or email address to get in touch with the service provider directly to confirm the validity of an invoice. To get in touch with the service provider, do not utilize the phone number or link provided in the invoice.
  • The simple notion that an email was delivered via a reputable website should not be used as proof of its validity. To make their schemes seem more credible, cybercriminals can exploit reliable websites.

Read more »
Tactics
Cyber Fraud Financial Security Fraud Fraudster Identity Fraud Spoofing Tactics

Fraudsters Resorting to 'Synthetic Identity Fraud to Commit Financial Crimes

 

Identity theft is still a common tactic for hackers to damage the credit score. To steal even more and avoid discovery, an increasing number of fraudsters are turning to "synthetic identity fraud," which includes constructing spoof personalities to deceive financial institutions.

Michael Timoney, VP of Secure Payments at the Federal Reserve Bank of Boston stated, “This is growing. It’s got big numbers tied to $20 billion(Opens in a new window) plus (in losses), and we’re not really seeing a drop in it. Due to the pandemic, the numbers have gotten even higher."

Timoney described how the threat exploits a critical vulnerability in the US banking system at the RSA conference in San Francisco: when a customer applies for a credit card or a loan, many businesses do not always verify their identification. Timoney defined synthetic identity fraud as the use of multiple pieces of personally identifiable information to create a totally new person. 

He added, “It’s different from traditional identity theft because if someone stole my identity they would be acting in my name. I would go into my bank account and see my money is gone or I’d try to log into my account but I’d be locked out.” 

“Because of data breaches, there is so much information out there for sale. In other cases, the crooks will alter or make up the Social Security number and address data entirely, hoping the companies won't catch on. Once you apply for credit with your brand new identity, there is no credit file out there for you, but one gets created immediately. So right off the bat, you now have a credit file associated with this synthetic. So it sort of validates the identity. Now you got an identity and it has a credit record."  

The hacker will then strive to improve the credit rating of the spoof identity in order to secure larger loans or credit card limits before bailing without ever paying the lending agency. He added that the fraudster will settle their charges and request further credit. 

According to Timoney, the scammers have also been using the fraudulent personas to seek for unemployment benefits and obtain loans from the Paycheck Protection Program, which began during the pandemic to assist businesses in paying their employees. 

How to stop synthetic identity fraud?

To combat synthetic identity fraud, the United States is developing (Opens in a new window) the Electronic Consent Based Social Security Number Verification Service, which can determine whether a Social Security number matches one of these on record. However, Timoney stated that the system will only be offered to financial institutions and will not be open to other industries that provide credit to clients. 

In response, Timoney emphasized that it is critical for businesses to be on the lookout for warning indicators linked with synthetic identity fraud. This might include inconsistencies in the applicant's background. For example, consider a person who is 60 years old but has never had a credit history while having lived in the United States their whole life or an 18-year-old with a credit score of at least 800. 

Another method for detecting synthetic identity theft is to see if a loan application has any confirmed family members. One should be looking at a lot more than just the name, address, and Social Security number.
Read more »
Spoofing
attacks Cyber Attacks Emails Hackers Spear Phishing Spoofing

New Spear Phishing Campaign Targets Russian Dissidents

 

In Russia, a new spear-phishing campaign targeting dissenters with alternative views to those presented by the state and national media over the war in Ukraine is underway. The campaign distributes emails to government personnel and public servants, alerting them about software and online platforms that are illegal in the country. 

The mails contain a malicious attachment or link that sends a Cobalt Strike beacon to the recipient's computer, allowing remote operators to execute eavesdropping on the victim. The campaign was discovered and reported on by Malwarebytes Labs threat analysts, who were able to sample some of the bait emails. 

Various phishing methods

To persuade recipients to open the attachment, the phishing emails pretend to be from a Russian state organisation, ministry, or federal service. The main two spoofed organizations are the "Russian Federation Ministry of Information Technologies and Communications" and the "Russian Federation Ministry of Digital Development, Communications, and Mass Communications." 

To attack their targets with Cobalt Strike, the threat actors use three different file types: RTF (rich text format) files, archive attachments of malicious documents, and download links inserted in the email body. Since it involves the exploitation of CVE-2021-40444, a remote code execution flaw in the rendering engine used by Microsoft Office documents, the case of RTFs is the most interesting. 

All of the phishing emails are written in Russian, as expected, and they appear to have been created by native speakers rather than machine translated, implying that the campaign is being spearheaded by a Russian-speaking individual. Malwarebytes discovered simultaneous attempts to spread a deeply obfuscated PowerShell-based remote access trojan (RAT) with next-stage payload fetching capabilities in addition to Cobalt Strike. 

The campaign's targets are mostly employed by the Russian government and public sector, including the following organisations: 
  • Portal of authorities of the Chuvash Republic Official Internet portal
  • Russian Ministry of Internal Affairs
  • ministry of education and science of the Republic of Altai
  • Ministry of Education of the Stavropol Territory
  • Minister of Education and Science of the Republic of North Ossetia-Alania
  • Government of Astrakhan region
  • Ministry of Education of the Irkutsk region
  • Portal of the state and municipal service Moscow region
  • Ministry of science and higher education of the Russian Federation
As per the aforementioned organisations, phishing actors target persons in crucial positions who could cause problems for the central government by stirring anti-war movements.
Read more »
Vulnerabilities and Exploits
Bug DDOS Attack Djano Exploits Flaws Fraud Password Hacking Scam Spoofing Vulnerabilities and Exploits

IP Spoofing Flaw Leaves Django REST Applications Vulnerable to DDoS Attacks

 

Attackers used an IP spoofing flaw in Django REST to bypass the framework's throttling function, which is designed to protect apps from mass requests. 

Mozilla, Red Hat, and Heroku, among others, use Django REST as a toolkit for constructing web APIs. It includes a throttling function that limits the number of API queries a client may make. Bot activity, denial-of-service attacks, and malicious actions such as brute-force attempts on login sites, one-time passwords, and password reset pages are all protected by this feature. 

IP addresses are used by Django REST to recognize clients and implement throttling request restrictions. Clients can, however, deceive the server and hide their IP address, according to security researcher Hosein Vita. 

He told The Daily Swig, “Django use WSGI (web server gateway interface) to communicate with web application and X-Forwarded-For HTTP header and REMOTE_ADDR WSGI variable are used to uniquely identify client IP addresses for throttling.” 

As a result, if the X-Forwarded-For header is included in a web request, the server will interpret it as the client's IP address. Vita was able to submit an endless number of requests with the same client by changing the X-Forwarded-For value. The approach only works for unauthenticated queries, according to Vita's bug report. 

APIs that require user authentication take both the user’s ID and the IP address into account when throttling, so IP spoofing is not enough to circumvent the request limits. According to Vita, the attack requires no specific server access, and an attacker who "can just see the website can abuse this method. 

Its immediate impact could be DDoS attacks caused by fraudulent requests flooding Django servers. However, it can also be used for other objectives, such as bypassing login page defences against brute-force attacks. Vita apparently identified the flaw while pen-testing an app with a one-time password login page. 

He stated, “You could log in [to the application] with OTP but I got blocked after many attempts. After my research, I used X-Forwarded-For header, and again I could send requests but after some attempts, again I got blocked.” 

The researcher added: “From my previous background in Django, I guessed it could get bypassed by changing the value of X-Forwarded-For header, and you could send 30 requests with each IP. Then I checked that in my Django API and it was correct.” 

The Django REST team was contacted by The Daily Swig for comment on the vulnerability. Meanwhile, Vita suggests using complementary strategies to protect applications from brute-force attacks. 

He added, “Always use other aspects of security measures as secondary methods. Use Captcha or other related methods to reduce attacks like this in important endpoints. For OTPs, use a token for each generated OTPs.”
Read more »
Spoofing
Cyber Fraud Data Privacy Fake Sites Financial Data Fraud Schemes Government Sites Spoofing

FBI: Fake Government Websites Used to Steal Private & Financial Data

 

The FBI has alerted the public in the United States that threat actors are proactively capturing sensitive financial and personal information from innocent victims via phoney and fraudulent unemployment benefit websites. 

Websites used in these assaults are built to seem just like official government platforms in order to deceive victims into giving over their information, infecting them with malware, and claiming unemployment benefits on their behalf. 

The federal law enforcement agency stated in a public service announcement published on Internet Crime Complaint Center's site, "These spoofed websites imitate the appearance of and can be easily mistaken for legitimate websites offering unemployment benefits. The fake websites prompt victims to enter sensitive personal and financial information. Cyber actors use this information to redirect unemployment benefits, harvest user credentials, collect personally identifiable information, and infect victim's devices with malware.” 

"In addition to a loss of benefits, victims of this activity can suffer a range of additional consequences, including ransomware infection and identity theft." 

As per the FBI, 385 domains were detected, with eight of them spoofing government sites related to official unemployment benefits platforms. Domain and status are listed below:
  • employ-nv[.]xyz:  Active 
  • employ-wiscon[.]xyz: Inactive 
  • gov2go[.]xyz : Active 
  • illiform-gov[.]xyz : Active 
  • mary-landgov[.]xyz : Active 
  • Marylandgov[.]xyz: Inactive 
  • newstate-nm[.]xyz:  Active 
  • Newstatenm[.]xyz: Inactive 
There is also a possibility that the data obtained through these fake sites will end up in the hands of identity fraudsters, who would use it in different benefit fraud schemes. The US Federal Trade Commission (FTC) reported in February 2021 that the overall number of identity theft reports doubled in 2020 compared to 2019, with 1.4 million reports in a single year. 

The FTC stated, "2020’s biggest surge in identity theft reports to the FTC related to the nationwide dip in employment. After the government expanded unemployment benefits to people left jobless by the pandemic, cybercriminals filed unemployment claims using other people’s personal information." 

For example, the FTC received 394,280 reports of government benefits fraud attempts last year, the majority of which were connected to unemployment benefit identity theft fraud, compared to 12,900 reported in 2019. 

The Internal Revenue Service (IRS) also issued taxpayer guidelines in January on recognizing theft activities involving unemployment payments. The US federal revenue service stated, "The Internal Revenue Service today urged taxpayers who receive Forms 1099-G for unemployment benefits they did not actually get because of identity theft to contact their appropriate state agency for a corrected form." 

"Additionally, if taxpayers are concerned that their personal information has been stolen and they want to protect their identity when filing their federal tax return, they can request an Identity Protection Pin (IP PIN) from the IRS." 

The FBI also offered some advice on how to safeguard yourself against identity theft in the release and a few are listed below: 
  • To identify limitations, the spelling of web addresses should be verified. 
  • Check that the website you're visiting has an SSL certificate. 
  • Software upgrades are required; 
  • It is recommended that two-factor authentication be utilized. 
  • Avoid phishing emails at all costs.
Read more »
Subscribe to: Posts (Atom)