Search This Blog
Powered by Blogger.

Blog Archive

Labels

About Me

Load More
Trendy Right Now

Popular Posts

Showing posts with label User Security. Show all posts
User Security
Data Breach Lawsuit Treasury Department US Citizens User Security

19 US States Sue to Prevent DOGE From Accessing Americans' Private Data

 

In an effort to prevent Elon Musk's Department of Government Efficiency from gaining access to Treasury Department documents that hold private information like Social Security numbers and bank account numbers for millions of Americans, 19 Democratic attorneys general filed a lawsuit against President Donald Trump on Friday last week. 

Filed in federal court in New York City, the lawsuit claims that the Trump administration violated federal law by giving Musk's team access to the Treasury Department's central payment system. 

The payment system manages tax refunds, Social Security payments, veterans' benefits, and much more. It sends out trillions of dollars annually and contains a vast network of financial and personal information about Americans. To identify and cut out what the Trump administration has determined to be unnecessary federal spending, Musk established his Department of federal Efficiency, or DOGE. 

Supporters have applauded the concept of limiting bloated government finances, but critics have expressed wide concern over Musk's growing authority as a result of DOGE's access to Treasury documents and its review of other government agencies. 

The case was filed by the office of New York Attorney General Letitia James, who stated that DOGE's access to the Treasury Department's data presents security issues and the potential for an illegal federal fund freezing. 

“This unelected group, led by the world’s richest man, is not authorized to have this information, and they explicitly sought this unauthorized access to illegally block payments that millions of Americans rely on, payments for health care, child care and other essential programs,” James noted in a video message published by her office. 

James, a Democrat who has been one of Trump's main opponents, stated that the president cannot stop federal payments that Congress has authorised or give out Americans' private information to anybody he wants. Moreover, Arizona, California, Colorado, Connecticut, Delaware, Hawaii, Illinois, Maine, Maryland, Massachusetts, Minnesota, Nevada, New Jersey, North Carolina, Oregon, Rhode Island, Vermont, and Wisconsin are parties to the complaint.

The suit claims that DOGE's access to Treasury records may interfere with funding already approved by Congress, which would go beyond the Treasury Department's legislative power. The case further contends that DOGE access violates federal administrative law as well as the separation of powers doctrine of the US Constitution. 

It also accuses Treasury Secretary Scott Bessent of altering the department's long-standing policy of safeguarding sensitive personally identifiable information and financial information in order to grant Musk's DOGE team access to the payment systems. 

The Treasury Department has stated that the review is intended to assess the system's integrity and that no adjustments would be made. According to two people familiar with the situation, Musk's team began exploring ways to block payments made by the US Agency for International Development, which Trump and Musk are aiming to abolish. The two persons spoke to The Associated Press on the condition of anonymity for fear of punishment.
Read more »
User Security
Cyber Fraud phishing QR code Quishing User Security

Quishing On The Rise: Strategies to Avert QR Code Phishing

 

QR codes are already ubiquitous: from restaurant menus to public transportation schedules, everyone wants you to scan theirs. This normalisation of scanning random QR codes is being exploited, resulting in a new cybersecurity threat known as Quishing. 

What is Quishing? 

Quishing (QR code phishing) is the process of placing a malicious URL into a QR code. Rather than linking to a legitimate website, the code will load a page that attempts to steal information, infect your device with malware, or execute another malicious act.

It's a goofy name, but it poses a serious threat. While we're all aware that you shouldn't browse suspicious websites or download unfamiliar files, the nature of QR codes makes it impossible to tell what's on the other side. With a scan and a tap, you're whisked away to a website that may contain material you don't want to see, or routed to a malware download. 

It's also possible to be duped into scanning a QR code: many businesses build their QR codes using third-party services and URL shorteners, which means that the embedded links may not always redirect to their actual websites. This makes it challenging to determine whether a QR code has been tampered by someone carrying out a quishing assault.

Is quishing a real threat? 

Yes. It is already happening and has proven to be beneficial. QR codes for parking meters, restaurant payments and tip systems, and phoney advertisements are being tampered with all across the world to perpetrate quishing frauds, typically by simply sticking a sticker with a bogus QR over an already existing official code.

These trick codes then lead to false login pages and payment sites, where you can either pay the scammer directly or give them your information (which can be used to steal your money later or push further scams). 

Safety tips 

There are a few efficient strategies to safeguard yourself from quishing: 

  • Make use of your device's built-in QR code scanner. App shops' QR scanners have a bad reputation for security and privacy.
  • Avoid clicking on links that employ URL shorteners and make sure the destination a QR code is attempting to direct you to is genuine before clicking on the link. 
  • Avoid paying with QR codes whenever you can, especially if the payment link takes you to an unidentified address. 
  • Additionally, be aware that phoney websites often use names that sound similar to legitimate ones, so double-check your spelling.
Read more »
User Security
Cyber Attacks Malicious Campaign Mishing PDF Files User Security

Cybercriminals Exploit PDFs in Novel Mishing Campaign

 

In a recently uncovered phishing campaign, threat actors are employing malicious PDF files to target mobile device users in potentially more than fifty nations.

Dubbed as the "PDF Mishing Attack," the effort exposes new vulnerabilities in mobile platforms by taking advantage of the general belief that PDFs are a secure file format. 

The phishing campaign poses as the United States Postal Service (USPS) to earn consumers' trust and trick them into downloading infected PDFs. Once opened, the hidden links take victims to phishing pages designed to steal credentials.

"PDFs are used extensively for contracts, reports, manuals, invoices, and other critical business communications," said the zLabs team at Zimperium, who uncovered the campaign. “Their ability to incorporate text, images, hyperlinks, and digital signatures while maintaining integrity makes them ideal for enterprises prioritizing professionalism and compliance.” 

Hidden in plain sight 

Threat analysts at zLabs have been keeping a close eye on the phishing campaign, which targets only mobile devices and poses as the US Postal Service (USPS). It has discovered 630 phishing pages and over 20 malicious PDF files.

“This campaign employs sophisticated social engineering tactics and a never-before-seen means of obfuscation to deliver malicious PDF files designed to steal credentials and compromise sensitive data,” the researchers noted. 

Advanced evasion techniques hide clickable malicious URLs within PDF documents, easily bypassing traditional endpoint security solutions. This assault is primarily aimed at mobile device users, capitalising on the limited accessibility that mobile platforms provide while previewing file contents. Unlike desktop platforms, where PDFs are often used with security overlays, mobile devices lack the same safeguards, leaving users vulnerable to covert attacks. 

On threat detection 

This latest attack highlights the need for enhanced mobile threat defenses. PDFs have long been thought to be safe for sharing and storing information, however this is not the case. 

According to an HP Wolf Security report, PDF threats are on the rise. While online criminals used to primarily use PDF lures to steal credentials and financial data via phishing, there has been a shift and an increase in malware distribution via PDFs, including strains such as WikiLoader, Ursnif, and Darkgate. 

Zimperium emphasises the value of on-device threat detection to find and eliminate these scourges before they can do any damage because traditional endpoint security systems, which are sometimes made with desktop settings in mind, may not be able to detect sophisticated attacks on mobile platforms.
Read more »
User Security
Banshee Stealer Infostealer macOS malware User Security

New Version of Banshee Malware Targets macOS Users

 

According to the latest study published this week, a new variant of the info-stealing malware known as "Banshee" has been targeting macOS users' passwords, cryptocurrency wallets, browser credentials, and other data for at least the past four months.

Check Point researchers discovered that the latest version targets anyone using a Mac and can be downloaded mostly through malicious GitHub uploads, but also through other websites (GitHub's policies prohibit malware, but this does not mean there is no malware on GitHub). 

This latest Banshee malware often disguises itself as the Telegram messaging app or the Google Chrome browser, two popular apps that other malware attackers use to trick users. This version first surfaced in September last year and attempts to evade detection by using Apple's proprietary string encryption algorithm, XProtect.

This malware targets your browsing activities in Chrome, Brave, Edge, or Vivaldi. It also attempts to steal your cryptocurrency if you have any crypto wallet browser extensions installed, and it may show macOS victims fake login pages in an attempt to steal their usernames and passwords, which it then uses to steal accounts and funds. It will target your Coinbase, Ronin, Slope, TONNE, MetaMask, and other cryptocurrency wallet extensions if you have them. 

The source code for Banshee was leaked online in November. This could have helped antivirus companies ensure their software catches the sneakier version in the months since. Prior versions of this malware were marketed as "stealer-as-a-service" malware on cybercriminal channels, including attacker-controlled Telegram channels, for $3,000 per "license.” 

To stay protected from info-stealer malware, it's a good idea to consider getting a crypto hardware wallet like one from Ledger or Trezor if you have over $1,000 in crypto. In general, it's also a good practice to avoid storing more than $1,000 in any browser extension-based crypto wallet (you can also store funds with an exchange like Coinbase, Robinhood, or Kraken). 

Additionally, passwords should never be kept in an unsecured digital document on your computer (no Google Docs). Instead, think about keeping your crypto seed phrases on paper in a closed box or safe at home.
Read more »
User Security
Data Breach Data Leak Russian State Silent Crow User Security

Silent Crow Claims Hack of Russia’s Rosreestr, Leaks Citizens’ Personal Data

 



The hacking group Silent Crow has claimed responsibility for breaching Russia's Federal Service for State Registration, Cadastre, and Cartography (Rosreestr), releasing what it describes as a fragment of the agency’s database. The leak reportedly includes sensitive personal information of Russian citizens, raising significant cybersecurity and privacy concerns.

According to the Telegram channel Information Leaks, which first reported the incident, the exposed data set contains nearly 82,000 records. These records reportedly include:
  • Full Names
  • Birth Dates
  • Residential Addresses
  • Phone Numbers and Email Addresses
  • SNILS Numbers: Russian equivalents of Social Security numbers
  • Rosreestr IDs
Silent Crow shared details of the breach via its anonymous Telegram channel on January 6, 2025, claiming the leaked data includes approximately 90,000 entries from Russia's Unified State Register of Real Estate.

Journalist Andrey Zakharov examined 15 randomly selected entries from the leaked data and confirmed their authenticity. In several cases, the leaked property addresses matched individuals' known residences. However, the dataset notably omits cadastral numbers, which could directly link properties to their owners. Zakharov suggested this omission may have been intentional to conceal the full extent of the breach.

Rosreestr has not officially acknowledged the breach, stating only that "additional checks" are underway regarding the circulating reports on Telegram. No formal confirmation or denial has been issued as of now.

Rosreestr’s Role in Investigations

Rosreestr’s real estate data has historically been instrumental for journalists and independent investigators uncovering corruption. Investigations led by the late Alexey Navalny’s Anti-Corruption Foundation (FBK) frequently utilized Rosreestr records to expose properties owned by government officials, often purchased far beyond their declared incomes.

In response to these investigations, the Russian government restricted access to property ownership data. In March 2023, Rosreestr implemented stricter privacy controls under a personal data law passed in July 2022, allowing property owner information to be disclosed only with the owner's consent.

The Rosreestr breach highlights severe vulnerabilities in the cybersecurity infrastructure of large state agencies. Silent Crow’s statement emphasized this, stating, “Rosreestr has become a vivid example of how large state structures can fall in just a few days.” The leak raises serious concerns about the protection of sensitive government data and the potential misuse of this information.

As cybersecurity threats escalate globally, this incident underscores the urgent need for robust security measures within government databases to safeguard citizen data against malicious actors.
Read more »
User Security
14C Cyber Crime Digital Fraud Indian Government User Security

India Launches 'Report and Check Suspect' Feature to Combat Cybercrime

 

India’s National Cyber Crime Reporting Portal now features a ‘Report and Check Suspect’ tool, allowing users to verify UPI IDs, phone numbers, emails, and social media handles against a database of known cyber fraudsters.

Focusing on Digital Arrest Scams

The system targets scams where fraudsters impersonate officials to extort money under the pretense of “digital arrests.” Users can search the database at cybercrime.gov.in to identify potential threats.

Integrated Cybersecurity Measures

The tool complements other initiatives like blocking 669,000 fake SIM cards and implementing enhanced KYC protocols for digital lending. Major tech firms, including Google and Facebook, are collaborating with the Indian Cyber Crime Coordination Centre (I4C) to share threat intelligence and curb misuse of platforms like Google Firebase and Android banking malware.

The Ministry of Home Affairs has also established a Cyber Volunteer Framework, enabling citizens to report illegal online content and promote cyber hygiene. Additionally, the Citizen Financial Cyber Frauds Reporting and Management System (CFCFRMS) expedites action against financial frauds.

These initiatives align with India’s broader efforts to secure digital transactions, including mandating multi-factor authentication for government services by 2025.

Read more »
User Security
Brushing Scam Cyber Fraud Fake Reviews Online fraud User Security

Security Experts Warn of Brushing Scam Involving Unsolicited Packages

 

Online shopping is something that we all love. It is time-efficient, convenient, and frequently results in the best offers and savings. However, since many people are busy with online shopping, con artists are also trying to find ways to trick consumers for their own benefit. You see, the majority of us base our decisions on whether or not to purchase anything from an online retailer on product reviews and ratings. 

According to reports, scammers are using popularity and review manipulation to create phoney sales in a new scheme known as the "Brushing Scam.” 

Modus operandi 

The brushing scam is a fraudulent online practice when con artists deliver fake products to victims and then write reviews online using their identities. Chinese e-commerce tactics known as "brushing" are where sellers fabricate orders and reviews to boost their product ratings.

In this fraudulent campaign, random e-commerce site consumers receive unsolicited deliveries from vendors. These parcels frequently include low-quality, inexpensive products like seeds, tiny devices, or costume jewellery. After the delivery is delivered, the con artists use the recipient's name to write five-star reviews on the product page, which increases the product's visibility and creates a false sense of popularity on websites like Amazon and AliExpress. 

Targeting unsuspecting users

This scam, according to the McAfee investigation, aims to manipulate sales data and give the impression that there is a demand for and quality of products on e-commerce platforms. 

This method is misleading to genuine customers, who are therefore influenced to buy products based on phoney reviews rather than real customer reviews. How dangerous can it be, though, if users are receiving free goods? Through this scam, con artists are taking advantage of your personal data, and if you don't take any safeguards, they may even steal your money. 

As previously stated, scammers increase the popularity of products by sending unwanted deliveries using the identities and addresses of naïve e-commerce users. And they can get this information through data breaches or illegal purchases of private data. Receiving such a package could mean that your personal information has been stolen, presenting serious concerns such as identity theft and other privacy crimes. 

Beside from identity theft and misleading reviews, ABC Action News reports that many unwanted parcels now include QR codes inviting recipients to scan them. Scammers send tempting deals such as, "Scan this QR code to leave a review and win a $500 gift card." Scanning these QR codes may lead to fraudulent websites that attempt to steal sensitive information or install malware on your device. The stolen personal information can subsequently be exploited for financial theft or phishing attempts.
Read more »
User Security
Clickjacking Cyber Fraud Fake Captcha Malicious Campaign User Security

New “Double-Clickjacking” Threat Revealed: Security Settings at Risk

 

Cybersecurity experts are raising alarms about a new twist on the classic clickjacking attack technique. Paulos Yibelo, a security engineer at Amazon, has uncovered a variant called “double-clickjacking,” capable of disabling security settings, deleting accounts, or even taking over existing ones. This novel approach reignites concerns over online safety, urging users to be cautious when interacting with websites.

Clickjacking is a malicious tactic where hackers manipulate user clicks on one website to trigger unintended actions on another. For instance, a user might think they are clicking a button to navigate a site but inadvertently perform an action, such as making a purchase, on an entirely different platform.

Double-clickjacking takes this concept further by introducing an additional click. This adaptation helps attackers bypass modern browser protections that no longer deliver cross-site cookies. According to Yibelo, this seemingly minor tweak “opens the door to new UI manipulation attacks that bypass all known clickjacking protections.”

In documented cases, hackers lure victims to phishing websites, often disguised with a standard CAPTCHA verification process. Instead of typing text or identifying objects in images, users are prompted to double-click a button to prove they are human.

Here’s where the attack takes place:

  • First Click: The user closes the top window, seemingly completing the CAPTCHA process.
  • Second Click: This click is redirected to a sensitive page, such as an OAuth authorization or account settings page. The victim unknowingly confirms permissions, disables security features, or performs other critical actions.

Yibelo explains that this subtle manipulation is effective against many popular websites, allowing attackers to gain OAuth and API authorizations. The attack can also facilitate one-click account modifications, including disabling security settings, deleting accounts, authorizing money transfers, and verifying sensitive transactions. Even browser extensions are not immune to this method.

The Implications for Online Security

The resurgence of clickjacking attacks, now enhanced by the double-click variant, poses significant risks to both individual and organizational security. By exploiting common website interfaces and leveraging seemingly harmless CAPTCHA verifications, attackers can easily gain unauthorized access to sensitive information and functionalities.

Yibelo’s findings serve as a stark reminder of the evolving nature of cybersecurity threats. Websites must remain vigilant, regularly updating their defenses to counter these new manipulation techniques.

How to Stay Safe

Cybersecurity professionals recommend the following precautions to minimize the risk of falling victim to double-clickjacking:

  • Verify Websites: Always ensure you are on a legitimate website before interacting with any CAPTCHA or button.
  • Update Software: Keep browsers and extensions up-to-date with the latest security patches to reduce vulnerabilities.
  • Use Anti-Phishing Tools: Enable browser settings or software designed to detect and block phishing sites.
  • Be Skeptical: Avoid double-clicking buttons on unfamiliar sites, especially if prompted during unexpected verifications.

As cyber threats continue to evolve, user awareness remains a critical line of defense. The discovery of double-clickjacking highlights the importance of staying informed and cautious while navigating the digital world. By adopting secure browsing habits and staying vigilant, individuals and organizations can protect themselves against this emerging attack vector.

Read more »
Subscribe to: Posts (Atom)