Phishing attackers have found a new avenue: bogus job offers
A series of phishing campaigns are targeting companies in various industries with phony job offers using direct messages on LinkedIn, according to researchers at Proofpoint. The attacker initially makes contact by sending an invitation to the target on LinkedIn with a short message regarding job offers.
Within a week after the target accepts the invitation, the attacker will send a follow-up email with either a link or a PDF attachment that contains embedded URLs. These links take the target to a spoofed version of a real staffing service, which forces the download of either a Word document or a JScript loader. This document or loader will result in the installation of a JScript backdoor known as “More_eggs.”
More_eggs ... Read More
Phishing attacks leverage Boeing 737 Max warnings
Large airline crashes tend to uniquely focus almost everyone's attention. Lowlife Internet thieves exploit the fear surrounding Boeing 737 Max crashes. They leverage that fear in phishing attacks.
A new phishing attack campaign is underway that uses the recent Boeing 737 Max crashes as a way to infect workstations with both remote access and info-stealing Trojans. This new campaign was discovered by 360 Threat Intelligence Center, who posted about them on Twitter and include a VirusTotal link which shows the AV engines that catch it.
These emails pretend to be from a private intelligence analyst who found a leaked document on the dark web. This document pretends to contain information about other airline companies will be affected by similar crashes soon, ... Read More
Healthcare data under attack
As the healthcare industry continues to be an attractive target in cyberattacks, the latest data shows that cybercriminals are taking more patient health data than ever.
When the number of breaches doesn’t materially change from year to year, it’s a natural assumption that the impact of those breaches is equally similar.
According to new data in the 2019 Annual Breach Barometer Report from patient privacy monitoring vendor Protenus, the number of breaches rose from 477 breaches in 2017 to 503 in 2018, with the number of records nearly tripling year over year – from 5.6 million to a little under 15.1 million.
With breached records costing healthcare organizations an average of $408, the massive jump in the number of total records breaches incurs a significant cost.
Also according ... Read More
Let follow-ups strengthen your AI embrace
Anybody looking at AI (Artificial Intelligence) and asking: “How can it make my life easier?” Here’s something built into AI that can help: Follow-ups. You can ask your favorite AI engine a question then write a follow-up to give you a more concise answer. Here's how.
I am using Perplexity Pro, available at https://perplexity.ai. Here’s my first prompting example: “How much water should a 50-year-old man drink each day?” Perplexity answers with:
For a 50-year-old man, the general recommendation for daily water intake is about 15.5 cups, which is equivalent to approximately 3.7 liters or 125 ounces of fluids per day. This guideline includes all fluids consumed, not just plain water. About 20% of this fluid intake typically comes from food, with ... Read More
Identity theft scammers offer low-interest rate credit cards
Scammers have committed identity theft by stealing large amounts of personal and financial information from thousands of people. They place fraudulent phone calls and offer lower interest rates on credit cards, an investigation by CBC’s Marketplace has found.
The scammers request a service charge between $500 and $5000 dollars to reduce the victim’s interest rate. The victim is required to supply their name, date of birth and address, as well as their credit card number, expiration date and CVV number.
Originated in Pakistan
Marketplace obtained a leaked list of records from an illegal call center in Pakistan, which “contained a wealth of sensitive personal information, including credit card numbers, social insurance numbers, addresses, maiden names, employer names, and annual incomes.” The ... Read More
Internet thieves pose as IRS agents
The Internal Revenue Service is warning us about a surge in phishing emails, links, and phone calls during tax season, according to Toni Birdsong at McAfee. These Internet thieves pose as IRS agents and threaten to seize the victim’s tax refund or have them sent to jail unless the victim makes a payment. The same is likely going on in other countries.
Many of the phishing emails also contain malicious links through which the attackers steal sensitive data, either by sending victims to a spoofed website where their information is harvested or by triggering the download of information-stealing malware. Scammers are also using threatening phone calls to demand immediate payment of taxes and to procure personal information from victims over the phone.
The ... Read More
Extortion scams capitalize on compromised credentials, sensitive data, and technical vulnerabilities
Cyber thieves seeking sensitive data on high net-worth individuals will pay an average of $360,000 per year to target executives, lawyers, doctors, and other prominent figures, researchers discovered. The money comes through extortion
The Digital Shadows Photon Research Team today published "A Tale of Epic Extortions," a deep dive into the ways cybercriminals prey on individuals' online exposure. Extortionists take advantage of compromised credentials, sensitive data (documents, intellectual property), and technical vulnerabilities on Internet-facing applications to convince their victims to pay up.
Extortion has a human element
"The extortion landscape is broader and more diverse than any of us thought before we started," says Rafael Amado, senior strategy and research analyst with Digital Shadows.
Oftentimes, he continues, the technical ... Read More
Fake reviews waste time and money
Earlier this month, the US Federal Trade Commission banned fake reviews. FTC Chair Linda M Khan reported: “Fake reviews not only waste people’s time and money, but also pollute the marketplace and divert business away from honest competitors. By strengthening the FTC’s toolkit to fight deceptive advertising, the final rule will protect Americans from getting cheated, put businesses that unlawfully game the system on notice, and promote markets that are fair, honest, and competitive.”
In real-world terms, advertisers cannot buy fake reviews to help promote a movie. This includes both positive and negative reviews. But wait there’s more. This also includes reviews and testimonials from someone that does not exist. You guessed it, I am talking about AI here. The FTC ... Read More
Successful cyber attacks attract additional cyber attackers
Recent cyber attacks against city governments have provided their attackers with revenue from scams, data breaches, and data held ransom. They also draw the attention of other cyber thieves. If you were a smart cyber thief, you’d be wanting to find victims that meet a few criteria:
Relatively vulnerable to attack
High-Profile (particularly in the case of Ransomware)
Have lots of valuable data to steal/hold for ransom
Deals in large monetary transactions
Cities are attractive targets
City governments across the U.S. have been the victim of countless attacks over the last number of years. It’s because they are one of the few organizations that meet all the needed criteria.
Vulnerable to Attack – Cities usually run as multiple departments with disparate technology and processes, ... Read More
Time for a PCI-DSS Assessment? Maybe?
If you accept charge cards, you are subject to the rules laid out by the PCI Security Standards Council. You could be in medical, retail or online. The field does not matter. What matters is you accept charge cards and/or debit cards. The PCI Security Standards Council mandates assessments and vulnerability scans. You perform assessments annually, or after significant changes. You perform vulnerability scans quarterly, or after a significant change.
Annual PCI-DSS Assessments
You should perform PCI-DSS assessments annually, or after significant changes. "What does that mean?" you may say.
Annually. https://www.pcisecuritystandards.org/minisite/en/docs/Navigating_DSS_v2.pdf tells us on page 4 "At least annually and prior to the annual assessment,
the assessed entity should confirm the accuracy of their PCI DSS scope by identifying all locations and ... Read More