Latest Cybersecurity News and Articles

---

Feds Seize $1.4 Million of Tech Support Scam Proceeds With the Help of Crypto Firm

The scam involves cybercriminals posing as Microsoft or Apple employees and convincing victims to transfer their funds to a fake "treasury account." The scammers also had victims install a digital currency wallet and transfer funds to USDT accounts.

---

Hackers Hiding Agent Tesla Keylogger, XWorm RAT Malware in SVG Image Files

Threat actors have been observed using SVG image files to distribute Agent Tesla keylogger and XWorm RAT malware in a two-month campaign. The use of SVG files allows threat actors to evade detection and successfully deliver harmful payloads.

---

Report: Investment Scams Grow, 13,000 Domains Detected in January 2024

Data from the Federal Trade Commission (FTC) revealed that investment scams resulted in over $4.6 billion in fraud losses in the United States in 2023, marking a troubling 21% rise from the previous year.

---

Research uncovers vulnerabilities in ChatGPT plugins

New research discloses the areas in ChatGPT plugins that could have been exploited. 

---

Researchers Detail Kubernetes Vulnerability That Enables Windows Node Takeover

Details have been made public about a now-patched high-severity flaw in Kubernetes that could allow a malicious attacker to achieve remote code execution with elevated privileges under specific circumstances. “The vulnerability allows remote code execution with SYSTEM privileges on all Windows endpoints within a Kubernetes cluster,” Akamai security researcher Tomer Peled said. “To exploit

---

PixPirate Android Malware Uses New Tactic to Hide on Phones

PixPirate utilizes two apps, including a downloader and a hidden malware app, to steal information and automate fraudulent transactions on the popular Brazilian payment platform Pix.

---

DarkGate Operators Exploit Microsoft Windows SmartScreen Bypass in Zero-Day Campaign

The Zero Day Initiative (ZDI) recently discovered a DarkGate campaign in mid-January 2024, leveraging CVE-2024-21412 with fake software installers distributed via Google DoubleClick Digital Marketing open redirects.

---

Keyloggers, Spyware, and Stealers Dominate SMB Malware Detections

These types of malware are used by attackers to steal data and credentials, which are then leveraged to gain unauthorized access, deploy ransomware, and carry out extortion.

---

White House Adds Teeth to Secure Software Development Requirements

The CISA and the Office of Management and Budget (OMB) have released an attestation form aimed at ensuring compliance with secure development practices for software producers working with the U.S. government.

---

Update: US Government Probes if Ransomware Gang Stole Change Healthcare Data

The BlackCat ransomware gang claims to have stolen 6TB of data from Change Healthcare, including sensitive information from various healthcare providers and insurance companies.

---

3 Things CISOs Achieve with Cato

Being a CISO is a balancing act: ensuring organizations are secure without compromising users’ productivity. This requires taking multiple elements into consideration, like cost, complexity, performance and user experience. CISOs around the globe use Cato SSE 360, as part of the Cato SASE Cloud platform to balance these factors without compromise. This article details how CISOs are

---

RedCurl Cybercrime Group Abuses Windows PCA Tool for Corporate Espionage

The Russian-speaking cybercrime group called RedCurl is leveraging a legitimate Microsoft Windows component called the Program Compatibility Assistant (PCA) to execute malicious commands. “The Program Compatibility Assistant Service (pcalua.exe) is a Windows service designed to identify and address compatibility issues with older programs,” Trend Micro said in an analysis

---

Bitcoin Fog Mixer Operator Convicted for Laundering $400 Million

Bitcoin Fog was a prominent cryptocurrency "tumbler" on the dark web, allowing cybercriminals to obscure the origins of their digital assets and make them harder to trace.

---

How Advances in AI are Impacting Business Cybersecurity

With the emergence of "interactive AI," security considerations become crucial. Interactive AI expands chatbots and digital assistants' capabilities, presenting new risks. Companies must exercise control and set boundaries to manage these risks.

---

Canada Sentences LockBit Hacker Mikhail Vasiliev to Four Years

LockBit ransomware affiliate Mikhail Vasiliev received a nearly four-year prison sentence in Canada and consented to extradition to the United States for conspiracy to commit computer intrusion.

---

Fortinet Warns of Critical RCE Bug in Endpoint Management Software

Fortinet patched a critical SQL injection vulnerability (CVE-2023-48788) in its FortiClient EMS software, allowing unauthenticated attackers to achieve remote code execution with SYSTEM privileges.

---

Russian Independent Media Outlet Meduza Faces ‘Most Intense Cyber Campaign’ Ever

The attacks on Meduza's systems include efforts to block mirror servers, launch DDoS attacks, compromise crowdfunding infrastructure, and target journalists with threats and spyware.

---

Ande Loader Malware Targets Manufacturing Sector in North America

The threat actor known as Blind Eagle has been observed using a loader malware called Ande Loader to deliver remote access trojans (RATs) like Remcos RAT and NjRAT. The attacks, which take the form of phishing emails, targeted Spanish-speaking users in the manufacturing industry based in North America, eSentire said. Blind Eagle (aka APT-C-36) is a financially motivated threat actor&

---

DarkGate Malware Exploits Recently Patched Microsoft Flaw in Zero-Day Attack

A DarkGate malware campaign observed in mid-January 2024 leveraged a recently patched security flaw in Microsoft Windows as a zero-day using bogus software installers. “During this campaign, users were lured using PDFs that contained Google DoubleClick Digital Marketing (DDM) open redirects that led unsuspecting victims to compromised sites hosting the Microsoft Windows SmartScreen bypass

---

Fortinet Warns of Severe SQLi Vulnerability in FortiClientEMS Software

Fortinet has warned of a critical security flaw impacting its FortiClientEMS software that could allow attackers to achieve code execution on affected systems. "An improper neutralization of special elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] in FortiClientEMS may allow an unauthenticated attacker to execute unauthorized code or commands via specifically crafted