Latest Cybersecurity News and Articles

---

New Scam Alerts Users About YouTube Altering Policy

A phishing scam has come to light that uses YouTube's genuine no-reply@youtube[.]com email address to trick users into revealing their login details. The phishing email write-up contains a YouTube video and text informing users about YouTube’s new monetization policy and new rules. Meanwhile, YouTube has warned users to be cautious of the scam.

---

CryptoClippy: New Clipper Malware That Targets Portuguese Users

Cybercriminals launched a malvertising campaign involving malware named CryptoClippy to pilfer cryptocurrency from users in Portugal. Discovered by Palo Alto Networks Unit 42, the campaign uses SEO poisoning techniques to push users looking for "WhatsApp web" to fake domains containing malicious software. The scheme has helped the group make roughly $983.

---

FusionCore - An Emerging Malware-as-a-Service Group in Europe

Active since November, FusionCore acts as a one-stop-shop for cybercriminals; it offers services such as malware-as-a-subscription, hacking for hire, and ransomware. It has rolled out a ransomware affiliate program as well called AnthraXXXLocker. Typhon Reborn is one example of the group's proprietary malware.

---

Almost Every Organization Suffered a Cyberattack, Says Sophos

Over the last year, almost all organizations, at 94%, have faced some type of cyberattack. The survey data presented below is derived from responses provided by 3,000 cybersecurity and IT leaders from 14 countries and was collected between January and February.

---

Cybercrime: be careful what you tell your chatbot helper…

Alluring and useful they may be, but the AI interfaces’ potential as gateways for fraud and intrusive data gathering is huge – and is only set to growConcerns about the growing abilities of chatbots trained on large language models, such as OpenAI’s GPT-4, Google’s Bard and Microsoft’s Bing Chat, are making headlines. Experts warn of their ability to spread misinformation on a monumental scale, as well as the existential risk their development may pose to humanity. As if this isn’t worrying enough, a third area of concern has opened up – illustrated by Italy’s recent ban of ChatGPT on privacy grounds.The Italian data regulator has voiced concerns over the model used by ChatGPT owner OpenAI and announced it would investigate whether the firm had broken strict European data protection laws. Continue reading...

---

Taiwanese PC Company MSI Falls Victim to Ransomware Attack

Taiwanese PC company MSI (short for Micro-Star International) officially confirmed it was the victim of a cyber attack on its systems. The company said it "promptly" initiated incident response and recovery measures after detecting "network anomalies." It also said it alerted law enforcement agencies of the matter. That said, MSI did not disclose any specifics about when the attack took place

---

Google: North Korea-Linked Hackers Target Subject Experts and Think Tanks

Google’s TAG identified a new campaign by the North Korean ARCHIPELAGO threat cluster (aka APT43) targeting U.S. and South Korean governments, think tanks, military personnel, academics, policymakers, and researchers. Most notably, ARCHIPELAGO used fraudulent Google Chrome extensions in combination with phishing and malware to harvest sensitive data.

---

Color1337: Linux Cryptomining Attack Campaign Used uhQCCSpB Bot

The attackers use a bot called uhQCCSpB that installs and launches a Monero miner on the infected machine. After killing all other miners on the device, the attacker uses two different strategies to maximize access to the compromised Linux machine.

---

FBI warns of companies exploiting sextortion victims for profit

While these for-profit companies offer to send and charge for cease and desist orders to the criminals behind the schemes, the FBI says these "services" are not legally enforceable.

---

Researchers Discover Critical Remote Code Execution Flaw in vm2 Sandbox Library

The maintainers of the vm2 JavaScript sandbox module have shipped a patch to address a critical flaw that could be abused to break out of security boundaries and execute arbitrary shellcode.

---

Apple Releases Updates to Address Zero-Day Flaws in iOS, iPadOS, macOS, and Safari

Details about the two vulnerabilities have been withheld in light of active exploitation and to prevent more threat actors from abusing them. The updates are available in version iOS 16.4.1, iPadOS 16.4.1, macOS Ventura 13.3.1, and Safari 16.4.1.

---

Tesla Retail Tool Vulnerability Led to Account Takeover

The application allows both internal and external account logins and uses for authentication a JSON Web Token (JWT) that specifies an email address cleared for manually defined user accounts, security researcher Evan Connelly explains.

---

Iran-Based Hackers Caught Carrying Out Destructive Attacks Under Ransomware Guise

The Iranian nation-state group known as MuddyWater has been observed carrying out destructive attacks on hybrid environments under the guise of a ransomware operation. That's according to new findings from the Microsoft Threat Intelligence team, which discovered the threat actor targeting both on-premises and cloud infrastructures in partnership with another emerging activity cluster dubbed 

---

Belgium's Herselt Municipality Hit by Cyberattack

The cyberattack was detected on Friday evening (07-04-2023), and security measures were immediately heightened. Currently, experts are combing through the municipality’s servers to determine whether any sensitive information has been accessed.

---

Apple Releases Updates to Address Zero-Day Flaws in iOS, iPadOS, macOS, and Safari

Apple on Friday released security updates for iOS, iPadOS, macOS, and Safari web browser to address a pair of zero-day flaws that are being exploited in the wild. The two vulnerabilities are as follows - CVE-2023-28205 - A use after free issue in WebKit that could lead to arbitrary code execution when processing specially crafted web content. CVE-2023-28206 - An out-of-bounds write issue in

---

Researchers Discover Critical Remote Code Execution Flaw in vm2 Sandbox Library

The maintainers of the vm2 JavaScript sandbox module have shipped a patch to address a critical flaw that could be abused to break out of security boundaries and execute arbitrary shellcode. The flaw, which affects all versions, including and prior to 3.9.14, was reported by researchers from South Korea-based KAIST WSP Lab on April 6, 2023, prompting vm2 to release a fix with version 3.9.15 on

---

AI and cyber security: Trends, challenges and future prospects

Yaniv Shechtman has over 15 years of expertise in cyber security, AI, and product management. At Check Point, Yaniv’s primary responsibility is to shape Check Point’s Threat Prevention strategy and technologies, ensuring their products are always ahead of modern attackers, and are able to prevent zero-day threats before anyone else.  In this exclusive CyberTalk interview, Yaniv […] The post AI and cyber security: Trends, challenges and future prospects appeared first on CyberTalk.

---

The security implications of using ChatGPT in the workplace

The increasing prevalence of AI technologies such as ChatGPT have raised concerns among security leaders, especially if used within the workplace.

---

Microsoft leads global crackdown against Cobalt Strike, protecting healthcare from ransomware

EXECUTIVE SUMMARY: Microsoft, the Health Information Sharing and Analysis Center (Health-ISAC) and other partners have announced a widespread technical and legal crackdown against servers hosting “cracked” copies of Cobalt Strike; a tool commonly deployed by cyber criminals to distribute malware, including ransomware. The primary goal is to prevent hackers from continuing to use Cobalt Strike […] The post Microsoft leads global crackdown against Cobalt Strike, protecting healthcare from ransomware appeared first on CyberTalk.

---

Typhon Reborn V2 Enhances Evasion Capabilities

Crypto miner/stealer for hire, Typhon Stealer, received a new update, disclosed Palo Alto Networks. The new variant boasts enhanced anti-analysis techniques, as well as other stealing and file-grabber features. The malware leverages Telegram’s API and infrastructure to exfiltrate all stolen data.