Cybersecurity Weekly: One-click hack, Discord Nitro ransomware, Codecov hacked
A one-click hack was found in popular desktop apps. Discord Nitro gift codes are now demanded as ransomware payments. The Codecov code coverage tool was hacked to steal dev credentials. All this, and more, in this week’s edition of Cybersecurity Weekly.
1. One-click hack found in popular desktop apps
Researchers discovered multiple one-click vulnerabilities across a variety of popular software applications, allowing an attacker to potentially execute arbitrary code on target systems. The issues affect apps like Telegram, Nextcloud, VLC, LibreOffice, OpenOffice, Bitcoin/Dogecoin Wallets, Wireshark and Mumble.
2. Discord Nitro gift codes now demanded as ransomware payments
In a novel approach to ransom demands, a new ransomware calling itself NitroRansomware encrypts files and then demands a Discord Nitro gift code to decrypt files. While most ransomware operations demand thousands of dollars or more in cryptocurrency, Nitro Ransomware deviates from the norm by demanding a $9.99 Nitro gift code instead.
3. Codecov code coverage tool hacked to steal dev credentials
The Codecov online platform for hosted code testing reports and statistics announced that a threat actor modified its Bash Uploader script, exposing sensitive information in customers’ continuous integration environment. The company learned of the compromise on April 1st but the first signs of this software supply-chain attack occurred in late January.
4. HackBoss malware poses as hacker tools on Telegram
The authors of a cryptocurrency-stealing malware are distributing it over Telegram to aspiring cybercriminals under the guise of free malicious applications. Researchers have named the malware HackBoss and say that its operators likely stole more than $500,000 from novice hackers that fell for the trick.
5. Severe bugs reported in EtherNet/IP stack for industrial systems
The U.S. Cybersecurity and Infrastructure Security Agency on Thursday issued an advisory warning of multiple vulnerabilities in the OpENer EtherNet/IP stack that could expose industrial systems to denial-of-service attacks, data leaks and remote code execution.
6. Celsius email system breach leads to phishing attack
Cryptocurrency rewards platform Celsius Network disclosed a security breach exposing customer information that led to a phishing attack. After gaining access to the customer list, the threat actors impersonated Celsius Networks in phishing texts and emails that promoted a new Celsius Web Wallet.
7. Hackers flood the web with pages offering malicious PDFs
Cybercriminals are resorting to search engine poisoning techniques to lure business professionals into seemingly legitimate Google sites that install a remote access trojan. The attack works by leveraging searches for business forms such as invoices, templates, questionnaires and receipts as a stepping stone toward infiltrating the systems.
8. Xcode project malware now targeting Apple's M1-based Macs
A Mac malware campaign targeting Xcode developers has been retooled to add support for Apple's new M1 chips. It expanded its features to steal confidential information from cryptocurrency apps. The modules can steal credentials, inject malicious JavaScript into websites, plunder user data from different apps and encrypt files for a ransom.
9. WordPress may automatically disable Google FLoC on websites
WordPress is now treating Google's new FLoC tracking technology as a security concern and may block it by default on WordPress sites. After Google began testing FLoC this month in Google Chrome, there has been a consensus among privacy advocates that Google's FLoC implementation just replaces one privacy risk with another one.
10. U.S. sanctions cryptocurrency addresses linked to Russian cyberactivities
The U.S. government sanctioned twenty-eight cryptocurrency addresses allegedly associated with entities or individuals linked to Russian cyberattacks or election interference. The government introduced these sanctions in an executive order by President Biden that formally announced that the Russian SVR was behind the recent SolarWinds supply chain attack.
In this Series
- Cybersecurity Weekly: One-click hack, Discord Nitro ransomware, Codecov hacked
- Canada Flipper Zero ban and new RustDoor macOS malware
- AnyDesk hack and iPhone patched kernel flaw
- Tesla Pwn2Own hacks and iOS push alerts abuse
- TeamViewer breach and Atlassian Jira outage
- Moscow ISP revenge hack and Microsoft Sharepoint bug warning
- X verified accounts hack and SpectralBlur macOS malware
- CISA default password alert and SOHO KV-botnet campaign
- New 5G modem flaws and Apple’s data breach report
- Staples cyberattack, Agent Racoon backdoor and other news
- British Library ransomware attack, Windows fingerprint authentication bypass
- Samsung UK data breach and ransomware actor’s SEC complaint
- ICBC ransomware attack and ChatGPT outage
- Boeing Lockbit ransomware attack, Apple’s vulnerability and WhatsApp mods spyware
- Octo Tempest hacking group and new iLeakage attack
- Okta support system breach and Google Ads fake KeePass campaign
- Skype DarkGate malware, Shadow PC breach and AvosLocker ransomware warning
- 23andMe data theft, MGM’s $100M ransomware loss and the Azure VM breach
- Malicious Bing Chat ads and FBI’s dual ransomware warning
- T-Mobile app glitch and fake Booking.com pages
- Airbus data leak, Cisco Webex ad malware and €345 million TikTok fine
- New Apple iMessage exploit and CISA’s Apache RocketMQ warning
- Forever 21 data breach and Android BadBazaar espionage
- Duolingo data leak and the Met Police IT hack
- Discord.io data breach and Ivanti Avalanche vulnerabilities
- UK Electoral Commission hack and Microsoft’s role in China email breach
- Salesforce email zero-day exploit and Microsoft Power Platform criticism
- Airlines disclose pilot data breach and the Microsoft Teams bug
- GravityRAT Android Trojan and new MOVEit Transfer flaw
- University of Manchester hack and Honda API flaws
- MOVEit zero-day exploit and the U.S. iPhone hack accusation
- Daam Android virus and Barracuda zero-day flaw
- TP-Link router exploit and 18-year-old charged with hacking DraftKings accounts
- Discord support hack and Toyota location data leak
- Twitter private tweets bug and Cisco phone router vulnerabilities
- Cisco XSS zero-day flaw and PaperCut vulnerabilities
- 3CX hackers hit critical infrastructure and secondhand routers cause security concerns
- Hyundai data breach and Microsoft’s warning to accountants
- Western Digital cloud breach and the MSI ransomware hack
- TMX loan data breach, Italy bans ChatGPT and WordPress Elementor Pro exploit
- ChatGPT data leak and Gmail message theft by North Korean hackers
- U.S. federal agency hack and the return of FakeCalls Android malware
- Massive AT&T data breach and fake jobs targeting security researchers
- U.S. Marshals service breach and TPM 2.0 security flaws
- Dangerous ChatGPT apps and food giant Dole ransomware attack
- GoDaddy malware installations, record-breaking DDoS attack and the new WhiskerSpy malware
- Reddit’s employees phished, healthcare firms targeted and the new Screenshotter malware
- JD Sports data breached, VMware ESXi servers attacked and the HeadCrab malware
- Yandex source code leaked, 4500+ WordPress sites hacked and the new SwiftSlicer malware
- PayPal accounts breached, Fortinet VPN flaw exploited, and the new Hook malware
- Twitter users’ emails leaked, ChatGPT used to write malware and Slack’s repository breach
- Reduce security events
- Reinforce cyber secure behaviors
- Strengthen cybersecurity culture at your organization
