Cybersecurity Weekly: Wells Fargo phish, Oxford server hack, Cisco Webex flaw
A new Wells Fargo phishing campaign baits customers with calendar invites. A hijacked Oxford server was used by hackers for Office 365 phishing. A new Cisco Webex Meetings flaw lets attackers steal auth tokens. All this, and more, in this week’s edition of Cybersecurity Weekly.
Top Security Awareness Posters
1. Wells Fargo phishing baits customers with calendar invites
Wells Fargo customers are being targeted by a phishing campaign impersonating the Wells Fargo security team and luring potential victims to phishing pages with the help of calendar invites. The phishing messages have targeted over 15,000 Wells Fargo customers using .ics calendar file attachments.
Read more »
2. Hijacked Oxford server used by hackers for Office 365 phishing
Hackers hijacked an Oxford email server to deliver malicious emails as part of a phishing campaign designed to harvest Microsoft Office 365 credentials. The threat actors' attacks had everything needed to bypass their victims' security email filters and trick the victims themselves into handing over their Office 365 credentials.
3. New Cisco Webex Meetings flaw lets attackers steal auth tokens
A new vulnerability in the Cisco Webex Meetings client could allow local authenticated attackers to gain access to sensitive information including usernames, authentication tokens and meeting information. The stolen account can be thus leveraged as part of future attacks or immediately view and edit meetings or download recordings.
4. Cognizant admitted data breach in April ransomware attack
The information technologies services giant was hit by Maze ransomware operators in April. Immediately after the attack, the company sent a security breach notification mail to its clients and shared IoCs related to the threat that affected its systems. At the time, the company stated that threat actors did not exfiltrate any customer’s information.
Read more »
5. InvisiMole hackers target high-profile military and diplomatic entities
Last week, cybersecurity researchers uncovered the method of an elusive threat group that hacks into the high-profile military and diplomatic entities in Eastern Europe for espionage. InvisiMole has been active at least since 2013 in connection with targeted cyber-espionage operations in Ukraine and Russia.
Read more »
6. Privnotes.com phishing users of private messaging service Privnote.com
For the past year, a site called Privnotes.com has been impersonating Privnote.com, a legitimate service that offers private, encrypted messages that self-destruct automatically after they are read. The phishing site Privnotes.com does not fully implement encryption, and can read and modify all messages sent by users.
Read more »
7. Hackers target military and aerospace staff by posing as recruiters
Cybersecurity researchers took the wraps off a new sophisticated cyber-espionage campaign directed against aerospace and military organizations. The primary goal of the operation was espionage, but in one case, the attackers tried to monetize access to a victim's email account through a business email compromise attack.
8. 79 Netgear router models affected by a dangerous zero-day
Last week, security experts reported a severe unpatched security vulnerability that affects 79 Netgear router models. The flaw could allow remote attackers to execute arbitrary code as “root” on the vulnerable devices and potentially take over them. These experts reported the vulnerability to the vendor early this year.
Read more »
9. New Ripple20 flaws put billions of internet-connected devices at risk of hacking
The Department of Homeland Security and CISA ICS-CERT issued a critical security advisory about over a dozen newly discovered vulnerabilities affecting billions of internet-connected devices manufactured by many vendors across the globe. Dubbed Ripple20, the set of 19 vulnerabilities resides in a low-level TCP/IP software library.
Read more »
See Infosec IQ in action
10. Copied master key forces South African bank to replace 12 million cards
Fraudsters stole more than $3.2 million from the banking division of South Africa’s post office, after employees printed out the bank’s master key. According to reports, the security breach occurred in December 2018 when a copy of Postbank’s digital master key was printed out at an offsite data center.
Read more »
In this Series
- Cybersecurity Weekly: Wells Fargo phish, Oxford server hack, Cisco Webex flaw
- Canada Flipper Zero ban and new RustDoor macOS malware
- AnyDesk hack and iPhone patched kernel flaw
- Tesla Pwn2Own hacks and iOS push alerts abuse
- TeamViewer breach and Atlassian Jira outage
- Moscow ISP revenge hack and Microsoft Sharepoint bug warning
- X verified accounts hack and SpectralBlur macOS malware
- CISA default password alert and SOHO KV-botnet campaign
- New 5G modem flaws and Apple’s data breach report
- Staples cyberattack, Agent Racoon backdoor and other news
- British Library ransomware attack, Windows fingerprint authentication bypass
- Samsung UK data breach and ransomware actor’s SEC complaint
- ICBC ransomware attack and ChatGPT outage
- Boeing Lockbit ransomware attack, Apple’s vulnerability and WhatsApp mods spyware
- Octo Tempest hacking group and new iLeakage attack
- Okta support system breach and Google Ads fake KeePass campaign
- Skype DarkGate malware, Shadow PC breach and AvosLocker ransomware warning
- 23andMe data theft, MGM’s $100M ransomware loss and the Azure VM breach
- Malicious Bing Chat ads and FBI’s dual ransomware warning
- T-Mobile app glitch and fake Booking.com pages
- Airbus data leak, Cisco Webex ad malware and €345 million TikTok fine
- New Apple iMessage exploit and CISA’s Apache RocketMQ warning
- Forever 21 data breach and Android BadBazaar espionage
- Duolingo data leak and the Met Police IT hack
- Discord.io data breach and Ivanti Avalanche vulnerabilities
- UK Electoral Commission hack and Microsoft’s role in China email breach
- Salesforce email zero-day exploit and Microsoft Power Platform criticism
- Airlines disclose pilot data breach and the Microsoft Teams bug
- GravityRAT Android Trojan and new MOVEit Transfer flaw
- University of Manchester hack and Honda API flaws
- MOVEit zero-day exploit and the U.S. iPhone hack accusation
- Daam Android virus and Barracuda zero-day flaw
- TP-Link router exploit and 18-year-old charged with hacking DraftKings accounts
- Discord support hack and Toyota location data leak
- Twitter private tweets bug and Cisco phone router vulnerabilities
- Cisco XSS zero-day flaw and PaperCut vulnerabilities
- 3CX hackers hit critical infrastructure and secondhand routers cause security concerns
- Hyundai data breach and Microsoft’s warning to accountants
- Western Digital cloud breach and the MSI ransomware hack
- TMX loan data breach, Italy bans ChatGPT and WordPress Elementor Pro exploit
- ChatGPT data leak and Gmail message theft by North Korean hackers
- U.S. federal agency hack and the return of FakeCalls Android malware
- Massive AT&T data breach and fake jobs targeting security researchers
- U.S. Marshals service breach and TPM 2.0 security flaws
- Dangerous ChatGPT apps and food giant Dole ransomware attack
- GoDaddy malware installations, record-breaking DDoS attack and the new WhiskerSpy malware
- Reddit’s employees phished, healthcare firms targeted and the new Screenshotter malware
- JD Sports data breached, VMware ESXi servers attacked and the HeadCrab malware
- Yandex source code leaked, 4500+ WordPress sites hacked and the new SwiftSlicer malware
- PayPal accounts breached, Fortinet VPN flaw exploited, and the new Hook malware
- Twitter users’ emails leaked, ChatGPT used to write malware and Slack’s repository breach
We’ll customize our demo to your
- Security awareness goals
- Existing security and employee training tools
- Industry and compliance requirements
