Trojan steals Facebook info, LastPass suffers another breach and Cuba ransomware warning
Android trojan steals Facebook credentials of over 300,000 users, LastPass experiences another breach and Cuba ransomware alert. Catch all this and more in this week’s edition of Cybersecurity Weekly.
See Infosec IQ in action
1. Android trojan infected 300,000 devices to steal Facebook details
An Android trojan called Schoolyard Bully has been masquerading as legit reading and education apps, attempting to steal users’ Facebook credentials. According to a new report, the trojan has infected at least 300,000 devices across 71 countries, with 37 apps associated with the campaign deployed via third-party app stores. Schoolyard Bully steals Facebook info by launching a legitimate Facebook login page in the app via WebView and using malicious JavaScript to derive the user’s inputs. Its goal is to spoof Facebook account ID, credentials (email and password), device RAM, device API, and device name.
2. LastPass suffers another security breach, exposing some customers’ information
Renowned password management provider LastPass revealed it faced a second security incident following a previous breach in August 2022. The digital break-in resulted in adversaries accessing some of its customer information. The company announced this after detecting unusual activity within a third-party cloud storage service, which both LastPass and its affiliate—GoTo—currently share. LastPass said it’s working to identify what data was accessed and has alerted law enforcement of the latest happening.
Hacked for the Holidays Toolkit
Kick off your organization's holiday celebrations with our free Hacked for the Holidays security awareness toolkit. The resources found in this toolkit cover topicabout:blanks like gift cards and charity scams to help keep your employees cyber-safe this season.
3. Over 100 organizations hit by Cuba ransomware: CISA, FBI
The FBI and CISA have issued a joint alert warning companies about the Cuba ransomware. Active since 2019, the ransomware has been used in attacks targeting firms in the healthcare, financial, IT, manufacturing and government sectors. Threat actors typically use it to compromise target networks through phishing, stolen credentials, and known software vulnerabilities, attempting to elevate privileges. The latest joint advisory revealed the Cuba ransomware gang has extorted $60 million from over 100 organizations and continues to expand its footprint.
4. Cybersecurity researchers take down DDoS botnet by accident
Security researchers at Akamai have accidentally crashed a cryptomining botnet utilized for DDoS attacks. Named KmsdBot, the botnet targets Linux and Windows devices with varying architectures and infects new systems using weak login credentials via SSH connections. Compromised systems were being used to launch distributed denial-of-service attacks and mine for cryptocurrency. However, the botnet didn’t have the capabilities to evade detection, which led to its demise after researchers unintentionally disabled its existing versions.
5. Hyundai app bugs allowed hackers to remotely unlock and start cars
Security researchers have found vulnerabilities in the mobile apps of Hyundai and Genesis, named MyHyundai and MyGenesis. Hackers exploiting these vulnerabilities can start, stop, lock and unlock people’s vehicles remotely. Additionally, they found that cars with the SiriusXM “smart vehicle” platform could be controlled through forged HTTP requests that enable hackers to derive vehicle information. Researchers verified if they could use such access to attack a car by trying to unlock a Hyundai vehicle. And in a moment, the car unlocked.
See Infosec IQ in action
In this Series
- Trojan steals Facebook info, LastPass suffers another breach and Cuba ransomware warning
- Canada Flipper Zero ban and new RustDoor macOS malware
- AnyDesk hack and iPhone patched kernel flaw
- Tesla Pwn2Own hacks and iOS push alerts abuse
- TeamViewer breach and Atlassian Jira outage
- Moscow ISP revenge hack and Microsoft Sharepoint bug warning
- X verified accounts hack and SpectralBlur macOS malware
- CISA default password alert and SOHO KV-botnet campaign
- New 5G modem flaws and Apple’s data breach report
- Staples cyberattack, Agent Racoon backdoor and other news
- British Library ransomware attack, Windows fingerprint authentication bypass
- Samsung UK data breach and ransomware actor’s SEC complaint
- ICBC ransomware attack and ChatGPT outage
- Boeing Lockbit ransomware attack, Apple’s vulnerability and WhatsApp mods spyware
- Octo Tempest hacking group and new iLeakage attack
- Okta support system breach and Google Ads fake KeePass campaign
- Skype DarkGate malware, Shadow PC breach and AvosLocker ransomware warning
- 23andMe data theft, MGM’s $100M ransomware loss and the Azure VM breach
- Malicious Bing Chat ads and FBI’s dual ransomware warning
- T-Mobile app glitch and fake Booking.com pages
- Airbus data leak, Cisco Webex ad malware and €345 million TikTok fine
- New Apple iMessage exploit and CISA’s Apache RocketMQ warning
- Forever 21 data breach and Android BadBazaar espionage
- Duolingo data leak and the Met Police IT hack
- Discord.io data breach and Ivanti Avalanche vulnerabilities
- UK Electoral Commission hack and Microsoft’s role in China email breach
- Salesforce email zero-day exploit and Microsoft Power Platform criticism
- Airlines disclose pilot data breach and the Microsoft Teams bug
- GravityRAT Android Trojan and new MOVEit Transfer flaw
- University of Manchester hack and Honda API flaws
- MOVEit zero-day exploit and the U.S. iPhone hack accusation
- Daam Android virus and Barracuda zero-day flaw
- TP-Link router exploit and 18-year-old charged with hacking DraftKings accounts
- Discord support hack and Toyota location data leak
- Twitter private tweets bug and Cisco phone router vulnerabilities
- Cisco XSS zero-day flaw and PaperCut vulnerabilities
- 3CX hackers hit critical infrastructure and secondhand routers cause security concerns
- Hyundai data breach and Microsoft’s warning to accountants
- Western Digital cloud breach and the MSI ransomware hack
- TMX loan data breach, Italy bans ChatGPT and WordPress Elementor Pro exploit
- ChatGPT data leak and Gmail message theft by North Korean hackers
- U.S. federal agency hack and the return of FakeCalls Android malware
- Massive AT&T data breach and fake jobs targeting security researchers
- U.S. Marshals service breach and TPM 2.0 security flaws
- Dangerous ChatGPT apps and food giant Dole ransomware attack
- GoDaddy malware installations, record-breaking DDoS attack and the new WhiskerSpy malware
- Reddit’s employees phished, healthcare firms targeted and the new Screenshotter malware
- JD Sports data breached, VMware ESXi servers attacked and the HeadCrab malware
- Yandex source code leaked, 4500+ WordPress sites hacked and the new SwiftSlicer malware
- PayPal accounts breached, Fortinet VPN flaw exploited, and the new Hook malware
- Twitter users’ emails leaked, ChatGPT used to write malware and Slack’s repository breach
- Reduce security events
- Reinforce cyber secure behaviors
- Strengthen cybersecurity culture at your organization
