By Waqas
The Android TV box you recently purchased may be riddled with harmful backdoors.
This is a post from HackRead.com Read the original post: Android TV Boxes Infected with Backdoors, Compromising Home Networks

A new report from the cybersecurity firm Human Security confirms the presence of two backdoors, Badbox and Peachpit, in popular and widely used Android TV boxes.

****_KEY FINDINGS_****

*   **Cybersecurity Firm Human Security has discovered malware on dozens of streaming devices and iOS/Android apps.**

*   **A huge number of Android TV boxes contain malware capable of conducting ad fraud, creating fake accounts, and selling access to home networks.**

*   **Researchers found that the malware they have dubbed Badbox is not only tricky to detect but difficult to remove as well.**

*   **Android TV box users must prefer installing apps from reliable sources and keep their devices up-to-date.**

*   **Human Security has already shared details of its findings with concerned law enforcement agencies.**

In a report published by Human Security’s Satori Threat Intelligence and Research Team on October 4th, 2023, there are signs that 200 different models of Android TV boxes might be containing malware, indicating an organized network of ad fraud behind it.

Researchers analyzed seven Android TV boxes and one tablet and found backdoors installed in all of them. Here are the tested models:

Q9

T95

X88

T95Z

J5-W

T95MAX

X12PLUS 

MXQ Pro 5G

All the devices had a vast and diverse user base comprising schools, businesses, and homes across the US. Another shocking detail is that 80% of the Android TV boxes sold in the US from online retailers contained Badbox.

It is worth noting that, T95 is a known TV Box for carrying pre-installed malware. **In January 2023**, Canadian infrastructure and security systems consultant, Daniel Milisic discovered malware on the T95 TV Box which he bought through Amazon.

**In February 2023**, Malwarebytes researchers confirmed that there are pre-installed malware on this particular TV Box. However, to this date, Amazon continues to sell the malicious T95 TV Box.

Malicious T95 TV Boxes ready to be shipped through Amazon (Screenshot: Hackread.com)

According to Human Security’s CISO Gavin Reid, the network resembles a “Swiss Army knife of doing bad things on the internet.” Gavin **told** Wired that this is a well-organized fraud.

For your information, these boxes use Android Open Source Project (**AOSP**) instead of Google-certified Google TV or Android TV, such as Nvidia Shield or Chromecast. The issue occurs due to AOSP’s open access.

In their **blog post**, researchers noted that Badbox comes preloaded on Android TV devices made in China before being dispatched to resellers. After the devices are plugged in, the malware connects with a C2 server in China.

Further, it fetches a set of instructions that informs it about the malicious activities it has to perform on the device. These **include ad fraud**, creating fake WhatsApp and Gmail accounts, selling access to home networks, and installing remote code.

Badbox backdoor helps install infected apps on devices. It modifies a component of the Android OS, forcing it to execute code and access apps installed on the device. While researching, Human Security found different types of fraud associated with the infected devices, including **residential proxy services** and advertising fraud, and noticed that the group behind this campaign is selling access to home networks.

> _**“The extent of BADBOX’s spread and impact is massive. HUMAN’s Satori team observed at least 74,000 Android-based mobile phones, tablets, and Connected TV boxes worldwide showing signs of BADBOX infection.”**_
> 
> Human Security

According to their **technical report** (PDF), Human Security focused on another malware called PEACHPIT, Badbox’s ad fraud component that can launch spoofed web traffic, hidden ads, and **malvertising** on Android and iOS devices and apps.

Imported library managing ad rendering (Screenshot: Human Security)

Peachpit malware is less harmful than Badbox, though. Researchers identified 39 iOS, Android, and TV box apps containing Peachpit. It is worth noting that Peachpit malware can operate on Android and iOS devices both, whereas Badbox targets Android devices only.

Peachpit is a collection of 39 Android, iOS, and CTV-centric apps, each containing a hardcoded connection to a fake SSP (**supply-side platform**), which adds a piece of JavaScript code into the app’s WebView to obtain details of the device the app is running on before launching the ad.

> _**“PEACHPIT reached a peak of 121,000 infected Android devices and 159,000 infected iOS devices. These devices accounted for an average of 4 billion ad requests a day. No iOS devices were themselves impacted by the BADBOX backdoor; they were targeted only by PEACHPIT apps available for download from many major app marketplaces.”**_
> 
> Human Security

People looking for low-cost streaming devices and TV boxes usually turn to Chinese manufacturers. However, time and again, it has been proven that Chinese Android TV boxes typically come infected with malware.

1.  Amazon Still Selling T95 TV Box with Pre-Installed Malware
2.  Hundreds of Android devices shipped with pre-installed malware
3.  Malware Duo pre-installed on thousands of cheap Android phones
4.  Smart TVs make screenshots every second & send them to the server
5.  Samsung asks users to scan their Smart TVs for malware – Here’s how to

Android TV Boxes Infected with Backdoors, Compromising Home Networks

By Deeba Ahmed
Facebook’s official page was hacked on Facebook after bizarre posts, including demands for the release of ex-Pakistani PM…
This is a post from HackRead.com Read the original post: Facebook’s Official Page Hacked; Demand Release of Pakistani PM Imran Khan

Facebook’s official page was hacked on Facebook after bizarre posts, including demands for the release of ex-Pakistani PM Imran Khan, filled its timeline.

*   **Facebook’s official page was apparently hacked on Friday, 6th October 2023.**

*   **Social media users were shocked to see Facebook posting strange messages.**

*   **One of the many weird messages was the hacker demanding the release of ex-PAK prime minister Imran Khan.**

*   **Mr Khan was arrested in early August 2023.**

*   **Whether it was a prank or the page was actually hacked, it raises serious concerns over the security of Facebook accounts and pages.**

Hacking of user accounts and pages on social media is nothing new. Even high-profile personalities, including politicians and celebrities, have experienced page compromises, with scammers posting messages in their names.

However, a rare event occurred on October 6th, 2023, when Facebook users were stunned to see strange posts emanating from Facebook’s official page. What made these posts truly bizarre was their focus on criticizing the BCCI (Board of Cricket Control India) for not granting visas to Pakistani cricket fans for the ICC World Cup matches.

The highlight of this supposed prank was a post demanding the release of Pakistan’s former Prime Minister, Imran Khan, alongside another post stating, “Release Zuck.”

At 10.40 pm this post appeared on Facebook’s official page: “No idea why I suddenly have access to post stuff on Facebook. Or have I got it completely wrong and I’m not posting as Facebook UK?”

This was followed by another post that read: “Let me take this opportunity to let & know they have completely botched the event by not issuing visas to people who wanted to watch Cricket World Cup in person.”

Here are multiple screenshots shared by an X (previously Twitter) user about the Facebook page hack:

According to reports, several posts appeared before Facebook realized the issue and responded. The social network promptly deleted all the posts and issued an official statement to notify users that the page had been compromised. Simultaneously, the platform launched an investigation into the incident and took steps to enhance the page’s security.

By 11.30 pm, Facebook’s official page was disabled. However, until then, thousands of users had seen these posts.

> Facebooks Facebook page got hacked 🤣 pic.twitter.com/7bshbl6t0k
> 
> — Nath Lewis (@TheNathanLewis) October 6, 2023

In February 2014, an Egyptian hacker managed to remove Mark Zuckerberg’s Facebook timeline cover photo from his account using a private exploit.

We will update our readers as Facebook shares further details on this incident.

Meanwhile, take a moment to reexamine the security of your profile on social media because this incident is a reminder that no platform or organization is safe from cyberattacks. So, users must prefer strong passwords, ideally with 2FA, and avoid using the same password for different accounts.

1.  Facebook glitch sent unintended friend requests to users
2.  NodeStealer 2.0 Poses as ‘Microsoft’ to Hack Facebook Data
3.  Fake Ads Manager Software, Extensions Target Facebook Accounts
4.  Fake ChatGPT and AI pages on Facebook are spreading infostealers
5.  Facebook removes 100s of accounts for spreading iOS, Android malware

Facebook’s Official Page Hacked; Demand Release of Pakistani PM Imran Khan

By Owais Sultan
SEO vs. PPC – Understanding the Difference and Choosing the Right Strategy for Your Business – Let’s delve…
This is a post from HackRead.com Read the original post: SEO vs. PPC: Choosing the Right Strategy for Your Business

SEO vs. PPC – Understanding the Difference and Choosing the Right Strategy for Your Business – Let’s delve into it.

Visibility is everything for online businesses nowadays – if you want visitors on your website, you’ll need some sort of exposure that will redirect users to your URL. The two most popular methods of this is through Search Engine Optimization, also known as SEO, or Pay-Per-Click (PPC) advertising. Both have their advantages, but which one is right for your business?

****What is SEO?****

Search Engine Optimization, or SEO, is a collection of techniques – some might even call it art – related to improving the visibility of your website in organic (i.e., non-paid) search engine results. This can be achieved by optimizing various website areas, primarily including its content, structure, and backlinks.

A website that is well-optimized will be able to attract a steady stream of traffic over time much easier. Since SEO relies purely on organic search results, users often trust these results more than paid ads, potentially increasing conversion rates and improving brand image when compared to other methods of online advertising.

SEO costs are usually lower than those of PPC campaigns, but it requires a holistic approach to be effective, typically restructuring entire websites and dramatically changing content, which might take some time to fully deploy.

****What is PPC?****

PPC is short for Pay-Per-Click advertising and involves placing ads on platforms like Google Ads or Meta Ads, where businesses can pay for their ad to be displayed and pay a set fee each time it is clicked. This method offers brands immediate visibility and can drive traffic to specific landing pages easily. Most platforms also offer handy tools for precise targeting of your ads, based on keywords, demographics, location, audience interests, and more. 

Looking for professional PPC services in London? Don’t leave your online visibility to amateurs – go with an experienced digital agency like Nautilus Marketing, which provides measurable performance indicators to track the effectiveness of PPC campaigns and implements optimal changes when necessary.

****PPC vs. SEO Strategies****

SEO can be more cost-effective in the long run, building trust and credibility in addition to just traffic. The results it provides are long-lasting and can significantly influence brand visibility. These results, however, are not immediate – SEO requires patience, and changes might take time to show up in measurable indicators. What’s more, search engine algorithms are constantly evolving, which can affect ranking and needs constant attention and monitoring.

PPC campaigns, on the other hand, give immediate results and traffic that is easily trackable. The specific ads can be easily targeted to your desired audience, and the budget can be adjusted dynamically according to your needs.

However, PPC campaigns can be expensive, especially in competitive niches, and the costs may increase based on targeting settings. It requires a constant budget that must be maintained, or the ads will immediately disappear, cutting visibility. Users might also be wary of paid advertisements, discouraging conversions.

In the end, which strategy is better depends on your specific needs, niche, and business model. SEO and PPC have their place in a comprehensive digital marketing strategy – a blend of both might often be the most effective approach.

****_RELATED ARTICLES_****

1.  How SASE Supports Digital Transformation
2.  The Most In-Demand Freelance Skills for 2023
3.  Understanding the E-Commerce Marketplaces in Europe
4.  cheqd’s Recent Rollout Focuses on Monetizing Digital Identity
5.  Key Considerations When Transferring Your Digital Workspace

SEO vs. PPC: Choosing the Right Strategy for Your Business

By Waqas
23andMe Investigating Potential Data Breach, Says Credentials May Have Been Gathered From Other Breaches.
This is a post from HackRead.com Read the original post: Hacker Claims to Have Data of 7 Million 23andMe Users from DNA Service

While one threat actor has leaked alleged 23andMe user data, another is advertising ‘Genetic Data For Sale,’ with prices determined by the number of profiles.

23andMe, a popular DNA testing company, is investigating a potential data breach after a hacker claimed to have obtained data from at least 7 million users.

The threat actor shared a link to a download for the stolen data on the infamous **Breached hacking forum**, but 23andMe denies that a breach has occurred.

“We do not have any indication at this time that there has been a data security incident within our systems,” a company spokesperson told Hackread.com.

“The preliminary results of this investigation suggest that the login credentials used in these access attempts may have been gathered by a threat actor from data leaked during incidents involving other online platforms where users have recycled login credentials,” the spokesperson added.

Instead, the company believes the hacker may have acquired login credentials from previous data breaches and used them to access 23andMe accounts. Below is a screenshot from the hacker forum, shared by an individual with an X (formerly Twitter) account using the handle @DarkWebInformer.

Although the hacker claims to have obtained data on at least 7 million users, it’s possible that much of the data was actually scraped through a profile-viewing feature available to 23andMe members.

23andMe has a function that lets you find “DNA relatives” with other users on the platform. Using the system is optional, but in doing so users create a profile that other members can see, allowing them to view ancestry results, along with photo and birth year, if provided.

Hence, it’s possible that the hacker broke through a smaller number of accounts, and then exploited the DNA relatives feature to gain access to a wider range of personal details.

****Genetic Data For Sale****

Another threat actor is offering ‘Genetic Data For Sale,’ purportedly belonging to 23andMe users, with a price tag of $100,000 for 100,000 profiles. They claim to possess a range of data, including ”Tailored ethnic groupings, individualized data sets, pinpointed origin estimations, haplogroup details, phenotype information, photographs, links to hundreds of potential relatives, and most crucially, raw data profiles.”

Screengrab credit: Hackread.com

This is not the first time a DNA service has made headlines due to a data breach. In June 2018, the DNA testing website **MyHeritage was hacked**, resulting in the leak of personal details from 92 million users.

Currently, 23andMe is treating this matter with utmost seriousness and continuing its investigation. In the meantime, users are encouraged to consider updating their passwords and enabling two-factor authentication to safeguard their accounts against potential unauthorized access.”

Here are some additional tips for protecting your 23andMe account:

*   Enable two-factor authentication.
*   Use a strong password and don’t reuse it for other online accounts.
*   Be careful about what information you share in your DNA relative’s profile.
*   Be wary of clicking on links or attachments in emails or messages from unknown senders.

If you are concerned about your privacy, you can also choose to delete your 23andMe account and DNA data.

Hacker Claims to Have Data of 7 Million 23andMe Users from DNA Service

By Waqas
The crypto scammers convinced a victim in the United States to transfer their Bitcoin to a Kraken cryptocurrency account that the victim did not control.
This is a post from HackRead.com Read the original post: US Police Recover $3M Stolen by Pakistani Crypto Scammers

While no arrests have occurred in Pakistan, authorities in Westport, Connecticut successfully traced and recovered funds following a local resident’s complaint about being scammed.

In a rare success story, Westport Police have recovered $3 million worth of crypto that Pakistani scammers stole. The victim, a local resident, was convinced in January 2023 to move money from a retirement account into a “Kraken” cryptocurrency account.

After moving the funds into that account, between January 2023 and March 2023, the victim reported that more than $3 million worth of Bitcoin was withdrawn and transferred to cryptocurrency wallets they did not control.

It is worth noting that scammers were falsely claiming to represent the legitimate United States-based cryptocurrency exchange Kraken.

In a press release (PDF), Westport Police Department revealed that their detectives worked with the Connecticut State Police Organized Crime Task Force to track the transactions and freeze all accounts associated with the scam. The investigation eventually led to people living in Pakistan, but arrests are highly unlikely.

Despite the challenges, Westport police were able to recover the stolen crypto. This is a significant accomplishment, as cryptocurrencies can be difficult to track and recover.

Westport Police Department on Facebook (Screenshot: Hackread.com)

The Westport Police Department is urging residents to be cautious of cryptocurrency scams. Scammers often use sophisticated methods to trick people into investing in fake cryptocurrencies or sending their crypto to wallets that the scammers control.

If you are considering investing in cryptocurrencies, it is important to do your own research (DYOR) and only invest with reputable companies. You should also never send your crypto to wallets that you do not control.

Here are some tips to help you avoid cryptocurrency scams:

*   **Watch out:** Be wary of unsolicited investment offers, especially those that come via email or social media.
*   **Do your own research:** Do your own research before investing in any cryptocurrency. Make sure the company is legitimate and the cryptocurrency is real.
*   **DO NOT:** Never send your crypto to wallets that you do not control.
*   **2FA and Password:** Enable 2FA and use a strong password and two-factor authentication for your cryptocurrency accounts.

If you believe you have been the victim of a cryptocurrency scam, report it to your local police department and the Federal Trade Commission.

****_RELATED ARTICLES_****

1.  Hacker returns $17 million worth of stolen Ethereum
2.  Hacker Returns $200 Million Stolen from Euler Finance
3.  Hacker returns $25 million after their IP address is exposed
4.  FBI recovers millions in ransom from DarkSide ransomware gang
5.  Multichain hack: Hacker returns $1m, keeps $150k as bug bounty
6.  Hacker steals $24M, returns $2.5M to DeFi protocol Harvest Finance

US Police Recover $3M Stolen by Pakistani Crypto Scammers

By Deeba Ahmed
Really Simple Systems exposed its database publicly without any password or security authentication. KEY FINDINGS A global CRM…
This is a post from HackRead.com Read the original post: Major CRM Provider Really Simple Systems Leaked 3M Customer Records

Really Simple Systems exposed its database publicly without any password or security authentication.

****_KEY FINDINGS_****

*   **Cybersecurity researcher Jeremiah Fowler discovered an unprotected database belonging to Really Simple Systems.**

*   **The database contained over 3 million records, making countless companies and customers associated with Really Simple Systems vulnerable to diverse online threats.**

*   **Many impacted businesses are located in the UK, USA, EU, and Australia.**

*   **Exposed data includes medical records, credit reports, identification documents, tax documents, legal documents, etc.**

A global CRM (customer relationship management) systems provider, Really Simple Systems, has suffered a data security incident in which more than 3 million customer records were exposed to the public without any password or security authentication.

These records were stored in an unprotected database discovered by cybersecurity researcher Jeremiah Fowler of vpnMentor.

Fowler had access to limited sampling, which indicated that a wide range of documents belonging to organizations from different sectors/sizes were part of the leaked database. Most were well-reputed, high-profile organizations, located in EU countries, the USA, the UK, and Australia.

One of the passports among the trove of leaked information (vpnMentor)

Fowler wrote that most exposed records can be considered ‘highly sensitive’ for exposing PII data (personally identifiable information). These records were publicly accessible to any user with an internet connection.

The exposed data includes internal communications/invoice records and customers’ CRM files containing valuable user data such as names, phone numbers, addresses, email IDs, and payment information.

Further probing revealed that the database also contained medical records, real estate contracts, identification documents, credit reports, disability claims, tax/legal documents, and non-disclosure agreements.

Many of the documents contained Social Security Numbers and tax identification numbers. One of the client folders had a large collection of confidential child psychological assessment files.

Moreover, many internal document templates belonging to Really Simple Systems were part of the database and contained billing data, emails, invoices, service agreements, etc. One of the folders belonged to a managed educational platform offering school management services.

According to Fowler’s report, after discovering the database, he sent a responsible disclosure notice. The school management service’s folder was removed from public access on the same day, whereas other folders remained accessible online for a few more days. Fowler then sent a follow-up email to the CRM solutions provider, in response to which the company stated:

> _**“As of Tuesday 29th August, we, at the CRM Success Team, understand that: Further settings changes/code changes are being applied to further resolve, over the next few days. The relevant company directors and GDPR officers have been notified, by the development manager”.**_
> 
> Real Simple Reason

There’s no clarity over how long this database remained exposed or whether someone accessed it before the company restricted access.

Really Simple Systems has launched an investigation and has improved its security mechanisms to prevent such incidents in the future. Impacted customers have been notified and requested to monitor their credit reports and change passwords.

Major CRM Provider Really Simple Systems Leaked 3M Customer Records

By Deeba Ahmed
Another day, another NPM typosquatting attack.
This is a post from HackRead.com Read the original post: NPM Typosquatting Attack Deploys r77 Rootkit via Legitimate Package

****_EXECUTIVE SUMMARY_****

*   **ReversingLabs researchers have discovered a new typosquatting campaign exploiting the NPM platform.**

*   **Researchers observed a malicious NPM package called node-hide-console-windows delivering the r77 rootkit to innocent users.**

*   **Typosquatting is a deceptive method where cybercriminals create domain names and social media accounts using the same spelling as the original organization’s name.**

*   **10 versions of the malicious NPM package were discovered.** 

*   **In this cybersquatting attack, scammers have exploited the legitimate package node-hide-console-window to deceive users.**

ReversingLabs’ cybersecurity researchers have uncovered a **malicious NPM package** (node-hide-console-windows) created using typosquatting to resemble a legitimate NPM package called node-hide-console-window.

As evident, the attackers have added an ‘s’ in the title of the malicious package to separate it from the original one. The concerning part is that this malicious package has been downloaded over 700 times. This campaign started at the end of August 2023.

ReversingLabs revealed that when a user installs this malicious package, a Discord bot is downloaded that plants the open-source **r77 rootkit**. This rootkit hides itself within the OS to remain undetected and lets the attacker obtain complete control of the victim’s device.

Researchers examined the executable fetched by a file titled index.js, which turned out to be DiscordRAT 2.0. All ten versions of the malicious NPM package downloaded the same DiscordRAT2.0 executable. However, the last two versions contained an additional malicious payload disguised as a visual code update and fetched by index.js.

For your information, **DiscordRAT 2.0** is a Discord Remote Administration Tool promoted for training purposes but is an open-source malware. Threat actors must register the bot with the Discord developer portal and add it to the Discord server or guild before deploying it. The guild ID is added to the DiscordRAT 2.0 executable and delivered to the victims through phishing email attachments or packages available on public repositories.

Further probing revealed that the Discord guild for the malware was launched on August 15, just 10 days before the malicious NPM package’s first version was published. The executable creates a channel in the connected Discord server for each victim and sends the initial payload to the infected host.

From there, the bot receives additional commands from the attacker and can perform a range of tasks like **disabling Windows Defender**, blocking the victim’s mouse and keyboard, bluescreening the device, and killing processes. There’s a long list of commands it facilitates but most important is the ‘!rootkit’ command recently added to DiscordRAT 2.0 to launch the r77 rootkit on the infected device.

This open-source, fileless ring 3 toolkit features extensive documentation and can disguise files/processes. This rootkit hides itself within the OS to remain undetected and lets the attacker obtain complete control of the victim’s device.

It is worth noting that this is the first time researchers have identified a malicious NPM package that facilitates functionality. This indicates a need to secure open-source projects as cybercriminals are preferring to exploit them to distribute malware.

Attackers used other tactics to ensure developers added the malicious package to their applications, such as creating an NPM page similar to the legitimate package’s page. Moreover, just like the original package, the malicious one also featured 10 published versions.

In their **blog post**, researchers have noted an uptick in campaigns exploiting the NPM package register platform. In August 2023, ReversingLabs researchers discovered multiple malicious NPM packages linked to a campaign targeting cryptocurrency providers. 

Another NPM-related campaign was discovered in July 2023, targeting developers and end-users with malicious code that stole sensitive user data via fake Microsoft.com login forms and implanted credential-stealing scripts in apps that unintentionally incorporated NPM packages.

For your information, the original package (**node-hide-console-window**) is used to toggle the console window visibility of an application.

In order to protect yourself against **typosquatting attacks**, it is essential to check the addresses while typing or searching for addresses/packages online so that you visit the original site/repository.

In addition, closely inspect the package’s name and description before installing. Install a reliable security solution to detect/block malicious packages timely. If you suspect your device is infected with the r77 rootkit, quickly run a system scam using a reliable antivirus and change the passwords for all accounts, especially **banking passwords**.

****_RELATED ARTICLES_****

1.  Luna Grabber Malware Hits Roblox Devs Through npm Packages
2.  6 official Python repositories plagued with cryptomining malware
3.  CISA warns of trojanized versions of JavaScript library’s NPM package
4.  VMCONNECT: Malicious PyPI Package Mimicking Common Python Tools
5.  Crypto Discord Communities Targeted by Malicious Bookmarks & JavaScript

NPM Typosquatting Attack Deploys r77 Rootkit via Legitimate Package

By Waqas
Watch out for the phishing campaign leveraging the dangerous EvilProxy Phishing Kit.
This is a post from HackRead.com Read the original post: EvilProxy Phishing Kit Targets Microsoft Users via Indeed.com Vulnerability

Threat actors are exploiting the open redirection vulnerability on Indeed.com to launch EvilProxy phishing attacks against high-ranking executives.

The cybersecurity researchers at Menlo Labs have uncovered a sophisticated phishing campaign in which cybercriminals are using the **infamous EvilProxy phishing kit** by exploiting an open redirection vulnerability in the job site Indeed.com.

The campaign specifically targets high-ranking executives across various industries, with a notable focus on Banking and Financial Services, Insurance providers, Property Management and Real Estate, and Manufacturing.

Industries targeted in the attack (Screenshot: Menlo Labs)

This disclosure comes after rigorous research by Menlo Labs, and the key findings from this investigation are both intriguing and concerning:

1.  **Campaign Timeline:** The phishing campaign was initiated in July 2023, and has persisted into August, demonstrating a sustained effort by the threat actors.
2.  **EvilProxy Phishing Kit:** The attackers harnessed a highly advanced phishing kit known as ‘EvilProxy.’ This kit operates as a reverse proxy, intercepting communication between the user and the genuine website. Notably, EvilProxy possesses the capability to harvest session cookies, effectively bypassing multi-factor authentication (MFA) defences.
3.  **Primarily US-based Targets:** The campaign predominantly targeted organizations based in the United States, raising questions about its origin and motivation.
4.  **Open Redirection Vulnerability:** To initiate their phishing scheme, threat actors exploited an open redirection vulnerability present on the popular job search platform “indeed.com.” Victims were redirected from this trusted platform to malicious phishing pages impersonating Microsoft.

This phishing campaign is emblematic of an “Adversary In The Middle” (AiTM) phishing attack, which hinges on stealing session cookies to circumvent MFA protections.

In July 2023, Menlo Security’s HEAT Shield detected and thwarted an innovative phishing attack. This attack employed an open redirection within the ‘indeed.com’ website, ultimately redirecting victims to a deceptive Microsoft login page. This redirection cleverly disguises the attack as originating from a reputable source, ‘indeed.com.’

The threat actors leveraged ‘EvilProxy,’ a phishing-as-a-service platform available on the dark web, offered as a subscription-based service with plan durations ranging from 10 to 31 days. ‘John\_Malkovich,’ a threat actor within this scheme, served as an administrator and intermediary for customers who purchased this nefarious service.

The campaign honed in on C-suite employees and key executives across various sectors, as illustrated in the chart below. This data was collected from intelligence gathered through URLScan, Phishtank, and VirusTotal feeds.

The phishing emails delivered a deceptive link that appeared to originate from ‘indeed.com,’ fooling victims into clicking. Once clicked, the link led to a counterfeit Microsoft Online login page.

The phishing email detected by researchers

According to Menlo Labs report, here’s a step-by-step breakdown of the attack chain:

1.  The victim receives a phishing email containing the seemingly legitimate Indeed link.
2.  The unsuspecting victim clicks the Indeed link, which redirects them to the fake Microsoft login page.
3.  The phishing page, deployed via the EvilProxy phishing framework, dynamically fetches content from the legitimate login site.
4.  The phishing site acts as a reverse proxy, intercepting requests to the genuine website.
5.  The attacker seizes the legitimate server’s requests and responses, thereby capturing session cookies.
6.  The stolen cookies grant access to the legitimate Microsoft Online site, enabling attackers to impersonate victims and bypass non-phishing-resistant MFA.

This attack relied on an open redirection vulnerability, wherein an application unintentionally redirects users to an untrusted external domain. In this case, users believed they were redirected to ‘indeed.com’ or its subdomains, but the subdomain ‘t.indeed.com’ was furnished with parameters to redirect them elsewhere, ultimately leading to a phishing page.

The attackers effectively employed the EvilProxy phishing kit, executing an “Adversary In The Middle” attack by pilfering user session cookies to successfully evade MFA.

The phishing pages, identified by the subdomain ‘lmo.,’ impersonated the Microsoft Online login page. These pages were hosted on nginx servers, capable of acting as reverse proxies, dynamically fetching content and intercepting requests and responses between the victim and the genuine site. This method facilitated session cookie theft and is attributed to the usage of the EvilProxy Phishing kit.

Artefacts pointing to EvilProxy usage include domains hosted on Nginx servers, phishing pages containing common URI paths, and the use of Microsoft’s Ajax CDN for dynamic content rendering.

In response to the findings, Roger Grimes, data-driven defence evangelist at KnowBe4 advised users to use common sense as the first defence mechanism against such attacks. “Open redirects are among the most tricky tricks that social engineering hackers can deploy. We tell our end-users to always hover over a URL and to make sure it goes to a legitimate domain before clicking on it. But with these types of open-redirects, the originating URL DOES point to a legitimate URL,” Grimes said.

“Technically, the only defence is for every website and service to make sure they aren’t implementing a “feature” that allows malicious redirects. Education-wise, you must tell users that not only must they inspect URLs before they click them, but to re-examine the URL after they click them to see where they ended up. With a malicious open redirect, the final destination will not be a legitimate one. So, in short, all users must check all URLs before clicking on them AND AFTER clicking on them. It’s not enough just to examine before clicking,” Grimes emphasized.

****Indeed.com Knows…****

Indeed.com was informed about the vulnerability however it is unclear whether the company has it has been patched or not.

In light of the gathered intelligence and analysis, it’s evident that threat actors deployed the ‘EvilProxy’ phishing kit, exploiting an open redirection vulnerability in ‘indeed.com’ to impersonate the Microsoft Online page for credential phishing and account compromise.

This attack is just the initial phase of a broader attack chain that could lead to severe consequences, including identity theft, intellectual property theft, and substantial financial losses.

There is a looming possibility of increased ‘EvilProxy’ usage, given its user-friendly interface and the ability to bypass MFA, making it an attractive choice for cybercriminals.

**_RELATED ARTICLES_**

1.  Warning as hackers breach MFA to target cloud services
2.  Global CDN Service ‘jsdelivr’ Exposed Users to Phishing Attacks
3.  FortiGuard Labs Discovers .ZIP Domains Fueling Phishing Attacks
4.  New Phishing Attack Spoofs Microsoft 365 Authentication System
5.  “Picture in Picture” Tactic Exploited in New Deceptive Phishing Attack

EvilProxy Phishing Kit Targets Microsoft Users via Indeed.com Vulnerability

By Deeba Ahmed
Bitdefender reports a surge in Stream-Jacking attacks on popular YouTube channels, distributing crypto scams and information stealers such as Redline.
This is a post from HackRead.com Read the original post: Stream-Jacking: Malicious YouTube Livestreams Aid Malware, Crypto Scams

Researchers observed that Tesla was the most targeted brand in the Stream-Jacking campaign, and these scams continue to increase on YouTube.

****_Executive Summary_****

*   **New research from Bitdefender has revealed shocking details of his threat actors hijacking YouTube accounts through stream-jacking.**

*   **The attack targets popular YouTube channels and lures their followers to a fake channel promising exclusive rewards.**

*   **The attackers use different tactics to lure channel followers, such as Livestream popups, infected links, and QR codes.**

*   **Researchers observed that Tesla was the most hijacked brand in this campaign.**

*   **The target accounts mostly had around ten million subscribers and up to 3.6 million views.**

Bitdefender has published new research, revealing a sudden rise in stream-jacking attacks targeted against high-profile, popular streaming services like YouTube and aimed at distributing malicious links or lures. The attacks lead to complete account takeover, but in some cases, the followers are lured towards mimicked channels promising rewards.

The focus of this research was stream-jacking attacks against YouTube. Researchers found that cybercriminals target accounts with large follower counts to spread fraudulent messages to the masses. They embed suspicious YouTube livestream popups in the end-users’ feeds promoting the same content but with malicious intentions. 

YouTube channels with large followership are desirable in this campaign as cybercriminals can easily monetize them after hijacking by demanding ransom from the owner or distributing malware/scams to their viewers/subscribers. These channels are primarily top-rated brands like Tesla, featuring millions of followers and billions of views.

Crypto scams on YouTube are a serious issue. In 2020, Apple co-founder Steve Wozniak sued YouTube over Bitcoin scams using his name. Wozniak accused YouTube and Google of enabling Bitcoin giveaway scams by failing to take action against them.

> _**“Observing such a “large-scale operation” made us wonder about the channels behind these scams, and, upon closer inspection, we noticed that most of the YouTube channels were, in fact, hijacked/stolen.”**_
> 
> Bitdefender

The modus operandi is generally the same involving phishing attacks. Cybercriminals send emails presenting opportunities for the owner, such as brand collaboration or sponsorship deals.

Sometimes, they may send fake copyright notices from YouTube to the owner. This email, designed as a legitimate business proposition, encourages the recipient to download a malicious file presented as a crucial element of the collaboration offer. It is usually a PDF file carrying the Redline Infostealer malware. It is a large file (over 300 MB) and can easily bypass most standard security mechanisms.

When it is opened, within 30 seconds, it starts collecting vital data from the computer, including session tokens and cookies. With this information, the attacker can access the YouTube channel directly, even if the user has enabled 2FA. After gaining control of the account, attackers re-broadcast or re-upload content after embedding a scam.

The commentary sections of these malicious livestreams could be enabled or disabled, but the catch is that subscribers of 10 to 15 years are allowed to comment. Most of the content featured on the hijacked channels are livestream scams, indicating that the original videos and playlists were made private or deleted.

Attackers also edit channel descriptions as per their requirements, but the channels also feature official Tesla playlists to create legitimacy, leaving the original owner with nothing.

> _**“The process is very likely automated, as conducting an operation on such a large scale would be time-consuming and could potentially give the actual owner of the channel enough time to spot suspicious behaviour.”**_
> 
> Bitdefender

****The Second Part****

According to Bitdefender’s report, the second part of the attack is targeting account subscribers/viewers with fraudulent offers. Attackers use several techniques to deceive channel subscribers, such as livestream popups, malicious links, and QR codes.

The mimicked channels try to create a sense of legitimacy by using official names, for instance, Tesla US, Tesla Official, Tesla (INC), and Tesla News, but, in reality, most account names involve homoglyphs where the letter L is substituted for an uppercased i (I) and include noise characters such as ‘\_’ (for instance, @tesla—us\_, @tesla—corp., @tesla\_us\_live24, etc.).

The maximum number of thumbnails in this attack features Elon Musk. The titles are also the same and less diverse. Such as:

*   Rebrands to X!
*   A New Era for Tesla Model 3 – Live Reveal with Elon Musk!
*   A New Era for Tesla Model 3 – Live Reveal with Elon Musk! Twitter
*   Live Stream of Tesla Model 3 2024 Unveiling with Elon Musk!
*   CEO Elon Musk Presents: Live Reveal of Upgraded Tesla Model 3

The videos’ descriptions, tags, thumbnails, and channel banners are also the same. Official Tesla streams mostly inspire stream titles. Sometimes, the channel name stays the same due to YouTube’s policy of two changes in two weeks, and when YouTube detects malicious activity, the account sadly gets deleted. 

Elon Musk and Tesla are the most abused Brands in YouTube scams (Screengrabs: Bitdefender)

In some instances, researchers noted a QR code embedded in the video leading to a phishing website, and if the comments section is enabled, the same link is posted there by the moderator, and sometimes the link is directly featured on the video. The malicious links promise similar rewards, such as sending cryptocurrency (e.g. bitcoin, Ethereum, BNB, USDT, Inu, Dogecoin, or Shiba) to get double the amount. 

Sometimes, the looped audio/video in the livestream are high quality, genuine-looking, deep fakes of Elon Musk. They also suggest a Telegram channel where the attackers promote phishing kits like those featured on the hijacked channel. Over 1300 crypto scams came from the same kits featured on over 150 websites, all with Cloudflare protection.

YouTube channel owners must remain vigilant and use strong, unique passwords, enable multiple layers of security (2FA or MFA), and install software to detect phishing attacks.

****_RELATED ARTICLES_****

1.  Fake YouTube Android Apps Used to Distribute CapraRAT
2.  New YouTube phishing scam using authentic email address
3.  British Military’s YouTube Accounts Hacked to Scam Crypto Users
4.  Hackers using smart home devices to live stream swatting attacks
5.  Google details cookie stealer malware campaign targeting YouTubers

Stream-Jacking: Malicious YouTube Livestreams Aid Malware, Crypto Scams

By Waqas
The data breach occurred from May 28th to May 30th, 2023, and the stolen data included "names and other personal identifiers combined with Social Security Numbers (SSNs)."
This is a post from HackRead.com Read the original post: Sony Data Breach via MOVEit Vulnerability Affects Thousands in US

Sony has confirmed a data breach due to a MOVEit vulnerability, which has impacted 6791 of its current and former employees or their family members.

Sony Interactive Entertainment LLC (“SIE”) has confirmed that it was the victim of a data breach due to MOVEit vulnerability. The data breach affected thousands of United States-based current and former employees or their family members.

In a data breach notification filed with the Office of the Maine Attorney General, Sony said that the attackers were able to gain unauthorized access to MOVEit servers and steal data that was being transferred through the tool.

The data breach occurred from May 28th to May 30th, 2023, and the stolen data included “names and other personal identifiers combined with Social Security Numbers (SSNs).”

Sony said that it has taken steps to mitigate the impact of the breach. The company is also offering credit monitoring and identity theft protection services to affected customers. In a notice to victims, Sony further explained the scope of the data breach stating:

> _“_On June 2, 2023, SIE discovered the unauthorized downloads, immediately took the platform offline and remediated the vulnerability. An investigation was then launched with assistance from external cybersecurity experts. We also notified law enforcement._“_
> 
> _“_Once SIE identified the downloaded files, we began a process to determine what types of personal information were affected and to whom it relates. While we worked quickly, this was a time-consuming process, and we wanted to provide you with accurate information._“_
> 
> Sony Interactive Entertainment LLC (“SIE”)

This is the latest in a series of data breaches that have affected Sony in recent years. In 2014, **Sony was hacked by North Korea**, and the attackers stole a massive amount of data, including unreleased movies and TV shows.

****MOVEit vulnerability – A Major Cybersecurity Treat****

The MOVEit vulnerability is a serious threat to businesses that use the tool to transfer files. The impact of the vulnerability is significant. According to a **report** published in September this year, MOVEit vulnerability has affected over 900 schools in the United States, resulting in data breaches involving sensitive student information.

It’s important to highlight that the MOVEit vulnerability was extensively exploited by the notorious Cl0p ransomware gang. In July 2023, the group took the unusual step of publishing data stolen through this vulnerability **on its clearnet website**, instead of confining it to the dark web. Sony was among the victim companies listed on their website.

Cl0P ransomware claiming Sony data breach (Screengrab: Hackread.com)

If you are a impacted by Sony data breach, you should be aware of the possibility that your data may have been compromised. You should monitor your accounts for any suspicious activity and change your passwords immediately. You should also contact Sony customer support for more information.

Nevertheless, businesses that use MOVEit should immediately patch their servers to fix the vulnerability. Businesses should also review their file transfer security policies to make sure that they are protecting their data from unauthorized access.

****_RELATED ARTICLES_****

1.  Private details of Palo Alto Networks employees leaked online
2.  Discord Notifies Users of Data Breach Impacting 180 Accounts
3.  Whistleblower Leak Reveals Tesla Data Breach, Affects 75,000
4.  RANSOMEDVC Ransomware Group Claims Breach of Sony Corporation