By Deeba Ahmed
The attack's perpetrators are Vietnamese, as confirmed by Malwarebytes.
This is a post from HackRead.com Read the original post: Fake Ads Manager Software and Malicious Extensions Target Facebook Accounts

Currently, the campaign has affected approximately 800 individuals and businesses globally, including 310 in the United States, with an ad budget compromise of $180,000.

Facebook serves as a thriving platform for optimizing ad campaigns, making it a crucial tool for businesses worldwide to boost their revenues. However, it is not without its downsides, as the platform has been exploited by cybercriminals to spread malware and, **even worse, ransomware**.

A recent warning issued by Malwarebytes’ senior threat researcher, Jérôme Segura, highlights the need for businesses to be vigilant. He cautions against falling victim to malicious Meta ad manager downloaders and Chrome extensions, particularly when faced with offers that seem too good to be true and involve clicking on suspicious URLs. The primary targets of these attacks are often business account users who are willing to invest their ad dollars in Meta platforms.

**Vietnamese Hackers Targeting Businesses’ Advertising Accounts**

According to Malwarebyte’s latest blog post, a newly identified cybercrime gang originating from Vietnam has been engaging in targeted attacks on **Facebook business users**, with the aim of stealing advertising accounts. What makes this situation even more alarming is that victims are not limited to a specific geographic region; the attacks have been reported worldwide.

Jérôme Segura, in his **analysis**, reported a noticeable surge in sponsored posts and accounts that are attempting to impersonate Meta/Facebook Ad Manager in recent weeks. Delving deeper into the matter, investigators uncovered that the cybercriminals are distributing counterfeit software, falsely promoting it as a more effective tool for optimizing ads on Facebook. Businesses and advertisers need to be aware of this emerging threat to safeguard their accounts and assets.

The cybercrime gang employs malware-infected Chrome extensions as their method of choice to steal Facebook business account credentials. What is particularly intriguing is that Jérôme Segura was able to detect their campaign thanks to a mistake made by the threat actors themselves.

Apparently, the attackers accidentally placed one of the **malware files** in the wrong location, which ultimately led to the inadvertent exposure of stolen data. This fortunate error provided valuable insights to the researchers at Malwarebytes, aiding them in their investigation and analysis of the cybercrime operation.

**What Happens When Meta Business Accounts Get Infected with Malware?**

Once the malicious extension is downloaded, the attackers gain control over the business’s ad budget, allowing them to exploit it according to their own agenda. The campaign came to light in early June when the threat actors enticed businesses with deceptive Facebook Ads Manager program installers, distributed through URLs, promising to enhance ad revenues.

To make their scheme more convincing, the attackers utilized fraudulent accounts with thousands of followers. Consequently, the posts made through these accounts quickly went viral, further deceiving unsuspecting victims and expanding the impact of the attack.

The victims are redirected to phishing pages that imitate the appearance of Meta’s official logo and branding. Upon downloading the program file, several components of an MSI installer package are installed in the directory: C:\\Program Files (x86)\\Ads Manager\\Ads Manager. Subsequently, a batch script is initiated, opening a new browser window displaying a custom extension.

In this window, the unsuspecting victim is prompted to enter their Facebook credentials on a deceptive login page. It is through this fraudulent login page that the cybercriminals aim to harvest the victims’ login credentials, granting them unauthorized access to the victims’ Facebook business accounts.

The custom extension cleverly masquerades as an unpacked Google Translate extension, making it appear innocuous and legitimate. However, upon reverse engineering, it becomes evident that the extension’s code is entirely unrelated to its purported function. Instead, the sole purpose of this deceptive extension is to illicitly gather Facebook login credentials and cookies from unsuspecting users.

Image: Malwarebytes

To exfiltrate the stolen data, the cybercriminals employ a cunning technique of bypassing Content Security Policy (CSP) restrictions by leveraging **Google Analytics**. This allows them to transmit the stolen information undetected and without triggering any alarms. In effect, the attackers exploit the widely-used Google Analytics service as a conduit to sneak the stolen data out of the victim’s system and into their own malicious infrastructure.

This sophisticated method allows the cybercrime gang to continue their **illicit activities** discreetly, evading detection while compromising the security and privacy of Facebook business account users.

Just for your information, Facebook Ad Manager is a tool that enables users to run online ads on various social media platforms owned by Meta, including Instagram. Recently, cybersecurity researchers detected approximately 20 malicious ad manager archives, which were used to distribute Chrome extensions with the intention of hijacking Facebook business accounts.

During their investigation, researchers stumbled upon a newly discovered phishing site and found an unexpected mistake made by the cybercriminals. The attackers had failed to include the payload but inadvertently leaked the stolen data.

Recognizing their error, the criminals promptly removed the file from their **Google Drive account** and then updated the download link on the phishing site with a new file hosted on MediaFire. This move was likely an attempt to cover their tracks and maintain their malicious activities undetected.

Upon further analysis, researchers identified column titles in the Vietnamese language within the stolen data, which were directly related to ad budgets and currencies. This points to the origin of the cybercrime gang or indicates that they might be targeting victims from **Vietnamese-speaking regions**.

As of now, the campaign has victimized around 800 individuals and businesses, highlighting the severity of the threat and the importance of staying vigilant against such phishing attacks and malware distribution schemes. What’s worse, the threat actors managed to compromise over $180,000 in ad budget including from 300 victims within the United States.

Targeted regions – Image: Malwarebytes

In previous research, Meta disclosed that **threat actors like DuckTail**, among others, have been targeting Facebook advertising accounts over an extended period. While Jérôme Segura acknowledges the uncertainty regarding the direct attribution of this threat actor to DuckTail, he highlights the undeniable similarities in motives and a shared preference for hacking Facebook business accounts, which raises the possibility of a connection.

In response to the campaign’s discovery, Facebook has been duly notified, and the company has taken prompt action. To protect themselves, users of Facebook business manager accounts are advised to immediately revoke access for any unidentified users and conduct a thorough scan of their computers to identify and remove any potential malware that might have been installed. Taking these precautionary measures will help safeguard their accounts and data from falling victim to these malicious attacks.

1.  **Mandrake Android malware stealing Facebook data since 2016**
2.  **Facebook ads dropped malware posing as a Clubhouse PC app**
3.  **CopperStealer malware steals Facebook and Google passwords**
4.  **Facebook removes 100s of accounts for iOS and Android malware**

Fake Ads Manager Software and Malicious Extensions Target Facebook Accounts

By Owais Sultan
Explore this review for excellent tips on how to choose the best web hosting service for your business.…
This is a post from HackRead.com Read the original post: Tips to Choose The Best Web Hosting Service for Your Business

**Explore this review for excellent tips on how to choose the best web hosting service for your business.**

Getting a website for your online business is one of the most important steps you can take as an entrepreneur. With quality web content on a great website, you can attract and capture the heart of many customers. However, one thing most company website owners ignore or underestimate is the process of choosing a **reliable web hosting service**. 

If you take the time to choose a good web hosting company, it will ensure your website is always online and secure. Making the wrong choice can result in a disastrous experience and loss of funds. In this article, we will provide tips for picking a suitable web hosting service. 

****Consider the Type of Hosting Services on Offer****

The **best domain hosting** companies provide different types of services. Your choice of the service will depend on your website needs. For fresh websites with little traffic, a shared hosting service can be a great option. However, if you expect large traffic or you’ll have to run heavy software on your site, you may want to opt for cloud hosting or a virtual private server (VPS). 

If you’re a new webmaster, you may also want to go for companies that provide managed hosting. When you host your site with a managed hosting company, the provider takes care of many things. You’ll not have to worry about software or security updates, as the provider will do them automatically. 

Furthermore, prioritize providers that offer different plans. As your website changes and your needs increase, you may need to upgrade your plans. The best domain hosting services allow you to make these upgrades without unnecessary downtime. 

****Check the Hosting Features****

Another factor to look out for is the features package of the different plans offered. For example, data storage. If you host with a low-budget company, they may store data on hard disk drives, which are prone to failure. Look for solid-state disks that offer more reliability and faster speeds. 

What’s more, consider the backup process of the hosting plan. We recommend selecting plans that offer **automatic backups**, which are necessary for recovering data after issues arise. 

Also, check for the hosting software included in the plans. Some hosts offer the popular cPanel software, which allows you to manage your site easily. However, some may offer other kinds of software that may be challenging to use. 

****Test the Customer Service****

It is necessary to **keep your website accessible** at all times. However, problems can arise at any time and make your site inaccessible. This could be due to mistakes on your path, malicious attacks, or an error from the hosting service. If your hosting provider has a responsive customer service department, it becomes easy to resolve issues like this. But if it is difficult to reach customer service, your website may remain offline for a long time. 

The best hosting companies offer support through various channels, with live chat being the most popular. A hosting company’s live chat service must be available 24/7 to help customers reach them anytime. Additional channels include emails and telephones. Before picking a company, test their customer support. 

****Consider the Security Features****

All websites face the risks of cyberattacks and data breaches. Even some of the most popular online platforms **have faced these cyber attacks**. If your website is not hosted on a secure platform, it would be susceptible to malicious actors. This will not just affect your website but can affect your visitors as well. 

It’s also possible for your website to be flagged by search engines like Google if you share the same IP addresses with spammy or compromised platforms. Thus, even if you don’t get any direct attacks, your website could be affected by using a hosting company that does not prioritize security. This will cause a reduction in traffic, which may ultimately affect your sales and business. 

Therefore, it’s important to examine the security features offered by different web companies. Many top companies have well-guarded data centers that protect your website. Some other hosts may give you the option to select what security features you want to implement on your website. 

1.  Why Web Hosting Security is important?
2.  What To Look For In The Best WordPress Hosting
3.  What Brings The Essence Of Secured Web Hosting
4.  Dark web host quits after hackers delete its database
5.  Managed Cloud Hosting vs. Unmanaged Cloud Hosting

Owais takes care of Hackread's social media from the very first day. At the same time He is pursuing for chartered accountancy and doing part time freelance writing.

Tips to Choose The Best Web Hosting Service for Your Business

By Owais Sultan
Let’s explore the steps involved in penetration testing and the methodology employed by cybersecurity professionals to conduct effective…
This is a post from HackRead.com Read the original post: Steps Involved In Penetration Testing And Their Methodology In Cybersecurity

Let’s explore the steps involved in penetration testing and the methodology employed by cybersecurity professionals to conduct effective and comprehensive assessments.

The internet world provides new opportunities and new routes for cyber assaults. Our systems and applications must be sufficiently secure to defend against these threats. Penetration Testing is useful in providing vital insights into security norms and weaknesses.

The study of the defences must be done proactively so that the pentester (person performing the audit) may identify their weaknesses and offer a fix before a hacker exploits this flaw. By using these procedures, businesses can reduce the time and resources needed to address application vulnerabilities in the future.

In cybersecurity, penetration testing plays a vital role in assessing the security posture of an organization’s systems and networks. Here, we will explore the steps involved in penetration testing and the methodology employed by cybersecurity professionals to conduct effective and comprehensive assessments.

**What is penetration testing?**

A penetration test may have the following goals: to evaluate policies, the preparedness and collaboration of security personnel, the cooperation between internal and external security providers, security vulnerabilities and gaps, security tools and defences, and incident response protocols.

**Pre-engagement Phase:**

The pre-engagement phase sets the foundation for a successful penetration testing exercise. It involves understanding the scope and objectives of the assessment, defining the rules of engagement, and obtaining necessary permissions from the organization.

**Vulnerability Analysis:**

In this step, the penetration testing team analyzes the vulnerabilities identified during the intelligence-gathering phase. They assess the severity and exploitability of each vulnerability and prioritize them based on their potential impact on the organization’s security. The team may also conduct manual verification to validate the vulnerabilities and identify any false positives or false negatives.

**Reporting and Remediation:**

Once the Penetration Testing exercise is complete, the team prepares a detailed report documenting their findings, including the vulnerabilities exploited, the impact of the exploits, and recommended remediation measures. The report includes actionable recommendations for strengthening security controls, patching vulnerabilities, and improving overall security posture. 

The report is typically presented to the organization’s management and technical teams, guiding them in addressing the identified vulnerabilities and implementing necessary security measures.

**Post-Testing Activities:**

After the penetration testing exercise, organizations should conduct post-testing activities, including debriefing sessions with the penetration testing team and the organization’s stakeholders. It allows for knowledge transfer, sharing insights, and addressing any questions or concerns.

Organizations should also implement the recommended remediation measures, monitor their security controls, and consider conducting periodic penetration testing assessments to ensure continuous security improvements.

**Methodologies and Standards for Penetration Testing**

The penetration test is legitimate and covers all crucial areas thanks to various standards and procedures. The following list includes some of them:

*   NIST
*   PTES
*   ISSAF
*   OWASP
*   OSSTMM

**Why are penetration testing methodologies crucial?**

When it comes to penetration testing, no one solution works for everyone. Security, compliance, and tolerance criteria vary depending on the target organization. These and other variables help decide the pentest’s scope. For this seemingly haphazard attempt to be more consistently executed, a penetration testing technique is crucial.

When a specific pentest technique is adopted, it aids pen testers in focusing their efforts and completing vital procedures without error, preserving the test’s credibility in the industry.

**Conclusion:**

Penetration testing follows a structured methodology to assess the security of an organization’s systems and networks. By following the steps involved in penetration testing, organizations can identify vulnerabilities, evaluate their potential impact, and implement appropriate remediation measures to strengthen their cybersecurity defences.

Regular penetration testing helps organizations proactively identify and address vulnerabilities, minimizing the risk of real-world attacks and safeguarding sensitive data and systems.

1.  Network Pentesting Checklist
2.  The 10 Best Cybersecurity Companies in the UK
3.  What is an OSINT Tool – Best OSINT Tools in 2023
4.  We Need Smarter Smart Contracts To Prevent DeFi Hacks
5.  AttackSurfaceMapper; new automated penetration testing tool

Owais takes care of Hackread's social media from the very first day. At the same time He is pursuing for chartered accountancy and doing part time freelance writing.

Steps Involved In Penetration Testing And Their Methodology In Cybersecurity

By Waqas
The developer behind the malicious app, Limestone Software Solutions, has also been banned from the Google Play Store.
This is a post from HackRead.com Read the original post: Google Removes Swing VPN Android App Exposed as DDoS Botnet

The app under discussion, Swing VPN – Fast VPN Proxy, was uncovered as a DDoS botnet by a cybersecurity researcher named “Lecromee” on June 4th, 2023.

On June 4th, 2023, cybersecurity researcher “Lecromee” uncovered alarming information about the popular VPN app, Swing VPN – Fast VPN Proxy. Developed by Limestone Software Solutions for Android and iOS platforms, Swing VPN’s Android version was found to be operating as a dangerous **DDoS botnet**, posing significant risks to its unsuspecting users.

Hackread.com, first **reported on the issue** on June 21, 2023, after Lecromee’s investigation raised serious concerns. The findings indicated that the app, which claimed to offer legitimate VPN services, was harbouring malicious intent and could carry out distributed denial of service (DDoS) attacks.

Shortly after the report was published, Hackread.com was contacted by Google on June 22, confirming the veracity of the claims. In response to the alarming discovery, Google took immediate action and swiftly removed Swing VPN’s Android app with over 5 million installs from the **Google Play Store**.

It is worth noting that another app from Limestone Software Solutions, called **Hotspot for Swing VPN**, has also been removed from the app store along with Swing VPN – Fast VPN Proxy.

A Google spokesperson emphasized the company’s commitment to user safety and security, stating,

> “The app was removed from Google Play on June 22, and the developer has been banned. Users are also protected by Google Play Protect, which warns users of apps known to exhibit malicious behaviour on Android devices with Google Play Services, even when those apps come from other sources.”
> 
> Google

The removal of **Swing VPN – Fast VPN Proxy** app from the official app store highlights the ongoing challenges faced by platforms like Google Play in combating malicious apps. Unfortunately, such occurrences are not uncommon, and Google continuously works to enhance its security measures to protect users.

However, users themselves must remain vigilant and cautious about the apps they download and grant permission to. Cybersecurity experts recommend the following best practices to stay safe:

*   **Research Before Download**: Always research the app and its developer before downloading it. Check user reviews, ratings, and previous security incidents, if any.
*   **Update Regularly**: Keep all apps, including VPNs, up-to-date with the latest versions and security patches to minimize vulnerabilities.
*   **Verify Permissions**: Be cautious about granting excessive permissions to apps. Review and understand the permissions an app requests before installation.
*   **Use Reputable Sources**: Stick to trusted app stores like Google Play and Apple’s App Store to minimize the risk of downloading malicious apps.
*   **Antivirus Software**: Install reputable antivirus software on your device to detect and block potential threats.

As the digital landscape continues to evolve, staying informed and vigilant against cyber threats is crucial. The Swing VPN incident serves as a reminder that even seemingly legitimate apps can harbour dangerous intentions, making it essential for users to prioritize their online safety.

If you suspect any app or service is engaging in malicious behaviour, report it to the respective app store or platform immediately. By working together, users, researchers, and tech companies can create a safer digital environment for everyone.

If you are an Android user, you can follow this **link** to report an app or an app developer. For iOS users, this **link** can be helpful.

1.  Fake GitHub Repos Delivering Malware as PoCs
2.  Google kicks out 600 malicious apps from Play Store
3.  Apple removed all major VPN apps from Chinese App Store
4.  Google removes ClearURLs Chrome extension from its store
5.  Google Fails To Remove “App Developer” Behind Malware Scam

I am a UK-based cybersecurity journalist with a passion for covering the latest happenings in cyber security and tech world. I am also into gaming, reading and investigative journalism

Google Removes Swing VPN Android App Exposed as DDoS Botnet

By Habiba Rashid
The individuals behind Genesis Market claim to have found a buyer, and the store is scheduled to be transferred to the new owner next month.
This is a post from HackRead.com Read the original post: Dark Web Domain of Genesis Market and Infrastructure Sold

**The apparent successful sale took place despite the FBI’s takedown and seizure of the clearnet domain and infrastructure of Genesis Market in April 2023.**

The criminal group responsible for Genesis Market, a prominent Dark Web platform known for facilitating cyber fraud, announced that the platform has been sold to an anonymous buyer.

The sale comes several months after U.S. authorities disrupted the platform, seizing some of its domains and adding it to the sanctions list. The move raises concerns about the potential revival of illicit activities and the evolving nature of cybercrime.

As we previously **reported**, in late June, Genesis Market was advertised to be available for sale on a hacker forum along with its source code and database. The operators’ attempt to sell the marketplace was met with suspicion in the cybersecurity community with researchers speculating that the advertisements were likely part of an **FBI honeypot operation**. 

The news of Genesis Market’s sale emerged when an account named GenesisStore, which had previously associated itself with the platform’s administrators, posted an announcement on the Russian-language Exploit Forum.

According to The Record’s **report**, the post stated that a buyer had been found, and a deposit had been made, with the store set to be transferred to the new owner next month. Notably, the sale does not include current user accounts.

Earlier this year, the FBI-led operation successfully **seized Genesis Market**‘s clear web domains and made several arrests of individuals globally who had been involved in fraudulent activities through the platform.

The operation also led to the identification and location of the platform’s backend servers, resulting in the acquisition of valuable information about approximately 59,000 user accounts.

The sale of Genesis Market, despite its tarnished reputation, has raised eyebrows within the cybersecurity community. Some experts speculate that the operators themselves orchestrated the sale to facilitate rebranding and disconnect from the sanctioned entity. Doubts have been cast on the viability of the sale, given the platform’s diminished standing and the legal consequences that potential buyers might face.

The seized clearnet domain of the Genesis Market (Image: Hackread.com)

Law enforcement agencies worldwide are likely to closely monitor the developments surrounding the sale of Genesis Market, ensuring that any potential resurgence of criminal activities is promptly addressed which is another disadvantage the new buyer of the marketplace will have to face.

Nevertheless, the cybersecurity community remains vigilant in combating cybercrime and safeguarding the digital landscape and it would be far from it for them to let a defunct marketplace rise back into power.

1.  Seizure of EncroChat Enables Police Access to 115m chats
2.  What Are Dark Web Search Engines and How to Find Them?
3.  Russian Dark Net Markets Dominate the Global Illicit Drug Trade
4.  Military Satellite Access Sold on Russian Hacker Forum for $15k
5.  Raidforums Database Leak: Data of 460k Users Dumped Online

I’m a student and cybersecurity writer. On a random Sunday, I am likely to be figuring out life and reading Kafka.

Dark Web Domain of Genesis Market and Infrastructure Sold

By Habiba Rashid
At the time of writing, all reported fake repositories have been taken down and the malicious PoC has been removed from GitHub.
This is a post from HackRead.com Read the original post: Fake GitHub Repos Caught Dropping Malware as PoCs AGAIN!

**The backdoor dropped in the scam had the ability to exfiltrate a wide range of data, including the hostname, username, and a comprehensive list of home directory contents.**

Cybersecurity researchers have uncovered a deceptive trend within the security community—a proof of concept (PoC) repository on **GitHub** that appears to address vulnerabilities but actually contains a hidden backdoor. The discovery by the Uptycs threat research team has raised concerns among the security research community.

PoCs are typically **used by researchers** to identify potential vulnerabilities through harmless testing. However, this malicious PoC operates as a downloader, disguising its activities as a kernel-level process while silently executing a Linux bash script. 

The backdoor has the ability to exfiltrate a wide range of data, including the hostname, username, and a comprehensive list of home directory contents. Moreover, by adding their SSH key to the authorized\_keys file, an attacker can achieve full control over a targeted system.

One of the fake profiles on GitHub that was used in spreading malicious PoCs (Image credit: Uptycs)

Here, Hackread.com can exclusively confirm that the image used in the above GitHub profile belongs to Shahriyar Hamid oghlu Mammadyarov, known internationally as **Shakhriyar Mamedyarov**, who is an Azerbaijani chess grandmaster. The profile image was stolen from a **blog post** and **a YouTube video** published by the popular Chess-related YouTube channel, ChessBase India.

The backdoor was discovered during the testing of PoCs for various Common Vulnerabilities and Exposures (CVEs) when the Uptycs team encountered a PoC claiming to address the critical vulnerability **CVE-2023-35829**. However, they detected several unusual activities that raised suspicions about the PoC’s legitimacy.

The suspicious behaviours encompassed unexpected network connections, abnormal data transfers, and unauthorized attempts to access the system. Further investigation revealed the significance of the “aclocal.m4” file, which required additional analysis.

The primary function of the binary file contains an interesting string, “kworker,” which plays a crucial role in the deception. The code checks if the binary is named “kworker” and performs specific actions accordingly, establishing **backdoor persistence** through file manipulation.

In their **report**, Nischay Hegde and Siddartha Malladi of the Uptycs Threat Research team wrote that the PoC used forking to create a new process, obscuring the original command line parameters. The parent process then executes the “curl\_func()” function, which downloads a URL containing a bash script. The script is executed if the curl request succeeds.

The fake PoC is a copy of a legitimate exploit for another Linux kernel vulnerability, **CVE-2022-34918**. It creates the illusion of being a root shell, exploiting differences in user namespaces to deceive users. However, the granted privileges are limited to the “/bin/bash” shell within a specific namespace.

Fake PocC (left) – Original PoC (right) – (Image credit: Uptycs)

Using Uptycs Extended Detection and Response (XDR), the binary’s behaviour was identified primarily as a downloader. It retrieves a script from a remote source and executes it on the compromised system. The downloaded script accesses the “/etc/passwd” file and modifies the “~/.ssh/authorized\_keys” file to grant unauthorized access and exfiltrates data using a specific URL.

This incident is not isolated; just last month, **it was reported that** several fake accounts on GitHub and Twitter were spreading malware in malicious PoC that infected both Windows- and Linux-based systems.

At the time of writing, ChriSander22’s repositories were taken down. Although the malicious PoC has also been removed from GitHub, it was widely shared, resulting in significant engagement before its true nature was exposed. Those who executed the PoC are at high risk of data compromise.

Therefore, it is crucial to take immediate action, including removing unauthorized SSH keys, deleting the “kworker” file, removing the kworker path from the “bashrc” file, and checking for potential threats in “/tmp/.iCE-unix.pid.”

**Malicious Repositories**

*   https://github.com/apkc/CVE-2023-35829-poc
*   https://github.com/ChriSanders22/CVE-2023-20871-poc/
*   https://github.com/ChriSanders22/CVE-2023-35829-poc/ (**archive link**)

Differentiating between legitimate and malicious PoCs can be challenging and security researchers are encouraged to adopt safe practices, such as conducting testing in isolated environments like virtual machines, to enhance protection against these **evolving cybersecurity risks**.

**RELATED ARTICLES**

1.  Crooks Targeting LinkedIn Users with Fake Profiles
2.  AI-Generated Images Used to Represent a Fake Law Firm
3.  Fake Facebook Profiles, Google Ads Pushing Sys01 Stealer
4.  Fake LinkedIn Job Offer Scam Hacked Off $625M from Axie Infinity
5.  Hackers Setup Fake Cyber Security Firm to Target InfoSec Experts

I’m a student and cybersecurity writer. On a random Sunday, I am likely to be figuring out life and reading Kafka.

Fake GitHub Repos Caught Dropping Malware as PoCs AGAIN!

By Waqas
Malicious AI Unleashed: WormGPT Raises Concerns in Cybersecurity!
This is a post from HackRead.com Read the original post: WormGPT – The Malicious ChatGPT Alternative Empowering Cybercriminals

**WormGPT is being offered for sale on a popular hacking forum, enabling malicious actors to exploit its capabilities for nefarious purposes.**

In a disconcerting development for the cybersecurity community, a hacker has created a new chatbot called WormGPT, specifically designed to assist cybercriminals in carrying out illegal activities.

WormGPT is being offered for sale on a popular hacking forum, enabling malicious actors to exploit its capabilities for nefarious purposes. This new breed of chatbot lacks the ethical guardrails found in similar **AI models**, making it a potent tool in the hands of cybercriminals.

The alarming discovery was made by SlashNext, an email security provider, which recently tested the chatbot’s functionalities. In a blog post, the company revealed that malicious actors are now developing custom modules similar to ChatGPT but tailored for illegal activities, ultimately making it easier for cybercriminals to execute their schemes.

According to SlashNext’s findings, the hacker behind WormGPT first introduced the chatbot in March, before officially launching it just last month. In stark contrast to **ChatGPT and Google’s Bard**, WormGPT lacks any safeguards or restrictions that prevent it from responding to malicious requests, making it an ideal tool for cybercriminals seeking to exploit its unrestricted capabilities.

The developer of WormGPT unabashedly touts the chatbot as a gateway to facilitate illegal activities, providing users with the means to engage in various blackhat activities without ever leaving the confines of their homes. The hacker has shared screenshots showcasing WormGPT’s ability to produce malware using the Python coding language and offer tips on crafting sophisticated and malicious attacks.

The chatbot’s creation involved using an older open-source language model called GPT-J from 2021, which was then trained on datasets specifically related to malware creation. The result is WormGPT, a highly potent and versatile tool in the hands of cybercriminals.

SlashNext **tested** WormGPT by assessing its ability to produce convincing emails for business email compromise (BEC) schemes, a form of a phishing attack. The results were unsettling, as the chatbot crafted an email that was not only highly persuasive but also strategically cunning, highlighting its potential for executing sophisticated **phishing and BEC attacks**.

The email created by WormGPT exhibited professional language and lacked any spelling or grammar mistakes, making it difficult to identify as a phishing attempt.

Summing up their experience with WormGPT, SlashNext emphasized the absence of ethical boundaries or limitations within the chatbot. The experiment served as a stark reminder of the severe threat posed by generative AI technologies like WormGPT, even in the hands of novice cybercriminals.

Thankfully, the exorbitant price tag associated with WormGPT’s access offers a degree of respite. The developer is selling monthly access to the chatbot for 60 Euros or an annual subscription for 550 Euros. However, despite its considerable capabilities, there have been complaints about the chatbot’s performance, with one buyer describing it as “not worth any dime.”

Nevertheless, the emergence of WormGPT serves as a grim reminder of the potential dangers posed by **generative AI programs** as they continue to mature. Cybersecurity experts are increasingly concerned about the proliferation of such malicious tools, emphasizing the urgent need for robust measures to counteract the growing cybercrime threat.

As the battle between cybercriminals and cybersecurity professionals continues, the development and deployment of AI models like WormGPT underscore the need for heightened vigilance and collaborative efforts to safeguard individuals, businesses, and societies from the escalating risks of cybercrime.

**RELATED ARTICLES**

1.  How to use AI in cybersecurity?
2.  Fake ChatGPT Extension Hijacks Facebook Accounts
3.  DarkBERT: Enhancing Cybersecurity Efforts on the Dark Web
4.  Russian Hackers Eager to Bypass Restrictions to Abuse ChatGPT
5.  Researcher create polymorphic Blackmamba malware with ChatGPT

I am a UK-based cybersecurity journalist with a passion for covering the latest happenings in cyber security and tech world. I am also into gaming, reading and investigative journalism

WormGPT – The Malicious ChatGPT Alternative Empowering Cybercriminals

By Waqas
Both teenagers, who are on trial in the United Kingdom, have been accused of being associated with the infamous Lapsus$ hacking group.
This is a post from HackRead.com Read the original post: Teenagers Face Trial for Hacking BT, Nvidia, Rockstar Games, Revolut, Uber

**One of the accused, 18-year-old Arion Kurtaj, has been referred to as highly competent and a genius by the prosecutors.**

Two UK teenagers are currently facing trial for engaging in serious computer misuse, blackmail, and fraud against BT Group Plc and Nvidia. The 17-year-old hacker, whose name remains undisclosed due to legal restrictions, and his 18-year-old partner, Arion Kurtaj, are accused of being associated with the notorious hacking group **Lapsus$**.

Prosecutors allege that the teenage hackers stole approximately one terabyte of sensitive data from Nvidia and demanded ransom money from BT Group. This article delves into the details of the case and highlights the security implications raised by these cyberattacks.

**The Allegations:**

The prosecutors claim that **the teenage hackers** successfully infiltrated the systems of Nvidia, a leading chipmaker, and gained access to one terabyte of sensitive data. Subsequently, they released a portion of the stolen data online and threatened to disclose the remainder unless a ransom was paid.

Additionally, the hackers targeted BT Group, a prominent British telecoms company, demanding ransom money. Furthermore, the teenagers were involved in **SIM swap fraud** to steal cryptocurrency.

**Legal Proceedings:**

While the 17-year-old hacker pleaded guilty to two charges related to BT Group, he maintained a not-guilty plea for the remaining charges. On the other hand, the legal restrictions on naming his 18-year-old partner, Arion Kurtaj, were lifted this week.

Prosecution lawyer Kevin Barry acknowledged Kurtaj’s technical skills, referring to him as highly competent and a genius. However, Barry also noted that Kurtaj’s tendency to boast about his exploits online ultimately aided the investigators in tracking him down.

**Previous Incidents:**

Arion Kurtaj’s expertise in hacking was demonstrated in previous incidents, where he **breached the security systems of Rockstar Games**, the renowned creators of the Grand Theft Auto (GTA) series.

Despite the stringent security measures typically employed by large tech giants like Rockstar Games, Kurtaj managed to steal sensitive code and videos related to the latest instalment of the popular game franchise. Additionally, it was revealed that Kurtaj had **hacked into Revolut** and **Uber** while on bail for unrelated charges.

**Implications and Security Concerns:**

The cyberattacks carried out by these teenage hackers highlight the importance of robust cybersecurity measures for both multinational corporations and individuals. The fact that they were able to breach the systems of Nvidia and Rockstar Games, known for their focus on security, raises concerns about the potential vulnerabilities in even the most fortified systems.

It also serves as a reminder for companies to continually update their security protocols and educate their employees about the risks associated with cybercrime. The trial also sheds light on the potential havoc that can be wreaked by skilled hackers, even at a young age.

The case not only emphasizes the need for strict cybersecurity measures but also underscores the significance of ongoing efforts to combat cybercrime. As the trial unfolds, the outcome will determine the legal consequences for these teenage hackers and serve as a precedent for future cybercrime cases involving young individuals.

1.  Microsoft and Okta Confirm Data Breach Claims by LAPSUS$
2.  Samsung confirms data breach as Lapsus$ leak its source code
3.  Lapsus$ Hackers Stole T-Mobile’s Source Code and Systems Data

I am a UK-based cybersecurity journalist with a passion for covering the latest happenings in cyber security and tech world. I am also into gaming, reading and investigative journalism

Teenagers Face Trial for Hacking BT, Nvidia, Rockstar Games, Revolut, Uber

By Habiba Rashid
A fake and malicious version of TeamViewer is being pushed as legitimate, which in reality infects devices with njRAT Malware (aka Bladabindi).
This is a post from HackRead.com Read the original post: Fake TeamViewer Installer Used to Deliver njRAT Malware

**The njRAT malware is a remote access trojan that can perform malicious activities such as keylogging, password stealing, data exfiltration, accessing webcams and microphones, and downloading additional files, posing a significant threat to system privacy and security.**

In recent news, cybersecurity researchers have discovered that threat actors are utilizing the popular remote desktop support software, TeamViewer, as a delivery mechanism for the njRAT malware.

The **njRAT, also known as Bladabindi**, is a remote access trojan that poses a significant threat to the privacy, security, and integrity of affected systems.

The recent findings by Cyble Research & Intelligence Labs (CRIL) shed light on the deceptive tactics employed by threat actors to exploit the trust associated with well-known applications. By leveraging the widespread adoption of TeamViewer, as well as other legitimate tools like WireShark and Process Hacker, the threat actors deceive unsuspecting users into downloading and executing the malicious files.

The njRAT malware, **initially discovered in 2012-2013**, has primarily targeted organizations in Middle Eastern nations. This trojan is capable of carrying out a range of malicious activities, including keylogging, password stealing, data exfiltration, accessing webcams and microphones, and downloading additional files.

Upon closer **analysis**, CRIL researchers identified a 32-bit Smart Installer as the delivery mechanism for the njRAT malware. The installer drops two files in the Windows folder, one of which is the njRAT malware itself, while the other is a genuine TeamViewer application. This clever camouflage allows the malware to operate undetected within compromised systems.

Once executed, the installer triggers the **njRAT** malware and simultaneously launches the legitimate TeamViewer application, creating a deceptive user prompt window that requests the user to proceed with the TeamViewer installation. While the user believes they are installing legitimate software, the njRAT quietly conducts its malicious operations within the compromised system.

To ensure persistence, njRAT modifies system settings, including the “SEE\_MASK\_NOZONECHECKS” environment variable in the Windows registry, thereby bypassing security warning prompts. Additionally, it creates autorun entries in the system registry and copies itself to the startup directory, guaranteeing that it automatically runs every time the system boots up.

njRAT files in the Windows folder (Cyble)

The njRAT trojan also engages in keylogging, capturing keystrokes by utilizing a dedicated thread with continuous monitoring and storage of the captured data. It collects various system information and encodes it using the base64 encoding scheme for exfiltration.

The malware establishes a connection with a Command and Control (C&C) server to transmit the gathered information, awaiting instructions from the C&C server for further malicious actions. 

The exploitation of legitimate **software like TeamViewer** highlights the resourcefulness and adaptability of threat actors in spreading malware. Users must take precautionary measures to protect themselves from such attacks.

Recommendations include downloading tools and applications only from official websites, enabling automatic software updates, using reputable antivirus and internet security software, and exercising caution when opening untrusted links or email attachments.

1.  TeamViewer was Targeted by Chinese Hackers in 2016
2.  TeamSpy malware targeting users via malicious TeamViewer app
3.  Hackers targeting embassies with trojanized version of TeamViewer
4.  VirusTotal Reveals Apps Most Exploited by Hackers to Spread Malware

I’m a student and cybersecurity writer. On a random Sunday, I am likely to be figuring out life and reading Kafka.

Fake TeamViewer Installer Used to Deliver njRAT Malware

By Waqas
According to court documents, devices owned by Pompompurin contained 600 explicit images of child abuse, which led him to plead guilty in court.
This is a post from HackRead.com Read the original post: BreachForums’ Pompompurin Pleads Guilty to Holding Child Abuse Content

**The court document described the disturbing content as “videos depicting prepubescent minors and minors who had not attained 12 years of age engaging in s\*\*ually explicit conduct.”**

Conor Brian Fitzpatrick, known by his online aliases Pompompurin and Pom, a 2021 graduate of Peekskill High School, was **arrested in March 2023**, for his involvement in operating the notorious hacker and cybercriminal platform called BreachForums. The arrest has also revealed a disturbing link to another illegal activity involving child abuse images.

**Court documents** (PDF) seen by Hackread.com shed light on the dark secrets hidden within Fitzpatrick’s digital possessions. It has been discovered that his devices contained over 600 explicit images of child abuse, leading him to plead guilty in court.

The court document described the disturbing content as “videos depicting prepubescent minors and minors who had not attained 12 years of age engaging in sexually explicit conduct.”

This new development was first **reported** by Dissent Doe of the Databreaches blog. It then went viral on Twitter when vx-underground, an online library for malware samples, **tweeted** about it.

The trial for Pompompurin, as he is known online, is scheduled to commence on November 17th. However, he is subject to strict restrictions, including no access to computers, no contact with minors, no browsing of websites focused on data leaks and no usage of virtual private networks (VPNs).

It is worth noting that the arrest of Fitzpatrick came in the wake of the **apprehension of Diogo Santos Coelho**, the owner and administrator of Raid Forums in the United Kingdom. BreachForums, which emerged as a reincarnation of Raid Forums, was **seized by the FBI** (Federal Bureau of Investigation) in their crackdown against cybercriminal activities.

Despite the intervention, a new version of **BreachForums has recently resurfaced**, now under the control of the infamous ShinyHunters group.

BreachForums and its predecessor, Raid Forums, have long been known as platforms where hackers and cybercriminals gather to exchange stolen data, hacking techniques, and illicit tools.

These forums have been a cause of concern for law enforcement agencies worldwide due to their role in facilitating various cybercrimes, including data breaches and **identity theft**.

The emergence of a new incarnation of BreachForums, led by the notorious ShinyHunters group, raises alarm bells for cybersecurity experts. The ShinyHunters group has been i**nvolved in high-profile cyberattacks**, often targeting corporations, government entities, and financial institutions. Their expertise and influence within the hacking community make them a formidable force to reckon with.

As the trial of Conor Brian Fitzpatrick approaches, many await the legal proceedings with a sense of urgency. The case not only highlights the dangers posed by cybercriminal forums but also sheds light on the dark underbelly of illegal activities involving child abuse imagery.

Hackread.com will continue to closely follow this case and provide updates as more information becomes available.

Note: Hackread.com encourages readers to report any suspicious online activities related to child abuse imagery to the appropriate law enforcement authorities.

**RELATED ARTICLES**

1.  5 Ways to Ensure Your Child’s Online Safety
2.  Authorities seize world’s biggest dark web child abuse site
3.  Data Breach at New BreachForums: 4,000 members’ data leaked
4.  Gender Diversity in Cybercrime Forums: Women Users on the Rise
5.  Raidforums Database Leak: Data of 460,000 Users Dumped Online

I am a UK-based cybersecurity journalist with a passion for covering the latest happenings in cyber security and tech world. I am also into gaming, reading and investigative journalism