We take a look at a round of phishing mails being sent to people in Belgium, promising tax-related refunds.
The post Watch out for this SMS phish promising a tax refund appeared first on Malwarebytes Labs.

Imagine logging into your bank’s website after responding to a text message claiming you’re due a refund, only to see a warning to watch out for bogus texts:

![](https://blog.malwarebytes.com/wp-content/uploads/2022/04/dbphish7-600x365.jpg)

Beware of SMS phishing!

For those who don’t read Dutch, the warning reads:

> Never respond to unusual emails or texts!
> 
> Fraudsters often send e-mails under the guise of renewing your debit card or digipas. Never go into that. They refer to websites that are not owned by Argenta. Argenta will also never ask you to provide your card number by telephone because you will allegedly receive a new debit card or digipas.
> 
> Do you still receive suspicious messages?
> 
> Have you already passed on codes over the phone? Or has money already been withdrawn from your account? Please contact us immediately on (available 24/7 for victims of phishing).

The warning above is genuine, on a real bank’s website. But the warning, in this case, comes too late because this is the last and only legitimate stop in a victim’s passage through a phishing scam.

**The bogus SMS trail begins**

Here’s one of the suspect SMS messages, as tweeted by Twitter user @ypselon:

> it has been decided that you will receive a refund. to receive this amount you can visit our website \[url removed\]

The text claims to be from “FOD”. This is the Federale Overheidsdienst Financien in Belgium. The suspect URL includes a domain registered just this month (often a red flag), in India, rather than Belgium.

Visiting the site presents you with a message that says:

![](https://blog.malwarebytes.com/wp-content/uploads/2022/04/dbphish1-600x551.jpg)

A fake FOD website offering fake refunds

> Refund:
> 
> In order to receive a refund of your personal income tax, you must verify your account so that we can transfer the full amount of €278.35 to the correct account.
> 
> It is important to carry out a one-time verification as a check. Afterwards you will receive the amount on your account within a few working days.

For “one-time verification” read “send us money”.

We all love a tax refund so it’s an effective hook to lure in potential victims. Continuing reveals a large assortment of banks commonly used in Belgium.

**A slippery phish**

The scam site includes customised pages for each popular bank. Some ask for card details, others for account numbers. All are fake, all are trying to hoover up information that can be used to steal your money.

![](https://blog.malwarebytes.com/wp-content/uploads/2022/04/dbphish5.jpg)

A phishing site asks for credit card details for a “one-time verification”

No matter which route you go down, entering your details will neither verify your identity nor secure you a tax refund. But all will leave you poorer and eventually redirect you to your bank’s real website (where you might encounter a warning about falling for scams like the one you’ve just fallen for).

At this point, your only option is to contact the bank for real, and tell them what’s happened. If you’re lucky, you may be able to have them shut things down. If not, days or weeks of hassle might lie in wait.

**Faking it to make it**

Fake tax refunds are hugely popular. They’re especially rampant during (or immediately following) any tax season. The Federale Overheidsdienst Financien has some advice for avoiding scams like this..

*   **If the FOD helped you with a tax return the previous year**, it may contact you by phone. The organisation warns that if the caller doesn’t know your name; asks for payment for assistance; asks to come to your home; or requests passwords, PINs, email, or address, then you should hang up.
*   **Report any request to provide confidential data** related to banking you receive by email, text, or WhatsApp.
*   **If you’re asked to make a payment to the FOD directly**, check their site because there’s only a limited number of ways to make a payment to an official account.

Watch out for this SMS phish promising a tax refund

Today on Lock and Code, we speak with returning guest Tanya Janca about why so much of our software comes packaged with vulnerabilities.
The post Why our software has so many vulnerabilities, with Tanya Janca: Lock and Code S03E09 appeared first on Malwarebytes Labs.

Less than one year ago, the worst ransomware attack in history struck dozens of organizations. Threat actors had exploited a serious flaw in the remote monitoring and management tool Kaseya VSA that, when discussed on the Lock and Code podcast, was revealed to be “not advanced at all.”

This was far from the only software vulnerability that the public learned about last year.

When Lock and Code discussed the efforts by agricultural companies to turn their physical equipment, like tractors and combines, into smart devices, we learned about simple flaws that allowed a group of hackers to uncover user IDs for pretty much every registered device in a company’s database. And we learned that the IDs could, through a simple comparison search with the Fortune 500, reveal what companies were clients of that agricultural company.

And when we discussed the famous app Clubhouse, we learned about an eavesdropping flaw that was discovered with no technical hacking requirements—all that was necessary was two iPhones.

These examples and many, many more throughout cyber-history beg the question: What is going on with how our applications are developed?

Today on the Lock and Code podcast with host David Ruiz, we speak to returning guest Tanya Janca to understand the many stages of software development and how security trainers can better work with developers to build safe, secure products. According to Janca, a good security team takes the security of their developers’ products as their own responsibility.

> “It’s our job to help them make their software secure. If at the end, they have all these things wrong, guess what, it’s because our team, the security team, is not doing a good job”
> 
> Tanya Janca, Director of developer relations of Bright, founder of the online training academy We Hack Purple and author of Alice and Bob Learn Application Security.

Tune in to hear all this and more on this week’s Lock and Code podcast by Malwarebytes Labs.

This video cannot be displayed because your _Functional Cookies_ are currently disabled.

To enable them, please visit our _privacy policy_ and search for the Cookies section. Select _“Click Here”_ to open the Privacy Preference Center and select _“Functional Cookies”_ in the menu. You can switch the tab back to _“Active”_ or disable by moving the tab to _“Inactive.”_ Click _“Save Settings.”_

You can also find us on Apple Podcasts, Spotify, and Google Podcasts, plus whatever preferred podcast platform you use.

Why our software has so many vulnerabilities, with Tanya Janca: Lock and Code S03E09

Apple will soon be rolling out its promised child safety features in the Messages app for users in Australia, Canada, New Zealand, and the UK
The post Apple’s child safety features are coming to a Messages app near you appeared first on Malwarebytes Labs.

![Apple’s child safety features are coming to a Messages app near you](https://blog.malwarebytes.com/wp-content/uploads/2022/04/GettyImages-1200217290-900x506.jpg)

Posted: April 25, 2022 by

Apple will soon be rolling out its promised child safety features in the Messages app for users in Australia, Canada, New Zealand, and the UK. The announcement comes four months after the features’ initial launch in the US on the iOS, iPad, and macOS devices.

To make communicating with Messages safer for Apple’s youngest users in the countries getting the rollout, it will start using machine learning to scan messages sent to and from an Apple device, looking for nudity to blur. Because scanning is done on-device, meaning the images are analyzed by the phone rather than in the Cloud, end-to-end encryption is not compromised.

“Messages analyses image attachments and determines if a photo contains nudity, while maintaining the end-to-end encryption of the messages,” Apple said in a statement. “The feature is designed so that no indication of the detection of nudity ever leaves the device. Apple does not get access to the messages, and no notifications are sent to the parent or anyone else.”

Of course, parents would have to enable this feature on their child’s iPhones first.

![](https://blog.malwarebytes.com/wp-content/uploads/2022/04/apple-child_safety-600x378.jpg)

Children are given the power to make a safe choice with what they want to see and do on Messages. (Source: Apple)

If the setting for this feature is on and a child receives a nude photo, Messages blurs it, warns the child of sensitive content, and points them to resources supported by child safety groups. If the child is about to send nude photos, the feature flags the picture and encourages them not to send the image. They could also talk to an adult they trust using the “Message a Grown-Up” button.

Note that the AI does not scan photos your child keeps in their Photo Library.

There have been some changes to these features since they were initially reported in August last year. Originally parents were also alerted if their young child (a child under 13) sent or received images that contained nudity. Privacy advocates and critics quickly pointed out that doing this could out queer kids to their parents, which could expose them to harm.

Apple is also delaying the rollout of an AI component that can scan photos in iCloud and compare them to a child sexual abuse material (CSAM) database. The company has yet to announce the date of this component’s release.

According to The Guardian, Apple will also introduce features that will kick in when users search for child exploitation content in Spotlight, Siri, and Safari.

**How to enable Apple’s safety features**

Parents/Carers/Guardians, you need to set up Apple’s Screen Time feature on your child’s phone first, which requires Family Sharing (If you haven’t done that already, go to the Set up Family Sharing help page for the steps).

Once you have Screen Time enabled and the communications safety features are already available in your country, please do the following:

1.  On your Apple device, open **Settings**.
2.  Choose **Screen Time**.
3.  Swipe down and choose your child’s device.
4.  Choose **Communications Safety**.
5.  Toggle **Check for Sensitive Photo**.

Stay safe!

**RELATED ARTICLES**

![“Your AppI‌e‌ ‌l‌D‌ ‌‌h‌‌a‌‌s‌‌ ‌‌b‌‌e‌‌e‌‌n‌‌ ‌‌l‌‌ocke‌‌d‌‌” spam email takes you on a website mystery tour](https://blog.malwarebytes.com/wp-content/uploads/2019/03/shutterstock_711671914-604x270.jpg)

April 14, 2022 - We take a look at what appears to be a phish, but ends up directing you to endless random websites instead.

![A week in security (March 28 – April 3)](https://blog.malwarebytes.com/wp-content/uploads/2018/01/shutterstock_610335074-604x270.jpg)

April 4, 2022 - The most important and interesting security stories from the last seven days.

![Update now! Apple patches two zero-day vulnerabilities that may have been actively exploited](https://blog.malwarebytes.com/wp-content/uploads/2021/06/patch_Apple-604x270.png)

April 1, 2022 - Apple released security updates for macOS Monterey 12.3.1, iOS 15.4.1, iPadOS 15.4.1, tvOS 15.4.1, and watchOS 8.5.1 patching 2 vulnerabilities that may have been exploited in the wild.

![De-Googling Carey Parker’s (and your) life: Lock and Code S03E06](https://blog.malwarebytes.com/wp-content/uploads/2021/12/Lock-and-Code-logo-2021-604x270.jpg)

March 14, 2022 - This week on Lock and Code, we talk about taking the right steps to removing Google and its many services from your life.

![Apple fixes Mac bug that could have allowed takeover of webcams and browser tabs](https://blog.malwarebytes.com/wp-content/uploads/2016/04/apple-mac-macbook-feature-604x270.jpg)

January 27, 2022 - A researcher discovered a way to gain control of both webcams and any open session in Safari. How did they do it?

Apple’s child safety features are coming to a Messages app near you

The latest MITRE ATT&CK results can guide any SMB into finding a cybersecurity product that works best for them.
The post Why MITRE matters to SMBs appeared first on Malwarebytes Labs.

Running a small- to medium-sized business (SMB) requires expertise in everything, from marketing and sales to management and hiring, but in the ever-expanding list of executive responsibilities, one particular item demands attention: Cybersecurity.

Cyberattacks can—and have—shuttered entire businesses. Cyberattacks can ruin reputations. Cyberattacks can lock up your workforce, grind revenue to a halt, send clients and customers looking for alternatives, and cost millions of dollars in recovery.

Running an SMB today, then, requires effective cybersecurity. But cybersecurity vendors don’t make it easy. Every few months another vendor promises the best, fastest, and most effective protection, appending new, three-letter acronyms to features that may not appropriately serve your business, or may require a level of time and resources that your business can’t afford.

For SMBs, one particular third-party evaluation can help clear up some of the clutter. The MITRE ATT&CK Evaluation, run by cybersecurity researchers at MITRE Engenuity, analyzes the performance of dozens of cybersecurity vendors against known, real-world attacks, testing their capabilities not against theoretical damage, but actual harm.

According to the researchers at MITRE:

“While organizations know that robust security solutions are imperative, determining what’s best is no easy feat. There is often a disconnect between security solution providers and their users, particularly related to how these solutions address real-world threats.

Our mission is to bridge this gap by enabling users to better understand and defend against known adversary behaviors through a transparent evaluation process and publicly available results – leading to a safer world for all.”

Though the MITRE ATT&CK results are not quick to comprehend—after all, MITRE does not rank or select any “winners” or “losers” in its testing—they are important to understand. MITRE results can reveal which vendors can best prevent incoming cyberattacks, which can provide high visibility into current problems, and which can detail the most information about those problems.

Crucially, MITRE results can detail which cybersecurity vendor will offer your business the most effective “out-of-the-box” experience, protecting your business from cyberattacks while requiring less daily input from you and your team.

Here’s what the MITRE researchers evaluate in their testing and why it matters to your SMB.

****Protection****

“Protection” is a term that describes whether a cybersecurity product can prevent an attack before it even reaches your computers or systems. Protection is the first line of defense for any business and its significance cannot be overstated. Preventing an attack is always preferrable to responding quickly to an attack after it has happened.

The MITRE ATT&CK Evaluation does not require its participants to be tested on their protection capabilities. In the most recent testing by MITRE, 22 out of 30 vendors entered the protection test. Just 10, including Malwarebytes, scored 100 percent on protection.

While no cybersecurity product can stop every single cyberthreat in existence—it just isn’t possible as cybercriminals constantly advance their tactics—a good cybersecurity product will still rank highly on MITRE’s protection analysis.

****Visibility and alert quality****

Cyberattacks do not happen in seconds. Instead, cybercriminals can plan their attacks for days or even weeks, brute-forcing their way into an insecure Remote Desktop Protocol port or simply tricking an employee into opening a malicious email attachment which then allows them to gain remote control of a machine, where they will then spread laterally through a network, deploying dangerous hacking tools along the way, until they launch a massive attack that can derail any business.

Any decent cybersecurity product should be able to flag any malicious or suspicious behavior happening on a network and deliver related warnings to the end-user. This capability to see potential attacks as they’re happening and then signal those attacks to users is called “Visibility,” and MITRE tests this in its own evaluations. The Visibility score reflects the number of dangerous steps that a cybersecurity solution caught and sent warnings about during a simulated attack.

Visibility is just one half of a cybersecurity response, though. The other half is “Alert quality.”

As we explained in our previous article describing the most recent MITRE ATT&CK Evaluation results:

“Not every alert is equal. Some provide far more detailed information that can be acted upon by security teams, while other alerts only notify a security team of a problem. In the MITRE ATT&CK evaluation results, alerts are given three tiers of specificity, from least to most specific—General, Tactic, and Technique.

Techniques are the types of alerts that empower security teams to solve problems faster. Going beyond a basic description of what happened, a Technique alert will explain the surrounding context. That can include what threat actors are trying to accomplish with a malicious script.”

Cybersecurity products that achieved both high Visibility and Alert Quality in the most recent MITRE testing can equip SMBs with the support they need: A product that will not only tell you when something is wrong, but also what, specifically, is happening, and what the outcome could be.

Malwarebytes detected  83 out of 90 steps involved in the MITRE ATT&CK Evaluation—a rate of 92 percent—and of those 83 alerts, 82 were Technique alerts.

****“Out-of-the-box” experience****

The reality that many SMBs face is that they do not have the time or the budget for an in-house security team or even a single devoted security hire. But that shouldn’t mean that these same SMBs are left vulnerable to cyberattacks. What they need most is a cybersecurity product that works seemingly “out of the box,” which could approach a level of “set it and forget it” ease.

The MITRE ATT&CK Evaluation does not incorporate any of this rhetoric in its testing, but there is a way to interpret MITRE results that takes into account just how engaged a business must be to achieve solid cybersecurity.

Here, we have to explain “configuration changes.” Configuration changes are settings that a cybersecurity vendor can change while MITRE is actually analyzing that vendor’s product. These configuration changes reflect the real-world use of cybersecurity products by some enterprise companies—changes in what a product notifies its end-users about that may help catch emerging threats as they evolve every few weeks.

But, as we wrote before, such configuration changes are not universally applied by businesses everywhere, and in fact, these changes could lead to adverse results:

“Importantly, these customers may actually lose some value if they try to implement the same types of configuration changes that MITRE Engenuity allows, as these changes will likely produce a greater quantity of alerts, leaving these customers to spend more time deciphering the importance of these alerts and how to respond. This adversely affects the visibility and alert quality components as customers spend time sifting through a potentially significant number of additional, low-quality alerts in order to determine priority actions. A productivity loss no organization—big or small—is willing to accept.”

Configuration changes can be a powerful tool specifically for the businesses that have the resources to implement them responsibly and nimbly. But for the countless number of businesses that would not realistically take advantage of these settings, any cybersecurity product worth its cost should provide efficient and effective cybersecurity with zero configuration changes made during the MITRE ATT&CK Evaluation.

Malwarebytes is one of the few cybersecurity vendors that achieved its results with zero configuration changes. For a full breakdown on how Malwarebytes ranks with this frame of analysis, read our full blog here.

****Understanding MITRE for your SMB****

The MITRE ATT&CK Evaluation can be overwhelming to understand at first glance, but interpreting the results is worth the effort. By looking at what products can offer your business effective cybersecurity while respecting your limited resources, you can better protect your business for the future.

Why MITRE matters to SMBs

The most important and interesting stories in security from the last seven days
The post A week in security (April 18 – 24) appeared first on Malwarebytes Labs.

![A week in security (April 18 – 24)](https://blog.malwarebytes.com/wp-content/uploads/2018/01/shutterstock_610335074-900x506.jpg)

Posted: April 25, 2022 by

**RELATED ARTICLES**

![The fake Elon Musk Bitcoin giveaway marathon will NOT make you rich](https://blog.malwarebytes.com/wp-content/uploads/2021/12/ReturnFunds-604x270.png)

April 20, 2022 - We take a look at a supposed Bitcoin giveaway marathon from somebody that isn't Elon Musk on a Twitter list. All is not as it seems.

![A week in security (July 12 – July 18)](https://blog.malwarebytes.com/wp-content/uploads/2018/01/shutterstock_610335074-604x270.jpg)

July 19, 2021 - A roundup of all the most interesting cybersecurity news stories, articles, and happenings of the previous seven days.

![Nope, that isn’t Elon Musk, and he isn’t offering a free Topmist Dust watch either](https://blog.malwarebytes.com/wp-content/uploads/2015/03/photodune-9321211-apps-on-wearables-s-604x270.jpg)

July 12, 2021 - We take a look at a peculiar batch of spam on social media, claiming to show Elon Musk recommending we go searching for watch brands.

![Teen behind 2020 Twitter hack pleads guilty](https://blog.malwarebytes.com/wp-content/uploads/2021/03/Twitter-dark-finger-604x270.jpeg)

March 17, 2021 - The teen behind the Twitter hack of 2020 pleaded guilty to several charges as part of a deal in which he will serve three years in prison.

![VideoBytes: Twitter gets hacked!](https://blog.malwarebytes.com/wp-content/uploads/2020/09/shutterstock_1779315221-604x270.jpg)

October 1, 2020 - Today, we're talking about the Twitter hack, in which 130 high-profile accounts, like those belonging to Barack Obama and Elon Musk, were accessed.

**ABOUT THE AUTHOR**

![](https://secure.gravatar.com/avatar/08d5edde926eb9c13cb36804ee5e5316?s=96&d=identicon&r=g)

A week in security (April 18 – 24)

The NSO Group's flagship spyware was found on a device in 10 Downing Street's network.
The post Pegasus spyware found on UK government office phone appeared first on Malwarebytes Labs.

Pegasus spyware found on UK government office phone

Fake profiles imitating a well known Twitter philanthropist are offering up to $750 for free, but there's a catch...
The post Beware of fake Twitter philanthropists offering to put $750 into your Cash App account appeared first on Malwarebytes Labs.

Beware of fake Twitter philanthropists offering to put $750 into your Cash App account

A US appeals court has ruled that scraping public data is legal. We look at some of the arguments for and against.
The post It’s legal to scrape public data—US appeals court appeared first on Malwarebytes Labs.

It’s legal to scrape public data—US appeals court

We take a look at a supposed Bitcoin giveaway marathon from somebody that isn't Elon Musk on a Twitter list. All is not as it seems.
The post The fake Elon Musk Bitcoin giveaway marathon will NOT make you rich appeared first on Malwarebytes Labs.

The fake Elon Musk Bitcoin giveaway marathon will NOT make you rich

Oracle's April Critical Patch UPdate contains 520 new security patches. We spell out some of the most important vulnerabilities.
The post Oracle releases massive Critical Patch Update containing 520 security patches appeared first on Malwarebytes Labs.