A massive data leak linked to the MOVEit vulnerability has exposed millions of employee records from major companies. Learn about the impact of this leak, the role of the "data vigilante" Nam3L3ss.

****SUMMARY****

*   **MOVEit Flaw and Data Leak**: Data stolen during the MOVEit hack spree is still creating issues for companies.

*   **Nam3L3ss and the Leaks:** A self-proclaimed “data vigilante” named Nam3L3ss has leaked over 760,000 employee records from 27 major companies, including Bank of America, and Nokia + Jll.com’s database containing 12 million rows taking the total number to 13.12 million.

*   **Leaked Data Content:** Leaked data includes sensitive and non-sensitive information such as names, emails, phone numbers, addresses, and company location coordinates.

*   **Cl0p Ransomware Link:** Originally, the data was stolen by the Cl0p ransomware gang after exploiting the MOVEit flaw, while Nam3L3ss is cleaning and leaking the data.

A self-proclaimed “Data Vigilante” named Nam3L3ss has once again caused widespread concern by leaking millions of employee records online, highlighting the fallout from the major security vulnerability in file transfer software called MOVEit.

As seen by Hackread.com, Nam3L3ss has released the information of over 760,000 employees of major organizations on a popular hacking forum ‘BreachForums’ on Monday morning. The leak additionally includes the Jones Lang LaSalle Incorporated (JLL.com) database, containing over 12 million data rows, bringing the total number of leaked records to 13.12 million.

Nam3L3ss on Breach Forums leaking the Bank of America employee data (Source: Hackread.com)

****The MOVEit Mess****

The MOVEit vulnerability was identified in Progress Software’s file transfer tool in 2023 allowing threat actors unauthorized access to sensitive data. Hackers affiliated with the Cl0p ransomware gang exploited this vulnerability and stole information from thousands of companies, impacting an estimated 2,800 organizations and nearly 100 million individuals. They even created clear web websites to leak the stolen data in July 2024.

****Nam3L3ss Leaks Millions****

In November 2024, as reported by Hackread.com, Nam3L3ss emerged on the scene, leaking what they claim is data obtained from the MOVEit breach. These leaks targeted industry giants like Amazon, 3M, HP, and Delta, raising serious concerns about the security practices employed by these corporations. At that time, Nam3L3ss leaked over 7.9 million records from 27 companies.

Hackread.com analyzed the leaked data and found it contained a mix of sensitive and non-sensitive information, including names, email addresses, phone numbers, office and residential addresses, and even company location coordinates. This information could be used by malicious actors for social engineering attacks, identity theft, or targeted phishing scams.

Just weeks after the initial leaks from Nam3L3ss, another batch of employee data surfaced online on Monday. This new data dump contained records from companies like Bank of America, Koch Industries, Nokia, and Morgan Stanley, and appears to be linked to the same MOVEit vulnerability.

Here’s the full list of companies involved in this leak:

*   audible.com – 3,790
*   b-f.com – 1,302
*   xerox.com – 42,735
*   univision.net – 5,954
*   saic.com – 26,917
*   nokia.com – 94,252
*   meijer.com – 7,422
*   cna.com – 6,680
*   cm3.com.au – 6,153
*   ciena.com – 10,820
*   bwater.com – 2,161
*   kochinc.com – 237,486
*   medibank.com.au – 5,201
*   morganstanley.com – 32,860
*   bankofamerica.com – 288,296
*   joneslanglasalle.com aka jll.com – 12,352,524

*   Total: 13,124,553

While Nam3L3ss claims to be a vigilante bringing attention to security flaws, their motives remain unclear. Regardless of their intentions, these leaks expose the significant impact of the MOVEit vulnerability and the risks posed by stolen employee data.

If you’re an employee of one of the affected companies, stay alert for phishing attempts. These could come through email, text messages (smishing), or even phone calls (vishing), as scammers might use this leaked data to target you.

1.  **Hacker Leaks Thousands of Microsoft and Nokia Employee Details**
2.  **Hackers Calling Employees to Steal VPN Credentials from US Firms**
3.  **Shadow IT: Personal GitHub Repos Expose Employee Cloud Secrets**
4.  **Hacker Leaks Data of 33K Accenture Employees in 3rd-Party Breach**
5.  **Indian Ex-Employee Jailed for Wiping 180 Virtual Servers in Singapore**

Data Vigilante Leaks 772K Employee Records from Top Firms and 12.3M-Row Database

This paper provides an in-depth technical explanation, illustration, and verification of discovered attacks affecting PlayReady on Windows 10 / 11 x64 that pertain to Warbird deficiencies, content key sniffer operation, magic XOR keys discovery, white-box crypto attack, and complete client identity compromise attacks.

Microsoft Warbird and PMP Security Research

New zero-day attack bypasses antivirus, sandboxes, and spam filters using corrupted files. Learn how ANY.RUN’s sandbox detects and…

New zero-day attack bypasses antivirus, sandboxes, and spam filters using corrupted files. Learn how ANY.RUN’s sandbox detects and combats these advanced threats.

A new zero-day attack campaign has surfaced, leveraging corrupted files to slip past even the strongest security protection. Recently identified by cybersecurity researchers at ANY.RUN, this attack demonstrates how sophisticated modern cyber threats have become. 

By bypassing antivirus software, sandbox environments, and email spam filters, these malicious files reach their targets with alarming efficiency. Let’s dive deeper into the details of this attack, explore why it’s so effective, and uncover how it can be identified to prevent further damage.

****New Zero-Day Attack Overview****

According to ANY.RUN research, this zero-day attack campaign has been active since at least August 2024. The research has uncovered that attackers are employing a unique technique: deliberately corrupting files to evade detection. 

These corrupted files, often disguised as ZIP archives or Microsoft Office documents like DOCX, bypass traditional security measures by exploiting gaps in standard file-handling procedures.

Despite appearing damaged, the files remain fully functional, executing malicious code when opened in their intended programs. Here’s what makes this approach particularly dangerous:

*   **Antivirus evasion**: Traditional antivirus solutions struggle to scan corrupted files properly. As a result, many classify these files as clean or return a “not found” error.
*   **Sandbox resistance**: Many static analysis tools fail to process these files because their corrupted structure prevents accurate identification.
*   **Spam filter bypass**: Even Outlook’s robust spam filters can’t block these malicious emails, allowing the payload to slip straight into inboxes.

As a result, the corrupted files execute successfully on the victim’s operating system, remaining invisible to most defences.

However, ANY.RUN’s interactive sandbox was able to overcome these challenges and detect malicious activity. Unlike other security tools, the sandbox dynamically analyzes corrupted files by interacting with them in real time. This allows it to uncover their true behaviour and accurately identify them as threats.

Malicious activity detected by ANY.RUN sandbox

In the following analysis session, the sandbox successfully detects the threat and labels it as malicious activity, thanks to its automated interactivity feature. This advanced capability launches the corrupted files in their corresponding programs, allowing the sandbox to observe and identify malicious behaviour that traditional tools might overlook.

****How the Zero-Day Attack is Executed****

During this cyberattack campaign, attackers exploit user applications’ built-in recovery mechanisms to restore and execute damaged or corrupted files. Below you can find more details about these steps: 

The analysis session revealed a corrupted file delivered via email, slipping past traditional detection systems. Security tools struggled to process the file, leaving it undetected. 

However, ANY.RUN’s sandbox took a different approach by opening the file in its intended application. When built-in recovery features, like Microsoft Word’s repair mechanism, were activated, the malicious payload executed as expected. 

The sandbox’s interactivity enabled it to identify this behaviour and flag the file as malicious, demonstrating its effectiveness in detecting threats that evade traditional tools.

****Get Your Black Friday Deal from ANY.RUN****

Combat advanced cyber threats like corrupted file attacks with ANY.RUN’s interactive sandbox. Its Automated Interactivity launches and analyzes even the most elusive files, revealing malicious behaviours that traditional tools miss.

With ANY.RUN, you can uncover the full picture of complex cyberattacks and protect your systems effectively. This Black Friday, take advantage of exclusive offers and strengthen your protection. Hurry, offers end December 8:

*   **For individual users**: Get 2 licenses for the price of 1.
*   **For teams**: Enjoy up to 3 licenses + an annual basic plan for Threat Intelligence Lookup, ANY.RUN’s extensive threat intelligence database.

See all offers and test the service with a free trial today →

How Attackers Use Corrupted Files to Slip Past Security

Though it's still just a proof of concept, the malware is functional and can evade the Secure Boot process on devices from multiple vendors.

Source: Alexander56891 via Shutterstock

Researchers have spotted what they believe is the first ever malware capable of infecting the boot process of Linux systems.

"Bootkitty" is proof-of-concept code that students in Korea developed for a cybersecurity training program they're involved in. Though still somewhat unfinished, the bootkit is fully functional and even includes an exploit for one of several so-called LogoFAIL vulnerabilities in the Unified Extensible Firmware Interface (UEFI) ecosystem that Binarly Research uncovered in November 2023.

**A Novel Proof-of-Concept**

Bootkits operate at the firmware level and execute before the operating system loads, allowing them to bypass the Secure Boot process for protecting systems from malware during startup. Such malware can persist through system reboots, operating system reinstallation, and even physical replacement of certain parts, like hard drives.

Researchers at ESET who analyzed Bootkitty after finding a sample on VirusTotal just last month described it as the first UEFI bootkit for Linux they have come across. That's significant because, until now, bootkits — the most notorious of which includes BlackLotus and FinSpy — have been Windows-specific.

"\[Bootkitty's\] main goal is to disable the kernel's signature verification feature and to preload two as yet unknown ELF binaries via the Linux init process (which is the first process executed by the Linux kernel during system startup)," ESET researchers Martin Smolar and Peter Strycek wrote.

Binarly, which also analyzed Bootkitty, found the malware to contain an exploit for CVE-2023-40238, one of several image parsing LogoFAIL vulnerabilities in UEFI that the company reported last year. The Bootkitty exploit leverages shellcode embedded within bitmap image (BMP) files to bypass Secure Boot and get the OS to trust the malware, Binarly said. The vendor identified Linux systems from multiple vendors as being vulnerable to the exploit, including those from Lenovo, Fujitsu, HP, and Acer.

"While this appears to be a proof-of-concept rather than an active threat, Bootkitty signals a major shift as attackers expand bootkit attacks beyond the Windows ecosystem," Binarly wrote. "The operating system bootloaders present a vast attack surface that is often overlooked by defenders, and the constant growth in complexity only makes it worse."

The UEFI — and prior to that the BIOS ecosystem — has been a popular target for attackers in recent years because of how malware operating at that level can remain virtually undetectable on compromised systems. But concerns over UEFI security really came to a head with the discovery of BlackLotus, the first malware to bypass Secure Boot protections even on fully patched Windows systems.

The malware took advantage of two vulnerabilities in the UEFI Secure Boot process, CVE-2022-2189, also known as Baton Drop, and CVE-2023-24932, to install itself in a virtually undetectable and unremovable manner. The relatively easy availability of the malware and Microsoft's struggles in addressing it, prompted a call from the US Cybersecurity and Infrastructure Security Agency (CISA) for improved UEFI protections.

"Based on recent incident responses to UEFI malware such as BlackLotus, the cybersecurity community and UEFI developers appear to still be in learning mode," CISA noted at the time. "In particular, UEFI secure boot developers haven't all implemented public key infrastructure (PKI) practices that enable patch distribution."

**Functional Bootkit**

ESET found Bootkitty to contain capabilities for modifying, in memory, functions that normally verify the integrity of the GRand Unified Bootloader (GRUB), which is responsible for loading the Linux kernel during startup. However, the specific functions that Bootkitty attempts to modify in memory are supported only on a relatively small number of Linux devices, suggesting the malware is more proof of concept than an active threat. Bolstering that theory is the presence of several unused artifacts in the code, including two functions for printing ASCII art and text during execution, ESET said.

The Korean students who developed the bootkit informed ESET after the security vendor published its analysis. ESET quoted the students as saying they had created the malware in an effort to spread awareness about the potential for bootkits becoming available for Linux systems. Details of the malware were only supposed to have become available as part of a future conference presentation. However, a few samples of the bootkit ended up being uploaded to VirusTotal, they noted.

**About the Author**

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year career at Computerworld, Jai also covered a variety of other technology topics, including big data, Hadoop, Internet of Things, e-voting, and data analytics. Prior to Computerworld, Jai covered technology issues for The Economic Times in Bangalore, India. Jai has a Master's degree in Statistics and lives in Naperville, Ill.

'Bootkitty' First Bootloader to Take Aim at Linux

SUMMARY Cybersecurity researchers at Trustwave have discovered “Rockstar 2FA,” a phishing-as-a-service platform designed to help hackers and script…

****SUMMARY****

*   **Rockstar 2FA Exposed**: Trustwave uncovers Rockstar 2FA, a phishing-as-a-service (PhaaS) platform targeting Microsoft 365 accounts with advanced tools.

*   **2FA Bypass**: Features include 2FA cookie harvesting, antibot protections, and fake login pages mimicking legitimate services.

*   **Credential Theft**: Attackers capture login credentials and session cookies through adversary-in-the-middle (AiTM) tactics.

*   **Wide Impact**: Linked to over 5,000 phishing domains and large-scale attacks across multiple industries since May 2024.

*   **Accessible for Hackers**: Affordable subscriptions make phishing accessible to attackers with minimal technical skills.

Cybersecurity researchers at Trustwave have discovered “Rockstar 2FA,” a phishing-as-a-service platform designed to help hackers and script kiddies bypass two-factor authentication (2FA) and gain unauthorized access to Microsoft 365 accounts.

This platform has already been linked to a surge in large-scale adversary-in-the-middle (AiTM) attacks targeting users across multiple sectors and regions, which have been successful in stealing Microsoft 365 credentials from unsuspecting victims.

****How Rockstar 2FA Works?****

Rockstar 2FA is an upgraded version of the DadSec/Phoenix phishing kit, which was behind some of the most global phishing campaigns in 2023, including attacks on major U.S. school districts in December 2023.

The platform’s features include 2FA bypass, 2FA cookie harvesting, antibot protection, login page themes mimicking popular services, fully undetectable (FUD) links, and Telegram bot integration.

Rockstar 2FA also provides a user-friendly admin panel that allows customers to track the status of their phishing campaigns, generate URLs and attachments, and personalized themes. The platform is offered as a subscription service, with prices starting at $200 for a two-week subscription.

****The Phishing Campaign****

The phishing campaign associated with Rockstar 2FA uses various email delivery mechanisms, including compromised accounts and abused legitimate services such as email marketing platforms. The emails are designed to trick victims into entering their credentials on a fake login page that mimics Microsoft 365.

Most importantly, once a victim clicks on a malicious link, they are redirected to a landing page that presents a Cloudflare Turnstile challenge. This challenge is designed to prevent automated analysis of the phishing page and only allows legitimate users to proceed. If the user passes the challenge, they are presented with a phishing page that closely resembles the sign-in page of the brand being imitated.

Once the victim enters their credentials, the AiTM server then acts as a proxy, forwarding the credentials to Microsoft’s legitimate service to complete the authentication process. Once the authentication is complete, the server captures the session cookie, which can be used by the attackers to gain direct access to the victim’s account, even if it’s protected by MFA.

Phishing emails (Source: Trustwave)

****The Impact****

According to Trustwave’s **blog post** shared with Hackread.com ahead of publishing on Monday, the Rockstar 2FA platform has led to large-scale phishing attacks using sophisticated tactics, techniques, and procedures (TTPs).

The platform’s ability to bypass 2FA protections has increased the possibility of secondary attacks, such as account takeovers, launching phishing campaigns using compromised accounts, or performing business email compromise (BEC) attacks.

What’s more, the Rockstar 2FA platform has been linked to over 5,000 hits on urlscan.io since May 2024, with a noteworthy increase in activity in August 2024.

> _“One distinguishable characteristic of this campaign is the incorporation of car-themed web pages. Via urlscan.io, we were able to find over 5,000 hits of car-themed domains linked to this campaign since May 2024.”_
> 
> Trustwave

According to **Krishna Vishnubhotla**, Vice President of Product Strategy at Zimperium, “PhaaS platforms like Rockstar 2FA are lowering the cost of entry for new attackers, mainly through mobile devices. By providing ready-made phishing kits, these platforms eliminate the need for extensive technical skills or resources usually required for phishing attacks.”

The growing use of Rockstar 2FA highlights how phishing has become a highly lucrative tactic for cybercriminals. To stay safe, avoid clicking links or downloading attachments from unknown emails, double-check before entering your credentials on a login page, and scan links and files using tools like VirusTotal.

For employees, **simulated phishing training** is far more effective than basic cybersecurity training in helping them recognize and respond to phishing threats.

1.  **Xiū gǒu Phishing Kit Hits UK and US Across Key Sectors**
2.  **V3B Phishing Kit Steals Logins, OTPs from EU Banking Users**
3.  **99% of UAE’s .ae Domains Exposed to Phishing and Spoofing**
4.  **Meet MEWKit, a tricky phishing attack draining Ethereum wallets**
5.  **Russian Hackers Use Telekopye Toolkit in Broad Phishing Attacks**

New Rockstar 2FA Phishing-as-a-Service Kit Targets Microsoft 365 Accounts

SmokeLoader malware has resurfaced with enhanced capabilities and functionalities, targeting your personal data.

****SUMMARY****

*   **Targeted Campaign**: SmokeLoader malware attacks Taiwanese industries, including manufacturing, healthcare, and IT.

*   **Phishing Emails**: The campaign uses phishing emails exploiting MS Office vulnerabilities (CVE-2017-0199, CVE-2017-11882).

*   **Credential Theft**: Plugins target browsers, email clients, and FTP software to steal credentials and sensitive data.

*   **Advanced Techniques**: SmokeLoader employs evasion tactics like code obfuscation, anti-debugging, and sandbox evasion.

*   **Preventative Measures**: FortiGuard Labs blocked the malware, offering antivirus signatures and IPS rules for protection.

Cybersecurity researchers at Fortinet’s FortiGuard Labs have discovered a series of new malware attacks targeting companies in Taiwan. The attacks, which have been linked to the **SmokeLoader malware**, have impacted industries ranging from manufacturing and healthcare to IT and beyond.

SmokeLoader, known for its ability to deliver other malicious payloads, is taking a more direct role in this campaign, using its own plugins to execute attacks and steal sensitive data.

According to research by FortiGuard Labs, the attacks began with phishing emails containing malicious attachments, which were designed to exploit vulnerabilities in Microsoft Office. These included **CVE-2017-0199**, enabling malicious documents to automatically download and execute harmful payloads, and **CVE-2017-11882**, exploiting a vulnerability in Microsoft Office’s equation editor for remote code execution.

The emails, as per FortiGuard Labs’ **blog post** shared with Hackread.com heard of this publishing on Monday, written in native Taiwanese, were convincing but contained inconsistencies, such as different font and colour schemes, that suggested the text had been copied from elsewhere.

Once the malicious attachment was opened, the SmokeLoader malware was downloaded and executed, allowing it to communicate with its command and control (C2) server. From there, the malware downloaded various plugins, each designed to target specific applications and extract sensitive information.

The plugins used by SmokeLoader were found to target popular web browsers, email clients, and file transfer protocol (FTP) software, including Internet Explorer, Firefox, Chrome, Opera, Outlook, Thunderbird, and FileZilla. The malware was able to extract login credentials, auto-fill data, and even email addresses from these applications.

One of the plugins, known as Plugin 4, was designed to clear cookies from targeted browsers, forcing victims to re-enter their login credentials. Another plugin, Plugin 8, was used to inject keylogging code into explorer.exe, allowing the malware to capture keyboard inputs and clipboard content.

The SmokeLoader malware was also found to use advanced techniques to evade detection, including code obfuscation, anti-debugging, and sandbox evasion. Its modular design allows it to adapt to different attack scenarios, making it a formidable threat to organizations.

The attack flow and phishing emails used in the attack (Via: Fortinet’s FortiGuard Labs)

FortiGuard Labs has detected and blocked the malware, assigning it a severity level of “High.” The company has also provided protections for its customers, including antivirus signatures and IPS rules to detect and prevent malware.

In a comment to Hackread.com, **Casey Ellis**, Founder and Advisor at Bugcrowd, a San Francisco, Calif.-based leader in crowdsourced cybersecurity suggests the use of SmokeLoader aligns with a broader global pattern of cyber actors preparing for future attacks by infiltrating systems in advance.

_“_Given the geo-political environment, Taiwan is no stranger to thinking about Advanced Persistent Threats (APTs) and the use of SmokeLoader does seem to follow suit with the general trend of pre-positioning that we have seen in other parts of the world._“_

****What can you do to protect yourself?****

To avoid falling victim to the SmokeLoader malware, it’s important to stay cautious with emails from unknown or suspicious sources. Don’t click on links or download attachments, especially if they prompt you to enable macros or run files.

If you’re unsure about an email, even from a familiar source, check its content carefully. Scan links, files, and attachments using tools like VirusTotal or your system’s security software to ensure they’re safe.

1.  **Fickle Stealer Exploits Software Flaws, Steals Browser Data**
2.  **Malware Exploits Avast Anti-Rootkit Driver to Disable Security**
3.  **Malware Bypasses Microsoft Defender, Steals $24,000 in Crypto**
4.  **SteelFox Malware Posing as Popular Software, Steal Browser Data**
5.  **Facebook Malvertising Attack Spreads Malware via Fake Bitwarden**

SmokeLoader Malware Exploits MS Office Flaws to Steal Browser Credentials

Microsoft is readying a new release of Windows in 2025 that will have significant security controls, such as more resilient drivers and a "self-defending" operating system kernel.

Source: mundissima via Shutterstock

Microsoft is making sweeping changes to its Windows operating system (OS) in the wake of this past summer's flawed CrowdStrike update, which caused millions of commercial devices to crash and cost customers billions of dollars in downtime.

The incident was a major impetus for the new Windows Resiliency Initiative, introduced and outlined during a session at last week's Microsoft Ignite conference. Microsoft officials said the changes are being made based on what they learned from the July 19 event, resulting in what they promised to be a more reliable and secure OS in 2025.

David Weston, Microsoft's vice president of enterprise and OS security, identified three objectives intended to make Windows more secure: faster and simpler recovery times, more resilient drivers, and tools and changes to how the OS kernel is secured to make it "more effective and self-defending."

The changes will also affect software developers and third-party security tool providers.

"We're working together across the industry and will improve reliability, based on lessons from July, with new changes and standards in the OS," said Pavan Davuluri, corporate VP for Windows and devices at Microsoft.

The new Windows release is being designed to resist malware and script attacks with stronger controls for applications and drivers, while improved identity protection aims to prevent phishing attacks. Microsoft is also establishing a new approach to privilege access management, Davuluri said.

Microsoft will release a preview of the new release to Windows Insiders next July. It will include tighter controls over what applications and software drivers are permitted to run, stronger identity management, quick machine recovery, personal data encryption for folders, and improved OS management and configuration capabilities.

The release is poised to arrive just as Microsoft ends support for Windows 10 on Oct. 14, 2025. Although Microsoft has been encouraging customers to upgrade to Windows 11, which was released in 2021, on an ongoing basis, nearly 61% of all PCs worldwide still have Windows 10, according to Statcounter.

**Enabling Security Partners to Build Outside the Kernel**

Further, tied to its long-term Secure Future Initiative announced a year ago, Microsoft is moving to safer programming languages by incrementally shifting from C++ to Rust. A new Windows Resilient Security Platform will enable third-party security product developers to build their products outside of the kernel, Weston explained.

"We're ensuring this platform will enable security solution providers to have the access they need to detect and respond to threats without introducing complexity into the kernel," he said. "This change will help end-user protection and antivirus products provide a high level of security and easier recovery."

While the moves should make Windows more resilient to attacks, Forrester senior analyst Paddy Harrington would like to see Microsoft tighten access even further.

"I would much prefer it if Microsoft bit the bullet and put the walls back up. That would mean recoding for everyone who messes in the kernel driver world, including Microsoft, but it's a safer method of operation," says Harrington, who first opined on that point in a July blog post.

**Post-Incident Security Summit in Redmond**

Two months after the CrowdStrike incident, Microsoft hosted its Windows Endpoint Security Ecosystem Summit, in Redmond, Wash., with security vendors and representatives of the US Cybersecurity and Infrastructure Security Agency (CISA) on hand to discuss how to make the OS more resilient.

Leading into the meeting, Weston indicated that an examination of Windows crash reports signaled the need to change how kernel drivers are deployed.

"Since kernel drivers run at the most trusted level of Windows, where containment and recovery capabilities are, by nature, constrained, security vendors must carefully balance needs like visibility and tamper resistance with the risk of operating within kernel mode," Weston wrote in a July 27 post.

Following the summit, CISA last month published its Safe Software Deployment white paper, co-authored by the FBI, the Australian Signals Directorate's Australian Cyber Security Centre, and the Joint Cyber Defense Collaborative.

Omdia principal analyst Andrew Braunberg says that Microsoft is one of numerous vendors that have issued statements of support for CISA's Secure by Design pledge. However, it remains to be seen if it will follow through.

"It will be interesting to see if there is any change in behavior from Microsoft and other large software companies because of \[Donald\] Trump's win \[of the U.S. presidential election\]," Braunberg says. "These companies may reassess the external benefits of this support given a reduced, or eliminated, CISA under the new administration. There are international drivers for embracing Secure by Design principles, such as the EU Cyber Resiliency Act, but CISA has been the primary advocate in the US."

Nevertheless, Weston described CISA as playing an essential role in determining Microsoft's revamped security and resiliency standards for Windows endpoints.

"They are providing a framework for the whole IT industry to ensure that all partners, customers, and organizations are able to stay ahead of evolving security threats," he said.

Among the vendors at Microsoft's summit was CrowdStrike, which signaled it is endorsing Microsoft's Windows Resiliency Initiative.

"Microsoft's initiatives build on the discussions CrowdStrike participated in at the Windows Endpoint Security Summit in September, and we welcome innovations that enhance resiliency for our shared customers," a CrowdStrike spokesperson said. "The entire industry benefits when we collaborate to create a more resilient and open ecosystem that strengthens security for all."

Endpoint protection provider ESET is offering conditional support for Microsoft's initiative.

"In general, we support this evolution if it demonstrates measurable improvements to stability and strongly stress this must be on condition that any change must not weaken security, affect performance, or limit the choice and differentiation between cybersecurity solutions for customers," says ESET CTO Juraj Malcho.

**Shifting to Trusted Apps and Drivers**

Because many attacks result from users who download malicious or unsafe apps and drivers, Microsoft is adding Smart App Control and App Control for Business to Windows. These features use artificial intelligence to let administrators employ policies that require verified applications, according to Weston. He noted that Microsoft already offers this through App Locker, but it is complicated to manage.

A feature called "robust app control" will ensure that only verified apps can run, eliminating attacks from malicious attachments and socially engineered malware, he added.

**Thwarting Identity-Based Attacks and Overprivileged Accounts**

According to Microsoft's Entra ID data, more than 600 million identity attacks occur every day, 99% of which are password-based. In response, Microsoft has hardened its Windows Hello multifactor authentication capability, which uses biometrics. Microsoft has extended Windows Hello support for passkeys.

As part of its latest Windows Insider build, last week Microsoft released a preview of updates to its implementation of the WebAuthn APIs that will enable plug-in support for passkeys. In the coming months, Microsoft said third-party password managers will work with the native Windows passkey provider using Windows Hello. 

The new Windows release will also aim to reduce attacks resulting from users who have too many privileges and organizations that have insufficient privilege controls, which, according to Microsoft's Digital Defense report, are the cause of 93% of ransomware attacks.

A new feature called "administrator protection" will give employees standard user permissions by default "so they can still make Windows system changes, including app installation, but only when necessary and only after authorizing the change using Windows Hello," Weston said. "Admin protection will be incredibly disruptive to attackers, as they no longer have elevated privileges by default, and it will help ensure that employees do not use malware and remain in control of Windows."

According to Forrester's Harrington, the new app control approach should help organizations lock down their endpoints.

"I think there will be plenty of businesses who still go to third parties because of the flexibility those solutions bring," he says. "But this is a good move by Microsoft to breathe life back into the app control solution. For all those functions, I would have liked to see these moves earlier in the Windows 11 releases, but with Windows 10 going end-of-service next year, the timing works to give more enterprises reasons to move to Windows 11."

**About the Author**

Contributing Writer

Jeffrey Schwartz is a journalist who has covered information security and all forms of business and enterprise IT, including client computing, data center and cloud infrastructure, and application development for more than 30 years. Jeff is a regular contributor to Channel Futures. Previously, he was editor-in-chief of Redmond magazine and contributed to its sister titles Redmond Channel Partner, Application Development Trends, and Virtualization Review. Earlier, he held editorial roles with CommunicationsWeek, InternetWeek, and VARBusiness. Jeff is based in the New York City suburb of Long Island.

Microsoft Boosts Device Security With Windows Resiliency Initiative

Despite advancements in cybersecurity tools, human vulnerability remains the weakest link, with phishing among the most dangerous forms…

Despite advancements in cybersecurity tools, human vulnerability remains the weakest link, with phishing among the most dangerous forms of social engineering. The FBI’s **Internet Crime Complaint Center (IC3)** identifies phishing as the most commonly reported type of cybercrime, with around 300,000 incidents in 2023 alone resulting in financial losses exceeding $18.23 million. 

Even employees are aware of these risks, even if they lag when it comes to actually ensuring the integrity of their data and access credentials. A recent industry survey found that **71% of working adults** have admitted to risky behaviour, which can include reusing or sharing a password, clicking on links from unverified sources, or giving credentials to untrustworthy websites or apps. Virtually all of these people engage in risky behaviour with full knowledge of the dangers involved.

This discrepancy between awareness and action is therefore a significant challenge. It is essential to **train employees to recognize** and properly deal with phishing attempts. One of the most effective ways to address this is through phishing simulations, which provide a practical and measurable approach to enhancing how employees identify and act on phishing attacks. 

By simulating real-world scenarios, organizations can establish a culture in which each team member can be an active participant in improving cybersecurity.

****Phishing Simulation’s Role and How It Works****

Simulated phishing attacks replicate real-world threats to test employee responses. Unlike passive training methods such as online educational modules or presentations, **phishing simulation can immerse users** in practical scenarios. Going beyond simple emails, simulations now offer advanced algorithms to tailor phishing emails based on organizational context, user behaviour, and other scenarios, which increases the effectiveness of training.

Platforms that provide this service also offer detailed analytics on employee performance, identifying high-risk individuals or departments. These insights allow organizations to implement targeted training, addressing gaps in knowledge or behaviour. Moreover, when simulation tests take place throughout people’s ongoing work, it can reinforce genuine cybersecurity awareness, fostering a culture of vigilance across the team.

Attack scenarios are executed with varying degrees of complexity. For instance, emails are crafted to resemble legitimate communications, often using common phishing tactics like spoofed domains, urgent requests, or enticing offers. These emails prompt employees to interact, asking them to **click on unknown links** or to provide credentials to unauthorized parties. Failing to identify the simulated phishing email, such as when a user clicks a link or logs in to a spoofed site, then triggers educational feedback, serving up micro-lessons explaining the red flags and consequences of such actions.

Organizations can customize simulations to address industry-specific threats. For example, finance teams might encounter simulated spear-phishing attempts targeting financial data, while HR teams might face phishing emails related to payroll fraud. Sophisticated platforms can also integrate threat intelligence, ensuring simulations evolve alongside real-world attack trends.

****The Benefits of Simulation-Based Training****

One of the most significant advantages of phishing simulations is behavioural conditioning. Regular exposure to simulated phishing attempts trains employees to recognize and respond appropriately to phishing threats. 

This repeated practice not only reinforces awareness but also develops instincts for identifying malicious attempts. For instance, it is reported that industries with higher engagement in phishing simulations, such as financial services, achieved reporting rates of up to 29%, indicating **increased employee awareness** and proactive reporting behaviours.

Phishing simulations also play a crucial role in compliance and reporting. Industries bound by stringent regulations, such as GDPR or HIPAA, require organizations to maintain robust cybersecurity training programs. Simulations provide tangible evidence of these efforts, demonstrating compliance during audits. 

By incorporating simulations into their training regimes, companies can fulfil legal obligations while simultaneously building a more security-conscious workforce.

Another key benefit is cost efficiency. Cyberattacks can lead to significant financial losses. IBM’s 2024 **Cost of a Data Breach Repor**t reveals that the global average cost of a data breach is $4.88 million. Thus, preventing just one successful breach can potentially save organizations millions in losses, regulatory penalties, lawsuits, and other costs.

Lastly, an enhanced security posture helps reduce downtime caused by cyberattacks. A successful phishing attempt can lead to operational disruptions that might require extensive recovery efforts. By training employees to identify and report phishing attempts, organizations can minimize disruptions, ensuring business continuity and protecting their bottom line.

****Strategies for Achieving Maximum Impact****

Despite their advantages, phishing simulations face challenges. Employees may feel tricked or resentful, perceiving simulations as punitive rather than educational. To address this, organizations should focus on transparency and communication, framing simulations as a learning opportunity rather than a test to foster cooperation.

Additionally, simulations must strike a balance between realism and ethical boundaries. Overly deceptive tactics can harm trust within the organization. Clear policies and ethical guidelines ensure simulations remain constructive. Organizations also need to establish protocols, such as debriefing, to ensure a collaborative environment and to incorporate lessons learned into further simulation activities.

To maximize the effectiveness of phishing simulations, organizations should implement a structured approach. Start with a baseline assessment to gauge the current level of phishing awareness among employees. This initial evaluation provides a clear starting point and helps identify specific weaknesses that need attention.

Next, regular and varied simulations should be conducted at unpredictable intervals to maintain employee vigilance. By keeping simulations unpredictable, employees remain alert and less likely to become desensitized. Additionally, the simulations should cover a wide range of scenarios to address different phishing tactics, such as email scams, spear phishing, and social engineering, ensuring employees are prepared for all types of attacks.

It is also important to use data-driven adjustments. Analytics from simulations should be used to refine training programs, focusing on areas where employees struggle the most. 

Engaging leadership involvement in the simulations can further strengthen the training. When leadership participates, it sets a positive example and reinforces the importance of cybersecurity across the organization, reducing vulnerabilities like **CEO fraud** or whale phishing.

Finally, establish a continuous feedback loop. After each simulation, provide immediate feedback to employees through debriefing, highlighting key lessons and areas for improvement. This ensures that the learning process remains ongoing.

****The Takeaway****

Phishing simulation can be an impactful component of an organization’s cybersecurity strategy. It bridges the gap between theoretical training and real-world applications. Organizations can use this proactive stance to enhance awareness, empower the workforce, and build a resilient cybersecurity culture.

1.  **4 Ways For Employees To Distinguish Phishing Attacks**
2.  **99% of UAE’s .ae Domains Exposed to Phishing, Spoofing**
3.  **GitLoker-Linked GoIssue Phishing Tool Targets GitHub Users**
4.  **Phishing Attacks Bypass Microsoft 365 Email Safety Warnings**
5.  **Future of Phishing Email Training for Employees in Cybersecurity**

Why Simulating Phishing Attacks Is the Best Way to Train Employees

Printer issues are very common, but searching Google for help may get you into more trouble than you'd expect.

Anyone who has ever used a printer likely has had a frustrating experience at some point. There always seems to be some kind of issue with the software not responding, paper getting jammed or one of many other possible failures.

When people need help, they often turn to Google (and now AI) to look for an answer. This is where scammers come in, preying on unsuspecting and irate users ready to throw their printer out the window.

After clicking on a malicious Google ad, victims are redirected to a fraudulent site often using official brand names and logos. The crooks’ end goal is to get people to call them, and they achieve that by tricking them with fake printer drivers that always fail to install.

In this blog post, we review how this scam works and how to stay away from it.

**Malicious Search Ads**

Two of the most popular printer brands are HP and Canon. If you were to Google for help related to either of those brands right now, you would likely see sponsored results at the top of the search results page.

Unfortunately, in the majority of cases these ads are not from trusted providers but instead from tech support scammers. In the image below, you can see 4 ads shown for the query ‘_hp printer help_‘. It’s only after those that the official HP website appears.

If you were to say that consumers stand no chance, you’d be right. Unless you clicked on the official (organic search results), you’d end up getting scammed.

The list of sites includes:

megadrive\[.\]solutions  
geeksprosoftwareprints\[.\]org  
select-easy123print\[.\]com  
printcaretech\[.\]com

**The driver scam**

A driver is a software program that your computer uses to talk to physical hardware (i.e. your printer). In the early Microsoft Windows days, drivers were very important to get printers, monitors and other peripherals working. Today, the operating system is usually good at detecting new hardware and installing the required drivers automatically. There are some exceptions, not to mention that some manufacturers like to package additional software with their drivers.

After clicking on a malicious ad, the website instructs you to enter your printer’s model number in order to download the required driver, which it proceeds to “install”. This is entirely fake, and the only thing the website displays is a recorded animation that will always end up with the same error message.

This type of error is very similar to those seen in the “Microsoft tech support scam”, typically done via a browser hijack. Scammers want to scare and then get their victims to contact them directly, via phone or live chat.

**Remote access and extortion**

There are many people that fall for these types of scams and entire armies of tech support agents working in poor conditions ready to defraud them. The script is usually standard across scams, with the support agent impersonating a popular brand and requesting personal information from the victim.

It is quite common for scammers to request and be granted remote access to the user’s computer. This gives them leverage to do a number of things, such as stealing data, locking the machine or even using it to log into the victim’s bank account.

This is why it is so important to be extremely cautious with online search ads, and search results in general. Browser extensions such as Malwarebytes Browser Guard will block ads but also the scam or malware sites associated with these schemes.

This won’t help with your printer issues, but at least it’ll save you the trouble of being defrauded. When it comes to such questions, online forums are usually a good place to start, and if you’re lucky to count a computer person in your family, that’s always a good favor to ask for.

 Printer problems? Beware the bogus help 

Check Point Research has discovered cybercriminals exploiting the popular Godot Game Engine to deliver malicious software. Discover the techniques used by attackers and how to protect yourself from these threats.

****SUMMARY****

*   **Cybercriminals are exploiting the Godot game engine to deliver malware called GodLoader, targeting multiple platforms like Windows, macOS, and Linux.**

*   **GodLoader hides malicious code in game files, bypassing antivirus detection and compromising over 17,000 devices since June 2024.**

*   **The malware uses sandbox evasion, Microsoft Defender exclusions, and GitHub-hosted repositories to distribute attacks.**

*   **GodLoader’s payloads include RedLine Stealer and cryptocurrency miners, affecting 1.2 million Godot game users.**

*   **The Godot team advises downloading software from trusted sources and avoiding cracked files to stay safe.**

Check Point Research (CPR) has published its latest research on a novel multi-platform technique employed by cybercriminals to exploit the popular open-source game engine, Godot to deliver a newly discovered malicious payload dubbed GodLoader after bypassing traditional security measures.

The concerning aspect is GodLoader’s cross-platform functionality, making it effective on macOS, Windows, Linux, iOS, and Android. Although designed to target Windows, it can be used on Linux and macOS with minimal adjustments.  The malware is, reportedly, distributed via the Stargazers Ghost Network on GitHub, using over 200 repositories and 225 accounts between September and October 2024. 

“The threat actor behind this malware has been utilizing it since June 29, 2024, infecting over 17,000 machines,” and an attack can put 1.2 million users of Godot-developed games at risk, researchers noted in the blog post.

According to CPR’s research, cybercriminals exploit the flexibility of Godot’s scripting language, GDScript and embed malicious code within game assets, executing it when the game is launched. This is a stealthy approach, which enables attackers to bypass antivirus detection and compromise systems without raising alarms.

Further probing revealed that it uses sandbox and virtual machine detection, as well as Microsoft Defender exclusions, to avoid detection. The malware was hosted on Bitbucket.org and distributed across four attack waves, with initial payloads including RedLine Stealer and XMRig cryptocurrency miners.

For your information, Godot is a powerful tool for game development that allows developers to bundle game assets and scripts into .pck files, which contain the game’s resources, including images, sounds, and scripts. By injecting malicious GDScript code into these .pck files, attackers can trick the game engine into executing harmful commands.

As soon as the game loads the infected .pck file, the hidden script springs into action, downloading and deploying additional malware payloads onto the victim’s device.

The attack flow (Via CPR)

****Godot Engine’s Statement****

The Godot Engine development team, in response, has issued a statement, explaining that GodLoader doesn’t exploit a specific weakness in Godot itself because like any programming language (e.g. Python or Ruby) Godot also allows the creation of both good and bad programs. Though the malware exploits Godot’s scripting language (GDScript) to deliver its payload, this doesn’t make Godot inherently unsafe.

The team also noted that it isn’t a one-click exploit because the GodLoader malware tricks users into downloading/executing a seemingly harmless file (typically a .pck file disguised as a software crack). This file wouldn’t work on its own and the attackers also must provide the Godot runtime (.exe file) separately to make it successful. This means users have to take multiple steps to install the malware, making it less likely to be a one-click exploit.

Nonetheless, team Godot emphasizes the importance of good security habits and downloading from trusted sources like official websites, established distribution platforms, or trusted individuals. Windows and macOS users should check for signed executables and notarization by a trusted party and avoid using cracked software as it is a common target for malicious actors.

1.  **Gcore Thwarts 500M PPS DDoS Attack on Gaming Firm**
2.  **What is Blockchain Gaming and its Play-to-Earn Model?**
3.  **Exploring Data Privacy and Security in B2B Gaming Data**
4.  **Winos4.0 Malware Hits Windows via Fake Gaming Apps**
5.  **Gaming Firms, Community Members Hit by Dark Frost Botnet**

Tag

#microsoft