Phishing campaign makes use of over 160 domains, some of which are intended to look like legitimate Okta or VPN sites. Group-IB has linked the campaign to breaches of over 130 other organizations, and attempts on likely thousands more.
The Twitter whistleblower report was filed with the DOJ, FTC, SEC and a number of relevant congressional committees. It describes ongoing lax security and privacy practices that are repeatedly papered over by top executives.
If you’re hit by the BlackByte ransomware gang you now have a-la-carte options for paying them off via their data leak site, as a tiered payment system has been added.
The damage from the Twilio hack is relatively minimal given that Signal’s privacy messaging app end-to-end encrypts all messages, and stores messages only on user devices. Concerns raised for users registering with phone number instead of only username.
Florida has become the second state in the US to forbid its government agencies to make ransomware payments, following similar rules passed in North Carolina in May.
Cisco network breach showed that while voice phishing is a sophisticated threat often undertaken by well-funded attackers, leveraging MFA fatigue is simple and can be done by nearly anyone.
A new study found that 3,200 mobile apps that link to users’ Twitter accounts are leaking Twitter API keys that could be used for account hijacking and other types of attacks.
Large-scale attempt to manipulate Github code repositories reinforces the importance of paying attention to exactly what you’re downloading. Malicious code tied to a single actor was found in about 35,000 forks and clones on the platform.
The entire U.S. population relies on FEMA’s Emergency Alert Systems for its first warning of natural disasters and threats to public safety. Vulnerable software can be exploited to issue messages and even gain full control of these systems.
Twitter says that the security breach occurred in December 2021, but was not public knowledge until July 21 of this year. An attacker using a zero-day was able to capture phone numbers and email addresses from anonymous accounts.