Why limit yourself to only stealing AWS credentials? A criminal crew with a history of deploying malware to harvest credentials from Amazon Web Services accounts may expand its attention to organizations using Microsoft Azure and Google Cloud Platform.... [...]

Time to start practicing identity protection A vendor that operates a pilot recruitment platform used by maor airlines exposed the personal files of more than 8,000 pilot and cadet applicants at American Airlines and Southwest Airlines.... [...]

WhisperGate-spreading Cadet Blizzard painted as haphazard but dangerous crew Here's a curious tale about a highly destructive yet flaky Kremlin-backed crew that was active during the early days of Russia's invasion of Ukraine, then went relatively quiet – until this year.... [...]

What a blast from the past, the past being a year before the pandemic American prosecutors have unsealed an indictment against two Russians who allegedly had a hand in the ransacking and collapse of Mt Gox a decade ago, an implosion that cost the cryptocurrency exchange's thousands of customers …

First the interview, then the phishing attack Miscreants targeting Discord and Twitter accounts have stolen more than $3.3 million in cryptocurrency from 2,300 victims so far in an ongoing campaign that started in April and saw the highest spike in activity earlier this month.... [...]

Win32k and Visual Studio flaws are under attack Two flaws in Microsoft software are under attack on systems that haven't been patched by admins.... [...]

Users' cryptocurrency wallets look unlikely to be refilled The North Korean criminal gang Lazarus Group has been blamed for last weekend's attack on Atomic Wallet that drained at least $35 million in cryptocurrency from private accounts.... [...]

It's better to take action than wait for attacks The timeworn adage that "those who don't learn from history are doomed to repeat it" can certainly be applied to cyber security. Microsoft is hoping to spare enterprises that use its cloud services from repeating history by sharing what it …

AI technology raises the bar in an already troubling crime Miscreants are using AI to create faked images of a sexual nature, then using them in sextortion schemes.... [...]

Victims nursing huge losses haven't the foggiest how heist happened, yet As much as $35 million worth of cryptocurrency may have been stolen in a large-scale attack on Atomic Wallet users, with one investigator claiming losses could potentially exceed $50 million.... [...]

Operators stay ahead of defenders with new access methods and C2 infrastructure The Qbot malware operation – which started more than a decade ago as banking trojan only to evolve into a backdoor and a delivery system for ransomware and other threats – continues to deftly adapt its techniques to stay …

Oh cool, something else to scan for Researchers recently uncovered the following novel attack on the Python Package Index (PyPI).... [...]

This RomCom is no laughing matter A change in the deployment of the RomCom malware strain has illustrated the blurring distinction between cyberattacks motivated by money and those fueled by geopolitics, in this case Russia's illegal invasion of Ukraine, according to Trend Micro analysts.... [...]

1. It's asked for 90% of the digital dosh back, or else it'll beg the cops for help Just days after releasing the second – and supposedly more stable and secure – version of its decentralized finance (DeFi) app, Jimbos Protocol over the weekend was hit by attackers who stole stole 4 …

You'll want to patch these as proof-of-concept exploit code is out there already Cisco rolled out patches for four critical security vulnerabilities in several of its network switches for small businesses that can be exploited to remotely hijack the equipment.... [...]

Certificate-based authentication comes first and phones last Microsoft wants to take the decision of which multi-factor authentication (MFA) method to use out of the users' hands and into its own.... [...]

Qilin gang crims can earn up to 85 percent of extortion cash, or jail Business is very good for affiliates of the Qilin ransomware-as-a-service (RaaS) group, which is very bad for the rest of us.... [...]

XCast knew it was breaking the law and didn't hold back, watchdog says A VoIP provider was at the heart of billions of robocalls made over the past five years that broke a slew of US regulations, from enabling telemarketing scams to calling numbers on the National Do Not …

Microsoft blocking 'net scripts sparked 'monumental shift' in attacks Microsoft's decision to block internet-sourced macros by default last year is forcing attackers to find new and creative ways to compromise systems and deliver malware, according to threat researchers at Proofpoint.... [...]

Let's take a quick dive into Windows API Microsoft in March fixed an interesting security hole in Outlook that was exploited by miscreants to leak victims' Windows credentials. This week the IT giant fixed that fix as part of its monthly Patch Tuesday update.... [...]

Mandatory measure against attackers who spam MFA folks into submission Microsoft is hoping to curb a growing threat to multi-factor authentication (MFA) by enforcing a number-matching step for those using Microsoft Authenticator push notifications when signing into services.... [...]

Hard times for buyers of these hard drives Customer information was stolen from the IT systems of Western Digital in that March IT security breach, forcing the storage manufacturer to shut down its online store until at least next week.... [...]

XSS marks the spot WordPress users with the Advanced Custom Fields plugin on their website should upgrade after the discovery of a vulnerability in the code that could open up sites and their visitors to cross-site scripting (XSS) attacks.... [...]

Guess this'll have to do while we wait for checks notes ES 2025 Microsoft last year said that it was putting off the next version of Exchange Server until the second half of 2025 so engineers could continue bulking up the security of a product that has become a …

Security hole ranks 9.8 out of 10 in severity, 0 out of 10 in patch availability There is a critical security flaw in a Cisco phone adapter, and the business technology giant says the only step to take is dumping the hardware and migrating to new kit.... [...]