Blog – Page 973 – Cyber Mike

5,000 Phishing PDFs on 260 Domains Distribute Lumma Stealer via Fake CAPTCHAs

Cybersecurity researchers have uncovered a widespread phishing campaign that uses fake CAPTCHA images shared via PDF documents hosted on Webflow’s content delivery network (CDN) to deliver the Lumma stealer malware.
Netskope Threat Labs said it discovered 260 unique domains hosting 5,000 phishing PDF files that redirect victims to malicious websites.
“The attacker uses SEO to trick victims into

In Other News: Krispy Kreme Breach Cost, Pwn2Own Berlin, Disney Hack Story

Noteworthy stories that might have slipped under the radar: Krispy Kreme data breach costs $11M, Pwn2Own moves to Berlin, the story of the 2024 Disney hack.

The post In Other News: Krispy Kreme Breach Cost, Pwn2Own Berlin, Disney Hack Story appeared first on SecurityWeek.

Ransomware Group Takes Credit for Lee Enterprises Attack

The Qilin ransomware gang claims to have stolen 350 Gb of files from Lee Enterprises in the attack that caused newspaper disruptions.

The post Ransomware Group Takes Credit for Lee Enterprises Attack appeared first on SecurityWeek.

Vo1d Botnet Evolves as It Ensnares 1.6 Million Android TV Boxes

The Vo1d botnet is now powered by 1.6 million Android TV devices, up from 1.3 million half a year ago.

The post Vo1d Botnet Evolves as It Ensnares 1.6 Million Android TV Boxes appeared first on SecurityWeek.

Microsoft Names Suspects in Lawsuit Against AI Hackers

In a lawsuit targeting cybercriminals who abuse AI services, Microsoft has named individuals from Iran, the UK, China and Vietnam.

The post Microsoft Names Suspects in Lawsuit Against AI Hackers appeared first on SecurityWeek.

Microsoft Exposes LLMjacking Cybercriminals Behind Azure AI Abuse Scheme

Microsoft on Thursday unmasked four of the individuals that it said were behind an Azure Abuse Enterprise scheme that involves leveraging unauthorized access to generative artificial intelligence (GenAI) services in order to produce offensive and harmful content.
The campaign, called LLMjacking, has targeted various AI offerings, including Microsoft’s Azure OpenAI Service. The tech giant is

12,000+ API Keys and Passwords Found in Public Datasets Used for LLM Training

A dataset used to train large language models (LLMs) has been found to contain nearly 12,000 live secrets, which allow for successful authentication.
The findings once again highlight how hard-coded credentials pose a severe security risk to users and organizations alike, not to mention compounding the problem when LLMs end up suggesting insecure coding practices to their users.
Truffle

Sticky Werewolf Uses Undocumented Implant to Deploy Lumma Stealer in Russia and Belarus

The threat actor known as Sticky Werewolf has been linked to targeted attacks primarily in Russia and Belarus with the aim of delivering the Lumma Stealer malware by means of a previously undocumented implant.
Cybersecurity company Kaspersky is tracking the activity under the name Angry Likho, which it said bears a “strong resemblance” to Awaken Likho (aka Core Werewolf, GamaCopy, and

Vo1d malware botnet grows to 1.6 million Android TVs worldwide

A new variant of the Vo1d malware botnet has grown to 1,590,299 infected Android TV devices across 226 countries, recruiting devices as part of anonymous proxy server networks. […]

Privacy tech firms warn France’s encryption and VPN laws threaten privacy

Privacy-focused email provider Tuta (previously Tutanota) and the VPN Trust Initiative (VTI) are raising concerns over proposed laws in France set to backdoor encrypted messaging systems and restrict internet access. […]

Cyber News