Suche
Beiträge, die mit MALWARE getaggt sind
Das 2024 entdeckte Botnetz Vo1d ist immer noch aktiv. Eine neue Version wurde nun von Sicherheitsforschern auseinandergenommen.
https://www.heise.de/news/Neue-Version-des-Vo1d-Botnetzes-auf-Hunderttausenden-Geraeten-mit-Android-TV-10300891.html?wt_mc=sm.red.ho.mastodon.mastodon.md_beitraege.md_beitraege&utm_source=mastodon
#Android #Botnet #Malware #Security #news
Perhaps they could ask about the use of #GammaGroup's #FinFisher #FinSpy #Finsky software used for targeting users at around a 250k run rate since 2015 & how that's a key user acquisition strategy software component wise but is never mentioned for some reason in the #press as a key component of ' non-organic growth ' but basic racketeering ( #RICO ) ¯\_(ツ)_/¯
#infosec #KiwiFarmsClone site #Meta #FacebookGroups #StalkerForums #StateSponsoredMalware use cases
Über eine Funktion zum gemeinsamen Sammeln klauen Gauner derzeit in einer Bonus-App Guthaben und versilbern es im Markt. Was hinter der Masche steckt.
https://www.heise.de/news/Punkteklau-im-Supermarkt-Cyberkriminelle-stehlen-Rewe-Bonuspunkte-10287640.html?wt_mc=sm.red.ho.mastodon.mastodon.md_beitraege.md_beitraege&utm_source=mastodon
#Datenleck #Malware #Security #news
Einige Zeit war es ruhig um die Mac-Malware XCSSET. Nun hat Microsoft neue aktive Varianten entdeckt, die Xcode-Projekte befallen.
https://www.heise.de/news/XCSSET-macOS-Malware-ist-wieder-aktiv-10285697.html?wt_mc=sm.red.ho.mastodon.mastodon.md_beitraege.md_beitraege&utm_source=mastodon
#macOS #Malware #Security #Xcode #news
Hacker schafften es, ein Spiel voller Malware auf Steam hochzuladen
Ein kostenloses Survival-Spiel auf Steam entpuppte sich als gefährliche Malware-Falle. Valve entfernte "PirateFi" umgehend und warnte Nutzer. Wer das Game heruntergeladen hat, muss nun sein komplettes System zurücksetzen.Witold Pryjda (WinFuture.de)
Dieses Mal nehmen sich die Podcast-Hosts eines kontroversen Themas an: Unternehmen installieren über Sicherheitslücken Malware - und das in staatlichem Auftrag.
https://www.heise.de/news/Passwort-Folge-25-Staatlich-sanktionierte-Schnueffelsoftware-10271855.html?wt_mc=sm.red.ho.mastodon.mastodon.md_beitraege.md_beitraege&utm_source=mastodon
#Android #Exploit #iOS #Malware #PasswortPodcast #Pegasus #Rootkit #Security #Spyware #news
https://www.kuketz-blog.de/cloudbasierte-dns-filter-als-schutzschild-gegen-unerwuenschte-inhalte/
#nextdns #controld #dns #dnsfilter #werbung #ads #tracking #filter #malware #schadsoftware
Cloudbasierte DNS-Filter als Schutzschild gegen unerwünschte Inhalte
Das Internet bietet eine Fülle von Informationen, aber nicht alle sind sicher oder erwünscht. Unternehmen, Schulen und Privathaushalte stehen vor…www.kuketz-blog.de
Microsoft bestätigt: ASP.NET-Schlüssel zur Malware-Verbreitung genutzt
Microsoft warnt vor einer neuen Angriffsmethode: Hacker nutzen öffentlich zugängliche ASP.NET-Schlüssel, um unbemerkt Malware in Netzwerke einzuschleusen. Über 3.000 gefährdete Schlüssel wurden bereits identifiziert.Nadine Juliana Dressler (WinFuture.de)
Lizenzstreit der Chip-Designer & -Hersteller + Amazons verdoppelte Gewinne + Malware scannt Screenshots + Sammelklage gegen DAZN + Datenschutz-Podcast zu Lecks
https://www.heise.de/news/Freitag-ARM-gegen-Nuvia-statt-gegen-Qualcomm-Amazons-Wachstum-laesst-etwas-nach-10273586.html?wt_mc=sm.red.ho.mastodon.mastodon.md_beitraege.md_beitraege&utm_source=mastodon
#Amazon #AmazonWebServices #ARM #Datenleck #Datenschutz #hoDaily #Kryptowährung #Malware #Qualcomm #Streaming #Verbraucherschutz #news
Freitag: ARM gegen Nuvia statt gegen Qualcomm, Amazons Wachstum lässt etwas nach
Lizenzstreit der Chip-Designer & -Hersteller + Amazons verdoppelte Gewinne + Malware scannt Screenshots + Sammelklage gegen DAZN + Datenschutz-Podcast zu LecksFrank Schräer (heise online)
OCR-Spyware in PlayStore- und AppStore-Apps stiehlt sensible Daten
Eine neue Malware-Kampagne namens SparkCat nimmt sowohl Android- als auch iOS-Nutzer ins Visier. Der Schadcode wurde dabei in verschiedenen Apps versteckt, die über die offiziellen Stores verfügbar sind, und soll wichtige Informationen stehlen.Christian Kahle (WinFuture.de)
The spyware allegedly came from an #israeli company called #paragon Solutions and targeted select users in over two dozen #countries, WhatsApp says.
#journalist #ICE #usa #facebook #meta #privacy #surveillance #data #pdf #malware #trojan #zeroclick #IM
Hypatia es el primer escáner de código malicioso #FOSS del mundo para #Android. Funciona con bases de datos de firmas al estilo #ClamAV.
https://f-droid.org/packages/us.spotco.malwarescanner
A real-time #malware scanner#Recomiendo
Hypatia | F-Droid - Free and Open Source Android App Repository
A real-time malware scannerf-droid.org
In der neuen Folge des Security-Podcasts geht es um ungewöhnliche Malware-Opfer, komische Malware-Namen und natürlich Zertifikate, Zertifikate und Zertifikate.
https://www.heise.de/news/Passwort-Folge-24-Zertifikate-sind-schwierig-Malwarenamen-auch-10253780.html?wt_mc=sm.red.ho.mastodon.mastodon.md_beitraege.md_beitraege&utm_source=mastodon
#CSS #Cybercrime #IETF #Malware #PasswortPodcast #Phishing #Security #news
Ein tatverdächtiger Ukrainer wurde wegen Malware-Einsatz und Lösegeld-Erpressung angeklagt. Der Mann soll einer weltweit agierenden Cybercrime-Gruppe angehören.
https://www.heise.de/news/Cyberkriminalitaet-Anklage-gegen-mutmasslichen-Cybererpresser-10258341.html?wt_mc=sm.red.ho.mastodon.mastodon.md_beitraege.md_beitraege&utm_source=mastodon
#Cybercrime #Cybersecurity #Malware #Ransomware #news
Having Barcelona become a crucial regional outpost for offensive cybersecurity companies puts the spyware problem squarely on the doorstep of Europe, which has a fractious relationship with surveillance tech, due to scandals in Cyprus, Greece, Hungary, and Poland — all involving Israeli spyware makers.
#Barcelona #spain #israel #spyware #startups #business #malware #security #cybersecurity #privacy #surveillance
https://techcrunch.com/2025/01/13/how-barcelona-became-an-unlikely-hub-for-spyware-startups/
How Barcelona became an unlikely hub for spyware startups | TechCrunch
Barcelona's mix of affordable cost of living and quality of life has helped create a vibrant startup community — and become a hotbed for the creation of surveillance technologies.Lorenzo Franceschi-Bicchierai (TechCrunch)
Sonderzeichen helfen nicht: 1 Mrd. Passwörter von Malware gestohlen
Obwohl immer wieder Alternativen angeschoben werden, beruhen Sicherheits-Konzepte weiterhin vor allem auf Passwörtern. Und diese werden in einem immer größeren Umfang von Kriminellen gestohlen, wie aktuelle Daten für das letzten Jahr zeigen.Christian Kahle (WinFuture.de)
Oftmals warnen sie eindringlich davor, dass der PC oder Laptop mit einem Virus infiziert sei, und legen nahe, umgehend Sicherheitssoftware zu installieren. Wenn ja, seid ihr wahrscheinliche #Scareware begegnet.
#DeutschlandDigitalSicherBSI #Malware
IT-security researchers have uncovered a new Linux rootkit called PUMAKIT that comes with capabilities to escalate privileges, hide files & directories, and conceal itself from system tools, while simultaneously evading detection.
https://www.elastic.co/security-labs/declawing-pumakit
#linux #pumakit #malware #it #security #privacy #engineer #media #tech #news
![[ImageSource: Elastic Security]
Pumakit Infection Chain.
Pumakit employs a multi-stage infection process starting with a dropper named 'cron,' which executes embedded payloads ('/memfd:tgt' and '/memfd:wpn') entirely from memory.
The '/memfd:wpn' payload, which executes in a child process, performs environment checks and kernel image manipulation and eventually deploys the LKM rootkit module ('puma.ko') into the system kernel.
Embedded within the LKM rootkit is Kitsune SO ('lib64/libs.so'), acting as the userland rootkit that injects itself into processes using 'LD_PRELOAD' to intercept system calls at the user level.](https://nerdculture.de/system/media_attachments/files/113/668/438/855/297/738/original/216f1cea50989548.jpeg "[ImageSource: Elastic Security]
Pumakit Infection Chain.
Pumakit employs a multi-stage infection process starting with a dropper named 'cron,' which executes embedded payloads ('/memfd:tgt' and '/memfd:wpn') entirely from memory.
The '/memfd:wpn' payload, which executes in a child process, performs environment checks and kernel image manipulation and eventually deploys the LKM rootkit module ('puma.ko') into the system kernel.
Embedded within the LKM rootkit is Kitsune SO ('lib64/libs.so'), acting as the userland rootkit that injects itself into processes using 'LD_PRELOAD' to intercept system calls at the user level.")
![[ImageSource: Elastic Security]
Pumakit using ftrace to hook Syscalls.
The malware uses the internal Linux function tracer (ftrace) to hook into as many as 18 different system calls and various kernel functions such as "prepare_creds," and "commit_creds" to alter core system behaviors and accomplish its goals.
<https://www.kernel.org/doc/html/latest/trace/ftrace.html>
"Unique methods are used to interact with Pumakid, including using the rmdir() syscall for privilege escalation and specialized commands for extracting configuration and runtime information," the researchers said.](https://nerdculture.de/system/media_attachments/files/113/668/440/433/885/855/original/d7035fe0f3215810.png "[ImageSource: Elastic Security]
Pumakit using ftrace to hook Syscalls.
The malware uses the internal Linux function tracer (ftrace) to hook into as many as 18 different system calls and various kernel functions such as \"prepare_creds,\" and \"commit_creds\" to alter core system behaviors and accomplish its goals.
<https://www.kernel.org/doc/html/latest/trace/ftrace.html>
\"Unique methods are used to interact with Pumakid, including using the rmdir() syscall for privilege escalation and specialized commands for extracting configuration and runtime information,\" the researchers said.")
Declawing PUMAKIT — Elastic Security Labs
PUMAKIT is a sophisticated loadable kernel module (LKM) rootkit that employs advanced stealth mechanisms to hide its presence and maintain communication with command-and-control servers.www.elastic.co
Cellebrite Unlocked This Journ...
Cellebrite Unlocked This Journalist’s Phone. Cops Then Infected it With Malware
A new report from Amnesty International reveals multiple cases where Serbian authorities used Cellebrite devices to access targets' mobile phones before loading them with spyware.Joseph Cox (404 Media)
#Cellebrite Unlocked This Journalist’s Phone. Cops Then Infected it With #Malware (#spyware)
https://www.404media.co/cellebrite-unlocked-this-journalists-phone-cops-then-infected-it-with-malware/ #cybersecurity #cybersec
Cellebrite Unlocked This Journalist’s Phone. Cops Then Infected it With Malware
A new report from Amnesty International reveals multiple cases where Serbian authorities used Cellebrite devices to access targets' mobile phones before loading them with spyware.Joseph Cox (404 Media)
https://www.bleepingcomputer.com/news/security/new-iocontrol-malware-used-in-critical-infrastructure-attacks/
#cybersecurity #IoT #SCADA #Israel #US
https://www.securityweek.com/iranian-hackers-use-iocontrol-malware-to-target-ot-iot-devices-in-us-israel/
#Infosec #Security #Cybersecurity #CeptBiro #IranianHackers #IOCONTROL #Malware #OT #IoTDevices #US #Israel
This devious new malware technique looks to hijack Windows itself to avoid detection
There is a way to abuse accessibility features on Windows to hide malwareSead Fadilpašić (TechRadar pro)
Threat hunters are warning about an updated version of the Python-based NodeStealer that's now equipped to extract more information from victims Facebook Ads Manager accounts and harvest credit card data stored in web browsers.
https://www.netskope.com/blog/python-nodestealer-targets-facebook-ads-manager-with-new-techniques
#facebook #socialmedia #ads #malware #it #security #privacy #engineer #media #tech #news
![[ImageSource: Netskope Threat Labs]
"We recently found several Python NodeStealer samples that collect budget details of the account using Facebook Graph API," Michael Alcantara explained. "The samples initially generate an access token by logging into adsmanager.facebook[.]com using cookies collected on the victim's machine."
Aside from collecting the tokens and business-related information tied to those accounts, the malware includes a check that's explicitly designed to avoid infecting machines located in Vietnam as a way to evade law enforcement actions, further solidifying its origins.](https://nerdculture.de/system/media_attachments/files/113/543/801/247/637/214/original/8f9c7aab48f850ec.png "[ImageSource: Netskope Threat Labs]
\"We recently found several Python NodeStealer samples that collect budget details of the account using Facebook Graph API,\" Michael Alcantara explained. \"The samples initially generate an access token by logging into adsmanager.facebook[.]com using cookies collected on the victim's machine.\"
Aside from collecting the tokens and business-related information tied to those accounts, the malware includes a check that's explicitly designed to avoid infecting machines located in Vietnam as a way to evade law enforcement actions, further solidifying its origins.")
![[ImageSource: Netskope Threat Labs]
On top of that, certain NodeStealer samples have been found to use the legitimate Windows Restart Manager to unlock SQLite database files that are possibly being used by other processes. This is done so in an attempt to siphon credit card data from various web browsers.
Data exfiltration is achieved using Telegram, underscoring that the messaging platform still continues to be a crucial vector for threat actors despite recent changes to its policy.
Malvertising via Facebook is a lucrative infection pathway, often impersonating trusted brands to disseminate all kinds of malware. This is evidenced by the emergence of a new campaign starting November 3, 2024, that has mimicked the Bitwarden password manager software through Facebook sponsored ads to install a rogue Google Chrome extension.
<https://www.bitdefender.com/en-us/blog/labs/inside-bitdefender-labs-investigation-of-a-malicious-facebook-ad-campaign-targeting-bitwarden-users>](https://nerdculture.de/system/media_attachments/files/113/543/801/854/620/038/original/d2a5cca00b79cd0a.png "[ImageSource: Netskope Threat Labs]
On top of that, certain NodeStealer samples have been found to use the legitimate Windows Restart Manager to unlock SQLite database files that are possibly being used by other processes. This is done so in an attempt to siphon credit card data from various web browsers.
Data exfiltration is achieved using Telegram, underscoring that the messaging platform still continues to be a crucial vector for threat actors despite recent changes to its policy.
Malvertising via Facebook is a lucrative infection pathway, often impersonating trusted brands to disseminate all kinds of malware. This is evidenced by the emergence of a new campaign starting November 3, 2024, that has mimicked the Bitwarden password manager software through Facebook sponsored ads to install a rogue Google Chrome extension.
<https://www.bitdefender.com/en-us/blog/labs/inside-bitdefender-labs-investigation-of-a-malicious-facebook-ad-campaign-targeting-bitwarden-users>")
Python NodeStealer Targets Facebook Ads Manager with New Techniques - Netskope
Summary In September 2023, Netskope Threat Labs reported a Python-based NodeStealer targeting Facebook business accounts. NodeStealer collects FacebookJan Michael Alcantara (Netskope)
Smashing Security podcast #392: Pasta spies and private eyes, and are you applying for a ghost job?
A Facebook friend request leads to arrest, Twitter scams ride again via promoted ads, and adult websites expose their members. Oh, and Graham finds out what…Graham Cluley
Based on interviews with malware developers, hackers who use the stolen credentials, and a review of manuals that tell new recruits how to spread the malware, 404 Media has mapped out this industry. Its end result is that a download of an innocent-looking piece of software by a single person can lead to a data breach at a multibillion-dollar company, putting Google and other tech giants in an ever-escalating cat-and-mouse game with the malware developers to keep people and companies safe."
https://www.wired.com/story/inside-the-massive-crime-industry-thats-hacking-billion-dollar-companies/
#CyberSecurity #CyberCrime #Hacking #Malware #InfoStealers #DataBreaches
Researchers have found new versions of a sophisticated Android financial-fraud Trojan that’s notable for its ability to intercept calls a victim tries to place to customer-support personnel of their banks.
https://www.zimperium.com/blog/mishing-in-motion-uncovering-the-evolving-functionality-of-fakecall-malware/
#android #fakecall #vishing #malware #it #security #privacy #engineer #media #tech #news
![[ImageSource: Zimperium]
Overview of latest FakeCall attacks.
The FakeCall malware typically infiltrates a device through a malicious app downloaded from a compromised website or a phishing email. The app requests permission to become the default call handler. If granted, the malware gains extensive privileges.
A fake call interface mimics the actual Android dialer, displaying trusted contact information and names, elevating the level of deception to a point that's hard for victims to realize.
What makes this malware so dangerous is that when a user attempts to call their financial institution, the malware secretly hijacks the call and redirects it to an attacker's phone number instead.](https://nerdculture.de/system/media_attachments/files/113/413/326/251/269/062/original/531c03137c2b88d1.png "[ImageSource: Zimperium]
Overview of latest FakeCall attacks.
The FakeCall malware typically infiltrates a device through a malicious app downloaded from a compromised website or a phishing email. The app requests permission to become the default call handler. If granted, the malware gains extensive privileges.
A fake call interface mimics the actual Android dialer, displaying trusted contact information and names, elevating the level of deception to a point that's hard for victims to realize.
What makes this malware so dangerous is that when a user attempts to call their financial institution, the malware secretly hijacks the call and redirects it to an attacker's phone number instead.")
Mishing in Motion: Uncovering the Evolving Functionality of FakeCall Malware - Zimperium
In this blog post we share Zimperium’s Zero-Day Protection against the Water Makara Spear-Phishing campaign.Zimperium