malwareAttack on cybersecurity researchers: pseudo-exploit for regreSSHion
Someone is targeting security experts using an archive that allegedly contains an exploit for the regreSSHion vulnerability.
Latest
supply-chain attackRemove Polyfill.io from your website
The JavaScript CDN service Polyfill.io has started spreading malicious code. Remove the service’s script from your website.
Turnkey phishing
A turnkey home? A turnkey website? How about turnkey phishing? Scammers now sell turnkey phishing services to other scammers. Read on to find out how it works.
vulnerabilitiesregreSSHion vulnerability in OpenSSH
A new vulnerability allows remote attackers to gain root privileges on Linux servers. How easy is it for CVE-2024-6387 to be exploited – and how to prevent it
Phishing on GitHub through job offers to… developers
Developers’ accounts are being hijacked using fake job offers sent from a legitimate GitHub address.
Meta wants to use your posts and photos to train AI… Or does it?
Training AI requires a colossal amount of data. Meta seems to have found a “brilliant” solution — using the personal data of its own users.
Don’t forget about Recall, because Recall won’t forget about you
The new AI function in Microsoft Windows has already been dubbed a “security nightmare” on the internet. What risks does it carry, and how to stay safe?
appleOther people’s smartphones are spying on your router. How to stop it
The exact location of your router is publicly available through global Wi-Fi geolocation databases. Let’s explore why this is necessary, and the risks it entails and how to mitigate them.
Progressive phishing: How PWAs can be used to steal passwords
A new phishing technique uses progressive web apps (PWAs) to mimic browser windows with convincing web addresses to steal passwords.
Gamers
gamersLive hack: Apex Legends esports tournament scandal
Hackers have long been engaging with the gaming world: from cracking games and creating cheats, to, more recently, attacking esports players live during an Apex Legends tournament. Regarding the latter, we break down what happened and how it could have been avoided.
Mario Forever, malware too: a free game with a miner and Trojans inside
Malicious versions of the free-to-download game Super Mario 3: Mario Forever plant a miner and a stealer on gamers’ machines.
Minecraft players under attack
Minecraft mods downloaded from several popular gaming websites contain dangerous malware. What we know so far.
The Phantom Menace: how gamers of different ages are being attacked
Why scammers are more likely to target kids than hardcore gamers, how they do it, and what they want to steal
The true cost of gaming
Our research reveals gamers’ attitudes toward computer performance — and the ethics of winning and losing.
Where did that game cheats video on your YouTube channel come from?
The RedLine Trojan stealer spreads under the guise of cheats for popular games and posts videos on victims’ YouTube channels with a link to itself in the description.
$2 million inventory hacked in CS:GO
An unnamed hacker allegedly stole two million dollars’ worth of items from a CS:GO player’s backpack and has already started auctioning off the items.
Business
biometricsHidden dangers of biometric authentication devices
Based on our analysis of ZKTeco vulnerabilities, we dissect the risks associated with biometric authentication.
ShrinkLocker ransomware employing BitLocker for encryption
Our experts have discovered ransomware they’ve dubbed “ShrinkLocker”, which encrypts infected computers’ drives using BitLocker — a utility built into Windows.
Phishing using FB infrastructure stealing business-account passwords
Cybercriminals are using genuine Facebook infrastructure to send phishing emails threatening to block accounts.
The evolution of the SIEM system
We’re expanding the capabilities of the Kaspersky Unified Monitoring and Analysis SIEM system by adding new normalizers and correlation rules.
E-mail attacks on the hotel business
Threat actors are targeting hotel staff with malicious and phishing e-mails.
I firmly believe that the concept of cybersecurity will soon become obsolete, and cyberimmunity will take its place.
Eugene Kaspersky
Popular
Critical vulnerability in Apache Log4j library
Researchers discovered a critical vulnerability in Apache Log4j library, which scores perfect 10 out of 10 in CVSS. Here’s how to protect against it.
cryptocurrenciesCase study: fake hardware cryptowallet
Full review of a fake cryptowallet incident. It looks and feels like a Trezor wallet, but puts all your crypto-investments into the hands of criminals.
Five things to update ASAP
Prioritize updating the apps that keep your devices and personal data safe from cyberattacks.
Update iOS, there is a dangerous vulnerability in WebKit
Dangerous vulnerability in WebKit (CVE-2022-22620) is believed to be actively exploited by hackers. Update your iOS devices as soon as possible!
What to do if you lose your phone with an authenticator app
Can’t sign in to an account because your authenticator app is on a lost phone? Here’s what to do.
Infected Android app store
The APKPure app store has been infected by a malicious module that downloads Trojans to Android devices.
Follina: office documents as an entrance
New vulnerability CVE-2022-30190, aka Follina, allows exploitation of Windows Support Diagnostic Tool via MS Office files.
Tips
Setting up both security and privacy in WhatsApp
We discuss key aspects of WhatsApp’s security and privacy, and how to configure this messenger to enhance protection.
The incognito myth: how private browsing really works
How to use private browsing mode, what it doesn’t protect against, and why Google is deleting five billion dollars’ worth of user data.
Advertisers sharing data about you with… intelligence agencies
Advertising firms’ extensive collection of personal data is becoming of great use to intelligence agencies. So how to guard against mass surveillance?
Watch the (verified) birdie, or new ways to recognize fakes
How to tell a real photo or video from a fake, and trace its provenance.