Search This Blog

Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Latest News

Axios npm Breach Exposes Threat of Social Engineering Attacks on Open-Source Ecosystem

  A security incident involving the widely used Axios HTTP library has revealed how attackers are increasingly targeting software maintainer...

All the recent news you need to know

Gmail Address Change Feature Fails to Address Core Security Risks, Report Warns

 

A recent update by Google allowing users to change their Gmail address has drawn attention, but cybersecurity experts say it does little to solve deeper issues tied to email privacy and security. 

The feature, which has gained visibility following its rollout in the United States, lets users modify their primary Gmail address while keeping the old one active as an alias. 

The change has been framed as a way to move beyond outdated or inappropriate usernames created years ago. Google CEO Sundar Pichai highlighted the shift in a public post, noting that users no longer need to be tied to early-era email identities. 

However, experts say the update does not address the main problem facing email users today, widespread exposure of email addresses to marketers, data brokers and cybercriminals. 

Once an email address is used online, it is likely to be stored across multiple databases, making it a long-term target for spam and phishing attempts. Changing the visible username does not remove that exposure, especially since older addresses continue to function. 

Jake Moore, a cybersecurity specialist at ESET, said the ability to edit email addresses reflects a broader shift in how digital identity works, but warned it could introduce new risks. “Old addresses will still work as aliases,” he said, adding that this could increase the risk of impersonation and phishing attacks. 

Security researchers also point to the absence of a built-in privacy feature similar to Apple’s “Hide My Email,” which allows users to generate disposable email addresses for sign-ups and online transactions. These temporary addresses can be disabled at any time, limiting long-term exposure. 

Without a comparable system, Gmail users who change their address may still need to share their primary email widely, continuing the cycle of data exposure. 

The update may also create new vulnerabilities in the short term. Cybersecurity reports indicate that attackers are already using the feature as a lure in phishing campaigns, sending emails that direct users to fake login pages designed to steal account credentials. 

There are also early signs of increased spam activity. Online forums have reported a rise in unwanted emails, with some researchers suggesting the address change feature could allow attackers to bypass existing spam filters and start fresh. 

According to security researchers cited by industry outlets, many email filtering systems rely heavily on known sender addresses. 

If attackers rotate or modify those addresses, they may temporarily evade detection until new filters are applied. At the same time, changing a Gmail address does not stop unwanted messages from reaching the original account, since it remains active in the background. 

Experts say the update highlights a broader issue in email security. While giving users more flexibility over their identity, it does not reduce reliance on a single, permanent address that is repeatedly shared across services. 

They suggest that more effective solutions would include tools that limit how widely a primary email address is distributed, along with stronger controls over incoming messages. 

For now, users are being advised to treat emails related to the new feature with caution, particularly those that include links to account settings, as these may be part of phishing attempts.

FBI and Indonesian Police Dismantle W3LL Phishing Network in Major Cybercrime Bust

 

In a landmark international operation, the U.S. Federal Bureau of Investigation (FBI) collaborated with the Indonesian National Police to dismantle the W3LL phishing network, a sophisticated cybercrime platform responsible for over $20 million in attempted fraud.Authorities seized critical infrastructure, including key domains, and detained the alleged developer, identified as G.L., marking the first joint U.S.-Indonesia effort to shut down a hacking platform.

The FBI's Atlanta division led the charge, emphasizing that the takedown severs a vital tool cybercriminals used to steal account credentials from thousands of victims worldwide. The W3LL phishing kit, sold for around $500, empowered even low-skilled hackers by providing ready-made templates mimicking legitimate login pages for banks and services like Microsoft 365. This phishing-as-a-service (PhaaS) model allowed attackers to deploy fake sites that harvested credentials, hijacked session cookies, and bypassed multi-factor authentication (MFA) via adversary-in-the-middle (AitM) techniques.

First documented by Group-IB in 2023, W3LL operated through an underground "W3LL Store" serving about 500 threat actors with tools for phishing, business email compromise (BEC), and stolen data sales. Active since 2017, the network's developer previously created spam tools like PunnySender and evolved W3LL into a full-service ecosystem, reselling over 25,000 compromised accounts from 2019 to 2023. Even after the W3LL Store shuttered in 2023, operations persisted via encrypted messaging, rebranding the kit and targeting over 17,000 victims in 2023-2024 alone. French firm Sekoia noted code reuse in other kits like Sneaky 2FA, highlighting W3LL's enduring influence in the cyber underground. 

FBI Atlanta Special Agent in Charge Marlo Graham hailed the bust as a strike against "full-service cybercrime," underscoring ongoing partnerships to protect the public. This operation disrupts a key resource for global fraud, but experts warn that cracked versions and similar kits continue circulating, perpetuating threats.For users in India and Asia, where phishing surges amid rising digital banking, the case spotlights the need for vigilance against PhaaS proliferation. 

As cybersecurity evolves, such takedowns signal stronger global enforcement, yet the low barrier to entry for phishing tools demands proactive defenses like direct URL typing and advanced MFA. This victory reinforces international cooperation's role in combating cybercrime, potentially deterring similar networks while urging organizations to bolster detection.

Why Restarting Your Smartphone Daily Can Improve Security and Reduce Cyber Risks

 

A daily routine most overlook could strengthen phone security in ways people rarely consider. Spurred by recent suggestions from Anthony Albanese, turning off mobile devices briefly each day is gaining notice among experts. Moments of complete shutdown, though small, disrupt potential digital intrusions before they take hold. Some risks fade simply because systems reset, clearing temporary weaknesses. What seems minor may actually reduce exposure over time. Brief downtime gives software a chance to shed lingering vulnerabilities. Officials now highlight this pause as both practical and effective. Restarting cuts connection threads hackers might exploit unnoticed. Even short breaks in operation tighten overall defenses. The act itself costs nothing, yet builds resilience through repetition. 

Though dismissed by some as old-fashioned, rebooting your device still holds value against modern digital threats. Security specialist Priyadarsi Nanda points out that such a step interrupts harmful background activities. On either platform - be it Apple’s system or Google’s - it makes intrusion less likely. One simple restart, oddly enough, weakens active exploits. Most times, turning a phone off and on removes short-lived glitches inside the system. Though an app seems inactive, it might still trigger unseen tasks behind the scenes. 

Under certain conditions, hackers take advantage of these lingering operations to stay connected to the hardware. A fresh start shuts every program and silent helper at once - breaking chains that sneaky actions rely upon. This tip has backing from the National Security Agency too; it suggests regular restarts to stay ahead of digital dangers. Its advice states that turning your phone off and on several times weekly may reduce exposure - not just to scams aimed at stealing data, but to complex intrusions as well. Even seemingly harmless app downloads might hide phishing traps aimed at stealing access. 

On the flip side, advanced methods like zero-click breaches take control without clicks or taps. Hidden flaws in chat platforms often open doors for these silent intrusions. A reboot won’t wipe out every trace of such stealthy code - but it may break its hold temporarily. Still, specialists point out rebooting alone won’t secure systems fully. One part of wider protection means also applying patches, steering clear of questionable websites, while relying on verified software. 

People managing confidential information might need extra steps beyond these basics. Though basic, rebooting a phone now then helps guard against shifting digital threats. Doing so each night before sleep cuts potential vulnerabilities without demanding much effort.

JanelaRAT Malware Attacks Banks in Brazil and Mexico, Steals Data


Banks in Latin American countries such as Mexico and Brazil have been victims of continuous malware attacks by a strain called JanelaRAT. 

An upgraded variant of BX RAT, JanelaRAT, can steal cryptocurrency and financial data from financial organizations, trace mouse inputs, log keystrokes, collect system information, and take screenshots.  

In a recent report, Kaspersky said, “One of the key differences between these trojans is that JanelaRAT uses a custom title bar detection mechanism to identify desired websites in victims' browsers and perform malicious actions.” The hackers behind the JanelaRAT attacks constantly modify the malware versions by adding new features. 

Security

Telemetry data collected by a Russian cybersecurity firm suggests that around 11,695 attacks happened in Mexico and 14,739 in Brazil in 2025. We do not know how many of these led to a successful exploit. 

In June 2023, Zscaler first discovered JanelaRAT in the wild, leveraging ZIP archives containing a VBScript to download another ZIP file, which came with a genuine executable and a DLL payload. The hacker then deploys the DLL side-loading tactic to launch the malware. 

Distribution tactic

An analysis by KPMG in 2025 revealed that the malware is circulated via rogue MSI installer files impersonating as a legit software hosted on trusted sites like GitLab. 

"Upon execution, the installer initiates a multi-stage infection process using orchestrating scripts written in Go, PowerShell, and batch,” KPMG said. "These scripts unpack a ZIP archive containing the RAT executable, a malicious Chromium-based browser extension, and supporting components."

The scripts are also made to recognize installed Chromium-based browsers and secretly configure their launch parameters to install the extension. The browser add-on collects system data, cookies, browsing history, tab metadata, and installed extensions. It also triggers actions depending upon URL pattern matches. 

Phishing campaign

The recent malware campaign found by Kaspersky reveals that phishing emails disguised as due invoices are used to lure recipients into downloading a PDF file by opening a link, causing the download of a ZIP archive that starts the attack chain, including DLL side-loading to deploy JanelaRAT.

Since May 2024, JanelaRAT malware has moved from VBScripts to MSI installers, which work as a dropper for the trojan via DLL side-loading and build persistence in the victim system by making a Windows Shortcut (LNK) in the Startup folder that leads to the executable. 

Victim tracking

According to Kaspersky, “The malware determines if the victim's machine has been inactive for more than 10 minutes by calculating the elapsed time since the last user input.” 

If the inactivity is over ten minutes, “the malware notifies the C2 by sending the corresponding message. Upon user activity, it notifies the threat actor again. This makes it possible to track the user's presence and routine to time possible remote operations," Kaspersky said.

Pavel Durov Says Russia VPN Restrictions Triggered Banking Disruption



In spite of the fact that the Russian government is intensifying its efforts to reaffirm its control over digital communication channels, unintended consequences of that strategy are becoming evident in a number of critical sectors beyond social media. Significant disruptions to the domestic financial infrastructure have coincided with the sweeping restrictions imposed on the use of virtual private networks widely relied upon for bypassing state-imposed restrictions over the past week. 


According to Pavel Durov, the billionaire founder and CEO of Telegram, these enforcement measures were responsible for the widespread banking outages, as attempts to block VPN access caused large-scale payments to be delayed. The remarks of the speaker not only emphasize the heightened tension between state-led digital controls and attempts to circumvent them, but also underscore a deeper systemic vulnerability where tightly interconnected networks can amplify policy actions into nationwide service failures affecting millions. 

Despite being relatively recent in terms of intensity, Russia's expanding intervention in the internet architecture is increasingly being characterized by unintended technical consequences. Service instability is becoming increasingly common as regulatory actions aimed at isolating specific platforms cascade across interconnected systems, resulting in service instability. In response to Maksut Shadayev's announcement late last month of a coordinated effort to curb VPN usage as part of a broader tightening of digital controls, this pattern was reinforced further. 

Max, a state-backed "super app" that combines digital services into a centrally observable ecosystem, announced the strategic shift toward channeling user activity into environments that have minimal encryption and limited resistance to state oversight in announcing the announcement. As a result of this approach, messaging platforms such as WhatsApp and Telegram have been systematically sidelined from Russian domestic internet layers, thereby reducing the number of secure communication channels available to users.

The disruption appears to have occurred as a result of aggressive scaling of traffic filtering and deep packet inspection mechanisms deployed for the identification and blocking of VPN traffic. It is by design that virtual private networks obscure routing metadata by redirecting user traffic through external nodes, which complicates network perimeter enforcement. As a result of these filtering operations-reportedly being managed by the state communications infrastructure-the routing and processing systems have been significantly strained. 

Industry reports, including Bloomberg account references, indicate that this strain resulted in outages affecting banking applications and other digital services, likely due to overload conditions within filtering layers rather than targeted failures of the financial system. When such interventions are implemented at large scale without adequate segmentation, they threaten to erode network stability and to disrupt critical infrastructure unintentionally. 

Pavel Durov has argued that the crackdown is both technically ineffective and strategically counterproductive against such a backdrop, contending that millions of users continue to use circumvention tools for accessing restricted platforms. As a result of VPN adoption, perimeter-based control is limited in a distributed network environment due to its inherent limitations. 

Historically, this assessment has been supported: a similar enforcement effort in 2018, inspired by demands for backdoor access to encrypted Telegram communications, led to significant collateral disruption across payment systems, online services, and connected devices, although only marginal reductions were observed in platform usage. These episodes illustrate the dynamic of centralized control introducing systemic fragility exposing the very infrastructure they seek to regulate to cascading operational risks through uncontrolled centralization. 

Further fueling concerns about the effectiveness of these measures, Pavel Durov expressed concern that restrictions on Telegram have failed to curtail its usage significantly, noting that tens of millions of users continue to access the platform every day through VPN-based routing. 

According to him, recent enforcement actions targeting circumvention tools did not just fail to achieve their objective, but instead caused systemic instability, with the interruption of payment infrastructures to the point that cash transactions were the only reliable means of conducting transactions during the disruption period. 

A parallel report from independent Russian media outlets, including The Bell, indicated that the outage affected banking applications was most likely a result of excessive load within state-operated filtering systems, where increased inspection and blocking mechanisms caused network layer bottlenecks. Without official clarification from regulators, technical assessments indicate that overload conditions within centralized traffic management frameworks are likely to be the primary cause. 

Experts warn that such interventions, when implemented on a national scale, may compromise network resilience by inadvertently doing so. As a result of tightening regulatory practices beyond messaging platforms, the broader operational environment has been impacted. 

The company confirmed disruptions to payment services related to its digital ecosystem beginning on April 1, without disclosing the underlying causes of the disruption. In domestic news reports, authorities were considering restricting top-ups for mobile accounts, a measure that could further restrict VPN accessibility by limiting the continuity of prepaid services. 

Despite the fact that these developments are a result of a sustained policy direction in Moscow toward the consolidation of digital activity within state-aligned infrastructure, the promotion of Max, a WeChat-inspired centralized application, is particularly noteworthy. Additionally, access limitations have been imposed on widely used global platforms such as YouTube, WhatsApp, and Snapchat, as well as intermittent limitations on Telegram. 

A combined effect of these measures, particularly the recent escalation in VPN suppression efforts, highlights the increasingly fragile balance between state-driven network control and interconnected digital service integrity. 

While accusations and counterclaims have risen in recent months, including assertions by Russian officials that Telegram has been compromised by foreign intelligence, a broader trend indicates a shift toward state-curated digital ecosystems based on Max, a product developed by VK, which is a state-curated digital platform. It is becoming increasingly evident that government governance of connectivity is becoming more interventionist, which includes mandatory preinstallations on consumer devices and selective internet shutdowns to test the network.

The developments underscore the importance of reassessing network resilience, implementing segmentation strategies, and preparing for policy-induced disruptions that can propagate across dependent systems in response to these developments for industry stakeholders and infrastructure operators.

The situation underscores the importance of maintaining technical safeguards, transparency, and redundancy within digital ecosystems, as attempts to centralize control over distributed networks continue to introduce systemic risks with widespread operational and security implications. The developments indicate a growing convergence between state policy enforcement and critical digital infrastructure operational stability.

A precautionary signal is being issued for enterprises, financial institutions, and network operators regarding strengthening architectural resilience, diversifying routing dependencies, and preparing for policy-driven disruptions. 

In tightly coupled systems, a proactive approach is essential to reducing cascading failures, anchored in redundancy planning, adaptive traffic management, and continuous risk assessment. Regulating internet access continues to evolve, and it remains a challenging task for both policymakers and technology stakeholders to strike a balance between governance and infrastructure integrity.

FBI Warns Smartphone Users About Risks Linked to Foreign Apps, Especially Chinese Platforms

 



The Federal Bureau of Investigation has issued a fresh alert cautioning users about potential security and privacy threats posed by mobile applications developed outside the United States, particularly those linked to China. The advisory emphasizes that while the concern may seem obvious, many users continue to download such apps without fully understanding the risks.

In its public notice, the agency highlighted that a significant number of widely used and top-earning apps in the U.S. market are owned or operated by foreign companies. Many of these are tied to Chinese firms, raising concerns due to China’s legal framework governing data access.

At the center of the warning are provisions within China’s National Intelligence Law. Under Article 7, individuals and organizations are required to assist state intelligence efforts and maintain secrecy around such cooperation. Article 14 further allows authorities to demand support, data, or cooperation from entities and citizens. Together, these provisions create a legal pathway through which user data collected by apps could be accessed by the Chinese state.

Despite raising these concerns, the FBI has not published a formal list of high-risk apps. Instead, it has urged users to evaluate all foreign-developed applications before installing them. Media reports, including analysis referenced by outlets such as New York Post, suggest that popular platforms like CapCut, Temu, SHEIN, and Lemon8 fall into this broader category of concern.

Further analysis by TechRadar indicates that several of these apps rank highly in download charts across both Android and iOS platforms. On Android, for example, TikTok Lite appears among the most downloaded, alongside TikTok and Temu. Some apps are linked to developers based in Hong Kong or operate through complex international structures, making origin tracing less transparent. While Android devices face higher exposure due to sideloading capabilities, iPhone users are not entirely shielded from such risks.

Notably, platforms like TikTok, CapCut, and Lemon8 currently operate in the U.S. under TikTok USDS LLC, a joint venture backed by Oracle Corporation, with majority U.S. ownership. This structure means their U.S. operations are treated differently from their global counterparts, even though their origins remain tied to Chinese development.

The FBI stresses that its advisory is not a blanket ban on Chinese apps. Rather, it encourages users to be more vigilant. One key concern is the type of permissions users grant during installation. Many individuals overlook privacy policies, allowing apps to continuously gather sensitive data such as contact lists, location details, and personal identifiers.

This data can be used to build detailed social networks, which may later support targeted cyberattacks or social engineering campaigns. Some applications also include features that encourage users to invite contacts, enabling developers to collect additional personal data such as names, email addresses, phone numbers, and physical addresses.

Another major concern is data storage. Certain apps explicitly state that collected information may be stored on servers located in China for extended periods. In some cases, users cannot access app functionality unless they agree to such data-sharing practices.

Beyond privacy risks, the FBI also warns about potential cybersecurity threats. Some foreign-developed apps may include hidden malicious components capable of exploiting system vulnerabilities, collecting unauthorized data, or establishing persistent backdoor access on devices.

The advisory highlights that installing apps from unofficial sources significantly increases these risks. This is particularly relevant for Android users, where sideloading is more common. While official app stores conduct security checks to detect harmful code, third-party sources may bypass these safeguards. Companies like Google have taken steps to limit installations from unknown developers, though risks remain.

To mitigate exposure, the FBI recommends several precautionary measures:

• Install applications only from official app stores

• Review terms of service and user agreements carefully

• Restrict unnecessary permissions and data sharing

• Regularly update passwords

• Keep device software up to date

In a parallel development stressing upon global regulatory tensions, China recently ordered the removal of a decentralized messaging application created by Jack Dorsey from its local app store. Authorities claimed the app violated national internet regulations, reinforcing how governments worldwide are tightening control over digital platforms.

The larger takeaway is that app-related risks are no longer limited to malware alone. Increasingly, they are shaped by legal frameworks, data governance policies, and geopolitical dynamics. For everyday users, this makes informed decision-making around app downloads more critical than ever.

Featured