Search This Blog
Powered by Blogger.

Blog Archive

Labels

Load More
Trendy Right Now

Popular Posts

Showing posts with label Email Fraud. Show all posts
UK Government
Action Fraud Cyber Crime Email Fraud Email Phishing Life Insurance UK Government

Rise in Fake Life Insurance Emails, Action Fraud Warns

 


Over the past few weeks, a surge in fraudulent emails impersonating reputable life insurance companies has prompted over 800 reports to Action Fraud, the UK’s national reporting centre for fraud and cybercrime. The scam emails are cleverly crafted to appear genuine, but they contain malicious links leading recipients to harmful websites designed to steal personal and financial information.

To help the public follow through this growing threat, Action Fraud has provided guidance on handling suspicious messages. Recipients are advised to independently verify the authenticity of an email by contacting the alleged sending organisation directly, using official contact details obtained from the organisation’s official website. This precaution is crucial, as scam emails often provide fake contact information that leads directly back to the fraudsters.

Action Fraud emphasises that legitimate banks and official sources will never request personal information via email, a tactic frequently employed by scammers to harvest sensitive data. To further combat these fraudulent activities, the public is encouraged to forward any suspicious emails to the Suspicious Email Reporting Service (SERS) at report@phishing.gov.uk. This service plays a pivotal role in the UK’s defence against the growing threat of email-based fraud, providing the government with a means to track and respond to these malicious activities.

In response to the increasing number of these incidents, it is essential for individuals to remain a step ahead and take proactive measures to protect themselves from falling victim to such scams. Understanding that fraudulent emails pose a significant threat, the public is urged to exercise caution and follow the provided guidance to verify the legitimacy of any communication from financial institutions or life insurance companies.

This warning comes as scammers continue to adapt and refine their tactics to exploit unsuspecting individuals. Action Fraud stresses the importance of public awareness and education to counter these evolving threats effectively. By disseminating this information through official channels, such as news blogs and other media outlets, the hope is to empower individuals with the knowledge needed to recognise and avoid falling prey to such scams.

As a responsible member of the online community, everyone has a role to play in staying informed and helping others stay safe from cyber threats. By adhering to the guidance provided by Action Fraud and reporting suspicious emails promptly, individuals can contribute to the collective effort to combat fraudulent activities and protect personal information from falling into the wrong hands.

Action Fraud's guidance provides a valuable resource for individuals to navigate these potential threats effectively, and the public is encouraged to remain vigilant and report any suspicious emails to contribute to the ongoing efforts against email-based fraud.



Read more »
Vidar Stealer
Antivirus Cyber Security Email Fraud Infostealer Online Data Ransomware Attacks. Vidar Stealer

New Information-Stealing Malware Campaign Targets Online Sellers

Online sellers have become the latest targets of a new information-stealing malware campaign that aims to compromise their sensitive data. Security researchers have discovered a strain of malware called Vidar being deployed in this campaign, with attackers using various methods to distribute the malicious software.

Vidar is a well-known information-stealing malware that has been active since at least 2018. It is designed to collect sensitive data from infected systems, including login credentials, financial information, and other personal details. The malware operates by monitoring the victim's activities and capturing keystrokes, taking screenshots, and even recording audio if necessary.

In this recent campaign, attackers have specifically focused on online sellers, recognizing the potential financial gain from stealing their login credentials and gaining unauthorized access to their e-commerce platforms. By compromising online seller accounts, attackers can manipulate product listings, redirect payments, and exploit customer data for fraudulent purposes.

The distribution methods employed in this campaign are diverse. They range from phishing emails containing malicious attachments or links to infected websites that host exploit kits. Once the malware is successfully installed on the victim's system, it remains silent and works stealthily in the background, gathering valuable information without the user's knowledge.

To protect against this type of threat, online sellers and individuals should implement robust cybersecurity practices. These include regularly updating operating systems and software to patch known vulnerabilities, employing strong and unique passwords for all online accounts, and being cautious when opening email attachments or clicking on suspicious links.

Furthermore, it is crucial to educate employees and individuals about the risks of phishing attacks and social engineering techniques commonly used by cybercriminals. By raising awareness and promoting a security-conscious mindset, organizations can significantly reduce the likelihood of falling victim to such malware campaigns.

Security solutions, including robust antivirus and anti-malware software, should be installed and kept up to date to detect and mitigate any potential threats. Regular system scans should also be conducted to identify and remove any malicious files or software.

The discovery of this new information-stealing malware campaign serves as a reminder that cybercriminals are continuously evolving their tactics and targeting specific industries for financial gain. Online sellers, in particular, should remain vigilant and implement strong security measures to safeguard their valuable data and protect their customers from fraud and identity theft.


Read more »
User Privacy
Data Breach Email Fraud IP Address Microsoft Azure Server TechCrunch Unauthorized access US Government User Privacy

 Crucial US military Emails was Publicly Available

A US Department of Defense exposed a server that was leaking private internal military emails online Security researcher Anurag Sen discovered the unprotected server, which was "hosted on Microsoft's Azure federal cloud for Department of Defense customers," according to a TechCrunch report.

The vulnerable server was housed on Microsoft's Azure federal cloud, which is available to Department of Defense clients. Azure uses servers that are physically isolated from other commercial customers so they can be utilized to share private but sensitive government information. The exposed server was a component of an internal mailbox system that included around three terabytes of internal military emails, a lot of them regarding the USSOCOM, the US military organization responsible for carrying out special military operations.

Nevertheless, due to a misconfiguration, the server was left without a password, making it possible for anyone with access to the internet to access the server's IP address and view the server's important mailbox data.

The server was filled with old internal military emails, a few of which contained private information about soldiers. A completed SF-86 questionnaire, which is filled out by government employees seeking a security clearance and contains extremely sensitive personal and health information for screening people prior to being cleared to handle classified information, was included in one of the disclosed files.

As classified networks are unreachable from the internet, TechCrunch's scant data did not appear to be any of it, which would be consistent with USSOCOM's civilian network. In addition to details regarding the applicant's employment history and prior living arrangements, the 136-page SF-86 form frequently includes details about family members, contacts abroad, and psychiatric data.

A government cloud email server which was accessible through the web without a password was made public and the US government was notified about it. Using just a web browser, anyone could access the private email data there.






Read more »
Hackers
Child Identity Theft Data Breach Email Fraud Fraud Hackers

Synthetic Identity Fraud: What Is It?

Frankenstein ID, the use of fake identities by scammers, has become prevalent over the last 12 to 18 months, with US financial institutions (FIs) reporting losses of $20 billion in 2021 as compared to $6 billion in 2016.

Synthetic Identity Fraud: What Is It? 

When a Social Security number is stolen, synthetic identity fraud occurs. Hackers then use it in conjunction with bits of accurate personal data obtained from various sources or entirely false information to build an identity in order to commit theft.

Synthetic identity theft is unknown, thus allowing fraudsters to carry out their crimes undetected. Researchers discovered that two out of every three American adults were extremely unaware of fake identity theft.

What is the Frequency of Child Identity Theft and Fraud?

In contrast to adults, stealing the identities of minors gives hackers a wider window to utilize the credentials since the majority of victims who had their identities taken as children do not become aware of the fraud until they are adults. Social media, personal health information, and school forms pose the greatest threats to data theft involving minors, which is a concern for nearly two-thirds of adults. 

SSNs can be found by hackers in different spots, like your email account or the database of your chosen merchant. Even student data is stolen and published on the dark web by ransomware groups. Hackers take SSNs to commit synthetic ID theft. As they are more likely to belong to minors, they favor numbers that were granted within the last 18 years. Children generally wait until they are 18 to apply for loans or credit, giving criminals ten or even fifteen years to cause havoc before anyone takes notice.

A hacker will start seeking credit online if they have a social security number. Users, then, simply build a credit history just by seeking credit. A creditor will eventually grant them a $500 or perhaps $1,000 credit line. A breakout occurs once hackers have access to $10,000 to $15,000 in credit. After a final flurry of charges, the attackers fade. 

86 % of parents do not check their kids' credit, so hackers can ruin it for years. Due to this, synthetic identity has severe repercussions that frequently prevent its young victims from beginning their adult lives. The fact that children lack control over their credit or financial information makes them vulnerable as well.


Read more »
Ransomware Attacks.
Cyber Crime Darkweb Email Fraud Endpoint HP Ransomware Attacks.

HP's Defense From Emerging Cybercrime


Cybersecurity is constantly evolving, so cybercrime's scope and consequences have grown significantly over time. Cybersecurity is a concern in the workplace and at the highest levels of government given the rise of ransomware.

With defined supply chains and markets, the cybercrime business has undergone a major shift or one that is more professional and industrialized. According to HP's senior malware expert Alex Holland, cybercrime has grown to be a significant industry. On contrary, as per HP's study, the dark web is encouraging cybercriminals to cooperate, exchange goods, support one another's operations, and even profit from them.

Maintaining its staff throughout the epidemic and after it, with the advent of hybrid work, has been one of the urgent concerns in this transforming landscape, as far as firms are concerned. "That's generated a lot of issues for organizations because they need to set up their devices remotely, manage their devices remotely, and we realize that endpoint visibility - in terms of security and identifying threats - has been a concern for the enterprise. Enterprises must also be able to defend against and recover from such attacks, should the worst happen," Holland adds.

Additionally, there is a significant risk for organizations because of the blurring of the barriers between an employee's personal and professional lives. 71% of employees, as per research HP published in May, claim they use computers at home more frequently and to access more company data. Office workers are also increasingly utilizing their work devices for personal tasks, in fact, 70% of them admit to doing so, such as checking their emails.

"We notice that utilizing work devices—especially for risky tasks like opening webmail. Email is effectively a direct line into the organization, as we continually observe from the data we examine in my team. Once an endpoint has been taken over, an attacker is free to move about or do a lot of harm," Holland claims.

By incorporating security into hardware, which is reinforced by the Endpoint Security Controller hardware chip, Holland claims HP wants to combat these threats. This secure-by-design strategy depends on a solid framework and system integrity verification. The maker offers a wide range of security systems, including firmware security, memory virus detection, and isolating dangerous tasks. 

HP offers services to provide a firm's desired security configuration right off the manufacturing line, which is the opposite side of the issue when it comes to configuring devices before they are dispatched to employees.










Read more »
Iranian
Cyber Attacks Cybersecurity Email Fraud Email Hacking email threat Energy sector Iran Iranian

Iran’s Atomic Energy Organization Confirms E-mail Hack

 

The Atomic Energy Organization of Iran (AEOI) has confirmed that an anonymous “foreign country” has hacked an e-mail server belonging to one of its subsidiaries and allegedly published the information online, as per reports. 

The Iranian threat actor, named ‘Black Reward’ in a statement posted on his Twitter handle says that it has released the hacked information relating to Iranian nuclear activities. The hackers describe their action as an act of support for the Iranian protesters. 

The said protests continue in Iran after the death of Mahsa Amini (22-year-old) in September, who apparently died in police custody for not following the strict Islamic dress protocol of the country. The violent protest and street violence resulted in several deaths of protesters, along with that of security force staff. Furthermore, hundreds of demonstrators have allegedly been detained. 

A statement published by the Black Reward on Saturday showing support for the protests, read “In the name of Mahsa Amini and for women, life, and freedom.”  

The hacking group threatened the Iranian state to leak the hacked documents of Tehran’s nuclear program if they would not release all the prisoners and people detained in the protests, within 24 hours. Additionally, the group demands the release of political prisoners, claiming to have leaked 50 gigabytes of internal emails, contracts and construction plans relating to the country’s Russian-sponsored nuclear power plant in Bushehr, publishing files on its Telegram channel. 

According to the statement shared by the hacking group, the released information includes “management and operational schedules of different parts of Bushehr power plant,” passport and visa details of Iran and Russia based specialists working in the power plant and “atomic development contracts and agreements with domestic and foreign partners.” 

Although the atomic energy organization’s general department of public diplomacy and information denied the relevance of the released data, stating “this move was made with the aim of attracting public attention” 

“It should be noted that the content in users’ emails contains technical messages and common and current daily exchanges […] It is obvious that the purpose of such illegal efforts, which are carried out of desperation, is to attract public attention, create media atmospheres and psychological operations, and lack any other value,” the organization confirmed.
Read more »
User Privacy
Cyber Security Email Fraud email security Phishing email User Privacy

Five Important Tips for Keeping Your Email Safe

 

Whether it’s on our smartphones or desktops – we can’t really function today without scanning our emails on a daily basis. However, we often undermine the hacker's abilities and think we're immune to scams. take the privacy and security of our inboxes and emails for granted. 

Email scam is often the easiest way for malicious hackers to trick individuals into giving personal and private data. According to the FBI, email frauds are the most expensive type of cybercrime, costing American billions of dollars in losses. 

According to Google Safe Browsing, there are now nearly 75 times as many phishing sites as there are malware sites on the internet. Interestingly, 20% of all employees are likely to click on phishing email links, and, of those, a whopping 68 percent go on to enter their credentials on a phishing website. 

So how can we mitigate this and safeguard our emails? Here are 5 simple steps that can assist in protecting your email account and steer clear of threat actors. 

1. Apply a strong and unique password 

This one may seem cliche, but never employ a password that contains your name, date of birth, user name, email address, or any other piece of information that can be easily accessed by hackers. Your password needs to be six characters or longer. Employ different passwords for each of your accounts, never the same one. 

You can store all your passwords in multiple ways, including on a piece of paper, hard drive, password manager, or otherwise. If you're using a password manager app, keep in mind that these can be prone to hacks, as they rely on internet connections and software programs to store your data, both of which can be abused by hackers. 

2. Post minimal personal information on social media 

Recognize the privacy settings you have. Always scan the default privacy settings before posting anything on a social media platform. The default privacy settings on multiple social media platforms are often lenient and may permit the sharing of information with a big online community. A social networking platform’s settings should be adjusted before sharing any content there. 

3. Employ a spam filter 

Spam filters help you keep spam emails from your inbox or flag spam emails so that you are aware of them. Relying on the software and configuration, some spam filters can automatically eliminate junk emails and thwart web bugs that track your activity and system information. 

4. Block Suspicious Addresses 

While some scammers may only try to contact you once or twice, others will make repeated attempts at getting in touch. This is why you should block email addresses that you have confirmed to be dangerous. It's usually pretty quick and easy to block an email address, but the process may differ slightly depending on the provider you're using. It can usually be done by highlighting a specific email and choosing the Block option, or by going into your email account settings. 

5. Use Antivirus Software 

It is highly recommended that you install and maintain good and well-respected antivirus software on your desktop, smartphone, or tablet to mitigate infection. Search all email attachments with an antivirus program before downloading them, even if they come from someone you know.
Read more »
Spoofing
Email Fraud PayPal Phishing Attacks Privacy Spoofing

PayPal Invoices Used for Data Theft

The past few months have seen an increase in the usage of convincing phishing emails made using an attack on PayPal's invoice system. Scammers are constantly seeking new ways to steal your personal information or money. 

Hackers send bogus invoices from PayPal's website using a free PayPal account they have registered. The emails' bodies contained spoof logos of companies like Norton to make their recipients believe they were authentic.

Emails from PayPal will likely be delivered to your inbox rather than your spam bin because they are not regarded as spam. Because it came from a real Paypal account, the email will appear to be trustworthy so users are advised to stay cautious and not fall for it. You won't receive a worthwhile service if you pay this charge, cybercriminals will receive your money and use it for their own gain. 

The PayPal invoices feature statements like "thank you for purchasing Norton Security Premium package, if you have not authorized this transaction, please call us with your credit card details." They resemble a related fraud that employed phony Quickbooks invoices and was disclosed earlier this month.

The scam, often known as a "double spear" assault, prompts users to call the number, at which point hackers attempt to get them to pay the invoice and steal their credit card information.

Phishing efforts are frequent and come in a variety of shapes, according to a written statement from PayPal.

PayPal stated that it has a zero-tolerance policy for attempted fraud on the platform and that its team is working relentlessly to protect its consumers.

"We are aware of this well-known phishing scheme and have added more measures to help mitigate this particular incidence," the company said. "Nevertheless, we advise clients to exercise constant vigilance online and to get in touch with Customer Service immediately if they believe they are a victim of a scam."

It's astonishing how well-adapted modern fraudsters are at using the very same technologies that financial institutions have long utilized to provide their consumers a sense of security while dealing online. 

Today's scamsters seem to be more interested in hacking your entire computer and online life with remote administration software than they are in stealing your PayPal password, which seems to be at the center of the majority of frauds these days.

Users are advised to follow the guidelines given below in order to safeguard themselves against the aforementioned scam. 
  • To prevent phishing emails from being sent to you, don't rely on email spam filters. Examine emails for warning signs, such as impending deadlines and scare tactics, to spot potential phishing frauds.
  • Use a recognized phone number or email address to get in touch with the service provider directly to confirm the validity of an invoice. To get in touch with the service provider, do not utilize the phone number or link provided in the invoice.
  • The simple notion that an email was delivered via a reputable website should not be used as proof of its validity. To make their schemes seem more credible, cybercriminals can exploit reliable websites.

Read more »
User Privacy
Data Breach Email Fraud Intuit Phishing Camapign SMB User Privacy

Users of Intuit QuickBooks Targeted in Phishing Scams

 

Intuit, a financial software business based in the US, has issued a warning to its clients about a new QuickBooks phishing effort. The current phishing campaign, which is the company's fifth big security threat this year, involves deceiving consumers into believing one‘s account has been suspended. 

"We're writing to advise you that we were unable to confirm certain information on your account after performing an assessment of your company. As a result, we've placed a temporary hold on your account." The phishing message goes as follows: "If you believe we've made a mistake, please let us know as soon as possible so we can correct it. Please fill out the verification form below to assist us with effectively revisiting your account. We will re-evaluate your account within 24-48 hours after verification is finished." 

Malicious material within the bogus Intuit support team message would send the target to a phishing website where criminals may steal personal data or install malware on infected devices if they clicked the "Complete Verification" button. The sender "is not linked with Intuit, is not an authorized agent of Intuit, nor is their use of Intuit's logos permitted by Intuit," according to the accounting software Intuit. Customers are advised not to open these phishing messages.

Small and medium-sized businesses (SMBs) all over the world utilize Intuit's QuickBooks software. According to the company's website, there are 4.5 million users globally. This year, cyber attackers have targeted the company's vast user base, particularly around tax season in the United States, when the corporation was compelled to release two separate security advisories in as many days in February. 

The email in both phishing scams pretended to be an account inactivity warning, suggesting that the user's account had been disabled due to inactivity. Victims were sent links to a bogus Intuit website, which could have been used to steal account information. 

It also advises consumers to delete the communications from email inboxes to avoid personal data being stolen and a possible malware infection. Customers who opened the email clicked a link, or downloaded a possibly harmful attachment should take the following precautions: 
  • Delete the downloaded attachment right away. 
  • Passwords should be changed regularly. 
  • Run a complete scan on the machine that may have been hacked. 
  • Intuit also offers a comprehensive list of security advice that can assist customers in avoiding common cyberattacks such as phishing emails, customer service scams, and identity theft.
Read more »
Microsoft Exchange Server
China CrowdStrike Email Fraud IISS Malicious Module malware Microsoft Exchange Server

On Microsoft Exchange Servers, a New IceApple Exploit Toolkit was Launched

 

Security analysts discovered a new post-exploitation framework that could enable Microsoft Exchange servers to be compromised. This framework, known as IceApple, was created by threat actors who wanted to preserve a low profile while launching long-term attacks to assist reconnaissance and data exfiltration. 

"As of May 2022, IceApple is under active development, with 18 modules seen in operation across several enterprise contexts," CrowdStrike reported. The complex virus was identified in various victim networks and in geographically separate areas, which were detected in late 2021. Victims come from a variety of fields, including technology, academia, and government.

IceApple is unique for being an in-memory framework, implying a threat actor's desire to keep a low forensic footprint and avoid detection, which bears all the signs of a long-term algorithmic mission by creating files that appear to come from Microsoft's IIS web server. While most of the malware has been found on Microsoft Exchange servers, IceApple can function under any Internet Information Services (IIS) web app, making it a dangerous threat.

IceApple activity, as per CrowdStrike researchers, could be linked to nation-state attacks. Although IceApple has not been linked to any single threat actor, many believe it was developed by China. 

The actual number of victims of the attack has not been determined by CrowdStrike, but they do not rule out the possibility that the threat will expand in the following weeks. In this regard, the experts suggested updating any apps used by public and commercial businesses to strengthen the system's protection against this framework. 

The malware can locate and erase files and directories, write data, collect credentials, search Active Directory, and transfer sensitive data due to the framework's various components. These components' build timestamps date back to May 2021.
Read more »
Spain
Arrests Email Fraud Frauds Fraudsters Hackers Mobile Security Scam Sim Hijacking SIM Swapping Attacks Spain

Spanish Police Arrested SIM Swappers who Stole Money from Victims Bank Accounts

 

The Spanish National Police have arrested eight suspected members of a criminal organisation who used SIM swapping assaults to steal money from the victims' bank accounts. 

SIM switching assaults are used by criminals to get control of victims' phone numbers by duping mobile operator workers into transferring their numbers to SIMs controlled by the fraudsters. The attackers can steal money, cryptocurrency, and personal information, including contacts linked with online accounts, once a SIM has been stolen. Criminals could take over social media accounts and utilise SMS to circumvent 2FA services utilized by online services, including financial services. 

In the incident under investigation by Spanish police, the cybercriminal gained the victims' personal information and bank details via fraudulent emails in which they pretended to be their bank. The fraudsters were able to falsify the victims' official documents and use them to dupe phone store staff into issuing them with replica SIM cards. They were able to overcome SMS-based 2FA needed to access bank accounts and take the money once they had the SIM cards. 

The press release published by the Spanish National Police stated, “Agents of the National Police have dismantled a criminal organization dedicated, presumably, to bank fraud through the duplication of SIM cards. There are eight detainees based in Catalonia and acting throughout Spain who, through malicious messages and posing as a bank, obtained personal information and bank details to access the accounts of the victims whose identity they usurped through the falsification of official documents. With this, they deceived the employees of phone stores to obtain duplicate SIM cards and, in this way, have access to the bank’s security confirmation messages. In this way they could operate in online banking and access bank accounts to empty them after receiving security confirmation messages from the banks.”

The first SIM swapping attack linked to this group occurred in March 2021, when Spanish authorities received two reports about fraudulent transactions in different parts of the country. Crooks used bank transfers and digital quick payment services based in the region of Barcelona to launder the stolen funds. Seven people were arrested in Barcelona and one in Seville as a byproduct of the operation. The suspects' bank accounts were also banned by the authorities. 

The FBI announced this week that SIM swap attacks have increased, with the objective of stealing millions of dollars from victims by hijacking their mobile phone numbers. According to the FBI, US individuals have lost more than $68 million as a result of SIM switching assaults in 2021, with the number of complaints and damages nearly doubling since 2018. The FBI's Internet Crime Complaint Center (IC3) received 1,611 SIM switching assault reports in 2018, compared to 320 complaints between 2018 and 2002, resulting in a total loss of $12 million. 

Individuals should take the following steps, as per the FBI: 

• Do not post details regarding financial assets, such as bitcoin ownership or investment, on social networking platforms or forums. 
• Do not disclose the mobile number account details to representatives who ask for the account password or pin over the phone. Verify the call by calling the mobile carrier's customer support number. • Posting personal information online, such as your phone number, address, or other identifying information, is not a good idea. 
• To access online accounts, use a variety of unique passwords. 
• Any changes in SMS-based connectivity should be noted. 
• To gain access to online accounts, use strong multi-factor authentication solutions such as biometrics, physical security tokens, or standalone authentication software. 
• For easy login on mobile device applications, do not save passwords, usernames, or other information. 

On the other hand, mobile providers should take the following safety measures, according to the FBI: 

• Employees should be instructed and training sessions on SIM swapping should be held. 
• Examine incoming email addresses containing formal correspondence for minor differences that could make fraudulent addresses appear real and match the names of actual clients. 
• Establish stringent security standards that allow workers to effectively check customer credentials before transferring their phone numbers to a new device.
Read more »
Subscribe to: Posts (Atom)