Search This Blog
Powered by Blogger.

Blog Archive

Labels

About Me

Load More
Trendy Right Now

Popular Posts

Showing posts with label data security. Show all posts
Remote Access Trojan
Data Breach data security Data Theft Fake Documents Fake PDF Info Stealer Malware Attack Malware Trojan Malwares Remote Access Trojan

Malware Hides in Fake PDF to DOCX Converters to Target Crypto Wallets and Steal Data

 

Cybercriminals have launched a deceptive malware campaign that disguises itself as online file converters, specifically targeting users searching for PDF to DOCX tools. This scheme uses convincing replicas of popular converter sites to execute hidden PowerShell scripts and deploy a Remote Access Trojan designed to steal sensitive data, including cryptocurrency wallets and browser credentials. 

Security researchers at CloudSEK investigated the threat following an FBI warning issued last month. They discovered that attackers are using a malware variant called Arechclient2, derived from the known info-stealing family SectopRAT. The campaign works by luring unsuspecting users to malicious websites that impersonate legitimate services like PDFCandy. These fake platforms feature realistic user interfaces, including loading indicators and CAPTCHA forms, to establish trust before delivering the malware. When a user attempts to convert a file, they are redirected multiple times before receiving a ZIP archive named “adobe.zip.” Inside the archive is the malicious payload, which installs the Arechclient2 Remote Access Trojan. 

This malware, active since 2019, is capable of scanning for browser-saved credentials, cryptocurrency wallet seed phrases, and even tapping into decentralized finance tools via Web3 APIs. Stephen Ajayi, Technical Lead at Hacken’s Dapp Audit division, explained that the malware not only lifts crypto wallet details but also enables attackers to “ghost-drain” assets after a transaction approval—making it especially dangerous for Web3 users. CloudSEK advises users to avoid downloading tools from unofficial or unverified sites, particularly free online file converters. Instead, they recommend trusted offline software or tools from official sources. 

They also warn that malicious files often disguise themselves using harmless-looking extensions, so users should inspect file types carefully and use reliable antivirus or endpoint detection software. Ajayi emphasized the importance of a proactive security mindset. “In cybersecurity, trust should be earned. Assume nothing is safe by default,” he said. He advised crypto users and general web users alike to adopt a zero-trust approach, keep their security tools updated, and monitor systems for unusual activity such as rogue msbuild.exe processes. 

As threats like these evolve, staying vigilant, maintaining strong security protocols, and preparing for worst-case scenarios are critical steps for avoiding compromise. Regular training and a well-tested incident response plan remain key defenses against such deceptive but damaging attacks.
Read more »
Ransomwares
Cyber Attacks cybercrime group cybercriminals data security Data Theft DOGE Dogecoin Elon Musk Ransom Demand Ransomware attack Ransomwares

Cybercriminals Behind DOGE Big Balls Ransomware Demand $1 Trillion, Troll Elon Musk

 

A cybercrime group notorious for its outrageous tactics has resurfaced with a ransomware attack demanding an unbelievable $1 trillion from its victims. The group, responsible for the DOGE Big Balls ransomware campaign, has updated its ransom demands with bizarre references to Elon Musk and the Dogecoin meme culture, blending humor with a highly dangerous threat.  

According to a report by Trend Micro researchers Nathaniel Morales and Sarah Pearl Camiling, the attackers are leveraging a modified form of the FOG ransomware to carry out these intrusions. The malware exploits a long-known Windows vulnerability (CVE-2015-2291) through a multi-step PowerShell script that allows deep access into infected systems. Delivered via deceptive shortcut files inside ZIP folders, the malware initiates a chain reaction to execute its payload. Though the ransom note may appear comical—mocking Musk’s past corporate directives and making false claims about stealing “trilatitude and trilongitude” coordinates—the security community warns against taking this threat lightly. 

The ransomware performs environment checks to avoid detection, analyzing machine specs, RAM, and registry entries to detect if it’s being run in a sandbox. If any signs of monitoring are detected, the malware will exit silently. The FBI, in its April 2025 Internet Crime Report, highlighted ransomware—particularly FOG variants—as a dominant threat, impacting critical infrastructure and organizations across the U.S. The report revealed over 100 known FOG ransomware infections between January and March 2025, making it the most reported strain of the year thus far. Beyond encryption, the malware also exfiltrates sensitive data and pressures victims to communicate via the Tor network for instructions. 

The attackers claim stolen files and urge victims not to involve law enforcement, adding a “don’t snitch now” line in their taunting ransom message. Despite its absurd tone, security leaders emphasize the seriousness of the attack. Dr. Ilia Kolochenko, CEO of ImmuniWeb, cautions that many victims discreetly pay ransoms to groups known for not leaking data—urging companies to seek legal and cybersecurity advice before making decisions. 

Although the group hides behind memes and internet jokes, their ability to cause significant operational and financial disruption is very real. Their humor might distract, but the threat demands urgent attention.
Read more »
Sandboxing
Cookies data security Google Google Chrome Google Chrome browser Google Chrome security Privacy Privacy Sandbox Sandboxing

Google Ends Privacy Sandbox, Keeps Third-Party Cookies in Chrome

 

Google has officially halted its years-long effort to eliminate third-party cookies from Chrome, marking the end of its once-ambitious Privacy Sandbox project. In a recent announcement, Anthony Chavez, VP of Privacy Sandbox, confirmed that the browser will continue offering users the choice to allow or block third-party cookies—abandoning its previous commitment to remove them entirely. 

Launched in 2020, Privacy Sandbox aimed to overhaul the way user data is collected and used for digital advertising. Instead of tracking individuals through cookies, Google proposed tools like the Topics API, which categorized users based on web behavior while promising stronger privacy protections. Despite this, critics claimed the project would ultimately serve Google’s interests more than users’ privacy or industry fairness. Privacy groups like the Electronic Frontier Foundation (EFF) warned users that the Sandbox still enabled behavioral tracking, and urged them to opt out. Meanwhile, regulators on both sides of the Atlantic scrutinized the initiative. 

In the UK, the Competition and Markets Authority (CMA) investigated the plan over concerns it would restrict competition by limiting how advertisers access user data. In the US, a federal judge recently ruled that Google engaged in deliberate anticompetitive conduct in the ad tech space—adding further pressure on the company. Originally intended to bring Chrome in line with browsers like Safari and Firefox, which block third-party cookies by default, the Sandbox effort repeatedly missed deadlines. In 2023, Google shifted its approach, saying users would be given the option to opt in rather than being automatically transitioned to the new system. Now, it appears the initiative has quietly folded. 

In his statement, Chavez acknowledged ongoing disagreements among advertisers, developers, regulators, and publishers about how to balance privacy with web functionality. As a result, Google will no longer introduce a standalone prompt to disable cookies and will instead continue with its current model of user control. The Movement for an Open Web (MOW), a vocal opponent of the Privacy Sandbox, described Google’s reversal as a victory. “This marks the end of their attempt to monopolize digital advertising by removing shared standards,” said MOW co-founder James Rosewell. “They’ve recognized the regulatory roadblocks are too great to continue.” 

With Privacy Sandbox effectively shelved, Chrome users will retain the ability to manage cookie preferences—but the web tracking status quo remains firmly in place.
Read more »
Mobile Cyber Attacks
Cyber Attacks Data Safety User Data data security Information Security Malware Attack Malwares Mobile Cyber Attacks

SK Telecom Malware Attack Exposes USIM Data in South Korea

 

SK Telecom, South Korea’s top mobile carrier, has disclosed a security incident involving a malware infection that exposed sensitive information tied to users’ Universal Subscriber Identity Modules (USIMs). The breach was detected on the night of April 19, 2025, during the weekend when many companies operate with reduced cybersecurity staffing. 

With nearly half of South Korea’s mobile market share and around 34 million subscribers, SK Telecom holds a crucial position in the country’s telecommunications sector. In an official statement, the company explained that malware had infiltrated parts of its network, prompting immediate action to contain the threat. 

The affected systems were isolated swiftly, and the malicious software was removed. So far, SK Telecom has stated there is no confirmed misuse of customer data linked to this breach. This was reported to the Korea Internet & Security Agency (KISA) on April 20, and to the Personal Information Protection Commission. 
Investigations are ongoing to determine how the attackers gained access and the extent of the data exposed. USIM cards store essential data such as International Mobile Subscriber Identity (IMSI) numbers, phone numbers (MSISDN), encryption keys for network authentication, and sometimes even stored contacts or text messages. Unauthorized access to this information could enable cybercriminals to conduct targeted surveillance, track users’ locations, or perform SIM-swapping attacks that could compromise online accounts and digital assets. 

In response, SK Telecom has strengthened security around USIM card management, increasing checks on SIM card replacement activities and monitoring authentication processes for suspicious behavior. Accounts showing irregular activities could face automatic suspension to prevent potential fraud. Additionally, the carrier is advising customers to activate their USIM protection service, a preventive measure that restricts unauthorized SIM swaps, adding extra protection to user accounts. 

A hacking group is yet to claim responsibility for the breach. SK Telecom emphasized that while the malware was neutralized quickly, they remain vigilant and are working closely with cybersecurity authorities to uncover more details about the intrusion and enhance future protections. 

This breach highlights ongoing risks faced by large mobile operators, especially during periods when cyber defenses might be less robust. It also underscores the critical need for mobile carriers to adopt continuous security monitoring and proactive measures to protect customer data from emerging threats. 

As investigations continue, SK Telecom has committed to updating customers and regulators about any new findings or developments related to the incident.
Read more »
Personal Information
data security device protection Device Security Information Security Mobile Security Password Privacy Personal Information

How to Protect Your Smartphone During US Border Crossings

 

Crossing into the United States has become riskier since the start of Trump’s second administration. Foreign visitors and US visa holders are increasingly being detained, questioned, or deported. As uncertainty grows, travel demand from Canada and Europe has dropped sharply. Regardless of why you are traveling, US Customs and Border Protection (CBP) has the authority to search phones and other electronic devices at the border. 

While other countries also inspect devices, the volatile US policies have led travelers and companies to reconsider what they carry. Canada has issued travel warnings, and journalists are advised to prepare for device searches. At the border, CBP can demand PINs or biometrics to unlock devices. US citizens and green card holders can refuse without being denied entry, although this may trigger additional questioning or device seizure. Visa holders and visitors, however, face detention or deportation if they refuse a search. Travelers must assess their own risk based on legal status, nationality, profession, and online activity. 

To minimize risk, disable facial recognition or fingerprint unlock before traveling and use only a PIN. Update your phone’s software to make it harder to crack. Carry a paper boarding pass and keep your phone off or out of sight when approaching agents. One strategy is to travel with a separate device, either by wiping an old phone or buying a new one. Build a limited digital footprint on the travel phone—use separate emails, social media accounts, and encrypted messaging apps like Signal. 

However, the device should not appear suspiciously clean; normal usage should be simulated to avoid drawing attention. Another option is to clean your primary phone before traveling by backing up and deleting sensitive data and unnecessary apps. After returning, you can restore your phone from backup. However, mistakes in this process can leave traces of personal information vulnerable during inspection. Even if you don’t make major changes, basic steps like deleting old apps, updating software, limiting social media use, and keeping important documents printed can protect your privacy. 

Experts warn that travelers should assume border agents may scrutinize online presence and past posts. As device searches become more common at US borders, preparing ahead of travel has become critical for safeguarding personal information.
Read more »
Ransomwares
Cyber Attacks Cyber Researchers Dark Web data security Interlock Interlock ransomware Malware Attack Ransomware attack Ransomwares

Interlock Ransomware Gang Deploys ClickFix Attacks to Breach Corporate Networks

 

Cybersecurity researchers have revealed that the Interlock ransomware gang has adopted a deceptive social engineering technique called ClickFix to infiltrate corporate networks. This method involves tricking users into executing malicious PowerShell commands under the guise of resolving system errors or completing identity verification steps, leading to the deployment of file-encrypting malware. 

While ClickFix attacks have previously been associated with ransomware campaigns, this marks the first confirmed use by Interlock, a ransomware operation that surfaced in late September 2024. The group targets both Windows systems and FreeBSD servers and maintains a dark web leak portal to pressure victims into paying ransoms that can reach millions of dollars. Interlock does not seem to operate as a ransomware-as-a-service (RaaS) model. 

According to Sekoia researchers, Interlock began using ClickFix tactics in January 2025. Attackers set up fake websites mimicking legitimate IT tools—such as Microsoft Teams and Advanced IP Scanner—to lure victims. These fake sites prompt users to click a “Fix it” button, which silently copies a malicious PowerShell script to the user’s clipboard. If run, the command downloads a 36MB PyInstaller payload that installs malware under the guise of a legitimate tool. 

Researchers found the malicious campaign hosted on spoofed domains like microsoft-msteams[.]com, microstteams[.]com, ecologilives[.]com, and advanceipscaner[.]com. Only the last domain led to the actual malware dropper disguised as Advanced IP Scanner. When users unknowingly run the script, a hidden PowerShell window executes actions such as system reconnaissance, persistence via Windows Registry, and data exfiltration. The attackers deploy a range of malware via command-and-control (C2) servers, including LummaStealer, BerserkStealer, keyloggers, and the Interlock RAT—a basic remote access trojan capable of dynamic configuration, file exfiltration, shell command execution, and DLL injection. 

Post-compromise, Interlock operators use stolen credentials to move laterally through networks via RDP, leveraging remote access tools like PuTTY, AnyDesk, and LogMeIn. Data is exfiltrated to Azure Blob Storage, after which the Windows variant of Interlock ransomware is scheduled to run daily at 8:00 PM—a redundancy tactic to ensure encryption if the initial payload fails. The gang’s ransom notes have also evolved, now placing emphasis on the legal and regulatory consequences of leaked data. 

ClickFix attacks are gaining popularity among various cybercriminal groups, with recent reports also linking them to North Korean state-sponsored actors like the Lazarus Group, who use similar tactics to target job seekers in the cryptocurrency sector.
Read more »
Ransomwares
cloud storage Cyber Attacks Cyber Researchers Data Backup Data protection data security Ransomware attack Ransomwares

Ransomware Attacks Surge in Q1 2025 as Immutable Backup Emerges as Critical Defense

Ransomware attacks have seen a dramatic rise in the first quarter of 2025, with new research from Object First revealing an 84% increase compared to the same period in 2024. This alarming trend highlights the growing sophistication and frequency of ransomware campaigns, with nearly two-thirds of organizations reporting at least one attack in the past two years. 

The findings suggest that ransomware is no longer a matter of “if” but “when” for most businesses. Despite the increased threat, Object First’s study offers a silver lining. A large majority—81% of IT decision-makers—now recognize that immutable backup storage is the most effective defense against ransomware. Immutable storage ensures that once data is written, it cannot be changed or deleted, offering a critical safety net when other security measures fail. This form of storage plays a key role in enabling organizations to recover their data without yielding to ransom demands. 

However, the report also highlights a concerning gap between awareness and action. While most IT professionals acknowledge the benefits of immutable backups, only 59% of organizations have actually implemented such storage. Additionally, just 58% maintain multiple copies of their data in separate locations, falling short of the recommended 3-2-1 backup strategy. This gap leaves many companies dangerously exposed. The report also shows that ransomware actors are evolving their methods. A staggering 96% of organizations that experienced ransomware attacks in the last two years had their backup systems targeted at least once. Even more concerning, 10% of them had their backup storage compromised in every incident. 

These findings demonstrate how attackers now routinely seek to destroy recovery options, increasing pressure on victims to pay ransoms. Many businesses still place heavy reliance on traditional IT security hardening. In fact, 61% of respondents believe this approach is sufficient. But ransomware attackers are adept at bypassing such defenses using phishing emails, stolen credentials, and remote access tools. That’s why Object First recommends adopting a “breach mentality”—an approach that assumes an eventual breach and focuses on limiting damage. 

A Zero Trust architecture, paired with immutable backup, is essential. Organizations are urged to segment networks, restrict user access to essential data only, and implement multi-factor authentication. As cloud services grow, many companies are also turning to immutable cloud storage for flexible, scalable protection. Together, these steps offer a stronger, more resilient defense against today’s aggressive ransomware landscape.
Read more »
sensitive user information
Data Breach Data Safety User Data data security Extortion GitLab Sensitive Information sensitive user information

Europcar GitLab Breach Exposes Sensitive User Data and Configuration Files

 

A cybersecurity breach allegedly targeting Europcar has brought attention to vulnerabilities in corporate development platforms. A threat actor operating under the alias “Europcar” recently claimed on an underground forum that they had gained unauthorized access to the car rental giant’s GitLab repository, leading to the extraction of thousands of sensitive files. The attacker reportedly obtained over 9,000 SQL files and at least 269 .ENV files, which are commonly used to store application configuration settings, API keys, and other sensitive operational data. 

The scale of the breach raised concerns about the potential exposure of customer and internal company information. Europcar later confirmed the breach to BleepingComputer, clarifying that only a limited portion of its GitLab repository was compromised, and not the entire system as initially claimed. The company stated it is currently assessing the scope of the intrusion and is in the process of notifying affected users. Initial findings suggest that customer names and email addresses from affiliated brands such as Goldcar and Ubeeqo, generated between 2017 and 2020, may have been exposed. Importantly, payment data was not compromised in this incident. 

The Europcar data breach is believed to have been part of an extortion attempt, although it remains unclear whether any ransom was paid. The method used to access Europcar’s GitLab remains under investigation, but cybersecurity experts suspect phishing or infostealer malware as the most likely attack vectors. Credential theft through malware or social engineering continues to be a leading cause of repository leaks across industries.  

GitLab, a widely used platform for code collaboration and storage, is frequently targeted by cybercriminals. Attackers often exploit its popularity by spoofing repositories or distributing malicious packages. Developers are advised to exercise caution by verifying repository sources, reading user feedback, and implementing multi-layered security protocols. The GitLab repository leak highlights the broader issue of digital supply chain vulnerabilities. 

When attackers gain access to development environments, the consequences can include compromised applications, internal data leaks, and reputational damage. This incident reinforces the importance of robust cybersecurity hygiene, particularly for companies managing user-sensitive platforms. As Europcar continues to investigate the breach and tighten security protocols, the incident serves as another reminder of the growing sophistication of cyberattacks and the urgent need for proactive security measures.
Read more »
Misinformation
AI Fraud AI Platform AI Scams AI technology AI tools Cyber Security data security Fake Documents Generative AI Identity Theft Misinformation

Generative AI Fuels Identity Theft, Aadhaar Card Fraud, and Misinformation in India

 

A disturbing trend is emerging in India’s digital landscape as generative AI tools are increasingly misused to forge identities and spread misinformation. One user, Piku, revealed that an AI platform generated a convincing Aadhaar card using only a name, birth date, and address—raising serious questions about data security. While AI models typically do not use real personal data, the near-perfect replication of government documents hints at training on real-world samples, possibly sourced from public leaks or open repositories. 

This AI-enabled fraud isn’t occurring in isolation. Criminals are combining fake document templates with authentic data collected from discarded paperwork, e-waste, and old printers. The resulting forged identities are realistic enough to pass basic checks, enabling SIM card fraud, bank scams, and more. What started as tools for entertainment and productivity now pose serious risks. Misinformation tactics are evolving too. 

A recent incident involving playback singer Shreya Ghoshal illustrated how scammers exploit public figures to push phishing links. These fake stories led users to malicious domains targeting them with investment scams under false brand names like Lovarionix Liquidity. Cyber intelligence experts traced these campaigns to websites built specifically for impersonation and data theft. The misuse of generative AI also extends into healthcare fraud. 

In a shocking case, a man impersonated renowned cardiologist Dr. N John Camm and performed unauthorized surgeries at a hospital in Madhya Pradesh. At least two patient deaths were confirmed between December 2024 and February 2025. Investigators believe the impersonator may have used manipulated or AI-generated credentials to gain credibility. Cybersecurity professionals are urging more vigilance. CertiK founder Ronghui Gu emphasizes that users must understand the risks of sharing biometric data, like facial images, with AI platforms. Without transparency, users cannot be sure how their data is used or whether it’s shared. He advises precautions such as using pseudonyms, secondary emails, and reading privacy policies carefully—especially on platforms not clearly compliant with regulations like GDPR or CCPA. 

A recent HiddenLayer report revealed that 77% of companies using AI have already suffered security breaches. This underscores the need for robust data protection as AI becomes more embedded in everyday processes. India now finds itself at the center of an escalating cybercrime wave powered by generative AI. What once seemed like harmless innovation now fuels identity theft, document forgery, and digital misinformation. The time for proactive regulation, corporate accountability, and public awareness is now—before this new age of AI-driven fraud becomes unmanageable.
Read more »
Personal Data
Dark Web Dark website Data Breach Data Brokers Data Leak data security DOGE Elon Musk ParkMobile Personal Data

Dark Web Site DogeQuest Targets Tesla Owners Using Data from ParkMobile Breach

 

A disturbing dark web website known as DogeQuest has surfaced, targeting Tesla owners and associates of Elon Musk by publishing their personal information. The data used on the site appears to have been sourced largely from a 2021 breach of the ParkMobile app, which affected over 21 million users. 

According to privacy research group ObscureIQ, 98.2% of the individuals listed on DogeQuest can be matched to victims of the ParkMobile hack. The site initially operated on the surface web but now functions under a .onion domain, which anonymizes its hosting and complicates takedown efforts by authorities. The purpose of DogeQuest is masked as an “artistic protest” platform, encouraging acts of vandalism against Tesla vehicles. 

Although the site claims neutrality by stating it does not endorse or condemn actions taken, it openly hosts names, home addresses, contact details, and even employment information of more than 1,700 individuals. These include not only Tesla drivers but also DOGE employees, their families, and high-profile individuals from the military, cybersecurity, and diplomatic sectors. The website’s presence has allegedly been linked to real-world vandalism, prompting federal investigations into its operations. 

ObscureIQ’s analysis reveals that the core data used by DogeQuest includes email addresses, phone numbers, and license plate details—information originally accessed through ParkMobile’s compromised Amazon Web Services cloud storage. While ParkMobile claimed at the time that no financial data was exposed, the combination of breached user data and information purchased from data brokers has been enough to target individuals effectively. 

A class-action lawsuit against ParkMobile later resulted in a $32 million settlement for failing to secure user data. Despite the gravity of the situation, no other public reporting had directly connected DogeQuest to the ParkMobile breach until ObscureIQ’s findings were shared. The doxxing platform has evolved into a larger campaign, now also publishing details of prominent federal employees and private sector figures. A spreadsheet reviewed by the Daily Caller News Foundation highlights how widespread and strategic the targeting has become, with individuals from sensitive fields like defense contracting and public health policy among the victims. 

Law enforcement agencies, including the FBI and DOJ, are now actively investigating both the digital and physical components of this campaign. Just last week, the Department of Justice charged three individuals suspected of attacking Tesla vehicles and infrastructure across multiple states. However, officials have not yet confirmed a direct link between these suspects and DogeQuest. The FBI has also noted a troubling increase in swatting incidents aimed at DOGE staff and affiliates, indicating that the site’s influence may extend beyond digital harassment into coordinated real-world disruptions. 

With DogeQuest continuing to evade takedown attempts due to its anonymized hosting, federal authorities face an uphill battle in curbing the campaign. ParkMobile has so far declined to comment on the matter. As the scope and sophistication of this doxxing effort grow, it underscores the lingering impact of data breaches and the increasing challenges in protecting personal information in the digital age.
Read more »
Malicious Devices
Connected Devices Cyber Security data security Device Security hardware vulnerabilities Laptops Malicious Devices

What Are USB Kill Sticks and How They Can Destroy Your Devices

 

Most people think of USB drives as simple tools for storing and transferring files. But not all USB sticks are as harmless as they appear. Some, known as “USB Kill Sticks” or “USB Killers,” are specifically designed to damage or destroy electronic devices within seconds of being plugged in. These malicious devices work by rapidly charging and discharging internal capacitors, sending high-voltage surges into the host device’s USB ports. 

The result? Severe hardware damage, often irreversible. A notable case in 2019 involved a man who used a USB Killer to destroy 66 computers at a college in New York, causing over $58,000 in damages. USB Killers can affect nearly any device with a USB port—laptops, smartphones, TVs, game consoles, and more. Some systems may suffer total failure, while others, like the MacBook Air M2, may only have their ports rendered inoperative. Originally developed by a security team in Hong Kong for testing device durability, USB Kill Sticks are now sold commercially. 

The most recent version, USB Kill v4, starts at $59. A more advanced “Kit” version includes adapters for compatibility with smartphones, printers, routers, and other electronics. What makes version 4 especially dangerous is its built-in battery. This allows it to deliver a destructive surge even if the target device is turned off, effectively bypassing USB-C and Lightning port security systems. Some models can be triggered remotely or on a timed schedule, making it incredibly difficult to trace the source of an attack. 

Though these tools were initially intended for testing and security purposes by manufacturers and law enforcement, their public availability raises serious concerns. In the wrong hands, they become tools of sabotage and theft. Defending against USB Killers isn’t easy. Even disabling USB ports in software won’t prevent voltage surges. The best strategy is to avoid plugging in unknown USB devices entirely. 

For added protection, you can physically block USB ports or invest in a USB Kill Shield, which costs around $25. This shield allows normal data flow while detecting and preventing surge attacks. Always be cautious with unfamiliar USB devices—what looks like a regular flash drive might be a silent destroyer in disguise.
Read more »
HDMI
AI Models AI Security Cyber Security data security Device Hack Device Security Hacker attack Hackers HDMI

Hackers Can Spy on Screens Using HDMI Radiation and AI Models

 

You may feel safe behind your screen, but it turns out that privacy might be more of an illusion than a fact. New research reveals that hackers have found an alarming way to peek at what’s happening on your display—without ever touching your computer. By tapping into the faint electromagnetic radiation that HDMI cables emit, they can now “listen in” on your screen and reconstruct what’s being shown with startling accuracy. 

Here’s how it works: when digital signals travel through HDMI cables from your computer to a monitor, they unintentionally give off tiny bursts of radiation. These signals, invisible to the naked eye, can be picked up using radio antennas or small, discreet devices planted nearby. Once captured, advanced AI tools get to work, decoding the radiation into readable screen content. 

The results? Up to 70% accuracy in reconstructing text—meaning everything from passwords and emails to private messages could be exposed. This new technique represents a serious leap in digital espionage. It doesn’t rely on malware or breaking into a network. Instead, it simply listens to the electronic “whispers” your hardware makes. It’s silent, stealthy, and completely undetectable to the average user. 

Worryingly, this method is already reportedly in use against high-profile targets like government agencies and critical infrastructure sites. These organizations often store and manage sensitive data that, if leaked, could cause major damage. While some have implemented shielding to block these emissions, not all are fully protected. And because this form of surveillance leaves virtually no trace, many attacks could be flying under the radar entirely. 

Hackers can go about this in two main ways: one, by sneaking a signal-collecting device into a location; or two, by using specialized antennas from nearby—like the building next door. Either way, they can eavesdrop on what’s displayed without ever getting physically close to the device. This new threat underscores the need for stronger physical and digital protections. 

As cyberattacks become more innovative, simply securing your data with passwords and firewalls isn’t enough. Shielding cables and securing workspaces might soon be as important as having good antivirus software. The digital age has brought us many conveniences—but with it comes a new breed of invisible spies.
Read more »
Employee Data
Australia Australian Businesses Cybersecurity Researchers Data Breach Data Leak data security Database Leaked Database Security Employee Data

Sydney Tools Data Leak Exposes Millions of Customer and Employee Records

 

A major data leak from Sydney Tools, an Australian retailer specializing in power tools, hand tools, and industrial equipment, has potentially exposed the personal information of millions of customers and employees. The breach, discovered by cybersecurity researchers at Cybernews, involved an unprotected Clickhouse database that remained publicly accessible online, allowing unauthorized individuals to view sensitive data.  

According to the report, the database contained more than 5,000 records related to Sydney Tools employees, including both current and former staff. These records included full names, branch locations, salary details, and sales targets. Given that Sydney Tools reportedly employs around 1,000 people, a large portion of the exposed records likely belong to individuals who no longer work for the company. While no banking details were included in the leak, the exposure of employee information still poses a significant security risk. 

Cybercriminals could use these details to craft convincing phishing scams or for identity theft. Beyond employee data, the breach also exposed an even larger volume of customer information. The database reportedly contained over 34 million online purchase records, revealing customer names, email addresses, phone numbers, home addresses, and details of purchased items. The exposure of this information is particularly concerning, as it not only compromises privacy but also increases the risk of targeted scams. 

Customers who purchased expensive tools and equipment may be especially vulnerable to fraud or burglary attempts. Cybernews researchers have expressed serious concerns over the extent of the breach, highlighting that the database includes a mix of personally identifiable information (PII) and financial details. This kind of information is highly valuable to cybercriminals, who can exploit it for various fraudulent activities. The researchers attempted to notify Sydney Tools about the security lapse, urging them to secure the exposed database. 

However, as of their last update, the data reportedly remained accessible, raising further concerns about the company’s response to the issue. This incident underscores the ongoing risks posed by unprotected databases, which continue to be one of the leading causes of data breaches. Companies handling large volumes of customer and employee information must prioritize data security by implementing robust protection measures, such as encryption, multi-factor authentication, and regular security audits. Failing to do so not only puts individuals at risk but also exposes businesses to legal and reputational damage. 

With cybersecurity threats on the rise, organizations must remain vigilant in safeguarding sensitive information. Until Sydney Tools secures the database and provides assurances about how it will handle data protection in the future, customers and employees should remain cautious and monitor their accounts for any suspicious activity.
Read more »
Data Theft
AT&T cloud storage services CyberCrime cybercriminal arrests Data Breach Data Hackers data security Data Theft

Connor Moucka Extradited to U.S. for Snowflake Data Breaches Targeting 165 Companies

 

Connor Moucka, a Canadian citizen accused of orchestrating large-scale data breaches affecting 165 companies using Snowflake’s cloud storage services, has agreed to be extradited to the United States to face multiple federal charges. The breaches, which targeted high-profile companies like AT&T and Ticketmaster, resulted in the exposure of hundreds of millions of sensitive records. 

Moucka, also known by online aliases such as “Waifu,” “Judische,” and “Ellyel8,” was arrested in Kitchener, Ontario, on October 30, 2024, at the request of U.S. authorities. Last Friday, he signed a written agreement before the Superior Court of Justice in Kitchener, consenting to his extradition without the standard 30-day waiting period. The 26-year-old faces 20 charges in the U.S., including conspiracy to commit computer fraud, unauthorized access to protected systems, wire fraud, and aggravated identity theft. Prosecutors allege that Moucka, along with co-conspirator John Binns, extorted over $2.5 million from victims by stealing and threatening to expose their sensitive information. 

The data breaches tied to this cybercrime operation have had widespread consequences. In May 2024, Ticketmaster’s parent company, Live Nation, confirmed that data from 560 million users had been compromised and put up for sale on hacking forums. Other companies affected include Santander Bank, Advance Auto Parts, and AT&T, among others. Moucka and Binns are believed to be linked to “The Com,” a cybercriminal network involved in various illicit activities, including cyber fraud, extortion, and violent crimes. 

Another alleged associate, Cameron Wagenius, a 21-year-old U.S. Army soldier, was arrested in December for attempting to sell stolen classified information to foreign intelligence agencies. Wagenius has since indicated his intent to plead guilty. U.S. prosecutors claim Moucka and his associates launched a series of cyberattacks on Snowflake customers, gaining unauthorized access to corporate environments and exfiltrating confidential data. 
These breaches, described as among the most extensive cyberattacks in recent history, compromised sensitive 
records from numerous enterprises. While the exact date of Moucka’s extradition remains undisclosed, his case underscores the growing threat of cyber extortion and the increasing international cooperation in tackling cybercrime. His legal representatives have not yet issued a statement regarding the extradition or upcoming trial proceedings.
Read more »
Malwares
Arcane Cyber Attacks Data Safety User Data data security Data Stealer Discord Infostealer Infostealer Malware Kaspersky Malwares

Arcane Malware Steals VPN, Gaming, and Messaging Credentials in New Cyber Threat

 

A newly identified malware strain, Arcane, is making headlines for its ability to steal a vast range of user data. This malicious software infiltrates systems to extract sensitive credentials from VPN services, gaming platforms, messaging apps, and web browsers. Since its emergence in late 2024, Arcane has undergone several modifications, increasing its effectiveness and expanding its reach. 

Unlike other cyber threats with long-established histories, Arcane is not linked to previous malware versions carrying a similar name. Analysts at Kaspersky have observed that the malware primarily affects users in Russia, Belarus, and Kazakhstan. This is an unusual pattern, as many Russian-based cybercriminal groups tend to avoid targeting their home region to steer clear of legal consequences. 

Additionally, communications linked to Arcane’s operators suggest that they are Russian-speaking, reinforcing its likely origin. The malware spreads through deceptive content on YouTube, where cybercriminals post videos promoting game cheats and cracked software. Viewers are enticed into downloading files that appear legitimate but contain hidden malware. Once opened, these files initiate a process that installs Arcane while simultaneously bypassing Windows security settings. 

This allows the malware to operate undetected, giving hackers access to private information. Prior to Arcane, the same group used a different infostealer known as VGS, a modified version of an older trojan. However, since November 2024, they have shifted to distributing Arcane, incorporating a new tool called ArcanaLoader. This fake installer claims to provide free access to premium game software but instead delivers the malware. 

It has been heavily marketed on YouTube and Discord, with its creators even offering financial incentives to content creators for promoting it. Arcane stands out because of its ability to extract detailed system data and compromise various applications. It collects hardware specifications, scans installed software, and retrieves login credentials from VPN clients, communication platforms, email services, gaming accounts, and cryptocurrency wallets. Additionally, the malware captures screenshots, which can expose confidential information visible on the victim’s screen. 

Though Arcane is currently targeting specific regions, its rapid evolution suggests it could soon expand to a broader audience. Cybersecurity experts warn that malware of this nature can lead to financial theft, identity fraud, and further cyberattacks. Once infected, victims must reset all passwords, secure compromised accounts, and ensure their systems are thoroughly cleaned. 

To reduce the risk of infection, users are advised to be cautious when downloading third-party software, especially from unverified sources. Game cheats and pirated programs often serve as delivery methods for malicious software, making them a significant security threat. Avoiding these downloads altogether is the safest approach to protecting personal information.
Read more »
Malwares
Cyber Attacks cybercriminals data security Data Theft Hackers Infostealer Infostealer Malware Malware attacks Malwares

The Growing Threat of Infostealer Malware: What You Need to Know

 

Infostealer malware is becoming one of the most alarming cybersecurity threats, silently stealing sensitive data from individuals and organizations. This type of malware operates stealthily, often going undetected for long periods while extracting valuable information such as login credentials, financial details, and personal data. As cybercriminals refine their tactics, infostealer attacks have become more frequent and sophisticated, making it crucial for users to stay informed and take preventive measures. 

A significant reason for concern is the sheer scale of data theft caused by infostealers. In 2024 alone, security firm KELA reported that infostealer malware was responsible for leaking 3.9 billion passwords and infecting over 4.3 million devices worldwide. Similarly, Huntress’ 2025 Cyber Threat Report revealed that these threats accounted for 25% of all cyberattacks in the previous year. This data highlights the growing reliance of cybercriminals on infostealers as an effective method of gathering personal and corporate information for financial gain. 

Infostealers operate by quietly collecting various forms of sensitive data. This includes login credentials, browser cookies, email conversations, banking details, and even clipboard content. Some variants incorporate keylogging capabilities to capture every keystroke a victim types, while others take screenshots or exfiltrate files. Cybercriminals often use the stolen data for identity theft, unauthorized financial transactions, and large-scale corporate breaches. Because these attacks do not immediately disrupt a victim’s system, they are harder to detect, allowing attackers to extract vast amounts of information over time. Hackers distribute infostealer malware through multiple channels, making it a widespread threat. 

Phishing emails remain one of the most common methods, tricking victims into downloading infected attachments or clicking malicious links. However, attackers also embed infostealers in pirated software, fake browser extensions, and even legitimate platforms. For example, in February 2025, a game called PirateFi was uploaded to Steam and later found to contain infostealer malware, compromising hundreds of devices before it was removed. Social media platforms, such as YouTube and LinkedIn, are also being exploited to spread malicious files disguised as helpful tools or software updates. 

Beyond stealing data, infostealers serve as an entry point for larger cyberattacks. Hackers often use stolen credentials to gain unauthorized access to corporate networks, paving the way for ransomware attacks, espionage, and large-scale financial fraud. Once inside a system, attackers can escalate their access, install additional malware, and compromise more critical assets. This makes infostealer infections not just an individual threat but a major risk to businesses and entire industries.  

The prevalence of infostealer malware is expected to grow, with attackers leveraging AI to improve phishing campaigns and developing more advanced evasion techniques. According to Check Point’s 2025 Cybersecurity Report, infostealer infections surged by 58% globally, with Europe, the Middle East, and Africa experiencing some of the highest increases. The SYS01 InfoStealer campaign, for instance, impacted millions across multiple continents, showing how widespread the issue has become. 

To mitigate the risks of infostealer malware, individuals and organizations must adopt strong security practices. This includes using reliable antivirus software, enabling multi-factor authentication (MFA), and avoiding downloads from untrusted sources. Regularly updating software and monitoring network activity can also help detect and prevent infections. Given the growing threat, cybersecurity awareness and proactive defense strategies are more important than ever.
Read more »
North Korean
Android App Safety Android Apps Android Spyware data security Fake Apps Google Play Google Play fake apps Mobile Security North Korean

North Korean Spyware Disguised as Android Apps Found on Google Play

 

Researchers have discovered at least five Android apps on Google Play that secretly function as spyware for the North Korean government. Despite passing Google Play’s security checks, these apps collect personal data from users without their knowledge. The malware, dubbed KoSpy by security firm Lookout, is embedded in utility apps that claim to assist with file management, software updates, and even device security. 

However, instead of providing real benefits, these apps function as surveillance tools, gathering a range of sensitive information. KoSpy-infected apps can collect SMS messages, call logs, location data, files, nearby audio, keystrokes, Wi-Fi details, and installed apps. Additionally, they can take screenshots and record users’ screens, potentially exposing private conversations, banking credentials, and other confidential data. All collected information is sent to servers controlled by North Korean intelligence operatives, raising serious cybersecurity concerns. 

Lookout researchers believe with “medium confidence” that two well-known North Korean advanced persistent threat (APT) groups, APT37 (ScarCruft) and APT43 (Kimsuki), are behind these spyware apps. These groups are known for conducting cyber espionage and targeting individuals in South Korea, the United States, and other countries. The malicious apps have been found in at least two app stores, including Google Play and Apkpure. The affected apps include 휴대폰 관리자 (Phone Manager), File Manager, 스마트 관리자 (Smart Manager), 카카오 보안 (Kakao Security), and Software Update Utility. 

On the surface, these apps appear legitimate, making it difficult for users to identify them as threats. According to Ars Technica, the developer email addresses are standard Gmail accounts, and the privacy policies are hosted on Blogspot, which does not raise immediate suspicions. However, a deeper analysis of the IP addresses linked to these apps reveals connections to North Korean intelligence operations dating back to 2019. These command-and-control servers have been used for previous cyberespionage campaigns. 

Google responded to the findings by stating that the “most recent app sample” was removed from Google Play before any users could download it. While this is reassuring, it highlights the ongoing risk of malicious apps bypassing security measures. Google also emphasized that its Play Protect service can detect certain malicious apps when installed, regardless of the source.  

This case serves as another reminder of the risks associated with installing apps, even from official sources like Google Play. Users should always scrutinize app permissions and avoid installing unnecessary applications. A file manager, for example, should not require access to location data. By staying cautious and using reputable security tools, Android users can better protect their personal information from spyware threats.
Read more »
Privacy
Data Brokers Data collection Data Mining Data Privacy Data Removal data security Online Privacy Privacy

How Data Removal Services Protect Your Online Privacy from Brokers

 

Data removal services play a crucial role in safeguarding online privacy by helping individuals remove their personal information from data brokers and people-finding websites. Every time users browse the internet, enter personal details on websites, or use search engines, they leave behind a digital footprint. This data is often collected by aggregators and sold to third parties, including marketing firms, advertisers, and even organizations with malicious intent. With data collection becoming a billion-dollar industry, the need for effective data removal services has never been more urgent. 

Many people are unaware of how much information is available about them online. A simple Google search may reveal social media profiles, public records, and forum posts, but this is just the surface. Data brokers go even further, gathering information from browsing history, purchase records, loyalty programs, and public documents such as birth and marriage certificates. This data is then packaged and sold to interested buyers, creating a detailed digital profile of individuals without their explicit consent. 

Data removal services work by identifying where a person’s data is stored, sending removal requests to brokers, and ensuring that information is deleted from their records. These services automate the process, saving users the time and effort required to manually request data removal from hundreds of sources. Some of the most well-known data removal services include Incogni, Aura, Kanary, and DeleteMe. While each service may have a slightly different approach, they generally follow a similar process. Users provide their personal details, such as name, email, and address, to the data removal service. 

The service then scans databases of data brokers and people-finder sites to locate where personal information is being stored. Automated removal requests are sent to these brokers, requesting the deletion of personal data. While some brokers comply with these requests quickly, others may take longer or resist removal efforts. A reliable data removal service provides transparency about the process and expected timelines, ensuring users understand how their information is being handled. Data brokers profit immensely from selling personal data, with the industry estimated to be worth over $400 billion. 

Major players like Experian, Equifax, and Acxiom collect a wide range of information, including addresses, birth dates, family status, hobbies, occupations, and even social security numbers. People-finding services, such as BeenVerified and Truthfinder, operate similarly by aggregating publicly available data and making it easily accessible for a fee. Unfortunately, this information can also fall into the hands of bad actors who use it for identity theft, fraud, or online stalking. 

For individuals concerned about privacy, data removal services offer a proactive way to reclaim control over personal information. Journalists, victims of stalking or abuse, and professionals in sensitive industries particularly benefit from these services. However, in an age where data collection is a persistent and lucrative business, staying vigilant and using trusted privacy tools is essential for maintaining online anonymity.
Read more »
enterprise cybersecurity
AI Chatbots AI Risks AI technology Chatbots ChatGPT. OpenAI Cyber Security data security DeepSeek enterprise cybersecurity

DeepSeek AI: Benefits, Risks, and Security Concerns for Businesses

 

DeepSeek, an AI chatbot developed by China-based High-Flyer, has gained rapid popularity due to its affordability and advanced natural language processing capabilities. Marketed as a cost-effective alternative to OpenAI’s ChatGPT, DeepSeek has been widely adopted by businesses looking for AI-driven insights. 

However, cybersecurity experts have raised serious concerns over its potential security risks, warning that the platform may expose sensitive corporate data to unauthorized surveillance. Reports suggest that DeepSeek’s code contains embedded links to China Mobile’s CMPassport.com, a registry controlled by the Chinese government. This discovery has sparked fears that businesses using DeepSeek may unknowingly be transferring sensitive intellectual property, financial records, and client communications to external entities. 

Investigative findings have drawn parallels between DeepSeek and TikTok, the latter having faced a U.S. federal ban over concerns regarding Chinese government access to user data. Unlike TikTok, however, security analysts claim to have found direct evidence of DeepSeek’s potential backdoor access, raising further alarms among cybersecurity professionals. Cybersecurity expert Ivan Tsarynny warns that DeepSeek’s digital fingerprinting capabilities could allow it to track users’ web activity even after they close the app. 

This means companies may be exposing not just individual employee data but also internal business strategies and confidential documents. While AI-driven tools like DeepSeek offer substantial productivity gains, business leaders must weigh these benefits against potential security vulnerabilities. A complete ban on DeepSeek may not be the most practical solution, as employees often adopt new AI tools before leadership can fully assess their risks. Instead, organizations should take a strategic approach to AI integration by implementing governance policies that define approved AI tools and security measures. 

Restricting DeepSeek’s usage to non-sensitive tasks such as content brainstorming or customer support automation can help mitigate data security concerns. Enterprises should prioritize the use of vetted AI solutions with stronger security frameworks. Platforms like OpenAI’s ChatGPT Enterprise, Microsoft Copilot, and Claude AI offer greater transparency and data protection. IT teams should conduct regular software audits to monitor unauthorized AI use and implement access restrictions where necessary. 

Employee education on AI risks and cybersecurity threats will also be crucial in ensuring compliance with corporate security policies. As AI technology continues to evolve, so do the challenges surrounding data privacy. Business leaders must remain proactive in evaluating emerging AI tools, balancing innovation with security to protect corporate data from potential exploitation.
Read more »
Sensitive Data Leak
Cyber Attacks Data Leak data security Data Theft IT Systems Ransomware attack Ransomware group Ransomwares Sensitive Data Leak

Tata Technologies Cyberattack: Hunters International Ransomware Gang Claims Responsibility for 1.4TB Data Theft

 

Hunters International, a ransomware group known for high-profile cyberattacks, has claimed responsibility for a January 2025 cyberattack on Tata Technologies. The group alleges it stole 1.4TB of sensitive data from the company and has issued a threat to release the stolen files if its ransom demands are not met. Tata Technologies, a Pune-based global provider of engineering and digital solutions, reported the cyberattack in January. 

The company, which operates in 27 countries with over 12,500 employees, offers services across the automotive, aerospace, and industrial sectors. At the time of the breach, Tata Technologies confirmed that the attack had caused disruptions to certain IT systems but stated that client delivery services remained unaffected. The company also assured stakeholders that it was actively restoring impacted systems and conducting an internal investigation with cybersecurity experts. 

However, more than a month later, Hunters International listed Tata Technologies on its dark web extortion page, taking responsibility for the attack. The group claims to have exfiltrated 730,000 files, totaling 1.4TB of data. While the ransomware gang has threatened to publish the stolen files within a week if a ransom is not paid, it has not provided any samples or disclosed the nature of the compromised documents. Tata Technologies has yet to release an update regarding the breach or respond to the hackers’ claims. 

BleepingComputer, a cybersecurity news platform, attempted to contact the company for a statement but did not receive an immediate response. Hunters International emerged in late 2023, suspected to be a rebranded version of the Hive ransomware group. Since then, it has carried out multiple high-profile attacks, including breaches of Austal USA, a U.S. Navy contractor, and Japanese optics company Hoya. 

The group has gained notoriety for targeting various organizations without ethical restraint, even engaging in extortion schemes against individuals, such as cancer patients from Fred Hutchinson Cancer Center. Although many of the gang’s claims have been verified, some remain disputed. For example, in August 2024, the U.S. Marshals Service denied that its systems had been compromised, despite Hunters International’s assertions.  

With cybercriminals continuing to exploit vulnerabilities, the Tata Technologies breach serves as another reminder of the persistent and evolving threats posed by ransomware groups.
Read more »
Subscribe to: Posts (Atom)