News

A bizarre six-word Google search term has been identified by cybersecurity experts as a potential risk for users, leaving them vulnerable to hackers. The search term “Are Bengal cats legal in Australia” has been hijacked by cybercriminals to create fake websites that can download malicious software, known as malware, onto users’ computers. This malware can steal personal data, financial details, and login credentials, and even give hackers remote access to the infected device.

Cybersecurity researcher Sean Gallagher from Sophos, a British cybersecurity company, explained that hackers exploit niche search terms with fewer search results by creating fake websites that appear to answer the question. These websites are used for malicious purposes. The technique, known as “SEO poisoning,” has been around since 2020 but has seen continued growth in recent years.

Hackers have also targeted popular software searches, such as Blender 3D, Photoshop, and financial trading tools, to infect users’ computers. To stay safe, users should be cautious when clicking on search results, check web addresses for misspellings or unusual names, and beware of unexpected downloads or requests for sensitive information. Keeping browsers and operating systems up to date is also essential.

Citation: Bradley Jolly, “Bizarre six-word Google search term which leaves you open to hackers is revealed,” Mirror

The Growing Threat of Quishing

QR codes have become an integral part of our mobile lives, offering quick access to websites, apps, and services. However, cybercriminals are exploiting this convenience with a new phishing technique called quishing. By creating fake QR codes that look legitimate, attackers can redirect users to malicious sites, install malware, or request sensitive device permissions. Anyone can generate QR codes, making it difficult to identify the real from the fake.

Who is at Risk?

Quishing targets a range of individuals, including the older people, online shoppers, job seekers, business executives, and those using public establishments like restaurants and coffee shops. These attacks have increased as QR codes have become more widespread, especially during the COVID-19 pandemic. To avoid falling victim, inspect QR codes for tampering, verify URLs before scanning, be cautious of unsolicited requests, and keep NFC turned off when not in use. Staying vigilant and following these guidelines can protect you from quishing schemes.

How Quishing Works

The Federal Trade Commission (FTC) has reported a rising trend in quishing attacks, where scammers use seemingly legitimate QR codes to send users to malicious websites and applications. These attacks are highly effective due to the impulsivity associated with scanning QR codes for convenience, the ease of code generation, and the anonymity they provide. Criminals can print out fake codes and paste them over legitimate ones to make them appear credible. Many people don’t think twice about scanning these codes and accept security bypass prompts to access applications or services.

Staying Protected

To stay protected, think before scanning a new code, especially if it requires access to device permissions. Look for physical signs of tampering, such as pixelation or misalignment, and inspect URLs before using them. Be wary of unsolicited QR code requests and keep NFC off when not in use. By being cautious and following these strategies, you can avoid becoming a quishing victim.

A recent data breach at Texas-based insurance administrative services company Landmark Admin has left nearly 68,000 Texans and over 800,000 individuals across the United States vulnerable to potential identity theft and financial harm. The breach, which occurred on May 13, 2024, was only discovered on October 23, 2024, and involved the unauthorized access and potential theft of sensitive personal information, including names, addresses, social security numbers, identification numbers, financial data such as credit or debit card numbers, and medical and health insurance details.

Upon discovering the incident, Landmark Admin took swift action to contain the breach by disconnecting the affected systems and engaging a specialized third-party cybersecurity firm to conduct a comprehensive forensic investigation. However, the investigation revealed that the unauthorized actor re-gained access to the company’s network on June 17, 2024, further complicating the situation. The investigation ultimately concluded on July 24, 2024, but the damage may already have been done.

As a third-party administrator for several insurance carriers, including Dallas-based Liberty Bankers Insurance Group, Landmark received personal data from a wide range of parties, including producers, policy owners, insured individuals, beneficiaries, and payors. This broad scope of data collection increases the potential impact of the breach and the risk of identity theft and financial fraud.

To mitigate the consequences of the breach, Landmark Admin is offering affected individuals credit monitoring and identity theft protection services, as well as a $1 million insurance reimbursement policy and identity theft recovery services. While these measures are a step in the right direction, they may not be enough to fully protect those whose sensitive information has been compromised.

The breach serves as a stark reminder of the importance of robust cybersecurity measures in the insurance industry, where personal data is often collected and stored. It also highlights the need for timely and transparent communication in the event of a breach, as Landmark Admin only recently notified those affected. As the investigation continues, it remains to be seen whether the company will face any regulatory action or legal consequences for the delay in disclosure.

In the meantime, those impacted by the breach should take proactive steps to monitor their financial accounts and credit reports closely and consider placing a fraud alert on their credit files. It is also crucial to be vigilant for any suspicious activity and report it immediately to the relevant authorities.

Citation: Rachel Snyder, “Massive data breach at Texas-based insurance servicer affects 800,000, filings show,”, 2024, https://www.wfaa.com/article/news/local/texas/data-breach-at-landmark-admin-texas-based-insurance-servicer-affects-800000/287-28adfbf9-3b19-4445-9cad-40d694002cb5

Cybersecurity researchers have identified an ongoing malvertising campaign exploiting Meta’s advertising platform to distribute SYS01stealer malware. This campaign hijacks Facebook accounts to steal login credentials, browsing history, and cookies, primarily targeting Facebook ads and business account data.

Using nearly 100 malicious domains for distribution and live command and control operations, the threat actors manage the attack in real-time and leverage trusted brands to expand their reach. Each compromised account serves to promote more malicious ads without needing new accounts.

The primary distribution method is malvertising across platforms like Facebook, YouTube, and LinkedIn, featuring ads for Windows themes, games, and other software. Most ads target men aged 45 and above, redirecting users to deceptive sites that initiate malware infection through a ZIP archive containing a benign executable that sideloads a malicious DLL.

This setup includes running PowerShell commands to avoid detection and manipulating security settings. The malware includes sandbox detection capabilities, making it harder to identify. What’s more, adaptations to the malware occur regularly to bypass security measures. This underscores the need for continuous vigilance and adaptation in the face of evolving threats.

Additionally, Perception Point reported phishing campaigns abusing the Eventbrite platform to steal financial information. These campaigns used manipulated emails that prompt users to pay bills or confirm package deliveries.

Threat hunters also note a significant rise in cryptocurrency fraud. Scammers are now impersonating reputable organizations to lure individuals with false job offers. Victims often end up investing more money as they attempt to reclaim losses from their fictitious commissions, reflecting tactics associated with pig butchering in cryptocurrency scams. This highlights the growing threat of cryptocurrency fraud and the need for increased awareness and caution.

Citation: Lakshmanan, R. Malvertising Campaign Hijacks Facebook Accounts to Spread SYS01stealer Malware. The Hacker News. https://thehackernews.com/2024/10/malvertising-campaign-hijacks-facebook.html

In the digital world, our online presence is an integral part of daily life. With every click, login, and piece of information shared, we build a digital footprint that demands constant protection from cyber threats. Two Google experts, Sriram Karra and Christiaan Brand, share common online security oversights and offer practical solutions to help you safeguard your digital life.

Step 1: Use Unique Passwords Reusing passwords across platforms can create a domino effect, compromising your accounts if one is breached. Sriram Karra, senior product manager of sign-in security, suggests using Google Password Manager to generate and store strong, unique passwords. This ensures your Google account remains secure, even if another platform is compromised. You can also leverage passkeys for a convenient, password-free sign-in experience.

Step 2: Prioritize Software Updates Regularly updating your devices’ software is crucial for maintaining a secure digital life. Christiaan Brand, group product manager of identity, emphasizes that timely updates provide essential security patches, proactively defending against emerging threats. Platforms like Android and ChromeOS offer automatic updates, ensuring your devices stay protected without extra effort.

Step 3: Enable 2-Step Verification Neglecting 2-Step Verification is another common mistake. This simple feature adds an extra layer of protection, making unauthorized access to your account much more challenging. Sriram recommends enabling 2-Step Verification by following Google Account instructions. This sends prompts to your phone, allowing you to control log-in attempts and safeguard your data.

Step 4: Set a Strong Screen Lock Configuring a screen lock on your mobile device is a vital step in protecting your data. Christiaan advises choosing a strong password or biometric authentication, like fingerprint or facial recognition, to prevent unauthorized access. Google’s Find My Device tool helps locate and secure your phone if lost or misplaced.

Step 5: Be Vigilant with Links Cybercriminals often disguise malicious links as legitimate ones. Christiaan suggests being cautious of links, even from trusted sources. Enable Google’s Enhanced Safe Browsing to identify and warn against known phishing and malware sites in real-time, providing an extra layer of protection.

Step 6: Prepare for Password Recovery Forgetting passwords or losing devices can happen. Sriram recommends setting up a recovery plan before it’s needed, ensuring a smooth account recovery process. Add a recovery email or phone number to your Google Account to receive automated assistance if locked out.

By following these simple steps and utilizing Google’s powerful tools, you can build a robust digital defense and navigate the online world with confidence. Stay safe and secure with these practical tips.

Citation: Google. 6 cybersecurity mistakes people make — and what to do instead. Retrieved from https://blog.google/technology/safety-security/online-safety-tips-cybersecurity-mistakes/

Microsoft has developed a groundbreaking approach to combat phishing by creating realistic-looking honeypot tenants on Azure, designed to lure cybercriminals into fake environments. These honeypots, created by Ross Bevington, are populated with thousands of user accounts and mimic internal company activity, including email communications and file-sharing. When phishers use stolen credentials to access the fake tenants, Microsoft collects valuable intelligence on their tactics, techniques, and procedures, including IP addresses, browsers, location, and phishing kits used. This deception technology, part of the Microsoft Deception Network, helps the company better detect and block malicious emails, wasting attackers’ time and resources. By slowing down responses and monitoring every action, Microsoft can attribute attacks to specific groups, such as financially-motivated or state-sponsored actors like the Russian Midnight Blizzard (Nobelium) threat group. The honeypots have already blocked over 40,000 connections to Microsoft resources and are a key part of the company’s efforts to protect customers. This active approach, which Bevington calls “hybrid high interaction honeypots,” is a departure from traditional honeypot strategies that wait for attackers to discover them. The intelligence gathered from these honeypots allows Microsoft to improve its defenses and create more complex profiles of threat actors, ultimately enhancing the security of its customers.