Found 264 bookmarks
Custom sorting
New phishing-as-a-service tool “Greatness” already seen in the wild
New phishing-as-a-service tool “Greatness” already seen in the wild
  • A previously unreported phishing-as-a-service (PaaS) offering named “Greatness” has been used in several phishing campaigns since at least mid-2022. Greatness incorporates features seen in some of the most advanced PaaS offerings, such as multi-factor authentication (MFA) bypass, IP filtering and integration with Telegram bots. * Greatness, for now, is only focused on Microsoft 365 phishing pages, providing its affiliates with an attachment and link builder that creates highly convincing decoy and login pages. It contains features such as having the victim’s email address pre-filled and displaying their appropriate company logo and background image, extracted from the target organization’s real Microsoft 365 login page. This makes Greatness particularly well-suited for phishing business users. * An analysis of the domains targeted in several ongoing and past campaigns revealed the victims were almost exclusively companies in the U.S., U.K., Australia, South Africa, and Canada, and the most commonly targeted sectors were manufacturing, health care and technology. The exact distribution of victims in each country and sector varies slightly between campaigns. * To use Greatness, affiliates must deploy and configure a provided phishing kit with an API key that allows even unskilled threat actors to easily take advantage of the service’s more advanced features. The phishing kit and API work as a proxy to the Microsoft 365 authentication system, performing a “man-in-the-middle” attack and stealing the victim’s authentication credentials or cookies.
#talosintelligence#EN#2023#Greatness#Phishing#phishing-kits#analysis
·blog.talosintelligence.com·
New phishing-as-a-service tool “Greatness” already seen in the wild
Can Better Training Reduce the Success Rate of Phishing Attacks?
Can Better Training Reduce the Success Rate of Phishing Attacks?
A review of Arun Vishwanath, “The Weakest Link: How to Diagnose, Detect, and Defend Users From Phishing Attacks” (MIT Press, 2022) Many elements of the cyber threat landscape have changed significantly over the past two decades. For one, the number of attackers has grown dramatically, aided by the increasing availability of hacking tools and services as commodities for purchase in online marketplaces. The value of the losses cyber criminals have been able to inflict on their victims has also grown, though the dollar estimates vary widely in absolute terms. In recent years, the popularity of ransomware has increased substantially, prompting the Biden administration to initiate an ongoing diplomatic effort to foster cross-border efforts to curb this dangerous form of cyber-enabled extortion.
#lawfareblog#EN#2023#Phishing#Training
·lawfareblog.com·
Can Better Training Reduce the Success Rate of Phishing Attacks?
An infostealer comes to town: Dissecting a highly evasive malware targeting Italy
An infostealer comes to town: Dissecting a highly evasive malware targeting Italy
Cluster25 researchers analyzed several campaigns (also publicly reported by CERT-AGID) that used phishing emails to spread an InfoStealer malware written in .NET through an infection chain that involves Windows Shortcut (LNK) files and Batch Scripts (BAT). Taking into account the used TTPs and extracted evidence, the attacks seem perpetrated by the same adversary (internally named AUI001).
#cluster25#EN#2022#infostealer#Italy#phishing#Campaigns#analysis#Alibaba2044#IoCs
·blog.cluster25.duskrise.com·
An infostealer comes to town: Dissecting a highly evasive malware targeting Italy
Using OpenAI Chat to Generate Phishing Campaigns
Using OpenAI Chat to Generate Phishing Campaigns
OpenAI chat has exploded in popularity over the last couple of weeks. People are using it to do all sorts of interesting things. If you are unfamiliar with OpenAI Chat and GPT-3, you can find a primer here. The gist is that it’s an artificial intelligence model that you can chat with as if it were a person. It can do all kinds of things like answer questions, write code, find bugs in code, and more. It also remembers context, so you can refer to something you already mentioned at it is able to follow along. I thought maybe this could be a useful tool for building email phishing campaigns for my pentesting work, so I thought I’d try it out and see what I could get it to do.
#richardosgood#ChatGPT#Phishing#Campaigns
·richardosgood.com·
Using OpenAI Chat to Generate Phishing Campaigns
Threat Spotlight: Cyber Criminal Adoption of IPFS for Phishing, Malware Campaigns
Threat Spotlight: Cyber Criminal Adoption of IPFS for Phishing, Malware Campaigns
  • The InterPlanetary File System (IPFS) is an emerging Web3 technology that is currently seeing widespread abuse by threat actors. * Cisco Talos has observed multiple ongoing campaigns that leverage the IPFS network to host their malware payloads and phishing kit infrastructure while facilitating other attacks. * IPFS is often used for legitimate
#talosintelligence#EN#2022#IPFS#Phishing#Malware#Campaigns
·blog.talosintelligence.com·
Threat Spotlight: Cyber Criminal Adoption of IPFS for Phishing, Malware Campaigns
How we handled a recent phishing incident that targeted Dropbox
How we handled a recent phishing incident that targeted Dropbox
We were recently the target of a phishing campaign that successfully accessed some of the code we store in GitHub. No one’s content, passwords, or payment information was accessed, and the issue was quickly resolved. Our core apps and infrastructure were also unaffected, as access to this code is even more limited and strictly controlled. We believe the risk to customers is minimal. Because we take our commitment to security, privacy, and transparency seriously, we have notified those affected and are sharing more here.
#dropbox#EN#2022#incident#phishing#GitHub
·dropbox.tech·
How we handled a recent phishing incident that targeted Dropbox
Lampion Trojan Utilizes New Delivery through Cloud-Based Sharing
Lampion Trojan Utilizes New Delivery through Cloud-Based Sharing
Analysts at the Cofense Phishing Defense Center (PDC) have recently analyzed an email asking users to download a “Proof of Payment” as well as other documents. While it is important to never click on the link(s) or download the attachment(s) of any suspicious email, if the recipient interacts with the link, it downloaded the malware Lampion.
#cofense#EN#2022#Phishing#Lampion#malware#IoCs
·cofense.com·
Lampion Trojan Utilizes New Delivery through Cloud-Based Sharing
DigitalOcean says customer email addresses were exposed after latest Mailchimp breach – TechCrunch
DigitalOcean says customer email addresses were exposed after latest Mailchimp breach – TechCrunch
Cloud giant DigitalOcean says that some customers’ email addresses were exposed because of a recent “security incident” at email marketing company Mailchimp. In a scant blog post dated August 12, just two days after the company’s co-founder and long-time CEO Ben Chestnut stepped down, Mailchimp said a recent but undated attack saw threat actors targeting […]
#techcrunch#EN#2022#digitalocean#mailchimp#password#phishing#sms#twilio
·techcrunch.com·
DigitalOcean says customer email addresses were exposed after latest Mailchimp breach – TechCrunch
Cisco confirms May attack by Yanluowang ransomware group
Cisco confirms May attack by Yanluowang ransomware group
Cisco confirmed on Wednesday that it was attack by the Yanluowang ransomware group in May, but said the hackers were not able to steal sensitive data or impact the company’s operations. In a statement to The Record, Cisco said the incident occured on their corporate network in late May and that they “immediately took action to contain and eradicate the bad actors.”
#therecord#EN#2022#Yanluowang#Cisco#talos#phishing#voicemail
·therecord.media·
Cisco confirms May attack by Yanluowang ransomware group
The mechanics of a sophisticated phishing scam and how we stopped it
The mechanics of a sophisticated phishing scam and how we stopped it
Yesterday, August 8, 2022, Twilio shared that they’d been compromised by a targeted phishing attack. Around the same time as Twilio was attacked, we saw an attack with very similar characteristics also targeting Cloudflare’s employees. While individual employees did fall for the phishing messages, we were able to thwart the attack through our own use of Cloudflare One products, and physical security keys issued to every employee that are required to access all our applications.
#cloudflare#EN#2022#phishing#scam#Twilio#okra
·blog.cloudflare.com·
The mechanics of a sophisticated phishing scam and how we stopped it