FreshRSS

πŸ”’
❌ About FreshRSS
☷
β–½ πŸ”ƒ
There are new available articles, click to refresh the page.
Before yesterdayYour RSS feeds

Instagram Hack Results in $1 Million Loss in NFTs

By McAfee

Imagine – your favorite brand on Instagram just announced a giveaway. You’ll receive a free gift! All you have to do is provide your credit card information. Sounds easy, right? This is a brand you’ve followed and trusted for a while now. You’ve engaged with them and even purchased some of their items. The link comes directly from their official page, so you don’t think to question it. Don’t fall prey to crypto scams, download reputable mobile security protection.

This is the same mindset that led to several Bored Ape Yacht Club (BAYC) NFTs being stolen by a cybercriminal who had hacked into the company’s official Instagram account. Let’s dive into the details of this scam.Β Β 

Sneaking Into the Bored Ape Yacht ClubΒ 

Bored Ape Yacht Club, the NFT collection, disclosed through Twitter that their Instagram account had been hacked, and advised users not to click on any links or link their crypto wallets to anything. The hacker managed to log into the account and post a phishing link promoting an β€œairdrop,” or a free token giveaway, to users who connected their MetaMask wallets. Those who linked their wallets before BAYC’s warning lost a combined amount of over $1 million in NFTs.Β 

Despite the large price tag attached to NFTs, they are often held in smartphone wallets rather than more secure alternatives. MetaMask, the crypto wallet application, only allows NFT display through mobile devices and encourages users to use the smartphone app to manage them. While it may be a good method for display purposes, this limitation provides hackers with a new and effective way to easily steal from users’ mobile wallets.Β 

BAYC does not yet know how the hacker was able to gain access to their Instagram account, but they are following security best practices and actively working to contact the users affected.Β 

N.F.T. – Not For TakingΒ 

This scam was conducted through the official BAYC account, making it appear legitimate to BAYC’s followers. It is incredibly important to stay vigilant and know how to protect yourself and your assets from scams like these. Follow the tips below to steer clear of phishing scams and keep your digital assets safe:Β Β 

Ensure wallet securityΒ 

A seed phrase is the β€œopen sesame” to your cryptocurrency wallet. The string of words is what grants you access to all your wallet’s assets. Ensuring that your seed phrase is stored away safely and not easily accessible by anyone but yourself is the first step to making sure your wallet is secure.Β 

Protect your privacyΒ 

With all transactional and wallet data publicly available, scammers can pick and choose their targets based on who appears to own valuable assets. To protect your privacy and avoid being targeted, refrain from sharing your personal information on social media sites or using your NFT as a social media avatar.Β 

Look out for phishing scamsΒ 

Phishing scams targeting NFT collectors are becoming increasingly common. Be wary of any airdrops offering free tokens in exchange for your information or other β€œcollectors” doing the same.Β 

Phishing scams tend to get more sophisticated over time, especially in cases like the Bored Ape Yacht Club where the malicious links are coming straight from the official account. It is always best to remain skeptical and cautious, but when in doubt, here are some extra tips to spot phishing scams:Β 

  • Is it written properly? A few spelling or grammar mistakes can be common, but many phishing messages will contain glaring errors that professional accounts or companies wouldn’t make. If you receive an error-filled message or promotion that requires giving your personal information, run in the other direction.Β 
  • Does the logo look right? Scammers will often steal the logo of whatever brand or company they’re impersonating to make the whole shtick look more legitimate. However, rarely do the logos look exactly how they’re supposed to. Pay close attention to any logo added in a message or link. Is the quality low? Is it crooked or off-center? Is it almost too small to completely make out? If yes, it’s most likely not the real deal.Β 
  • Is the URL legit? In any phishing scam, there will always be a link involved. To check if a link is actually legitimate, copy and paste the URL into a word processor where you can examine it for any odd spelling or grammatical errors. If you receive a strange link via email, hover over it with your mouse to see the link preview. If it looks suspicious, ignore and delete it. Even on mobile devices, you can press and hold the link with your finger to check out the legitimacy of the URL.Β 

As crypto and NFTs continue to take the world by storm, hackers and scammers are constantly on the prowl for ways to steal and deceive. No matter the source or how trustworthy it may seem at first glance, always exercise caution to keep yourself and your assets safe!Β 

The post Instagram Hack Results in $1 Million Loss in NFTs appeared first on McAfee Blog.

FBI Seizes 'SSNDOB' ID Theft Service for Selling Personal Info of 24 Million People

By Ravie Lakshmanan
An illicit online marketplace known as SSNDOB was taken down in operation led by U.S. law enforcement agencies, the Department of Justice (DoJ) announced Tuesday. SSNDOB trafficked in personal information such as names, dates of birth, credit card numbers, and Social Security numbers of about 24 million individuals in the U.S., generating its operators $19 million in sales revenue. The action

Researchers Detail How Cyber Criminals Targeting Cryptocurrency Users

By Ravie Lakshmanan
Cybercriminals are impersonating popular crypto platforms such as Binance, Celo, and Trust Wallet with spoofed emails and fake login pages in an attempt to steal login details and deceptively transfer virtual funds. "As cryptocurrency and non-fungible tokens (NFTs) become more mainstream, and capture headlines for their volatility, there is a greater likelihood of more individuals falling victim

Atlassian Confluence Flaw Being Used to Deploy Ransomware and Crypto Miners

By Ravie Lakshmanan
A recently patchedΒ critical security flawΒ in Atlassian Confluence Server and Data Center products is being actively weaponized in real-world attacks to drop cryptocurrency miners and ransomware payloads. In at least two of the Windows-related incidents observed by cybersecurity vendor Sophos, adversaries exploited the vulnerability to deliver Cerber ransomware and aΒ crypto minerΒ called z0miner

Capital One identity theft hacker finally gets convicted

By Paul Ducklin
It took three years, but the Capital One cracker was convicted in the end. Don't get caught out in a data breach of your own!

Researchers Uncover Ways to Break the Encryption of 'MEGA' Cloud Storage Service

By Ravie Lakshmanan
A new piece of research from academics at ETH Zurich has identified a number of critical security issues in the MEGA cloud storage service that could be leveraged to break the confidentiality and integrity of user data. In a paper titled "MEGA: Malleable Encryption Goes Awry," the researchers point out how MEGA's system does not protect its users against a malicious server, thereby enabling a

OpenSSL issues a bugfix for the previous bugfix

By Paul Ducklin
Fortunately, it's not a major bugfix, which means it's easy to patch and can teach us all some useful lessons.

Harmony blockchain loses nearly $100M due to hacked private keys

By Paul Ducklin
The crooks needed at least two private keys, each stored in two parts... but they got them anyway.

North Korean Hackers Suspected to be Behind $100M Horizon Bridge Hack

By Ravie Lakshmanan
The notorious North Korea-backed hacking collective Lazarus Group is suspected to be behind the recent $100 million altcoin theft from Harmony Horizon Bridge, citing similarities to theΒ Ronin bridge attackΒ in March 2022. The finding comes as HarmonyΒ confirmedΒ that its Horizon Bridge, aΒ platformΒ that allows users to move cryptocurrency across different blockchains, had been breached last week.

Microsoft Warns of Cryptomining Malware Campaign Targeting Linux Servers

By Ravie Lakshmanan
A cloud threat actor group tracked as 8220 has updated its malware toolset to breach Linux servers with the goal of installing crypto miners as part of a long-running campaign. "The updates include the deployment of new versions of a crypto miner and an IRC bot," Microsoft Security Intelligence said in a series of tweets on Thursday. "The group has actively updated its techniques and payloads

OpenSSL fixes two β€œone-liner” crypto bugs – what you need to know

By Paul Ducklin
"As bad as Heartbleed"? We heard that concern a week ago, but we think it's less ungood than that...

Over 1,200 NPM Packages Found Involved in "CuteBoi" Cryptomining Campaign

By Ravie Lakshmanan
Researchers have disclosed what they say could be an attempt to kick-off a new large-scale cryptocurrency mining campaign targeting the NPM JavaScript package repository. The malicious activity, attributed to a software supply chain threat actor dubbedΒ CuteBoi, involves an array of 1,283 rogue modules that were published in an automated fashion from over 1,000 different user accounts. "This was

Hackers Used Fake Job Offer to Hack and Steal $540 Million from Axie Infinity

By Ravie Lakshmanan
The $540 million hack of Axie Infinity'sΒ Ronin BridgeΒ in late March 2022 was the consequence of one of its former employees getting tricked by a fraudulent job offer on LinkedIn, it has emerged.Β  According to a report fromΒ The BlockΒ published last week citing two people familiar with the matter, a senior engineer at the company was duped into applying for a job at a non-existent company, causing

Cloud-based Cryptocurrency Miners Targeting GitHub Actions and Azure VMs

By Ravie Lakshmanan
GitHub Actions and Azure virtual machines (VMs) are being leveraged for cloud-based cryptocurrency mining, indicating sustained attempts on the part of malicious actors to target cloud resources for illicit purposes. "Attackers can abuse theΒ runnersΒ or servers provided by GitHub to run an organization's pipelines and automation by maliciously downloading and installing their own cryptocurrency

Popular NFT Marketplace Phished for $540M

By Nate Nelson
In March, a North Korean APT siphoned blockchain gaming platform Axie Infinity of $540M.

Popular NFT Marketplace Phished for $540M

By Nate Nelson
In March, a North Korean APT siphoned blockchain gaming platform Axie Infinity of $540M.

S3 Ep91: CodeRed, OpenSSL, Java bugs, Office macros [Audio + Text]

By Paul Ducklin
Latest episode - listen now! Great discussion, technical content, solid advice... all covered in plain English.

This Cloud Botnet Has Hijacked 30,000 Systems to Mine Cryptocurrencies

By Ravie Lakshmanan
The 8220 cryptomining group has expanded in size to encompass as many as 30,000 infected hosts, up from 2,000 hosts globally in mid-2021. "8220 Gang is one of the many low-skill crimeware gangs we continually observe infecting cloud hosts and operating a botnet and cryptocurrency miners through known vulnerabilities and remote access brute forcing infection vectors," Tom Hegel of SentinelOneΒ 

Hackers Use Evilnum Malware to Target Cryptocurrency and Commodities Platforms

By Ravie Lakshmanan
The advanced persistent threat (APT) actor tracked as Evilnum is once again exhibiting signs of renewed activity aimed at European financial and investment entities. "Evilnum is a backdoor that can be used for data theft or to load additional payloads," enterprise security firm ProofpointΒ saidΒ in a report shared with The Hacker News. "The malware includes multiple interesting components to evade

Hackers Increasingly Using WebAssembly Coded Cryptominers to Evade Detection

By Ravie Lakshmanan
As many as 207 websites have been infected with malicious code designed to launch a cryptocurrency miner by leveraging WebAssembly (Wasm) on the browser. Web security company Sucuri, which published details of the campaign, said it launched an investigation after one of its clients had their computer slowed down significantly every time upon navigating to their own WordPress portal. This

U.S. Offers $10 Million Reward for Information on North Korean Hackers

By Ravie Lakshmanan
The U.S. State Department has announced rewards of up to $10 million for any information that could help disrupt North Korea's cryptocurrency theft, cyber-espionage, and other illicit state-backed activities. "If you have information on any individuals associated with the North Korean government-linked malicious cyber groups (such as Andariel, APT38, Bluenoroff, Guardians of Peace, Kimsuky, or

GnuTLS patches memory mismanagement bug – update now!

By Paul Ducklin
GnuTLS may well be the most widespread cryptographic toolkit you've never heard of. Learn more...

❌