CyberSecurity news
FlagThis - #scams
|
@gbhackers.com
// 3d
References:
gbhackers.com
, Malwarebytes
,
Cybercriminals are increasingly employing sophisticated tactics to bypass traditional security measures and ensnare unsuspecting users in phishing scams. One notable trend is the use of benign-worded email subjects such as "request," "forward," and "report" to lower suspicion. Additionally, attackers are leveraging URL shorteners and QR codes to mask malicious links, making it harder for users and security systems to identify threats. These techniques allow cybercriminals to evade detection and increase the likelihood of successful attacks aimed at stealing personal and financial information.
Tax-themed phishing campaigns are surging as the United States approaches Tax Day on April 15th. Microsoft has observed threat actors exploiting tax-related anxieties through emails containing malicious attachments. These attachments frequently include QR codes that redirect users to fake login pages designed to steal credentials. In other instances, attackers embed DoubleClick URLs in PDF attachments that redirect users through shortened links to fake DocuSign pages, serving either malicious JavaScript files leading to malware installation or benign decoy files based on filtering rules. The malware families being deployed in these campaigns are becoming increasingly advanced. Latrodectus, for example, features dynamic command-and-control configurations and anti-analysis capabilities, allowing attackers to execute Windows commands remotely and establish persistence through scheduled tasks. BruteRatel C4 (BRc4), originally designed for red-teaming exercises, is being exploited for post-exploitation activities, enabling attackers to bypass security defenses. According to Kendall McKay, strategic lead for cyber threat intelligence at Cisco’s Talos division, phishing scams are constantly evolving to maintain their effectiveness. Recommended read:
References :
@cyberalerts.io
// 22d
The FBI has issued a warning about the rising trend of cybercriminals using fake file converter tools to distribute malware. These tools, often advertised as free online document converters, are designed to trick users into downloading malicious software onto their computers. While these tools may perform the advertised file conversion, they also secretly install malware that can lead to identity theft, ransomware attacks, and the compromise of sensitive data.
The threat actors exploit various file converter or downloader tools, enticing users with promises of converting files from one format to another, such as .doc to .pdf, or combining multiple files. The malicious code, disguised as a file conversion utility, can scrape uploaded files for personal identifying information, including social security numbers, banking information, and cryptocurrency wallet addresses. The FBI advises users to be cautious of such tools and report any instances of this scam to protect their assets. The FBI Denver Field Office is warning that they are increasingly seeing scams involving free online document converter tools and encourages victims to report any instances of this scam. Malwarebytes has identified some of these suspect file converters, which include Imageconvertors.com, convertitoremp3.it, convertisseurs-pdf.com and convertscloud.com. The agency emphasized the importance of educating individuals about these threats to prevent them from falling victim to these scams. Recommended read:
References :
@www.bleepingcomputer.com
// 49d
JPMorgan Chase Bank will soon block Zelle payments that originate from social media platforms and messaging apps, aiming to combat a surge in online scams. This policy change, set to take effect on March 23rd, 2025, is a direct response to the increasing fraudulent activities exploiting peer-to-peer payment services. Chase emphasizes that Zelle is intended for transactions between trusted contacts like friends and family, not for payments to unfamiliar individuals encountered through social media.
The bank will decline or block payments identified as stemming from social media interactions. In addition, Chase may request further information from users when setting up payments or adding recipients, including the payment purpose and contact method. This move follows scrutiny from the Consumer Financial Protection Bureau (CFPB), which has criticized Zelle for its limited safeguards against fraud and scams, and a lawsuit filed in December by the CFPB. Recommended read:
References :
@securityboulevard.com
// 90d
References:
ciso2ciso.com
, securityboulevard.com
Work-from-home scams are becoming increasingly sophisticated, preying on job seekers with the promise of dream roles. These scams disguise themselves as legitimate opportunities, often using techniques that can cost victims time, money and confidence. Scammers often lure victims with promises of “be your own boss” and “unlimited earnings”, however, the reality is that the scheme requires payment from the victim with no return on investment. Some common work-from-home scams include multi-level marketing schemes that require upfront fees, fraudulent bounced checks, and mandatory training fees.
Additionally, some schemes offer payment in cryptocurrency, often requiring investment in advance, while others use suspicious cold messaging techniques to impersonate legitimate companies. Be cautious of offers that appear too good to be true, such as high hourly rates with no experience needed and also be wary of any job offer that does not provide full documentation and contracts. The increasing sophistication of work-from-home scams highlights the need for job seekers to be vigilant and to spot the red flags. Recommended read:
References :
|