Welcome to Gone Phishing, your daily cybersecurity Newsletter that helps you put up boundaries against cybercriminals. Like Jonah Hill with his ex ???? #Juicy ????????????

Today’s hottest cyber security stories:

• ???? Calling All Readers! Watch Out for “Letscall” Vishing Scam in South Korea! ????

• ???? Beware the BlackByte 2.0 Ransomware: Strikes in a Flash! ⚡

• ⭐ Mastodon’s Marvellous Update: Shielding Users from Cyber Shenanigans! ????️

You’ll vish you didn’t pick up ????

Hey there, cyber squad! We’ve got some breaking news from the cyber world that you need to know about.

Brace yourselves for an advanced and sneaky form of voice phishing (vishing) known as “Letscall.” ???? These crafty scammers are currently targeting our friends in South Korea. Let’s dive into the details!

Picture this: you innocently surf the web, stumble upon a fake Google Play Store site, and BAM! You’re tricked into downloading a nasty app by these vishing villains. Once that evil software takes root in your device, it’s game over. Incoming calls on your phone get sneakily redirected to a call centre controlled by these cyber criminals. ???? But wait, it gets worse!

Now, these swindlers have trained their crew to pose as bank employees. They’ll sweet-talk you and extract sensitive info right out of you! Talk about a double whammy. ????

How do they pull this off, you ask? Well, “Letscall” isn’t your average scam. It’s got all the bells and whistles of modern technology. Think voice over IP (VOIP) and WebRTC. Fancy, huh?

They even use something called STUN and TURN protocols to ensure those phone or video calls are smooth as silk. They’re all about bypassing NAT and firewall restrictions. These tech-savvy baddies mean business!

Who are these devious folks, you might wonder? Turns out, the “Letscall” group is like a squad of supervillains. They’ve got Android developers, designers, frontend and backend wizards, and even call operators who specialise in voice social engineering. It’s like they’re assembling the Avengers of the cyber underworld! ????

So, how does the malware work? Hold onto your hats, folks! First, there’s a sneaky downloader app that paves the way for some super powerful spyware to invade your device. ????️‍♂️

Once that’s in place, the final stage is triggered. Incoming calls get rerouted straight to the crooks’ call centre. It’s like they’ve hijacked your phone, and you didn’t even get a chance to say, “Avengers, assemble!” ????

Quick word from our sponsors today – ZZZ Money Club

I came across ZZZ money club during the crypto market bull run, even during the bear market this discord group have been amazing at giving information on projects and ways to make passive income in various ways.

The group are very active and everyone in this private discord group is very chatty and helpful.

Its run by Yourfriendandy and Decadeinvestor, you can find them here on YouTube, both top guys with great content.

If you are interested in joining the group you can through the link below.

Byte me, hackers ???? Actually don’t ????

We’ve got an urgent heads-up for you today. The battle against ransomware just got a whole lot tougher. ???? Microsoft’s Incident Response team recently uncovered the terrifying truth about the BlackByte 2.0 ransomware attacks, and it’s a wild ride. Let’s dive into the deets!

These cyber villains have mastered the art of speed, completing their dastardly attack process in a jaw-dropping five days. That’s right, folks—five days to infiltrate systems, encrypt crucial data, and hold it hostage for a hefty ransom. Woah, grease lightning ⚡????

This condensed timeline poses a massive challenge for organisations trying to defend against these ruthless operations. It’s like trying to outrun a cheetah on roller skates! ????‍♀️????

Now, let’s talk tactics. The BlackByte ransomware, unleashed in the final stage of the attack, boasts an 8-digit number key that locks away your precious data. Yikes! But how do these hackers pull off such a rapid assault? Well, they’ve got an arsenal of tricks up their sleeves.

First, they exploit unpatched Microsoft Exchange Servers—oh, the sneaky devils! This approach has proven frightfully successful in gaining initial access to target networks. It’s like finding an open backdoor and slipping right in without anyone noticing. ????

????️ Extra, Extra! Read all about it ????️

Each week, we carefully select three hot newsletters to show you. Reputation is everything, so any links we share come from personal recommendation or carefully researched businesses at the time of posting. Enjoy!

• ???? Millionaire Habits’s: Learn how to steal the simple habits of millionaire in 3 minutes or less straight from your inbox

• ???? Bot Eat Brain: Teaches how to harness the awesome power of AI whilst avoiding common pitfalls.

• ???? Stand the f*ck out: Anxious about AI, wary customers, and rising competition? This on-trend newsletter could be just the ticket.

Let us know what you think!

Mastodon’t try it, Anakin ⚔️

Your favourite decentralised platform (we’d never heard of it either ????) is levelling up its security game with a brand-new update! Time to buckle up and stay protected from potential attacks. Let’s dig into the details!

Mastodon, famous for its federated model of thousands of unique servers called “instances,” boasts a whopping 14 million users across over 20,000 instances.

But wait, there’s a twist in this tale. Some sneaky vulnerabilities have been discovered, putting millions of users at risk. Yikes!

The most critical of these flaws, CVE-2023-36460, targets the media attachments feature. Hackers can exploit this weakness to create and overwrite files in any corner of the software’s reach within an instance. It’s like a digital break-in! ????????

The potential consequences are no joke. This vulnerability opens the door for DoS attacks and even allows arbitrary remote code execution. Translation: bad news for users and the wider Internet ecosystem. We’ve got to put a stop to this cyber chaos! ????

Picture this: an attacker gains control over multiple instances. That’s when the real trouble starts. They can wreak havoc by tricking users into downloading malicious apps or even bring down the entire Mastodon infrastructure.

But fret not, dear Mastodon mavens! The good news is that there’s no evidence of this vulnerability being exploited so far. ????

All credit goes to the cybersecurity superheroes at Cure53, who discovered this critical flaw during a comprehensive penetration testing initiative funded by the Mozilla Foundation. They’re the real MVPs in this cyber adventure, keeping us safe from harm. Hooray for their heroic efforts! ????‍♀️????‍♂️

So long and thanks for reading all the phish!