Nov 23 2023
Welcome to Gone Phishing, your daily cybersecurity newsletter that thinks Dominic Cummings has been hacked by cybercriminals 😵💫 #CovidInquiryA
Today’s hottest cybersecurity news stories:
🍏 Mac users beware! ‘ClearFake’ campaign targets macOS 🖥️
🍚 N. Koreans masquerade as recruiters, distribute malware 👾
👨💻 Hackers exploit fingerprint flaws to bypass Windows login 🔑
🚨 The notorious macOS data-stealing malware, Atomic Stealer (AMOS), has evolved! Now, it's infiltrating Mac systems through a deceptive web browser update chain called ClearFake. 😱
💰 $1,000 a month 💰
🕵️♂️ According to Malwarebytes' analysis, this marks a significant shift in social engineering tactics, expanding beyond Windows to target macOS users worldwide. AMOS, a subscription-based malware sold for $1,000/month, specialises in extracting data from web browsers and cryptocurrency wallets. 😨
🎭 ClearFake 🎭
🖥️ In a recent development, ClearFake, a rising malware distribution operation, uses compromised WordPress sites to deploy fraudulent browser update notices. It has joined the league of threat actors like TA569 and RogueRaticate, employing fake browser updates to spread malware.
🌐 The ClearFake campaign, as of November 2023, has expanded its reach to macOS systems. This highlights the adaptability of stealer malware, relying on fake installer files via malicious ads, drive-by downloads, and phishing.
👾 LummaC2 👾
🍪 Additionally, beware of LummaC2 stealer updates featuring an anti-sandbox technique and claiming to extract persistent Google cookies. This could open the door to extensive cyber attacks, compromising Google accounts.
🛡️ Stay vigilant, update your security software, and avoid suspicious downloads! Your digital safety is our top priority. 🔐
A robust vendor management program isn’t just required by compliance frameworks like SOC 2 and ISO 27001. It’s also a critical part of a holistic trust management strategy.
Implementing a vendor management program, however, has become more complex and challenging with the proliferation of SaaS tools and shadow IT. And many overstretched security teams are being asked to do more with less.
To stay compliant and secure — and deepen trust with customers and partners — security teams need a way to proactively manage vendor risk.
This guide from Vanta, the leading trust management platform, brings together perspectives from the frontlines of vendor security management. Get insights and best practices from security and compliance leaders.
In this campaign, North Korean threat actors disguise themselves as job recruiters, targeting software developers in a bid to spread malware through deceptive job interviews. The malware, including BeaverTail and InvisibleFerret, poses a cross-platform risk for Windows, Linux, and macOS users.
🦛 Wagemole 🦛
Wagemole involves a cunning scheme where hackers, impersonating job seekers, utilize GitHub to host fake resumes. The ultimate goal is financial gain and espionage, with threat actors aiming to embed insiders within targeted companies. The sophistication of these attacks highlights the evolving tactics of North Korean cyber threats.
🦦 BeaverTail & InvisibleFerret 🦦
The Contagious Interview campaign introduces two previously undocumented malware, BeaverTail and InvisibleFerret. These threats can compromise systems running on Windows, Linux, and macOS. BeaverTail acts as a JavaScript implant, stealing sensitive information, while InvisibleFerret serves as a Python-based backdoor, enabling remote control and data exfiltration.
👀 Persistent Threats 👀
These tactics mirror previous North Korean threat activities, emphasising the ongoing risk of deception. The threat landscape remains dynamic, with hackers adapting their strategies to exploit vulnerabilities. Cybersecurity measures must evolve to counter these sophisticated attacks.
🔐 Emerging Threats! 🤖
As software developers become a prime target, and fake job offers persist, maintaining robust cybersecurity defences is crucial. Keep your systems updated and be cautious of unsolicited communications. Together, we can thwart these sophisticated cyber threats!
🃏 The Motley Fool: “Fool me once, shame on — shame on you. Fool me — you can't get fooled again.” Good ol’ George Dubya 😂 Let us tell who’s not fooling around though; that’s the Crüe 👀 at Motley Fool. You’d be a fool (alright, enough already! 🙈) not to check out their Share Tips from time to time so your savings can one day emerge from their cocoon as a beautiful butterfly! 🐛 Kidding aside, if you check out their website they’ve actually got a ton of great content with a wide variety of different investment ideas to suit most budgets 🤑 (LINK)
🚵 Wander: Find your happy place. Cue Happy Gilmore flashback 🏌️⛳🌈🕊️ Mmmm Happy Place… 😇 So, we’ve noticed a lot of you guys are interested in travel. As are we! We stumbled upon this cool company that offers a range of breath-taking spots around the United States and, honestly, the website alone is worth a gander. When all you see about the Land of the free and the home of the brave is news of rioting, looting and school shootings, it’s easy to forget how beautiful some parts of it are. The awe-inspiring locations along with the innovative architecture of the hotels sets Wander apart from your run of the mill American getaway 🏞️😍 (LINK)
🌊 Digital Ocean: If you build it they will come. Nope, we’re not talking about a baseball field for ghosts ⚾👻🍿 (Great movie, to be fair 🙈). This is the Digital Ocean who’ve got a really cool platform for building and hosting pretty much anything you can think of. If you check out their website you’ll find yourself catching the buzz even if you can’t code (guilty 😑). But if you can and you’re looking for somewhere to test things out or launch something new or simply enhance what you’ve got, we’d recommend checking out their services fo’ sho 😉 And how can you not love their slogan: Dream it. Build it. Grow it. Right on, brother! 🌿 (LINK)
🔍 Researchers at Blackwing Intelligence have uncovered serious vulnerabilities in fingerprint sensors from Goodix, Synaptics, and ELAN, affecting Dell Inspiron 15, Lenovo ThinkPad T14, and Microsoft Surface Pro X laptops. 😱
👾 The flaws, identified as a potential gateway to bypass Windows Hello authentication, stem from weaknesses in the "match on chip" (MoC) type fingerprint sensors integrated into these devices.
📟 MoC 📟
🛡️ Despite MoC preventing the replay of stored fingerprint data, it fails to prevent malicious sensors from falsely claiming authorised user authentication, leaving the door open for exploitation.
🌐 ELAN's vulnerability allows any USB device to impersonate the fingerprint sensor, potentially leading to unauthorised access.
🔒 Synaptics faces issues with the default disabling of the Secure Device Connection Protocol (SDCP), relying on a flawed Transport Layer Security (TLS) stack, posing a risk to biometric authentication.
😈 Goodix 😈
💻 Goodix's exploit takes advantage of the difference in enrollment operations between Windows and Linux, potentially allowing attackers to compromise the system.
🛑 To counter these threats, original equipment manufacturers (OEMs) are advised to enable SDCP and undergo independent expert audits of fingerprint sensor implementations.
🔐 Windows Hello biometrics, designed with the Secure Device Connection Protocol, faces challenges in device manufacturers' understanding and limited coverage of the device's overall security. Stay vigilant for updates and patches! 🤖👁️🗨️
Every few weeks, we carefully select three hot newsletters to show you. Reputation is everything, so any links we share come from personal recommendation or carefully researched businesses at the time of posting. Enjoy!
The GeekAI: A daily 3 min newsletter on what matters in AI, with all the new AI things coming to market its good to stay ahead of the curve.
Libby Copa: The Rebel Newsletter helps writers strengthen their writing and creative practice, navigate the publishing world, and turn their art into an act of rebellion.
Techspresso: Receive a daily summary of the most important AI and Tech news, selected from 50+ media outlets (The Verge, Wired, Tech Crunch etc)
Let us know what you think!
So long and thanks for reading all the phish!
