Search results for financial cyberthreats

By Owais Sultan The financial industry is undergoing a digital transformation. Digital technology has been around for decades, but it’s only… This is a post from HackRead.com Read the original post: Digital Transformation in the Financial Industry: The Role of Fintech

An Android malware campaign targeting Iranian banks has expanded its capabilities and incorporated additional evasion tactics to fly under the radar. That's according to a new report from Zimperium, which discovered more than 200 malicious apps associated with the malicious operation, with the threat actor also observed carrying out phishing attacks against the targeted financial institutions.

Android Store Apps Targeting Banking Users Iranian Android Iranian Banks Store Installed

It has come to light that Facebook Business accounts have been compromised through the use of harmful browser extensions developed by the notorious Ducktail family. Ducktail is a specifically designed information stealer that can have severe consequences, such as privacy breaches, financial losses, and identity theft. Its constant updates enable it to bypass most Social […] The post Hackers Using Malicious Browser Extensions to Steal Facebook Business Accounts appeared first on Cyber Security News.

Malicious Browser Steal Facebook

Join the Be.Cyber community! On the program: news and tools monitoring, mutual aid and knowledge sharing, event organization (workshops, CTF resolution), ... And it's all in good fun!

Kaspersky experts review last year's predictions on consumer cyberthreats and try to anticipate the trends for 2024.

Consumer Consumer cyberthreats experts review Kaspersky experts

MaaS (Malware-as-a-Service) thrives as a top choice for new cyber threats, offering easy access to powerful tools. Threat actors primarily focus on information theft under Maas, specializing in stealing and leaking sensitive data from hacked devices. This malicious behavior poses a serious risk to both individuals and businesses, with the potential to cause significant financial […] The post LummaC2 Employs Trigonometry to Track Mouse Movements appeared first on Cyber Security News.

Employs Trigonometry Mouse Movements offering easy Track Mouse

Kaspersky assesses last year's predictions for the financial threat landscape, and tries to anticipate crimeware trends for the coming year 2024.

financial cyberthreats financial threat Kaspersky assesses

Microsoft has observed ongoing activity from mobile banking trojan campaigns targeting users in India with social media messages and malicious applications designed to impersonate legitimate organizations and steal users' information for financial fraud scams. The post Social engineering attacks lure Indian users to install Android banking trojans appeared first on Microsoft Security Blog.

Indian users install Android lure Indian

Discover how an IDOR vulnerability allowed unauthorized budget changes in Private Program. Learn the steps to reproduce this security flaw and its potential impact on user privacy.IDOR vulnerabilities can potentially expose user data or allow unauthorized access to sensitive features. In this blog post, I'll walk you through a recent discovery I made while testing Examlent.com(virtual name of privat program domain), a platform where individuals seek job opportunities and employers find potential candidates. This IDOR flaw had the potential to compromise user privacy by letting an attacker manipulate a user's budget without their consent.The IDOR BugAs a bug bounty hunter, my mission was to explore Examlent.com for any potential security vulnerabilities. During my testing, I discover an intriguing IDOR (Insecure Direct Object Reference) bug that allowed any user to change another user's budget without taking over their account. The endpoint responsible for this flaw was /employers/posts/ajax/action-crud-job.php?country=us&language=en&hid=------.Steps to ReproducePrepare Two Accounts: You'll need two different accounts for this test — one as the attacker and the other as the victim.Capture the Edit Budget Request: Use your attacker account to capture the “Edit Budget” request made by the victim.Identify the hid= Value: Now, you may be wondering how the attacker can obtain the `hid=` value. Well, in this scenario, the attacker is conducting a random attack because here the hid has only 8 char long. They can attempt to brute force random id values.Send the Request: With the “Edit Budget” request and the hid= value in hand, the attacker can now send the request.Observe the Change: As a result, you'll notice that the budget of the victim's account has been altered without their consent.The ImpactThe unauthorized budget change not only compromises user privacy but also potentially results in financial losses, creating significant repercussions for both the victims and the platform's integrity.The BountyThis critical IDOR vulnerability raised awareness about the need for enhanced security measures. Recognizing the significance of this discovery, Examlet.com promptly awarded a bounty of 00 to me.TakeawayThis IDOR bug underscores the importance of continuously examining web applications for potential vulnerabilities. Security researchers should consider testing the boundaries of permissions within applications to see if they can make changes without gaining full access to another user's account.Leave some clap if you enjoyed this read, leave your feedback in comment and consider following me for more exciting findings.Find me on Twitter: @a13h1_Thank you everyoneKeep Supporting, Keep Clapping, Keep Commenting.Budget Change: IDOR 1000$ Bug was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.

Budget Budget Change IDOR Bug Private Program

As Black Friday approaches, Kaspersky analyzes phishing and spam activity around major sales events, and reviews statistics on online shopping threats in 2023.

decoding cyberthreats Friday approaches Kaspersky analyzes sales events

Recently, AhnLab Security Emergency response Center (ASEC) has identified a malicious LNK file being distributed to financial and blockchain corporation personnel through email and other ways. The malicious LNK file is distributed via URLs and AhnLab Smart Defense (ASD) has confirmed the following URLs. The file being downloaded is a compressed file named “Blockchain Corporate Solution Handbook Production.zip”. The threat actor alternately uploaded a malicious file and a legitimate file at the URLs, causing confusion in analysis. When the malicious... The post Distribution of Malicious LNK File Disguised as Producing Corporate Promotional Materials appeared first on ASEC BLOG.

Corporate Promotional Producing Corporate

The threat actors behind the 8Base ransomware are leveraging a variant of the Phobos ransomware to conduct their financially motivated attacks. The findings come from Cisco Talos, which has recorded an increase in activity carried out by cybercriminals. “Most of the group's Phobos variants are distributed by SmokeLoader, a backdoor trojan," security researcher Guilherme Venere said in an

motivated attacks