Author: HackWatchit

The post Talkin’ About Infosec News – 2/20/24 appeared first on Black Hills Information Security.

An ongoing PayPal email scam exploits the platform’s address settings to send fake purchase notifications, tricking users into granting remote access to scammers For the past month, BleepingComputer and others [1, 2] have received emails from PayPal stating, “You added a new address. This is just a quick confirmation that you added an address in your PayPal account.”  The email includes the new address that was allegedly added to your PayPal account, including a message claiming to be a purchase confirmation for a MacBook M4, and to call the enclosed PayPal number if you did not authorize the purchase. “Confirmation: Your…

A startup called Firefly that’s tackling the thorny and growing issue of cloud asset management with an “infrastructure as code” solution has raised $23 million in funding. That comes on the heels of strong demand for its tech and increasing revenue fourfold in 2023. The firm’s latest success also comes on the heels of tragedy, as co-founder CTO Joseph “Sefi” Genis was among the hundreds killed by Hamas in October 2023 at the now-infamous Nova music festival. The firm finds itself at the intersection of technology and major world events for the second time. Firefly was hatched in 2021 in…

Overview: In a newly observed scam, Check Point researchers found 200,000 phishing emails that abused URL information to obfuscate phishing links. The scam was first observed on January 21st, and remains ongoing, although the daily threat volume is decreasing. Geographically, 75% of these emails have been distributed in the US, while 17% were distributed in the EMEA region, and 5% were distributed in Canada. Why it matters: The cyber criminals behind this campaign aim to compromise as many organizations and individuals as possible. The hackers do not appear to target specific industries, rendering a wide spectrum of enterprises vulnerable to…

Here’s a look at the most interesting products from the past week, featuring releases from 1Password, Fortinet, Pangea, Privacera, and Veeam Software. Fortinet enhances FortiAnalyzer to deliver accelerated threat hunting and incident response FortiAnalyzer offers a streamlined entry point to scale an organization’s security operations center (SOC), providing broad coverage for both on-premises and cloud environments from a single platform. With ready-to-deploy capabilities that deliver complete control with centralized visibility, advanced threat detection, and automated incident response, organizations increase their agility and ability to expand SecOps coverage and use cases without adding complexity. 1Password helps MSPs boost security and streamline…

North Korea’s notorious Lazarus Group hackers reportedly hit the world’s second-largest cryptocurrency exchange, draining Bybit of almost $1.5 billion in digital assets in what’s being seen as the largest such heist in history.According to Bloomberg, crypto market observers on February 21 began seeing huge and suspicious withdrawals of Ether from the Dubai-based Bybit exchange, which the news organization said has more than $36 billion in daily average trading volume.Bybit CEO Ben Zhou took to X (formerly Twitter) to explain the attack, saying the attackers took control of a particular Ether cold wallet, adding that “Bybit Hot wallet, Warm wallet and…

What if your daily commute could transform into an interactive digital experience? In a bustling Osaka station, commuters may soon encounter real-time 3D digital guides as part of a new urban initiative. Mawari has partnered with Nankai Electric Railway Co., Ltd., Meta Osaka Co., Ltd., and e-stadium Co., Ltd. to launch Digital Entertainment City Namba, a project that will integrate AI-driven 3D avatars, extended reality (XR), and decentralized physical infrastructure (DePIN) across the city. The initiative will deploy AI agents capable of providing tourist guidance and customer service in public spaces using real-time 3D streaming and edge computing devices installed…

Imagine this: you wake up one morning to find that your bank account has been emptied overnight. Someone halfway across the world has accessed your account using a password you thought was secure. Incidents like these are unfortunately becoming more common, with identity theft and fraud cases steadily increasing over the last decade. This month is Cybersecurity Awareness Month, with the theme “Secure Our World,” which serves as a timely reminder to reassess and enhance your cybersecurity strategies against ever-evolving cyber threats. In an election year, the digital landscape becomes a breeding ground for cyber scams and malicious activities aimed…

Security Analyst, Malware Researcher, New Technology Researcher Evangelist Today’s endpoint defense landscape on the Windows desktop platform is rich with product offerings of quite sophisticated capabilities. Beyond the world of antivirus products, Extended Detection and Response (XDR), and complementary behavioral analysis approaches provide a broad coverage of both initial access malware techniques, as well as post exploitation activity detection. Anybody participating in Red Teaming activities today will tell you that gaining initial access through the execution of some binary artifact is much harder now than ever before. Even if access is gained on a Windows desktop platform, post exploitation activities…