By Waqas
If you are using an iPhone, it is time to update it to the latest version RIGHT NOW!
This is a post from HackRead.com Read the original post: Update NOW! Pegasus Spyware Exploit Found in iPhones Running Latest iOS

**Apple issues an urgent security update as the Pegasus spyware exploit is found targeting iPhones without any user interaction.**

Apple has issued an urgent security update to fix a zero-click vulnerability that was being used to deliver NSO Group’s Pegasus spyware to iPhones.

The vulnerability, which was discovered by Citizen Lab, is known as BLASTPASS. It allows attackers to compromise iPhones running the latest version of iOS (16.6) without any interaction from the victim.

The exploit involves PassKit attachments containing malicious images sent from an attacker’s iMessage account to the victim. When the victim opens the attachment, the malicious code is executed and the device is infected with Pegasus spyware.

Pegasus is a powerful spyware that can be used to track a victim’s location, record their calls and messages, and even access their camera and microphone. It has been used by governments to target journalists, activists, and political opponents.

Apple has released a security update that fixes the BLASTPASS vulnerability. The update is available for all iPhones running iOS 16.6 and later.

In a blog post, Citizen Lab also urged users to enable Lockdown Mode, a new feature that provides additional security protections for users who may be at risk of targeted attacks. Lockdown Mode disables a number of features on the iPhone, including iMessage attachments, wired connections, and Face ID authentication with unknown devices.

Citizen Lab on X (Twitter)

The BLASTPASS vulnerability is a serious security issue, but Apple’s quick response and patch cycle should help to protect users. The discovery of the vulnerability also highlights the importance of supporting civil society organizations, which often play a vital role in identifying and exposing these types of threats.

Here are some additional tips for protecting your iPhone from malware and other cyberattacks:

*   Keep your software up to date.
*   Only download apps from trusted sources.
*   Use a strong password and enable two-factor authentication.
*   Be careful about what links you click on and what files you open.
*   Be suspicious of any emails or messages that ask for personal information.

1.  QuaDream: Israeli Cyber Mercenary Behind iPhone Hacks
2.  Israeli spyware used in hacking phones of journalists globally
3.  Android Version of Sophisticated Pegasus Spyware Discovered
4.  Israeli Spyware Vendor Uses Chrome 0day to Target Journalists
5.  European Spyware Vendor Offering Android and iOS Device Exploits

Update NOW! Pegasus Spyware Exploit Found in iPhones Running Latest iOS

By Deeba Ahmed
Microsoft has shared its findings related to the Outlook breach in July in a write-up titled “Results of Major Technical Investigations for Storm-0558 Key Acquisitions.”
This is a post from HackRead.com Read the original post: Microsoft: How Chinese Hackers Stole Signing Key to Breach Outlook Accounts

In July 2023, Hackread.com reported, based on Microsoft’s findings, that Chinese hackers from the Storm-0558 ATP group had hacked European government emails. They accomplished this by using forged authentication tokens and an acquired Microsoft account (MSA) consumer signing key. Microsoft has now revealed how this breach occurred.

**RELATED ARTICLES**

*   **Chinese hackers stole a signing key from a Microsoft software dump.**

*   **The key was used to forge tokens for Outlook.com and Outlook Web Access.**

*   **The hackers gained access to email accounts of around 25 US organizations, including government agencies.**

*   **Microsoft has fixed the bugs that allowed the breach to happen.**

*   **Users should still be vigilant and take steps to protect their accounts.**

On Wednesday, Microsoft published an incident post-mortem report to explain how the Chinese threat actor Storm-0558 obtained the MSA cryptographic consumer key, forged tokens for Outlook.com and Outlook Web Access accepted by enterprise systems, and broke into US organizations accounts. 

In that breach, the Chinese spying group gained access to email accounts of around 25 US organizations, including government agencies, through exploiting a security flaw in Microsoft Cloud platform. The Washington Post reported that US State Department officials and Commerce Secretary Raimondo’s email accounts were breached in that incident.

Microsoft admitted that Storm-0558 stole the key from a software dump that crashed in April 2021. The key was leaked accidentally when the computer crashed, and the machines generated a crash dump report.

“The crash dumps, which redact sensitive information, should not include the signing key. In this case, a race condition allowed the key to be present in the crash dump,” the report read.

Microsoft explained that when this error occurred, the machine failed to redact the key from the file because of a software flaw. It also admitted that the dump shouldn’t have included the digital key in the first place.

Microsoft noted that it always isolates all the computers holding signing keys, and these machines don’t contain several key internet-based services like email or video conferencing.

However, the crash dump report created a dent in its security mechanisms because the unredacted file was passed automatically to an internet-connected Microsoft computer used to perform debugging.

The issue occured because Microsoft’s systems didn’t detect the key’s presence in the crash dump. This issue was later fixed by Microsoft and the dump was shifted from the isolated production network into its debugging environment on the “internet-connected corporate network,” as part of the company’s standard debugging process.

But the Windows giant is still figuring out how the Chinese threat actors gained access to the key. The company suspects that the group had access to an already compromised Microsoft engineer’s corporate account that provided access to the debugging environment where the crash dump was present.

It is worth noting that the signing key couldn’t be used for enterprise accounts, targeted by the hackers, because it was designed for consumer Microsoft accounts. Here Microsoft’s failure is evident.

The company didn’t update a critical software library to validate key signing signatures automatically between consumer and enterprise accounts. Its mail system developers believed that libraries performed complete validation and didn’t add necessary issuer/scope validation. This allowed the mail system to accept a request for enterprise email using a security token signed with that consumer key.

However, the company asserts that it has now fixed the bugs and processes that let the hackers carry out the breach, including improving its detection systems and preventing sensitive data from mistakenly getting added to crash dump files.

**Key Points to Understand**

*   The signing key is a digital certificate that is used to sign email messages and other Microsoft services.

*   The hackers were able to steal the key from a software dump that was created when a Microsoft computer crashed.

*   The key was not supposed to be included in the crash dump, but a software flaw allowed it to be included.

*   The hackers used the key to forge tokens that allowed them to access Outlook.com and Outlook Web Access accounts.

*   Microsoft has fixed the bug that allowed the key to be included in the crash dump.

*   Microsoft has also updated its systems to prevent sensitive data from being mistakenly added to crash dump files.

**RELATED ARTICLES**

1.  Chinese APT group spying on Vietnam military with FoundCore RAT
2.  Chinese Hackers Using Stolen Ivacy VPN Certificate To Sign Malware
3.  Chinese APT Slid Fake Signal and Telegram Apps onto Official App Stores
4.  Microsoft: Chinese APT Flax Typhoon uses legit tools for cyber espionage
5.  Chinese Smishing Triad Gang Hits US Users in Extensive Cybercrime Attack

Microsoft: How Chinese Hackers Stole Signing Key to Breach Outlook Accounts

By Waqas
IBM, a service provider to Johnson & Johnson Health Care Systems, Inc., has notified customers and users of…
This is a post from HackRead.com Read the original post: IBM Notifies Janssen CarePath Customers of Data Breach

*   **Janssen CarePath data breach exposed names, contact info, insurance info, and medication data.**

*   **IBM disabled a “technical method” used to gain unauthorized access.**

*   **Complimentary 1-year credit monitoring is offered.**

*   **Janssen CarePath users should monitor account statements.**

*   **Data breach is a reminder to protect personal info.**

IBM, a service provider to Johnson & Johnson Health Care Systems, Inc., has notified customers and users of the Janssen CarePath patient support platform of a data breach that may have exposed personal information.

The breach involved unauthorized access to a database used by Janssen CarePath. The information that may have been compromised includes individuals’ names and one or more of the following: contact information, date of birth, health insurance information, and information about medications and associated conditions. Social Security numbers and financial account information were not contained in the database or affected.

IBM said that it was notified of the issue by Janssen on August 2, 2023 and that it promptly worked with the database provider to disable the technical method that was used to gain unauthorized access. IBM also augmented security controls to reduce the chance of a similar event occurring in the future.

While there is no indication that any of the involved information has been misused, a complimentary one-year credit monitoring service is being offered to individuals whose information may have been involved. Individuals can arrange for credit monitoring by following the instructions in the notification letters that they receive or by calling the dedicated call center.

Janssen CarePath users are encouraged to remain vigilant by regularly reviewing their account statements and explanations of benefits from their health insurer or care providers with respect to any unauthorized activity and to promptly report any suspicious activity.

In response to the news, William Wright, CEO of Closed Door Security told Hackrad.com that, “IBM hasn’t provided information around how the database was accessed, however, by saying it identified a ‘technical method’, this sounds like it could have been via an unpatched vulnerability, or a failure to properly secure the database against external access.”

“Organisations must run regular pen tests on their assets to identify unpatched vulnerabilities and to spot network blind spots that could be exploited by adversaries. These security assessments must be attack-driven, where all the different routes an attacker could take to infiltrate the network are tested and sealed. Otherwise, as we are seeing here, it won’t be long before an adversary identifies and exploits them,” William added.

“IBM is clearly still investigating the incident, but the data potentially exposed could be a gold mine for attackers. Healthcare data is the most valuable information on the dark web, so attackers have multiple ways to monetise from it – either by selling it or exploiting victims further,” he wanted. “IBM must communicate with those impacted as a matter of urgency because they need to be on guard for further attacks.”

The data breach is the latest in a series of high-profile security incidents affecting healthcare organizations. In recent months, there have been data breaches at Apria, LabCorp, Quest Diagnostics, and Anthem.

The Janssen CarePath data breach is a reminder of the importance of data security in the healthcare industry. Healthcare organizations should take steps to protect patient data, including implementing strong security controls and conducting regular security assessments.

IBM Notifies Janssen CarePath Customers of Data Breach

By Waqas
Key Findings ProtonMail, a popular Swiss-based email service that markets itself as a secure and private alternative to…
This is a post from HackRead.com Read the original post: ProtonMail Code Vulnerabilities Leaked Emails

**Key Findings**

*   **The vulnerabilities were found in the ProtonMail web app, which is used by most ProtonMail users.**

*   **The vulnerabilities could allow attackers to inject malicious code into the web app.**

*   **The malicious code could then be used to steal emails.**

*   **ProtonMail has released a fix for the vulnerabilities.**

ProtonMail, a popular Swiss-based email service that markets itself as a secure and private alternative to Gmail and other major email providers, has been found to have multiple code vulnerabilities that could allow attackers to leak emails.

The vulnerabilities were discovered by cybersecurity researchers at SonarSource, a company that provides code analysis tools. The researchers found that the vulnerabilities could allow attackers to inject malicious code into ProtonMail’s web app, which could then be used to steal emails.

PoC of the vulnerability

ProtonMail is a popular email service with over 77 million users, including many journalists, activists, and whistleblowers. The service is known for its strong security features. However, these vulnerabilities could make it easier for attackers to target ProtonMail users, who are often at risk of surveillance and harassment.

ProtonMail has acknowledged the vulnerabilities and has released a fix. The vulnerabilities are the latest in a series of security issues to affect ProtonMail. In September 2021, the ProtonMail Web Client was found to be exposed to a denial-of-service vulnerability.

Proton AG, the company that runs ProtonMail, has a detailed vulnerability disclosure page that showcases the issues and fixes for all of the company’s products. This page is a valuable resource for security researchers and ProtonMail users, as it allows them to stay up-to-date on the latest security vulnerabilities and fixes.

ProtonMail has said that it is committed to security and that it is constantly working to improve the security of its service.

Summary of the exploit flow

A plethora of technical details are available on SonarSource’s blog post here.

If you are a ProtonMail user, you should update your app to the latest version. You should also be careful about what emails you open and what links you click on. If you think that your account may have been compromised, you should change your password immediately.

ProtonMail Code Vulnerabilities Leaked Emails

By Owais Sultan
GAM3S.GG Secures $2M Seed Funding Led by Mechanism Capital to Grow Web3 Gaming Superapp.
This is a post from HackRead.com Read the original post: GAM3S.GG Raises $2M to Grow Web3 Gaming Superapp

GAM3S.GG, formerly Polkastarter Gaming, has closed a  $2 million seed funding round, led by Mechanism Capital with the participation of other major venture and angel investors.

The seed round fundraiser coincides with a rebrand of the project to align with its new vision. The full list of investors also includes Polygon, Double Peak, ArkStream Capital, LD Capital, ROK Capital, Hyperithm, Snackclub, Emurgo Ventures, Eden Ventures, MixMarvel DAO Venture, 4SV, CommonWealth Capital, Venly Ventures, TKX Capital, SkyVision Capital, Compute Ventures and MarketAcross, as well as several angel investors in the Web3 gaming space.

The raise will serve to scale and grow the GAM3S.GG gaming superapp — dubbed the “IGN for web3” by investors and partners. The platform currently offers curated Web3 gaming content, with 200+ games listed across 15 chains, and over 60,000+ registered gamers, positioning itself as the biggest hub for Web3 gamers since its launch in November 2022.

“Web3 games are a uniquely difficult product to build, let alone the infrastructure surrounding and enabling it. This holds especially true for gaming hubs and aggregators,” said Ken, Partner at Mechanism Capital. “Finding the win will require teams to take us past the feature sets we have been stuck with for years, and the ability to understand incumbent playbooks and evolve them with aggressive experimentation. We see that here with this squad – now it’s just a matter of time for players to make their way to GAM3S.GG.” added Ken.

Throughout 2023, we have seen more gaming industry giants test the waters of web3 gaming, with the likes of Zynga and Ubisoft working on web3-native games, Sugartown and Champions Tactics: Grimoria Chronicles respectively. With new gamers entering the space, the a necessity for an aggregator like GAM3S.GG is growing by the day.

Moreover, gamers’ sentiment towards web3 gaming is shifting, and GAM3S.GG is building the hub to enable newcomers and natives alike to explore new frontiers and experiences within one single web3 gaming superapp.

“The gaming industry is at a crossroads; while Web3 offers new exciting possibilities, the lack of quality content and a singular destination for all your Web3 gaming needs has left many gamers lost,” said Omar Ghanem, Co-Founder & CEO at GAM3S.GG.

GAM3S.GG has seen thousands of registered gamers exploring its selection of curated content focused on next-gen Web3 games since its inception. Last December, the platform hosted the first and largest web3 game award show – the GAM3 Awards, which saw over 250,000 votes and 140,000 unique viewers tune into the streamed event.

Now, the platform aims to continue building advanced features to eliminate barriers to entry for blockchain games, including social logins, player-owned item management, progression rewards, retrospective in-game progress tracking, as well as directly playing Web3 games on the platform.

“Traditional gaming has its IGN and Kotaku, yet the industry isn’t ready for the change that blockchain-powered titles present; and if we wait for them to step in, we’d lose potential early adopters and valuable progress — and that’s why GAM3S.GG was born,” added Ghanem. “We’re not just curating; we’re spotlighting the top games, setting the gold standard, and allowing gamers to engage with games in unprecedented ways as we aim to become the definitive home of Web3 gaming.” 

The team’s mission for GAM3S.GG is to help Web3 gaming reach 100 million users through its platform and content and continue its evolution as the trusted gateway for gamers looking to explore the possibilities of blockchain-powered games through upcoming features that aim to bring all your Web3 gaming needs under one roof.

“There’s immense value in platforms that curate and guide, particularly at early stages in new niches, and while we’ve seen plenty of platforms & aggregators rise over the years, GAM3S.GG stands out as a beacon of innovation in Web3 gaming,” said Shreyansh Singh, Head of Investments at Polygon. “We’ve worked closely with the team over the past 18 months and investing in them isn’t just about backing a platform; it’s about championing a vision where Web3 gaming is accessible, quality games rise above the noise, and where gamers have a trusted compass in this new frontier.”

This is only the beginning of the GAM3S.GG journey and the industry is still in its infancy. With several household names entering the blockchain gaming world more often, the platform will serve as the gateway for all gamers to enjoy Web3 games to their maximum potential with all the content they need.

**About GAM3S.GG**

GAM3S.GG is a Web3 gaming superapp that curates and creates content to spotlight the top games and showcases reviews, guides, news, quests, annual awards, and more. Its vision is to become the one-stop-shop for Web3 gaming to help onboard millions of gamers, allowing them to engage with blockchain-powered games in unprecedented ways, and becoming the ultimate bookmark on every gamer’s device. 

1.  What is Blockchain Gaming and its Play-to-Earn Model?
2.  The Rise of Blockchain Gaming and Secure Marketplaces
3.  5 Ways Smart Contracts Are Making A Real-World Difference
4.  AS Roma’s Paulo Dybala is the new face of Web3 soccer game
5.  Korea Blockchain Week 2023: Presenting Web3’s Leading Voices

GAM3S.GG Raises $2M to Grow Web3 Gaming Superapp

By Deeba Ahmed
FortiGuard Discovers Phishing Campaign Distributing New Agent Tesla Variant to Windows Devices.
This is a post from HackRead.com Read the original post: New Agent Tesla Variant Uses Excel Exploit to Infect Windows PCs

The new Agent Tesla variant exploits CVE-2017-11882/CVE-2018-0802 vulnerability to execute the malware. 

**Key Findings**

*   **A new variant of the Agent Tesla malware family is being used in a phishing campaign.**

*   **The malware can steal credentials, keylogging data, and active screenshots from the victim’s device.**

*   **The malware is spread through a malicious MS Excel attachment in phishing emails.**

*   **The malware exploits an old security vulnerability (CVE-2017-11882/CVE-2018-0802) to infect Windows devices.**

*   **The malware ensures persistence even when the device is restarted or the malware process is killed.**

**New Agent Tesla Variant Detected in Malicious Phishing Campaign**

FortiGuard Labs threat researchers have detected a new variant of the notorious Agent Tesla malware family used in a phishing campaign. Report author Xiaopeng Zhang revealed that the malware can steal “credentials, keylogging data, and active screenshots” from the victim’s device. Stolen data is transferred to the malware operator through email or SMTP protocol. The malware mainly infects Windows devices.

For your information, Agent Tesla malware is also offered as a Malware-as-a-Service tool. The malware variants use a data stealer and .NET-based RAT (remote access trojan) for initial access.

**How Phishers Trap Users?**

This is a phishing campaign, so initial access is gained through a phishing email designed to trick users into downloading the malware. The email is a Purchase Order notification that asks the recipient to confirm their order from an industrial equipment supplier.

The email contains a malicious MS Excel attachment titled Order 45232429.xls. This document is in OLE format and contains crafted equation data that exploits an old security RCE vulnerability tracked as CVE-2017-11882/CVE-2018-0802 instead of using a VBS macro.

This vulnerability causes memory corruption in the EQNEDT32.EXE process and allows arbitrary code execution through ProcessHollowing method, in which a hacker replaces the executable file’s code with malicious code.

A shellcode download/execute the Agent Tesla file (dasHost.exe) from this link “hxxp://2395.128.195/3355/chromium.exe” onto the targeted device. It is a .NET program protected by IntelliLock and .NET Reactor. Relevant modules are encrypted/encoded in the Resource section to prevent its core module from detection and analysis.

It is worth noting that Microsoft released fixes for this vulnerability in November 2017 and January 2018. However, it is still being exploited by threat actors indicating the presence of unpatched devices. Per FortiGuard research, they observe around 1300 vulnerable devices daily and mitigate 3,000 attacks at the IPS level per day.

The phishing email and the ShellCode identified by the researchers (Screenshots: FortiGuard Labs)

**Analysis of Agent Tesla Activities**

According to FortiGuard Labs’ report, published on 5 Sep 2023, Agent Tesla variant steals stored credentials from web browsers, email clients, FTP clients, etc. There is a long list of targeted software and email clients available here.

The malware sets a keyboard hook through the API SetWindowsHookEx() to monitor low-level keyboard inputs and calls the callback hook procedure “this.EiqpViCm9()” whenever the victim types something on the device. The malware steals the program title, time, and input contents at regular intervals. A Timer calls a method to check the log.tmp file every 20 seconds and sends the info to the attacker via STMP. Moreover, the malware uses another Timer with a 20-minute interval to check for device activities and determine when to capture screenshots.

**How does Agent Tesla maintain persistence?**

Agent Tesla malware ensures persistence even when the device is restarted, or the malware process is killed, using two methods. It either executes a command for creating a task in the TaskScheuler system in the payload module or adds an auto-run item in the system registry. These methods allow duplication of dasHost.exe to launch automatically when the system restarts.

**Protection against such campaigns**

**Be suspicious of any email that asks for your personal or financial information:** Phishing emails often try to trick you into giving up your passwords, credit card numbers, or other sensitive information. Never click on links or open attachments in emails from senders you don’t know or trust.

**Keep your software up to date**: Software updates often include security patches that can help protect you from malware. Make sure to install security updates as soon as they are available.

**Use a strong antivirus and anti-malware program**: Antivirus and anti-malware programs can help detect and remove malware from your computer. Keep your antivirus and anti-malware programs up to date and scan your computer regularly.

**Be careful what you click on**: Phishing emails often contain links that lead to malicious websites. If you click on a link in an email, make sure to check the URL carefully before visiting the website.

**Use a spam filter**: A spam filter can help reduce the number of phishing emails that you receive.

**Educate yourself about phishing**: The more you know about phishing, the better you will be able to spot it. Read up on phishing scams and how to protect yourself.

1.  Hackers leak logins of vulnerable Fortinet SSL VPNs
2.  Hackers Using Stolen Ivacy VPN Certificate To Sign Malware
3.  Smoke Loader Drops Location Tracker Whiffy Recon Malware
4.  Luna Grabber Malware Hits Roblox Devs Using npm Packages
5.  Chae$4 Malware Steals Login, Financial Data from Businesses
6.  Adobe ColdFusion Vulnerabilities Exploited to Deploy Malware

New Agent Tesla Variant Uses Excel Exploit to Infect Windows PCs

By Habiba Rashid
Meet Chae$4 malware: the new and even harder-to-detect variant of the infamous Chaes malware.
This is a post from HackRead.com Read the original post: New Chae$4 Malware Steals Login, Financial Data from Businesses

**KEY FINDINGS**

*   **Chae$4 is a new and advanced malware variant that targets customers of financial and logistics companies in Latin America.**

*   **The malware is difficult to detect because it uses sophisticated encryption techniques and stealth mechanisms.**

*   **Chae$4 can steal login credentials, financial data, and other sensitive information.**

*   **The malware is spread through malicious MSI installers, often disguised as legitimate application installers.**

Morphisec, a leading cybersecurity firm, has discovered a new and advanced variant of the Chaes malware targeting customers of financial and logistics companies in Latin America. This article delves into the mechanics of this evolved malware, dubbed Chae$4 as well as its implications, and strategies for businesses to safeguard against it.

The Chaes malware first emerged in November 2020 primarily targeting e-commerce customers in Latin America, particularly Brazil. The malware had been active since at least mid-2020, making its presence known by targeting unsuspecting victims.

The latest variant, Chae$4, marks a significant evolution in its capabilities. Chae$4 malware features a more sophisticated code structure advanced encryption techniques and stealth mechanisms, making it even harder to detect.

According to a report shared by Morphisec to Hackread.com, Chae$4 malware predominantly uses Python, employing decryption and dynamic in-memory execution, therefore evading traditional defence systems. The malware has abandoned Puppeteer in favour of a bespoke approach to monitor and intercept Chromium browsers’ activities.

Chae$4 targets a broader range of services, including prominent platforms and banks such as Mercado Libre, Mercado Pago, WhatsApp Web, Itau Bank, Caixa Bank, and even MetaMask.

The new variant employs WebSockets for primary communication between its modules and the Command and Control (C2) server. In addition to this, Chae$4 uses a Domain Generation Algorithm (DGA) for the dynamic resolution of the C2 server’s address.

The Chae$4 malware comprises several modules, each serving a specific purpose. These modules include:

*   _**Init Module**_: This module initiates communication with the attacker, gathering extensive data about the infected system.

*   _**Online Module**_: It functions as a beacon, informing the attacker of the infected system’s activity status.

*   _**Chronod Module**_: Responsible for stealing credentials, this module targets browser activities, including login data and financial information including BTC, ETH and PIX transfers.

*   _**Appita Module**_: Similar to the Chronod module, this one specifically focuses on targeting Itau Bank’s application.

*   _**Chrautos Module**_: An advanced version of Chronod and Appita modules, it offers better code architecture and enhanced capabilities.

*   _**Stealer Module**_: This module specializes in stealing data from Chromium-based browsers, including login data, credit card details, cookies, and autofill information.

*   _**File Upload Module**_: This recent addition allows the malware to search for and upload specific files, such as those related to the MetaMask’s Chrome extension.

The infection typically starts with the execution of a malicious MSI installer, often disguised as a legitimate application installer. The malware then deploys and downloads necessary files to establish persistence on the infected system.

The core component, ChaesCore, is responsible for setting up persistence and migrating into legitimate processes. Once initialized, ChaesCore communicates with the C2 server and downloads additional modules as required. Communication is encrypted to hide its activities.

Components of Chae$4 malware

The MSI installer contains obfuscated JavaScript and PowerShell scripts that establish the malware’s working directory and downloads essential files. The Module Wrapper decrypts and dynamically loads modules, executing their malicious code.

Different modules focus on stealing various types of data, such as login credentials, personal information, and financial data. 

Chae$4 malware is a serious threat, but by taking steps to protect yourself, you can help to keep your data safe. In addition to the information above, here are some other things to keep in mind about Chae$4:

*   The malware is still under development, so new features or capabilities may be added in the future.

*   The malware is targeted at a specific region, but it is possible that it could be used to target other regions in the future.

*   The malware is constantly evolving, so it is important to stay up-to-date on the latest information about it.

New Chae$4 Malware Steals Login, Financial Data from Businesses

By Owais Sultan
Tel Aviv, Israel, Sep 05, 2023 — Reflectiz, a cybersecurity company specializing in continuous web threat management offers…
This is a post from HackRead.com Read the original post: Holiday Season Cyber Alert: Reflectiz Declares War on Magecart

_Tel Aviv, Israel, Sep 05, 2023_ — Reflectiz, a cybersecurity company specializing in continuous web threat management offers an exclusive, fully remote solution to battle Magecart web-skimming attacks, a popular type of cyberattack involving injecting malicious code into the checkout pages.

As the Holiday Season approaches, online retailers face the challenge of protecting their websites against the growing threat of malicious attacks, such as Magecart. However, they struggle to add new security layers due to restrictions on modifying their website code to avoid impacting website performance during the peak shopping season.

**Reflectiz, a unique web security tool,** **ensures 100% readiness** **for Magecart attacks before and during the Holiday Season.** This is made possible by Reflectiz’s external, non-intrusive solution, requiring no code implementation or IT resources. Your website(s) will be fully protected within days, and there will be no impact on your website performance whatsoever. 

Reflectiz automatically detects third-party code changes, keylogging, and communication with malicious domains to prevent Magecart web-skimming attacks. It overcomes the most sophisticated malware obfuscation techniques, lets you track changes, prioritize issues, and implement alerts according to their severity level, empowering you to act before the damage is done.

Despite being so powerful, Reflectiz does not affect website performance. It has zero impact on your IT resources, and it does not require any installation on the client. It begins protecting your web assets within days, ensuring continuous monitoring of all crucial and sensitive web pages, not just checkout pages. 

_“Reflectiz understands the challenges faced by online retailers during this busy time of the year. In fact, in 2023, Reflectiz detected Magecart attacks on more than 150 websites, and the count is still rising. Our advanced technology enables the automatic detection of sophisticated threats throughout your entire online environment, all with quick and easy external implementation. You will be up and running within days” – Ysrael Gurt, Co-founder & CTO, Reflectiz_

Sign up for our exclusive offer today, and get the ideal head start in the war on Magecart.

**Contact**

*   **Daniel Sharabi**
*   **Marketing Director**
*   **Reflectiz**
*   **daniel.s@reflectiz.com**

Holiday Season Cyber Alert: Reflectiz Declares War on Magecart

By Owais Sultan
Technology enhances our lives, but it also leaves us vulnerable to unprecedented cyber threats. 
This is a post from HackRead.com Read the original post: Gcore Thwarts 500 Million PPS DDoS Attack on Gaming Company

Enter Gcore, the unsung cybersecurity hero, recently thwarted a staggering 500 million packets per second (PPS) DDoS attack on a gaming company. 

As we delve into the heart of this article, prepare to uncover the fascinating world of Distributed Denial of Service attacks (DDoS attacks), witness the monumental scale of Gcore’s intervention, and grasp the critical importance of cybersecurity in preserving the integrity of our online experiences.

**Gcore’s Role in Cybersecurity: Mitigating DDoS Threats**

Gcore emerges as a leading player in cybersecurity, with a specialized focus on combating Distributed Denial of Service attacks. With cyber threats becoming more sophisticated, Gcore DDoS protection solutions have become crucial.

**ExpertBBise in Handling Large-Scale DDoS Attacks**

Gcore’s prowess lies in its ability to effectively tackle substantial and complex DDoS attacks. These attacks, designed to overwhelm online services, require intricate strategies and technologies for successful mitigation.

Gcore employs dedicated teams of cybersecurity experts with hands-on experience handling various DDoS attacks. Gcore’s experts utilize advanced analytics to identify attack patterns, anticipate potential threats, and implement countermeasures.

**Solutions and Technologies for DDoS Mitigation**

By employing sophisticated traffic analysis techniques, Gcore identifies and filters out malicious traffic, allowing legitimate users to access the services without disruption. Their Anycast network spreads incoming traffic across multiple geographically distributed data centers. This reduces the impact of DDoS attacks by distributing the load. Their cloud infrastructure distributes attack traffic across multiple points, preventing any single point of failure.

**The Attack on the Gaming Company**

The gaming company faced an unprecedented DDoS attack, unleashing 500 million packets per second. This surge overwhelmed the company’s network infrastructure, causing widespread disruption.

The attackers likely employed a botnet, harnessing thousands of compromised devices to flood the company’s servers with massive malicious traffic. The scale and intensity of the attack made it difficult to mitigate.

**Potential Risks and Consequences**

Let’s take a look at some more detrimental consequences and risks.

**Service Disruption**

The attack resulted in severe service disruption, causing widespread outages and rendering the gaming platform inaccessible to users. This undermined user trust and satisfaction, impacting the company’s reputation.

**Financial Loss**

Extended downtime translates to financial loss, including lost revenue, operational expenses related to recovery efforts, and potential legal costs if user data is compromised.

**Gcore’s Response and Mitigation: Countering the DDoS Onslaught**

Gcore’s swift response to the DDoS attack demonstrates their commitment to safeguarding their clients’ digital infrastructure. Their proactive involvement was instrumental in mitigating the attack’s impact.

**Strategies and Methodologies Employed**

Gcore’s team thoroughly analyzed the incoming traffic to identify malicious patterns and sources. This enabled them to differentiate legitimate traffic from attack traffic. Leveraging advanced filtering technologies, Gcore’s experts filtered out malicious traffic while allowing legitimate users to access the services seamlessly.

By intelligently distributing incoming traffic across multiple servers, Gcore minimized the risk of overload on any single server, ensuring smooth operations even during the attack.

**Effectiveness of Gcore’s Approach**

Gcore’s strategic approach to DDoS mitigation showcased its efficacy during the attack. By promptly analyzing, filtering, and distributing traffic intelligently, they could maintain service availability, prevent downtime, and minimize disruptions to client operations.

**Significance of the Successful Mitigation: Safeguarding the Digital Realm**

In this section, we will analyze Gcore’s success, how it helps businesses and the implications of using its services.

**Analysis of Gcore’s Success**

Gcore’s successful mitigation of the massive DDoS attack underscores its robust infrastructure and expertise in cybersecurity. Analyzing their approach reveals insights into effective cyber defence strategies. They can swiftly respond to the attack by redistributing traffic and neutralizing threats, showcasing their preparedness and agility in dealing with evolving cyber threats.

**Implications for the Gaming Industry and Beyond**

The mitigation’s success highlights the need for collaboration among gaming companies, cybersecurity experts, and law enforcement agencies to combat cyber threats collectively.

Conversely, Gcore’s success sets a precedent for the gaming industry and other potential targets. It emphasizes the critical importance of investing in advanced cybersecurity measures to thwart large-scale attacks.

**Gcore’s Role in Safeguarding Businesses**

Emphasize Gcore’s role as a cybersecurity expert, specializing in protecting businesses against evolving cyber threats, including DDoS attacks. Highlight Gcore’s cybersecurity solutions, including advanced DDoS protection, security audits, and ongoing monitoring. Discuss how these services contribute to overall cyber resilience.

**Conclusion**

Gcore’s triumph in thwarting a massive DDoS attack on a gaming company showcases the power of expert cybersecurity. As we traverse the complexities of online safety, Gcore’s ability to safeguard digital landscapes becomes more than just a service—it becomes a necessity. 

Their strategic response protected the gaming realm and set a powerful example for industries at risk. With Gcore at the helm, businesses can stride confidently into the digital future, knowing their defences are fortified against the unseen.

Gcore Thwarts 500 Million PPS DDoS Attack on Gaming Company

By Waqas
The Freecycle data breach is the latest in a string of high-profile security incidents affecting online platforms in the United Kingdom.
This is a post from HackRead.com Read the original post: Freecycle Data Breach Impacts 7 Million Users

Freecycle is yet another UK-based platform to experience a data breach. Recently, several notable names, including the UK Air Traffic Control System, the Met Police IT Contractor, and the IT Firm Swan Retail, have also fallen victim to data breaches.

Freecycle, an online forum for giving and receiving unwanted items, has confirmed that it suffered a data breach on August 30, 2023. The breach exposed the personal information of over 7 million users, including usernames, User IDs, email addresses, and MD5-hashed passwords.

The organization says that it has notified the “appropriate US authorities” of the incident, as well as the Information Commissioner’s Office (ICO) in the UK. Few details of what happened have been revealed, but Freecycle is advising all members to change their account passwords as a security measure.

“On August 30th we became aware of a data breach on Freecycle.org,” said Deron Beal, executive director of Freecycle. “As a result, we are advising all members to change their passwords as soon as possible. We apologize for the inconvenience and would ask that you watch this space for further pending background.”

Freecycle is yet another UK-based platform to experience a data breach. Recently, several notable names, including the UK Air Traffic Control System, the Met Police IT Contractor, and the IT Firm Swan Retail, have also fallen victim to data breaches.

The Freecycle data breach is a reminder of the importance of online security. Users should always use strong passwords and enable two-factor authentication whenever possible. They should also be careful about what information they share online.

If you are a Freecycle user, you should change your password immediately. You can also monitor your credit report for any signs of fraudulent activity.

*   Here are some additional tips for protecting your online security:
*   Use a different password for each online account.
*   Enable two-factor authentication whenever possible.
*   Be careful about what information you share online.
*   Keep your software up to date.
*   Be suspicious of any emails or messages that ask for personal information.

By following these tips, you can help to protect yourself from further attacks and embarrassment.