By Deeba Ahmed
The backdoors used in this campaign are never-before-seen malware strains called CommonMagic and PowerMagic.
This is a post from HackRead.com Read the original post: New Backdoor Attack Uses Russian-Ukrainian Conflict Phishing Emails

****The primary targets of this phishing campaign are located in the Ukrainian regions of Crimea, Donetsk, and Lugansk, which were annexed by Russia in 2014.****

Threat actors have launched a new spear phishing campaign in which they install a PowerShell-based PowerMagic backdoor and CommonMagic framework, according to a report by Kaspersky’s Global Research and Analysis Team.

The attackers send phishing emails containing malicious documents that lead to the installation of the backdoors. The primary targets of this campaign are located in the Ukrainian regions of Crimea, Donetsk, and Lugansk, which were annexed by Russia in 2014.

The emails are designed around the Russian-Ukrainian conflict, indicating that the attackers may have a specific interest in the regional geopolitical situation.

Example of the phishing email (Image credit: Kaspersky)

Kaspersky researcher Leonid Besverzhenko stated that the campaign is primarily an espionage operation targeting administrative, agricultural, and transportation organizations to steal sensitive data.

The phishing emails contain a URL that directs the victim to a ZIP archive containing a malicious LNK file disguised as a PDF. When the victim launches the file, their network is infiltrated, and PowerMagic establishes a connection with its C2 server using OneDrive and Dropbox folders, triggering infection through CommonMagic, a previously undiscovered “malicious framework.”

The CommonMagic framework includes separate modules for different tasks, such as encryption/decryption, screenshot capturing, and document stealing. It can also use plugins for stealing a wide range of files, including DOC, DOCX, XLS, XLSX, RTF, ODT, ODS, ZIP, RAR, TXT, and PDF from USB devices.

Additionally, it can take screenshots every three seconds by abusing the Windows Graphics Device Interface (GDI) API. Both malware have been in active use since September 2021, and Kaspersky discovered the campaign in October.

However, researchers have not yet been able to associate this campaign with a previously known actor. They do believe that an advanced threat actor is behind this campaign.

1.  Ukraine thwart Russian Industroyer 2 malware attack
2.  34 Russian hacking gangs stole 50m user passwords
3.  DDoS app meant to hit Russia infected Ukrainian phones
4.  CryWiper disguised as ransomware to hit Russian courts
5.  Data of Millions of Russians & Ukrainians Exposed Online

New Backdoor Attack Uses Russian-Ukrainian Conflict Phishing Emails

By Habiba Rashid
OpenAI has apologized and reached out to affected users about the potential data breach.
This is a post from HackRead.com Read the original post: ChatGPT Bug Exposed Payment Details of Paid Users

****Earlier, a ChatGPT bug exposed conversation histories to other users, but now reports indicate that the bug also exposed the payment details of paid users (ChatGPT Plus subscribers).****

OpenAI has confirmed that a software bug on Monday caused ChatGPT to expose conversation histories from random users and payment details for some paid users. As a result, the company has reached out to affected users and implemented measures to prevent similar incidents in the future.

The glitch was first reported on Monday when users attempting to subscribe to the paid ChatGPT Plus service noticed email addresses from random users appearing in the payment form.

Upon further investigation, OpenAI discovered that the glitch also exposed payment-related information of 1.2% of the ChatGPT Plus subscribers who were active during a specific nine-hour window.

The exposed payment details included the first and last name, email address, payment address, last four digits of a credit card number, and credit card expiration date of another active user. However, OpenAI has emphasized that full credit card numbers were not exposed at any time.

OpenAI believes that the chances of a stranger viewing this payment information are extremely low because the exposed details partly arrived through emails confirming the subscription of new ChatGPT Plus users on Monday morning between 1 a.m. and 10 a.m. Pacific Standard Time (PST). Certain subscription confirmation emails created within that time frame were delivered to incorrect recipients as a result of the glitch.

If a user accessed the “My Account” function on ChatGPT’s website and clicked on the “Manage my subscription” feature between 1 a.m. and 10 a.m., other payment details would have been visible to them.

In a blog post, OpenAI apologized to its users and reached out to affected users about the potential data breach. The company has also identified the cause of the leak, blaming it on a bug in an open-source library used to run a Redis database.

To prevent similar incidents from occurring, OpenAI has patched the ChatGPT bug and added safeguards to ensure requests to the Redis caches match the requesting user. OpenAI is confident that there is no ongoing risk to users’ data. In addition, the chat history sidebar appears to be restored on ChatGPT.

If you are currently a paid subscriber and believe that your payment information has been exposed, it is recommended that you monitor your account for any unauthorized activity and contact your bank if you suspect any fraudulent charges.

1.  OpenAI’s ChatGPT exploited to deploy malware
2.  Blackmamba malware developed with ChatGPT
3.  ARMO integrates ChatGPT to secure Kubernetes
4.  ChatGPT bug exposes conversation history titles
5.  Crooks pose as ChatGPT in a new phishing scam
6.  Fake ChatGPT Extension Hacks Facebook Accounts

I’m a student and cybersecurity writer. On a random Sunday, I am likely to be figuring out life and reading Kafka.

ChatGPT Bug Exposed Payment Details of Paid Users

By Waqas
The National Crime Agency (NCA) has conducted a sting operation to infiltrate the cybercrime market with fake DDoS sites for Operation Power Off.
This is a post from HackRead.com Read the original post: UK’s NCA infiltrates cybercrime market with fake DDoS sites

****The agency set up several fake DDoS sites offering DDoS-for-hire services to infiltrate the online criminal marketplace**.**

Remember when the Dutch police sent letters to those who bought “booters” from DDoS sites? The National Crime Agency (NCA) of the United Kingdom is doing something similar but in a tricky way.

The agency has launched a sting operation as part of Operation Power Off, a collaboration between international law enforcement agencies to take down DDoS (distributed denial of service) infrastructure.

The operation involved the NCA setting up several fake DDoS sites and offering DDoS-for-hire or booter services to infiltrate the online criminal marketplace. It is important to note that DDoS attacks are illegal in the UK under the Computer Misuse Act 1990.

The NCA designed all these sites to appear authentic, giving the visitor the impression that the tools and services offered would allow them to launch DDoS attacks.

The agency claims that several thousand people have visited these sites, but upon registering on the site, instead of getting the services, users are shown a splash page informing them that their data has been collected, and law enforcement agencies will contact them.

This is what is shown once a user registers an account (Image: NCA)

For foreign visitors (users outside the United Kingdom), their data is transferred to international agencies. For instance, if a user from the United States has registered on one of the fake DDoS sites, their details would be forwarded to the FBI.

According to the NCA‘s National Cyber Crime Unit’s Alan Merrett, booter services are currently under the agency’s radar because they serve as a potent enabler of cybercrime in the country and elsewhere.

Merrett noted that the perceived anonymity and ease of use provided by these services make DDoS an attractive entry-level crime, allowing individuals with little technical ability to commit cyber offences with ease.

> The perceived anonymity and ease of use afforded by these services mean that DDoS has become an attractive entry-level crime, allowing individuals with little technical ability to commit cyber offences with ease.”
> 
> Alan Merrett -NCA

Merrett added that the agency would not reveal the number of fake DDoS sites it is currently operating or how long the sting operation will last. Therefore, people looking for these services should be cautious as they might not know who is operating them.

1.  Admin of DDoS-For-Hire Service jailed for 2 Years
2.  Teen arrested for 8 DDoS attacks on school classes
3.  Tor Network Hit By a Series of Ongoing DDoS Attacks

I am a UK-based cybersecurity journalist with a passion for covering the latest happenings in cyber security and tech world. I am also into gaming, reading and investigative journalism

UK’s NCA infiltrates cybercrime market with fake DDoS sites

By Deeba Ahmed
According to the attorney general of Ecuador, a terrorism investigation has been launched after the incident took place in the country.
This is a post from HackRead.com Read the original post: Journalist Targeted in USB Drive Bombing Attack

****The USB drive was found to contain RDX, a military-grade explosive substance that was inside a capsule attached to the drive.****

We’ve heard about the Killer USB, which could fry a targeted laptop, but have you heard about a USB that can be used to donate money and physically harm victims? Lenin Artieda, a journalist and presenter at Ecuador’s national television network Ecuavisa, was injured in a pre-planned attack earlier this week.

In a report published by the local TV network Ecuavisa, Artieda received a package containing a USB drive, which exploded when he connected it to his computer to check its contents.

The package

The explosion injured him on his hands and face, indicating that the USB drive was designed to detonate after getting connected to a computer. The incident took place at Ecuavisa’s TV network’s newsroom, where Artieda received the package via mail.

In another report, Ecuavisa revealed that the USB drive was found to contain RDX, a military-grade explosive substance that was inside a capsule attached to the drive. The explosion did not cause any damage inside the newsroom, but Artieda suffered injuries.

Investigation into the incident revealed that only half of the RDX exploded because it was not fully activated, and it is speculated that the device pulled just enough voltage from the USB connector on the PC to make it detonate.

Two other journalists from different media outlets in Ecuador also received similar explosive USB drives, but the drives did not detonate when they were connected to their computers.

Furthermore, reportedly, four more letters containing similar devices were sent to other media outlets across Ecuador, but the targets remained unharmed because they did not open the packages or the devices did not explode.

> — FUNDAMEDIOS (@FUNDAMEDIOS) March 20, 2023

The police revealed that the device did not explode because it was inserted into an adapter that did not provide the same electrical charge as a computer.

The country’s attorney general has launched a terrorism investigation, as the use of military-grade explosives suggests a possible attempt to intimidate journalists. The attacker’s possible objectives and identity are still unclear, but the government has called it an aggressive act.

“Any attempt to intimidate journalism and freedom of expression is a loathsome action that should be punished with all the rigour of justice,” the government responded.

The incident highlights the danger journalists face when reporting the news and the need for adequate security measures to protect them.

1.  Hackers mailing USB drives to spread ransomware
2.  ‘BadPower’ attack on fast chargers burn smartphone
3.  BusKill USB cable switches off laptop in event of theft

Journalist Targeted in USB Drive Bombing Attack

By Habiba Rashid
Reportedly, Do Kwon was caught using falsified documents at an airport in the capital city of Montenegro.
This is a post from HackRead.com Read the original post: Do Kwon, Founder of Terraform Labs, Arrested in Montenegro

****According to Montenegro’s minister of interior Filip Adzic, Do Kwon was suspected of being “one of the most wanted fugitives.”****

Do Kwon, the co-founder and CEO of Terraform Labs, has been reportedly arrested. Kwon had been on the run for several months before being caught using falsified documents at an airport in Podgorica, the capital city of Montenegro.

Filip Adzic, Montenegro’s minister of interior, announced the arrest in a tweet, saying that Do Kwon was suspected of being “one of the most wanted fugitives” and that authorities were awaiting official confirmation of his identity.

Do Kwon

Kwon’s arrest came after he was accused of playing a major role in the $40 billion Terra/LUNA collapse, which had a significant impact on the cryptocurrency markets.

“Montenegrin police have detained a person suspected of being one of the most wanted fugitives, South Korean citizen Do Kwon, co-founder and CEO of Singapore-based Terraform Labs,” Adzic tweeted.

Kwon had been under investigation for the past 11 months since the collapse of the platform, and in September 2022, Interpol issued a red notice requesting law enforcement agencies worldwide to search for and arrest him.

In mid-February, the U.S. Securities and Exchange Commission also charged Terraform Labs and Kwon with defrauding U.S. investors who purchased its crypto assets, LUNA and the stablecoin Terra.

Kwon had denied claims that he was hiding from authorities, but prosecutors refuted those claims. The fact that he was caught using falsified documents at the airport suggests that he was indeed trying to evade authorities.

According to reports, Kwon had fled Singapore, where he had been living, and had made stops in Dubai and Serbia before being arrested in Montenegro. The Korean National Police Agency has confirmed that the suspect appears to be Kwon based on checking his age, name, and nationality on his ID card.

The collapse of the Terra stablecoin had a significant impact on the cryptocurrency markets, with about $40 billion being wiped out. Kwon has been accused of financial fraud, tax evasion, and violating South Korean capital market rules. He has denied these charges and claimed that they are politically motivated.

Kwon’s arrest has been welcomed by many who were affected by the collapse of the Terra platform. As more information about the arrest becomes available, it will be interesting to see how it affects the ongoing investigations and legal proceedings against Kwon and Terraform Labs.

The arrest of his alleged aide, Han Mo, is also a significant development in the case. It is likely that more information will come to light as the investigation progresses, shedding further light on the collapse of the Terra platform and the role played by Kwon and Terraform Labs.

This news is a reminder that the cryptocurrency industry is still largely unregulated and that investors need to be cautious when investing in digital assets. It is essential to conduct thorough research and due diligence before investing in any cryptocurrency to avoid significant losses.

The collapse of the Terra platform is just one example of the potential risks involved in the industry, and investors should be aware of these risks before investing.

1.  $3.6B worth of BTC seized from 2016’s Bitfinex hack
2.  Japanese boy arrested for developing crypto malware
3.  DoJ seizes $1B in BTC linked to Silk Road marketplace

I’m a student and cybersecurity writer. On a random Sunday, I am likely to be figuring out life and reading Kafka.

Do Kwon, Founder of Terraform Labs, Arrested in Montenegro

By Deeba Ahmed
At the time of reporting this scam to Google, the fake ChatGPT extension had over 7,000 installations.
This is a post from HackRead.com Read the original post: Fake ChatGPT Extension Hijacks Facebook Accounts

****In this campaign, attackers have used the legitimate ChatGPT for Google extension and added malicious code to it in order to steal Facebook session cookies.****

The cybersecurity researchers at Guardio have found a new info-stealing campaign exploiting ChatGPT, the popular AI chatbot from OpenAI. In this campaign, attackers are distributing fake ChatGPT extensions that promise to integrate the chatbot with your Google search results. In reality, it can steal your Facebook account.

The latest ChatGPT scam should not come as a surprise, as cybercriminals have been attempting to exploit the popularity of the AI chatbot since its launch last year. In January 2023, it was reported that several fake ChatGPT clone apps on the iOS and Play Stores were collecting user data and sending it to remote servers.

The fake ChatGPT extension (Guardio)

**Fake ChatGPT Extension Discovered**

In the newly discovered campaign, Guardio researchers noted that it is based on an open-source extension containing malicious code to force the product to function as per the attacker’s demands and make it difficult to detect it.

The fake extension is leveraged by the Chrome Extension API to obtain active Facebook cookies and send the data to the attacker’s server. Hackers can easily log into the victim’s Facebook account, change account credentials and create zombie accounts by converting profiles into a false persona “Lily Collins.” The accounts are then used to distribute malicious ads and propaganda campaigns.

**How Does the Attack Work?**

Attackers have used the legitimate ChatGPT for Google extension and added malicious code to it in order to steal Facebook session cookies. Users are lured to download the extension via fake sponsored search results.

When the user search for ChatGPT 4, you will click on a sponsored search result that will redirect you to a landing page offering to embed the chatbot inside your search results. After you have installed the extension from the official Chrome Web Store, it allows you access to ChatGPT in search results along with compromising your Facebook account.

Attack flow (Guardio)

“Looking at the “OnInstalled” handler function that is triggered once the extension is installed, we see the genuine extension just using it to make sure you see the options screen (to log in to your OpenAI account). On the other hand, the forked, turned malicious, code is exploiting this exact moment to snatch your session cookies,” the report read.

**How to Identify Fake Extension?**

Researchers explained that the fake add-on was most probably downloaded via a sponsored ad in Google search results for Chat GPT 4, just like Bitwarden and Radeon users were targeted earlier in 2023. This extension was downloaded from the Chrome Store between Feb 14 and Mar 22.

It has now been removed from the store. You can check if the ChatGPT for Google installed on your computer is fake or legit by clicking on the puzzle icon on the Chrome address bar’s right side. then click on Manage Extension> Details> View in Chrome Web Store.

If the official extension shows chatgpt4googlecom as its verified developer and boasts more than a million users then it is original else it is fake.

1.  OpenAI’s ChatGPT exploited to deploy malware
2.  Blackmamba malware developed with ChatGPT
3.  ARMO integrates ChatGPT to secure Kubernetes
4.  ChatGPT bug exposes conversation history titles
5.  Crooks pose as ChatGPT in a new phishing scam

Fake ChatGPT Extension Hijacks Facebook Accounts

By Habiba Rashid
Nexus contains a module equipped with encryption capabilities which point towards ransomware.
This is a post from HackRead.com Read the original post: New Android Botnet Nexus Being Rented Out on Russian Hacker Forum

****The developer of the Android botnet is rending out Nexus through a Malware-as-a-Service (MaaS) subscription for $3000 per month.****

A recent detailed technical analysis by Cleafy security researchers warns users about a new Android banking botnet called Nexus that was introduced by an individual on various underground hacking forums in January 2023.

The malware developer claimed that Nexus was entirely coded from scratch and that it could be rented out through a Malware-as-a-Service (MaaS) subscription for $3000 per month. 

MaaS is a business model employed by cybercriminals to rent or sell their malware to other parties, particularly those who lack the technical knowledge to develop their own malware. This model is widely used in the distribution of Android banking trojans, as malware authors leverage MaaS platforms to reach a broader audience.

Nexus is a banking Trojan that primarily targets banking applications installed on Android devices. Nexus contains all the main features to perform Account Takeover attacks (ATO) against banking apps from all over the world and cryptocurrency services.

It can perform overlay attacks, keylogging activities, and steal SMS messages to obtain two-factor authentication codes. Through the abuse of the Accessibility Services, Nexus can steal some information from crypto wallets, the 2FA codes of the Google Authenticator app, and the cookies from specific websites.

Nexus is also equipped with a mechanism for autonomous updating. It asynchronously checks against its C2 server for updates when the malware is running. If the value sent back from the C2 does not correspond to the one installed on the device, the malware starts the update process. Otherwise, it ignores the value and continues with all its routine activities.

The malware is distributed through a MaaS platform called “Nexus Botnet,” which allows attackers to customize and distribute the malware as per their needs. The platform offers various features, including control panel access, auto-update, and anti-analysis techniques, making it harder for security researchers to detect and mitigate the threat.

Despite its authors claiming that the source code was written entirely from scratch, some code similarity with SOVA, an Android banking trojan that emerged in mid-2021, suggests that they may have reused some parts of its internals.

This is what the malware developer has to say about the Nexus Android banking trojan (Image: Cleafy)

The SOVA author, who operates under the alias “sovenok,” called out an affiliate who rented SOVA previously for stealing the entire source code of the project. This event could explain why parts of the SOVA source code have been passing through multiple banking trojans.

Nexus also contains a module equipped with encryption capabilities which point towards ransomware. However, the company clarified that the module appeared to be undergoing development due to the presence of debugging strings and the lack of useful references. 

“At the time of writing, the absence of a VNC module limits its action range and its capabilities; however, according to the infection rate retrieved from multiple C2 panels, Nexus is a real threat that is capable of infecting hundreds of devices around the world. Because of that, we cannot exclude that it will be ready to take the stage in the next few months,” the advisory concluded.

1.  ‘Geost’ banking botnet hits Android devices
2.  New Matryosh DDoS botnet hits Android devices
3.  Cryptomining botnet malware hits Android devices
4.  Sockbot Malware Turns Android Devices into Botnet
5.  Viking Horde malware turns Android phones into botnet

I’m a student and cybersecurity writer. On a random Sunday, I am likely to be figuring out life and reading Kafka.

New Android Botnet Nexus Being Rented Out on Russian Hacker Forum

By Deeba Ahmed
As per a report from AhnLab Security Emergency Response Center (ASEC), poorly managed Linux SSH servers are becoming…
This is a post from HackRead.com Read the original post: ShellBot DDoS Malware Targets Linux SSH Servers

As per a report from AhnLab Security Emergency Response Center (ASEC), poorly managed Linux SSH servers are becoming the targets of a new campaign in which different variants of ShellBot malware are being deployed.

**What is meant by Poorly Managed Servers?**

Poorly managed services refer to weak account credentials, which make the server vulnerable to dictionary attacks. Services such as MS-SQL and RDP (remote desktop protocol) are often targeted.

In Linux servers, SSH (secure shell) services are the primary targets. In IoT environments, dictionary attacks are targeted against the Telnet service installed on an embedded Linux OS or an old Linux server.

**What is ShellBot?**

ShellBot, also known as PerIBot, is an old DDoS bot malware developed in Perl. The malware typically uses Internet Relay Chat/IRC protocol to establish communication with its C2 server.

Currently, the malware is being used to launch attacks against insecure Linux systems, targeting servers with weak credentials. It is deployed on a system after attackers use scanner malware to determine whether the system has SSH port 22 open.

**Attack Details**

ASEC researchers noted that ShellBot was used in attacks targeting Linux servers that were distributing cryptocurrency miners through a shell script compiler.

“If ShellBot is installed, Linux servers can be used as DDoS Bots for DDoS attacks against specific targets after receiving a command from the threat actor,” ASEC’s report read.

The attack begins by using a list of SSH credentials to launch a dictionary attack and breach the server. Once this is accomplished, the threat actor deploys the payload and leverages the IRC protocol to communicate with the C2 server and receive commands that instruct ShellBot to conduct DDoS attacks and steal data.

**Different ShellBot Variants Used in the Campaign**

According to ASEC researchers, three variants of ShellBot were identified, including LiGhT’s Modded perlbot v2, DDoS PBot v2.0, and PowerBots (C) GohacK. The first two versions feature a wide range of DDoS attack commands with HTTP, UDP, and TCP protocols.

Conversely, PowerBots are equipped with backdoor-like capabilities that can provide shell access and upload arbitrary files from the infected host. Threat actors can use these backdoor capabilities for the installation of additional malware and launch different types of attacks, abusing the server.

1.  Windows, Linux and macOS Users Hit by APT Group
2.  Multi-platform SysJoker backdoor hits Linux Devices
3.  DDoS Malware ‘Chaos’ Hits Linux and Windows Devices

ShellBot DDoS Malware Targets Linux SSH Servers

By Waqas
Pinduoduo has confirmed the incident, but denied the presence of malware in its app.
This is a post from HackRead.com Read the original post: Google Suspends Chinese Shopping App Pinduoduo Over Malware Concerns

****The company has criticized the cherry-picking of its app, arguing that other apps have been suspended at the same time and it’s not fair to single out their app.****

Google has temporarily suspended Pinduoduo, a leading Chinese budget shopping app, from its Play Store due to the discovery of malware in certain versions of the app.

The news of Pinduoduo’s ban came just a couple of weeks after Shein, another Chinese shopping giant, was caught copying clipboard content on Android phones of users who were using its older version.

In a statement issued on Tuesday, Google stated that it found malware in some versions of the app that were not available on the Play Store. The company has enforced Google Play Protect, which scans installed Android phone apps for malicious behaviour, on these allegedly harmful apps.

Google has set the Play Protect enforcement to block the installation of these apps and prompt users to uninstall them if they have already downloaded them to their devices.

Pinduoduo has confirmed that it is in communication with Google for further information, and it has also stated that several other apps have been suspended at the same time. Pinduoduo has over 900 million users and is one of China’s most popular e-commerce platforms.

Pinduoduo made a name for itself with its group-buying business model, which allowed users to save money by pooling together and buying items in bulk.

The app’s US-listed parent company, PDD, launched Temu, an online shopping platform in the United States last year, which has quickly become the most downloaded app in the US for both iOS and Android.

The app has been downloaded 24 million times since its launch in September and has more than 11 million monthly active users.

At the time of publication, the Pinduoduo app was unavailable on the Play Store. (Screenshot: Hackread.com)

In a statement, Pinduoduo said that “we strongly reject the speculation and accusation by some anonymous researcher and non-conclusive response from Google that Pinduoduo app is malicious.”

Malware refers to any software developed to steal data or damage computer systems and mobile devices. When hidden in apps, it can be used to gain unauthorized access to information on a user’s phone.

Google has not mentioned Temu in its statement, and the app is still available to download on the Play Store. Pinduoduo has strongly rejected the accusations of malicious activity and speculation surrounding the suspension of its app.

1.  Google removes ClearURLs Chrome extension
2.  Google Ads drop FatalRAT in fake messenger apps
3.  Apple removes Clearview AI iPhone app from Store
4.  Zombinder Lets Hackers Add Malware to Legit Apps
5.  Google bans Avast security extensions over snooping

I am a UK-based cybersecurity journalist with a passion for covering the latest happenings in cyber security and tech world. I am also into gaming, reading and investigative journalism

Google Suspends Chinese Shopping App Pinduoduo Over Malware Concerns

By Waqas
Microsoft has stated that they are aware of the issue and are investigating, adding that they will take action to help keep customers protected.
This is a post from HackRead.com Read the original post: Windows 11 and 10’s Snipping Tools Vulnerable to Data Exposure

****The vulnerability could potentially be used to access sensitive information by others.****

New research has revealed that Microsoft’s Snipping Tool for Windows 11 and the Snip & Sketch tool in Windows 10 has a vulnerability that could allow sensitive information to be accessed by others.

The vulnerability was discovered by David Buchanan, who found that if a screenshot was taken, saved and then cropped and saved again, the data may still be available in the file, and with a few “minor changes” the information could be accessed.

While the vulnerability appears to be somewhat limited, Buchanan warns that information people thought they had deleted may still be floating around on the internet.

> – Take a screenshot.  
> – Press the save icon.  
> – Crop the screenshot.  
> – Press the save icon and save to the same file (the default!)
> 
> — David Buchanan (@David3141593) March 21, 2023

This discovery comes on the heels of a previous report by Buchanan and researcher Simon Aarons about the “acropalypse” vulnerability for Pixels, which highlighted the risk of sensitive information being left intact in images created using the tool.

Microsoft has stated that they are aware of the issue and are investigating, adding that they will take action to help keep customers protected.

1.  Fake Windows 11 Downloads Drop Vidar Malware
2.  9-year-old Windows flaw drops ZLoader malware
3.  Chinese Hackers Hiding Malware in Windows Logo
4.  QBot Exploits Windows Calculator to Hack Devices
5.  Software bug lets one gain admin rights on Windows

I am a UK-based cybersecurity journalist with a passion for covering the latest happenings in cyber security and tech world. I am also into gaming, reading and investigative journalism

Source

HackRead