By Habiba Rashid
Europol searched 8 houses in Israel and France, with the main culprit arrested in Israel along with seven others.
This is a post from HackRead.com Read the original post: Franco-Israeli Gang Linked to $40 Million CEO Scam Busted

Europol has dismantled a gang linked to a $40 million CEO scam. Find out more about how this international criminal syndicate was uncovered and who was involved.

The email scam gang behind France’s largest-ever CEO scam has been dismantled after a coordinated police operation across multiple countries was successful in arresting six people in France and two in Israel. 

The Europe-wide operation to track down the Franco-Israeli criminal organization involved the Croatian National Police, the Croatian Anti Money Laundering Office, the French National Police, the French Gendarmerie, the Hungarian Budapest Metropolitan Police, the Israel Police, the Portuguese Judicial Police, and the Spanish National Police.

Law enforcement authorities involved in the operation (Image: Europol)

In early December 2021, one of the gang members, now arrested as a suspect, impersonated the CEO of a metallurgy company in northeastern France and tricked the accountant into making an urgent and confidential transfer of €500,000 ($530,000) which was subsequently spotted and blocked. 

In late December 2021, according to Europol’s press release, Sefri-Cime, a real-estate developer, fell victim to the same group after its members impersonated lawyers working for a well-known French accounting firm. According to Europol, they persuaded the Chief Financial Officer (CFO) to transfer almost €38 million ($40 million) altogether.

The criminal network, consisting of French and Israeli nationals, used a pre-existing money laundering scheme that laundered the funds via European countries, China, and then Israel. An investigation that followed revealed the money mules working for the gang in Croatia, Portugal, and Hungary.

The police were able to seize electronic equipment and vehicles, €3 million from Portuguese bank accounts, €1.1 million from Hungarian bank accounts, €600,000 from Croatian bank accounts, €EUR 400,000 from Spanish bank accounts and €350,000 in virtual currencies. 

The operation continued for five days between January 2022 and 2023 in France and Israel, leading to eight house searches and eight arrests, including the alleged Israeli gang leader, according to Europol.

1.  Leader of BEC Scams Arrested in Nigeria
2.  Firm loses $44m due to an online email scam
3.  US Judge falls for email scam; loses $1 million
4.  74 arrested – FBI disrupts gang of BEC scammers
5.  BEC attack: Nikkei employee transfers $29m to crooks

I’m a student and cybersecurity writer. On a random Sunday, I am likely to be figuring out life and reading Kafka.

Franco-Israeli Gang Linked to $40 Million CEO Scam Busted

By Deeba Ahmed
Samsung Message Guard is a new feature that protects users against zero-click attacks, including those appearing from messaging apps.
This is a post from HackRead.com Read the original post: New Samsung Message Guard protects users against Zero-Click attacks

Samsung Message Guard will inspect the file bit by bit and process it in a controlled environment, thus neutralizing the threat to ensure the malicious file doesn’t infect the device.

Zero-Click attacks have become very powerful and widespread, mainly due to their ease of deployment. With the evolution of zero-click attacks, mobile phone manufacturers, such as Samsung, are also improving their defence mechanisms against such threats. Samsung Message Guard is one such step that prevents users from zero-click exploits on Samsung Galaxy S23 smartphones.

**What are Zero-Click Attacks?**

Zero-click exploits can install malware on a device using just a JPEG or PNG image file. They are pretty dangerous, as the user doesn’t need to interact with the file, such as clicking or tapping on it, to get their device infected. Users cannot detect these exploits while the malicious code steals their private data and transmits it to hackers.

As previously reported, state-sponsored cybercriminals used zero-click attacks to install NSO Group’s spyware Pegasus onto the mobile phones of dissidents, government officials, activists, politicians, and journalists.

**Samsung Message Guard Will Protect Against Zero-Click Attacks**

Samsung Galaxy smartphones are already equipped with advanced safety measures and a powerful Samsung Knox platform that thwart attacks exploiting audio and video formats. With Samsung Message Guard, the company has taken another step to safeguard its devices and restrict their exposure to malicious codes hidden in image attachments.

According to Samsung’s press release, this feature will work on Samsung Messages and Messages by Google. The company will also release an update to make this feature compatible with third-party messaging apps.

> Simply put, Samsung Message Guard automatically neutralizes any potential threat hiding in image files before they have a chance to do you any harm. It also runs silently and largely invisibly in the background and does not need to be activated by the user.
> 
> Samsung

**How Does Message Guard Prevent Zero-Click Attacks?**

You can consider it an advanced sandbox or a virtual quarantine; it will run in the background with the Messages app. As soon as any image file is received, it will be isolated from the rest of the data to prevent any hidden malicious code from accessing the device data or interacting with the OS.

Samsung Message Guard will inspect the file bit by bit and process it in a controlled environment, thus neutralizing the threat to ensure the malicious file doesn’t infect the device.

Message Guard will look for malware in PNG, JPG, JPEG, GIF, ICO, WEBP, BMP, and WBMP formats. The feature will be rolled out to different versions of Galaxy smartphones and tablets running One UI 5.1 or above versions.

New Samsung Message Guard protects users against Zero-Click attacks

By Deeba Ahmed
The web hosting giant GoDaddy has been rattled by an almost two-year-long data breach that went undetected from 2020 to 2022.
This is a post from HackRead.com Read the original post: Hackers Stole GoDaddy Source Code in a Multi-Year Data Breach

In a filing with the Securities and Exchange Commission (SEC), GoDaddy revealed that three serious security breaches had impacted the company, boasting 21 million customers and almost $4 billion in revenue.

On Friday, **GoDaddy**, the world’s leading web hosting firm, confirmed that its network had been impacted by a data breach that started in 2020 and continued until 2022. As a result of this compromise, unidentified hackers stole the company’s source code.

Additionally, part of the stolen data included employees’ and customers’ login credentials. Moreover, the flaw allowed attackers to install malware, which would redirect customers’ websites to malicious domains.

This should not come as a surprise, since GoDaddy has a history of security-related incidents. For instance, **in November 2021**, hackers accessed 1.2 million GoDaddy customers’ accounts.

**In November 2020**, GoDaddy revealed that its employees had been tricked by hackers into modifying the DNS settings of at least two cryptocurrency websites. **In April 2020**, Escrow.com was defaced by hackers after they managed to hack one of GoDaddy’s employees.

As for the recent incident, in a **filing** with the Securities and Exchange Commission, GoDaddy revealed that three serious security breaches had impacted the company, boasting 21 million customers and almost $4 billion in revenue.

The incident started in 2020, and the latest was recorded in 2022. The company noted that a sophisticated hacker group was responsible for all the incidents. This means the same group has repeatedly invaded its networks and may or may not have left, despite the company’s extensive security measures.

The first incident occurred in March 2020, when the attackers obtained login credentials and accessed a limited number of employee accounts and hosting accounts belonging to approximately 28,000 customers. But they couldn’t access the main accounts of GoDaddy customers.

The most recent invasion was noticed in December of 2022. At that time, the attacker accessed the cPanel hosting servers. The company explained that it has responded to subpoenas about the incident that the Federal Trade Commission (FTC) issued in July 2020 and October 2021.

In November 2021, GoDaddy discovered another security breach in which the attacker obtained a password that provided access to GoDaddy’s Managed WordPress service source code.

The attackers gained access in September 2021 and obtained login credentials of WordPress admin accounts, email addresses, and FTP accounts of 1.2 million inactive currently Managed WordPress users. GoDaddy formally disclosed the breach in November 2021.

> “We believe these incidents are part of a multi-year campaign by a sophisticated threat actor group that, among other things, installed malware on our systems and obtained pieces of code related to some services within GoDaddy.”
> 
> GoDaddy

GoDaddy has claimed that it has evidence, and law enforcement authorities have also confirmed that a security breach occurred, performed by an organized and sophisticated group.

Furthermore, the company added that the hackers’ primary targets are hosting services such as GoDaddy, infecting websites with malware, and launching phishing campaigns.

1.  **GoDaddy customers targeted by clever phishing scam**
2.  **Sensitive data on 31,000 GoDaddy servers exposed online**
3.  **Ransomware attack hits SmarterASP.NET hosting’s network**
4.  **Dark web hosting firm quits after hackers delete its database**

Hackers Stole GoDaddy Source Code in a Multi-Year Data Breach

By Waqas
The RailYatri hack took place in December 2022, but the stolen data has only been leaked earlier today on a prominent hacker forum.
This is a post from HackRead.com Read the original post: Indian Ticketing Platform RailYatri Hacked – 31 Million Impacted

Among personal information, the RailYatri hack has also exposed the location details of millions of travellers across India.

RailYatri, a popular **Indian** train ticket booking platform, has suffered a massive data breach that has exposed the personal information of over 31 million (31,062,673) users/travellers. The breach is believed to have occurred in late December 2022, with the database of sensitive information now being leaked online.

The compromised data includes email addresses, full names, genders, phone numbers, and locations, which could put millions of users at risk of identity theft, phishing attacks, and other cyber crimes.

Hackread.com can confirm that the database has been leaked on Breachforums, a hacker and cybercrime forum that surfaced as an alternative to the popular and **now-seized Raidforums**.

Image credit: Hackread.com

**RailYatri and its Data Breach Yatra**

RailYatri means train passenger, while Yatra stands for the journey. The RailYatri data breach is not a typical case of hackers exploiting vulnerabilities, stealing, and leaking data. In fact, it began in **February 2020** when cybersecurity researcher Anurag Sen identified a misconfigured Elasticsearch server exposed to the public without any password or security authentication.

Sen noted that the server belonged to RailYatri and informed the company about the issue, which initially denied that it belonged to them. Later, the company claimed that it was merely test data. At that time, the server contained over 700,000 logs with over 37 million entries in total including internal production logs.

In 2020, Railyatri managed to secure its data only when Indian Computer Emergency Response Team (CERT-In) got involved; however, two years later, on February 16th, 2023, hackers rattled the company with yet another security breach due to a new leak.

Screenshot from RailYatri’s data exposure in 2020 (Image credit: Anurag Sen)

“Back in 2020, when I reached out to Railyatri, they never replied or reached out to me, but after I contacted Cert-In, the server got closed,” Anurag told Hackread.com. “I have reported various data leaks in India; the most common issue I saw is that these companies are not getting fined due to India not having any GDPR-like law,” added Anurag.

**Anurag** believes that the latest data breach could have been avoided “if the company had implemented proper cybersecurity measures from the outset.”

Hackread.com advises all users to change their passwords and enable two-factor authentication on their accounts as a precautionary measure. They have also advised users to monitor their bank accounts and credit card statements for any suspicious activity.

This breach serves as a stark reminder of the increasing frequency and severity of cyber attacks, particularly in the wake of the **COVID-19 pandemic**, which has forced millions of people to rely on online platforms for their daily needs. It highlights the need for companies to prioritize cybersecurity measures and take all necessary steps to protect their customers’ personal information.

1.  **Hackers selling 13TB of Domino’s India data**
2.  **Hackers leak millions of Airtel India user data**
3.  **Hackers leak 9 million Indian job seekers’ data**
4.  **Hacker claims to steal 8.2TB of MobiKwik data**
5.  **India’s COVID-19 surveillance tool leaked user data**

I am a UK-based cybersecurity journalist with a passion for covering the latest happenings in cyber security and tech world. I am also into gaming, reading and investigative journalism

Indian Ticketing Platform RailYatri Hacked – 31 Million Impacted

By Waqas
My QR Code was informed about the leak almost two weeks ago, yet it failed to respond or secure its server.
This is a post from HackRead.com Read the original post: QR code generator My QR Code leaks users’ login data and addresses

At the time of writing, the total number of impacted customers was 65,000; however, at the time of publishing this article, the number had increased to 67,000, meaning the leak is ongoing.

MyQRcode, a popular Sofia, Bulgaria-based QR code generator website, is leaking the personal data of its users. The security breach or data leak has resulted in the leakage of over 128 GB of data, including the personal information of 66,000 customers.

The leak was caused by misconfiguration, making the server publicly accessible to the public without any security authentication or password. What’s worse, it was also noted that the data was being actively updated with new records each day, indicating that the leak was still ongoing.

On the other hand, the leaked data includes personal and login credentials of My QR Code customers, including the following information:

*   Full names
*   Job title
*   Email addresses
*   Password hashes
*   URLs to QR codes
*   Phone numbers
*   Physical addresses
*   Alternative phone numbers
*   Links to social media profiles
*   States, postcodes and country
*   Links to users’ personal, business, or company websites

Security researcher **Anurag Sen** exclusively reported the leak to Hackread.com. Sen discovered the server on Shodan while searching for misconfigured cloud databases.

For your information, **Shodan is an OSINT tool** and a specialized search engine used by cybersecurity researchers to locate vulnerable Internet of Things (IoT) devices, including servers and misconfigured databases on the internet.

Upon further investigation with **CloudDefenseAI**, it was discovered that new records were being actively added to the data each day. For instance, at the time of writing, the total number of impacted customers was 65,000 however at the time of publishing this article, the number increased to 67,000.

This leak can have serious consequences for the affected customers. Cybercriminals and scammers can potentially use the leaked data to carry out identity theft, **phishing attacks**, or physical crimes since the addresses of users are part of the leak.

Here, it is worth noting that the server has been misconfigured since February 4th, 2023. MyQRcode was informed about the leak last week, but the company has not responded or released a statement on the matter. It is also unclear how long the server has been left unprotected, or if it has been accessed by a third party with malicious intent.

In the meantime, Hackread.com can advise customers who have used MyQRcode to generate QR codes to be vigilant about any suspicious activity on their accounts and to monitor their personal information closely. It is also recommended that they change their passwords and enable two-factor authentication wherever possible.

**MyQRcode and GDPR**

The General Data Protection Regulation in Europe (GDPR) applies to Bulgaria, as the country is one of the **27 member states** of the European Union. The GDPR is implemented in Bulgaria through the Personal Data Protection Act (PDPA).

Under the GDPR, the fines for data breaches and other violations of the regulation can be up to 20 million EUR or 4% of a company’s global annual revenue, whichever is higher. In 2019, Commission for Personal Data Protection **issued** a BGN 5.1 million ($2,790,392) fine to the country’s National Revenue Agency for violations of the GDPR.

Nevertheless, the incident once again highlights the importance of proper cybersecurity measures, particularly in a digital world where more and more personal data is being stored online.

Companies must take every possible step to ensure the safety and security of their customer’s data, and failure to do so could result in serious consequences for everyone involved.

1.  **AWS bucket exposed 421GB of Artwork Archive data**
2.  **Misconfigured baby monitors expose video stream online**
3.  **S3 buckets exposed US military social media spying plans**
4.  **ElasticSearch server leaked 579GB of users’ website activity**
5.  **350m email addresses exposed in S3 bucket** **misconfiguration**

I am a UK-based cybersecurity journalist with a passion for covering the latest happenings in cyber security and tech world. I am also into gaming, reading and investigative journalism

QR code generator My QR Code leaks users’ login data and addresses

By Habiba Rashid
Twitter will now charge for 2FA, limiting the must-have security feature to only Twitter Blue subscribers.
This is a post from HackRead.com Read the original post: SMS-Based 2FA Will Be Limited to Twitter Blue Users

Twitter users have until March 19th to disable SMS-based 2FA from their accounts, as the company is displaying a message stating that, “To avoid losing access to Twitter, remove text message two-factor authentication by March 19th, 2023.”

Twitter has announced that users who are not subscribed to Twitter Blue will no longer be able to use two-factor authentication (2FA) based on SMS. Twitter offers a total of three types of two-factor authentication methods: the other two use an authentication app or a security key.

While APT groups are exploiting Twitter for large-scale cyber-espionage campaigns, Elon Musk has a different idea to improve the platform’s security.

“While historically a popular form of 2FA, unfortunately, we have seen phone-number based 2FA be used – and abused – by bad actors,” Twitter wrote in its blog post. “So starting today, we will no longer allow accounts to enrol in the text message/SMS method of 2FA unless they are Twitter Blue subscribers.”

Users have until March 19th to disable SMS-based 2FA from their accounts and shift to an authenticator app or a security key for 2FA. On the other hand, they may buy its subscription service, Twitter Blue, which costs between $8 and $11 a month or $84 a year and adds new perks to an account, such as a checkmark next to the user’s name or the ability to edit tweets.

“After 20 March 2023, we will no longer permit non-Twitter Blue subscribers to use text messages as a 2FA method. At that time, accounts with text message 2FA still enabled will have it disabled,” Twitter says.

SMS-based multi-factor authentication is, in fact, considered the weakest type of 2FA since hackers can clone a victim’s mobile phone number to a new SIM card. This allows them to intercept the code sent through SMS.

According to Twitter’s own transparency report from December 2021, only 2.6% of all Twitter users had enabled two-factor authentication, though the numbers may have increased since then.

To change your 2FA status on your Twitter account, you can navigate to “Settings & Privacy,” then “Security and Account Access,” then “Security,” and finally “Two-Factor Authentication” to choose between an authentication app.

1.  Twitter’s Unpredictable Path Under Elon Musk
2.  Twitter Denies Hack in 200M Account Leak Scare
3.  400 Million Twitter Users’ Scraped Info Goes on Sale!
4.  Your Guide To Navigating Twitter Alternative Mastodon

I’m a student and cybersecurity writer. On a random Sunday, I am likely to be figuring out life and reading Kafka.

SMS-Based 2FA Will Be Limited to Twitter Blue Users

By Owais Sultan
Crypto debit cards are becoming critical payment tools due to the growth in popularity of cryptocurrencies such as…
This is a post from HackRead.com Read the original post: 6 Factors to Consider When Shopping for Crypto Debit Card

Crypto debit cards are becoming critical payment tools due to the growth in popularity of cryptocurrencies such as Bitcoin. While cryptocurrency can be used anywhere in the world, most online and offline merchants do not accept it for various reasons, including a lack of technical knowledge and a lack of regulatory clarity.

Crypto debit cards facilitate customers to pay in crypto, while merchants receive payments in their preferred currency. They serve as on-ramps and off-ramps for crypto enthusiasts.

The list of brands to choose from is growing over time. Most of the crypto debit cards in the market are issued by exchanges such as Binance, Coinbase, and Wirex. Others are issued by membership platforms, such as ClubSwan, which specializes in luxury metal cards.

The following are factors to consider when choosing a crypto debit card:

*   The countries it serves

Many crypto debit card providers are limited in terms of the countries to which they ship their cards; for example, Coinbase is mostly targeting American users. However, some brands not only ship to most countries around the world but can also be used in most countries.

*   The number of assets it supports 

The list of crypto assets is approaching ten thousand. There is hardly any card that supports all of them; however, some support more assets than others. You should find out whether the card you want to order supports the assets you care about or the most valuable cryptocurrency assets.

*   Transaction limits

If you often make large purchases or need to withdraw large amounts from the ATM, you must investigate the limits imposed by the card provider before ordering it. The limits also include how much you can convert through the linked exchanges.

*   Charges 

Indeed, different crypto card providers have different fees they charge. However, considering this factor should not be so much about going for the cheapest option in the market, but rather making your decision based on the best value for money. The fees include shipping fees for cards, monthly subscriptions, and transaction charges.

*   Concierge services

Most of the crypto card providers have a customer support component; however, before you sign up, it can be challenging to determine the quality of customer support you are likely to receive. With that said, you can collect some information about this from online reviews.

A few providers, such as ClubSwan, have gone the extra mile and not only help you with accessing their services but also offer support in travelling through an elaborate concierge service.

*   The quality of the physical card 

A physical crypto debit card is a functional tool for making payments and withdrawing from ATMs. It can also be a way to express your taste to those around you.

This latter function is achieved through designs and the quality of the materials they are made of. The basic card designs are plastic cards, and the most elegant are metal cards.

Over time, the list of choices available to users regarding crypto debit cards is growing. While this is a good thing, it poses a challenge when shopping for one. However, with a strategy that focuses on the critical components, you stand to get the best solution in the market for the price you are willing to pay.

1.  How to exchange BNB cryptocurrency
2.  6 of the Best Crypto Bug Bounty Programs
3.  The Different Ways to Mine Cryptocurrency
4.  Trust Wallet launches desktop browser extension
5.  What is Blockchain Gaming and Play-to-Earn Model?

Owais takes care of Hackread's social media from the very first day. At the same time He is pursuing for chartered accountancy and doing part time freelance writing.

6 Factors to Consider When Shopping for Crypto Debit Card

By Habiba Rashid
The Federal Bureau of Investigation (FBI) is investigating an internal network breach caused by an isolated incident, which the agency claims is now contained.
This is a post from HackRead.com Read the original post: FBI Hack – Agency Investigating Internal Network Breach

The FBI believes that the incident involves the computer system used by the New York Field Office for investigating child sexual exploitation.

The U.S. Federal Bureau of Investigation (FBI) is reportedly investigating a hack that occurred on its own computer network. The now-contained malicious cyber activity is said to be an “isolated incident,” the agency said on Friday. 

However, the agency is still working to uncover the scope and overall impact of the cyberattack.

“The FBI is aware of the incident and is working to gain additional information,” the U.S. domestic intelligence and security service said in an emailed statement to Reuters.

“This is an isolated incident that has been contained. As this is an ongoing investigation the FBI does not have a further comment to provide at this time.”

CNN, which first reported the incident on Friday, said that FBI officials believe it involved the New York Field Office computer system used for investigating child sexual exploitation.

It has not yet been determined when the incident occurred, but, according to one of CNN’s sources, the origin of the hack is still being probed.

This is not the first time the FBI was successfully attacked by cybercriminals. In November 2021, as reported by Hackread.com, the FBI’s email servers were hacked by threat actors who distributed spam emails impersonating FBI warnings in a sophisticated chain attack.

Using eims@ic.fbi.gov, a legitimate email address linked to the FBI’s Law Enforcement Enterprise Portal (LEEP), the hackers successfully sent out tens of thousands of spam messages in multiple waves. 

Stay tuned; this article will be updated with additional information.

1.  U.S. No Fly List Leaked on Hacker Forum
2.  Hackers post data of Federal agents online
3.  Hacker Leaks FBI’s InfraGard database Online
4.  Russian Hackers Claim Data Theft of FBI Agents
5.  Hacker access FBI server sends fake email threats

I’m a student and cybersecurity writer. On a random Sunday, I am likely to be figuring out life and reading Kafka.

FBI Hack – Agency Investigating Internal Network Breach

By Deeba Ahmed
Scammers are creating legit PayPal accounts and sending phishing invoices to unsuspected users and since the email comes from service@paypal.com chances of falling for this scam are more than usual.
This is a post from HackRead.com Read the original post: PayPal Scammers Using Legitimate Accounts to Send Phishing Invoices

Protect yourself from PayPal phishing attacks: Learn to spot the signs of a spoofed email and avoid falling for scams that use legitimate PayPal accounts to deceive unsuspecting victims.

PayPal has been one of the most lucrative targets for hackers and spammers which is why customers often complain about phishing scams. Now, the cybersecurity researchers at Avanan have discovered that cybercriminals are once again exploiting PayPal’s online payment system to send malicious invoices directly to users.

In the ongoing campaign, attackers are reportedly abusing PayPal by creating accounts and generating invoices for sending phishing emails. This should not come as a surprise, as just last month, **PayPal notified over 35,000 customers** about a security breach, which goes to show the popularity of PayPal among cyber criminals.

**Email Content Analysis**

The email informs the recipient about fraudulent activity on their account, and if they do not call the listed number, they will be charged a hefty amount, such as $699.99 or more.

It is worth noting that the emails sent in this campaign are not malicious; they are sent directly via PayPal and can pass several checks, such as DMARC, DKIM, and SPF. The problem is that these emails are sent from **service@paypal.com**, so they appear legitimate, and users fail to identify the trap.

The phishing invoice (Credit: Avanan)

Additionally, in a **blog post**, Jeremy Fuchs of Avanan stated that the scam works because of static email Allow Lists, which allow content to go directly into the inbox if it arrives from a reputable service like PayPal.

**Why is PayPal being Targeted?**

The reason PayPal is so easily targeted in this campaign is that the platform allows users to create accounts easily. Therefore, anyone can exploit the free service. Furthermore, threat actors can use PayPal’s tools to create professional-looking malicious invoices. This way, attackers can easily disguise themselves as employers or family members.

**How Can You Detect Malicious Invoices?**

This campaign is different from other attacks leveraging PayPal, as detecting or preventing the attack proved to be very difficult for email security services and users. It happened because the malicious invoices “comes directly from PayPal.”

However, according to Jeremy Fuchs, marketing content manager at Avanan, the email’s content is such that it can raise suspicion. For instance, the content has many grammar and spelling errors.

Moreover, the phone number listed in the email does not belong to PayPal. Fuchs suggests that users should call the phone numbers to find out whether the invoice is legitimate or not.

Here are some additional steps you can take to detect and protect yourself from PayPal phishing emails:

**Google the content of the email before responding**: It is always a good idea to Google the content and email address of the email that you suspect is a phishing one; it is quite possible that someone has already addressed the issue on discussion forums.

**Look for spelling and grammar mistakes:** Phishing emails often contain spelling and grammar mistakes. Be especially wary of emails that contain urgent requests or threats, as scammers often use these tactics to create a sense of urgency and panic.

**Don’t click on any links:** If an email asks you to click on a link to verify your account or update your information, don’t click on it. Instead, go directly to the PayPal website and log in to your account to see if there are any alerts or messages.

**Never enter personal information:** Never enter your personal or financial information in response to an email. PayPal will never ask you to provide sensitive information such as your password, Social Security number, or credit card details via email.

**Use two-factor authentication:** Enable two-factor authentication on your PayPal account to add an extra layer of security. This will require you to enter a code sent to your phone or another device in addition to your password when logging in to your account.

**Report suspicious emails:** If you receive a suspicious email, report it to PayPal immediately. Forward the email to phishing@paypal.com and then delete it from your inbox.

1.  **Phishing link in ransom note steals PayPal data**
2.  **Phishing Links in Text Messages Steal PayPal Account**
3.  **Nasty Android malware stealing its victims’ PayPal funds**
4.  **PayPal’s TIO Networks breach affects millions of customers**
5.  **PayPal & Facebook most targeted brands in phishing scams**

PayPal Scammers Using Legitimate Accounts to Send Phishing Invoices

By Habiba Rashid
The suspected Indian state-sponsored group has targeted 61 government, military, law enforcement, and other organizations across the Asia-Pacific region.
This is a post from HackRead.com Read the original post: SideWinder Behind Govt Phishing Spree Across the East

SideWinder is apparently an India-based advanced persistent threat (APT) group known for spreading malware, infiltrating networks, and stealing sensitive information.

Security researchers at Group-IB have finally been successful in connecting a series of phishing campaigns between June and November 2021 to an Indian Advanced Persistent Threat (APT) group, SideWinder.

The suspected state-sponsored group has targeted 61 government, military, law enforcement, and other organizations across the Asia-Pacific region, according to a report from Group-IB.

Also known as Rattlesnake, Hardcore Nationalist (HN2), and T-APT4, the group is considered one of the oldest national-state groups, going as far back as 2012. **In January 2020**, the group was found to be infecting Android devices with malware through the Play Store.

In another attack **reported in February 2022**, SideWinder was observed collaborating with another group called ModifiedElephant and targeting unsuspecting users by planting incriminating evidence on their devices.

In June of last year, the group’s custom tool, SideWinder.AntiBot.Script, was used in previously undocumented phishing attacks against Pakistani organizations. The group was also linked to an attack on the Maldivian government in 2020.

Like many others, SideWinder also uses **spear phishing** as its initial attack vector, sending phishing emails containing malicious attachments or URLs to victims. Two of these campaigns featured emails in which the group impersonated a cryptocurrency firm, said Group-IB.

If a user clicks on the link attachment, a malicious document, an LNK file, or a payload is subsequently downloaded onto their computer. The LNK file downloads an HTA file, which then downloads the payload. This payload could be either a remote access Trojan (RAT) or an information stealer, according to Group-IB’s technical analysis.

Further, two new custom-made SideWinder tools discovered by Group-IB during the campaign were SideWinder.RAT.b, a RAT, and SideWinder.StealerPy, an info-stealer.

The info-stealer is capable of collecting **Google Chrome browsing history**, credentials saved in the browser, the list of folders in the directory, meta-information, the contents of docx, pdf, and txt files and more.

The APT group’s motive seems to be linked to India’s cryptocurrency market, Group-IB’s **report** speculates.

> “Interestingly, Group-IB analysts discovered two phishing projects mimicking crypto companies. SideWinder’s growing interest in cryptocurrency could be linked to the recent attempts to regulate the crypto market in India.”

However, Group-IB cannot confirm how many, if any, of these phishing campaigns were successful. Nevertheless, users and organizations must take precautions against SideWinder’s attack, starting with the following steps:

**Keep your software up to date:** Make sure your operating system and all your software are up to date with the latest security patches. This will help protect you against known vulnerabilities that could be exploited by SideWinder.

**Use strong passwords:** Use complex and unique passwords for all your accounts and enable two-factor authentication whenever possible. This can help prevent unauthorized access to your accounts and make it more difficult for SideWinder to gain access.

**Be cautious of phishing emails:** SideWinder often uses phishing emails to trick users into clicking on a malicious link or downloading a malicious attachment. Be cautious of emails from unknown senders, and do not click on links or download attachments unless you are sure they are safe.

**Use anti-malware software:** Install and use anti-malware software to help detect and prevent SideWinder attacks. Make sure your **anti-malware software** is up to date and set to automatically scan your system on a regular basis.

**Limit access to sensitive information:** Limit the number of people who have access to sensitive information, and use encryption to protect data that is transmitted or stored.

**Train employees:** **Train employees** on how to recognize and avoid SideWinder attacks. Educate them on safe browsing habits, how to identify phishing emails, and the importance of keeping software up to date.

1.  **Nation-State Hackers Targeted Facebook – Meta**
2.  **Novel Confucius Android spyware hits Pakistan military**
3.  **Indian PM Modi’s Twitter Account HACKED for Bitcoin scam**
4.  **Google closes sites with ties to hack-for-hire groups in India**
5.  **Indian APT infects its own devices, exposes Modus Operandi**

I’m a student and cybersecurity writer. On a random Sunday, I am likely to be figuring out life and reading Kafka.