By Uzair Amir
Phishing has long been a common way to induce a receiver to unveil personal data. Primarily, it works…
This is a post from HackRead.com Read the original post: How to detect phishing images in emails

Phishing has long been a common way to induce a receiver to unveil personal data. Primarily, it works this way: You receive an email from a purportedly reputable source–say, your employer–asking you to click the link and get familiar with new regulations effective in the following week.

You are curious about the contents, so you click the link, which asks you to log in to the company’s systems (looks logical, doesn’t it?). Once you fill out the fields, press enter, and nothing happens, you’ve been phished. A bit late for understanding that you’ve made a mistake. 

But to tell you more, it’s one of the most mundane phishing strategies; these days, much more creative phishing methods exist, with images being among the most effective ones. 

Innocent at first glance, phishing images can pose great danger. And most interestingly, designing phishing images doesn’t necessarily require hackers’ direct intrusion. They can create a tool doing all the legwork for them so that many people won’t even know whether their attached images include viruses.

Therefore, it’s vitally important to use a verified and time-trusted email banner creator to ensure the email is free from bugs and other harmful elements. But not only that. You should also pay close attention to pictures added to received emails. So the main question arises: Can you detect phishing images in emails before hackers access your data? Let’s find out together.

**Don’t be afraid to open and read the email**

You won’t be able to identify the images and whether they contain phishing elements until you open the email. Reading the email itself isn’t dangerous. If your system is up-to-date, you don’t have to worry about the email’s content and attachments. Only after you open the email can you detect whether images are phishing. 

**Turn off the automatic image display option**

Disabling an automatic image display feature is the first thing you should do to stay safe. Modern email apps, like Gmail (_How To_) or Outlook (_How To_), are advanced to the extent they do all the dirty work, automatically eliminating the chances of you getting phishing images. But forewarned is forearmed, and it would be best to turn the mentioned feature off. It will allow you to read the email and be certain about your digital security. 

**Check the email and its details and hover the cursor over the image **

Hackers don’t shun using dirty tricks to achieve their ultimate goals. Not only do they send emails from reportedly credible addresses, e.g., which differ from an authentic company by only one symbol, but they also camouflage phishing images with thought-provoking content. Many people fall into the trap of thoughtful texts; being impressed, they complete the final catchy phrase to “click on the image to learn more,” and voila, their passwords got into the wrong hands.

More to the point, the most effective way to check phishing images is to first go through the email and its details and second peruse the picture. Do not click on the image! Even if you are a hundred percent positive that the email is reliable, it’s best to double-check the image. Simply hover the cursor over the image and tell us – can you see any embedded link? If so, look at it carefully. Phishing images usually include links that are similar to official websites. 

**Did the email trigger a spam filter?**

There is no denying that spam filters are tricky and can consider authoritative websites’ emails spam, propelling them forward to a respective box. So, remember to review your spam box, as you can find long-awaited emails there.

Other than that, pay close attention to any email that has triggered spam filters. Email apps have developed tremendously, and they mainly direct suspicious emails, such as unsolicited commercial emails, to the spam box for a reason. The latter may touch on images, too, so be careful when walking through them.

_Source_

**Look at calls to action dispersed in the email**

Besides mind-boggling content, hackers deceive people by inserting “effective” call-to-action buttons. Such buttons often contain links leading to credible websites. “So what’s their point then?” you might ask.

Call to action buttons aims to make your alertness level plummet. By clicking on several calls to action, you may think the email is informative. As a result, you mindlessly do what the email asks and finally click on the image that leads you to the website that causes no second thoughts as to its reliability. You fill out the sections with sensitive data and end up phished. Under no circumstances should you click on images, even if trustworthy call-to-action buttons back them up.

**Wrapping up**

Viewing images in emails is not a security issue. It can only inform the sender that you have read the email. It’s way more important to stay away from clicking on the image, for it can lead to a page that mirrors a reliable website and asks to provide your credentials. Unless you do that, you are safe. Switching off an automatic display feature is an optional measure to prevent you from being fished. 

Also, try to update your devices and apps so that the chances of phishing images permeating your inbox undetected will equal close to zero. And of course, don’t be gullible, clicking on every image and link included in emails. This way, you are unlikely to be phished.

How to detect phishing images in emails

By Owais Sultan
Securing applications on-premises and on the cloud are two entirely different processes. The cloud provides plenty of benefits…
This is a post from HackRead.com Read the original post: Explaining Cloud Native Application Security

Securing applications on-premises and on the cloud are two entirely different processes. The cloud provides plenty of benefits to organizations that use it, though it can also complicate things when it comes to security, which is why cloud native application security is a topic of its own. Luckily, there are security tools that are built specifically for protecting cloud native applications. 

**Cloud Native – How Are Cloud Native Applications Different?**

The idea of using the power of modern cloud computing to create applications that offer significantly more flexibility, scalability, and resilience is called cloud native. The latest cloud native methodologies such as DevOps, CI/CD, and cloud native tools like microservices and containers, allow developers to build highly scalable apps. 

Regarding cloud native applications, the architecture of these apps is designed in a specific way that enables them to make the most of cloud environments. By using agile techniques, developers are capable of running applications on multiple microservices, instead of the traditional single server. There are several benefits to this approach, including:

*   Quicker releases.
*   Minimized cost of development.
*   An overall more reliable system.
*   Backup and recovery automation.

Cloud native architecture is very similar to microservices architecture, though they are not exactly the same. Using microservices is quite common for cloud native, but they are not absolutely necessary. The only purpose of cloud native is to provide resilience and horizontal scalability so that the applications can run on the cloud.

Namely, not all cloud solutions are cloud native. To better understand the differences between all cloud solutions, you can use the following list:

*   **Cloud computing** – refers to the on-demand computing services over the internet, like storage, databases, and other online services.
*   **Cloud based apps** – are all the applications that are accessible through the cloud regardless of the location of the computer that runs them.
*   **Cloud aware apps** – these are applications that are deployed on a traditional server but have the necessary compatibility with cloud technology to be run on the cloud too. 
*   **Cloud enabled apps** – this term is used to describe applications that were initially created for a traditional server, but were later lifted and shifted to the cloud.
*   **Cloud hosted apps** – are applications that were originally run on-premise but were moved to the cloud with the help of a cloud provider.
*   **Cloud agnostic apps** – refer to applications that are easy to move from one cloud platform to another. 

Cloud native is complemented by cloud agnostic and its portability so they are used in combinations to build scalable and portable apps. 

**Security In Cloud Native Applications**

Although cloud native offers many benefits, securing these apps is not the easiest feat. The only way to do this is by implementing the security from the very start of the development life cycle. Additionally, there should be multiple layers of protection integrated into the whole SDLC model which will enforce continuous monitoring and identify security flaws all the way to production.

There are plenty of legacy tools that were used in the past and did a great job at protecting traditional applications, however, these tools are simply not up to the task when it comes to cloud native. Trying to secure a cloud native app with a traditional security tool will lead to missing critical vulnerabilities and a lot of false positives as well. 

CNS solutions are tools that are specialized to provide the needed security for cloud native architecture. They rely on strict policies on granular identity management and provide robust authentication controls, driven by a zero-trust security model. 

They can also add an extra layer of protection to all data and communication through encryption. Finally, cloud native security tools can be used to control traffic by setting up firewalls which will act as safeguards for the applications that need to be secured.

**CNS Tools vs. Traditional Ones**

The main difference between CNS and traditional tools is in the way they operate to secure your applications. For example, while legacy tools manage access through a perimeter security model, CNS tools take a more modern approach. They make use of encryption, authorization, and authentication to prevent unauthorized access.

Coupled with the zero-trust model, CNS tools can make it very difficult for attackers to gain access to a large amount of data. This is why they are more suitable for cloud native applications, whereas traditional tools fail to guarantee protection.

**Conclusion**

To summarize, cloud-native applications utilize the latest technology to create scalable and reliable applications. Software organizations know that the cloud is a necessary tool to stay relevant in today’s modern times and meet customer demands. 

However, the cloud is still a somewhat unexplored territory when it comes to security and can be challenging to protect cloud-native architectures. While legacy tools are not suitable for securing cloud native applications, CNS tools can deliver significantly better results.

**More Cloud Topics on Hackread.com**

1.  4 Benefits of Cloud VPN to your Business
2.  What are the future prospects of a Cloud Architect?
3.  Cloud security is an ongoing struggle to keep sensitive data safe
4.  MetaMask to Apple Users: Disable iCloud Backup for Wallet ASAP
5.  How cloud data distracts businesses from correct data security practices

![](https://secure.gravatar.com/avatar/4f37cea0e53ee98cbc93980e7a0a8b2d?s=100&d=wavatar&r=g)

Owais takes care of Hackread's social media from the very first day. At the same time He is pursuing for chartered accountancy and doing part time freelance writing.

Explaining Cloud Native Application Security

By Waqas
The vulnerability that existed for the last 8 months allowed attackers to weaponize the VirusTotal platform to achieve…
This is a post from HackRead.com Read the original post: Critical RCE Vulnerability Reported in Google’s VirusTotal

**The vulnerability that existed for the last 8 months allowed attackers to weaponize the VirusTotal platform to achieve remote code execution on an unpatched 3rd party sandboxing machine employing anti-virus engines.**

In January 2022, a report dubbed “VirusTotal Hacking” revealed how the platform can be used to access stolen login credentials and other sensitive files. Now, the IT security researchers at CySource have reported a method to abuse the VirusTotal malware scanning service to execute arbitrary commands and access multiple internal hosts remotely by using a remote code execution (RCE) vulnerability (CVE-2021-22204).

According to researchers, the vulnerability could allow attackers to weaponize the VirusTotal platform and achieve remote code execution on an unpatched 3rd party sandboxing machine employing anti-virus engines.

**How Could the Vulnerability be Exploited?**

Israeli security services provider CySource’s researchers Shai Alfasi and Marlon Fabiano da Silva embedded a payload in the DjVu file’s metadata for exploiting the vulnerability, identified in ExifTool open-source utility. This utility extracts Exchangeable Image File annotations, metadata, and tags.

Moreover, it can trigger another vulnerability to obtain remote code execution. This vulnerability is triggered by DjVu files and was identified by researcher William Bowling in 2021 in ExifTool 12.23. It was surprising that none of the VirusTotal anti-virus scanners could detect the CySource researchers’ Base64 encoded payload they included in the malicious DjVu file’s metadata.

> “Instead of ExifTool detecting the metadata of the file, it executes our payload.”
> 
> CySource

The researchers also got a reverse shell that allowed them to access over 50 internal network hosts with high privileges at Google and its other VirusTotal security vendor partners. Every time they uploaded a file with a new hash and a new payload, VirusTotal forwarded it to bots.

This indicates that apart from an RCE, the payload was forwarded by Google servers to the company’s internal network, partners, and customers as well. When researchers were able to invade the networks, they mapped out various services, including MySQL, Kubernetes container orchestration, Oracle databases, web applications, and Secure Shell (SSH).

**More Vulnerability News on Hackread.com**

1.  Hackers mining Monero on Microsoft SQL databases for last 2 years
2.  Hackers are using a 19-year-old WinRAR bug to install nasty malware
3.  12-Year-Old vulnerability in Windows Defender risked 1 billion devices
4.  Google, Microsoft and Oracle generated the most vulnerabilities in 2021
5.  Google Drive accounted for 50% of malicious Office document downloads

**Google Released Patch after Eight Months**

The vulnerability was disclosed to Google’s vulnerability reward program in April 2021, and the report was accepted in May 2021. However, the fix was dispatched in January 2022, after which CySource received the green signal to share details of the bug.

It is still unclear why Google took so long to fix this vulnerability. VirusTotal is a trusted service from Google’s subsidiary Chronicle, offering access to more than 70 different anti-virus scanning solutions from mainstream security vendors, including ESET, Kaspersky, and 360 Total Security. It is, therefore, quite shocking that a dangerous remote code execution vulnerability plagued this service for over eight months.

![](https://secure.gravatar.com/avatar/cf728b76a63b387b11edeafcb1b9b654?s=100&d=wavatar&r=g)

I am a UK-based cybersecurity journalist with a passion for covering the latest happenings in cyber security and tech world. I am also into gaming, reading and investigative journalism

Critical RCE Vulnerability Reported in Google’s VirusTotal

By Waqas
Learn everything there is to know about ransomware attacks. We cover the definition, statistics, and ransomware protection. Even…
This is a post from HackRead.com Read the original post: Ransomware Attacks: Everything You Need to Know

****Learn everything there is to know about ransomware attacks. We cover the definition, statistics, and ransomware protection.****

Even though it ends with a ransom, ransomware attacks are a bit different from regular ransom attacks that leverage sensitive information. They include malware that attacks devices, and the ransom is mostly demanded in hackers’ preferred cryptocurrency.

What is a ransomware attack exactly, how common are ransomware attacks, how does ransomware find its way to your computer, and do you have ransomware protection? Let’s dive in and find out.

**What is a Ransomware Attack? **

Ransomware is a type of malicious software. This malware can get into your computer, encrypt data, and withhold it until you pay the ransom. Data that is unlocked until a ransom is paid can be that of a single device or an entire network.

The victim of a ransomware attack, be it a company or an individual, has a certain time frame during which they have to pay the ransom or do what the note says. If they don’t oblige, they risk losing access to their data forever.

After the victim pays the ransom in the demanded cryptocurrency (that is used for illegal cyber activities because it’s more difficult to trace it), hackers unlock the access to their data. 

Or do they?

**Should You Pay the Ransom? **

No. You should contact authorities in your area that can take over, such as the FBI. 

Why?

Paying the ransom could imply you’re financing criminal activity.

So, why do most people pay the ransom?

When it comes to ransomware, there is a high chance you’ll lose your data. For companies, this means that they might have to rebuild everything they’ve worked for from scratch. 

Most companies don’t want their clients to find out about the attack at all. They might risk their reputation if others find out about the hacking, and their customers might be reluctant to use their services again in the future. 

Ransomware attacks also disrupt the workflow of an organization. As hackers withhold data, organizations might not be able to work or lose a lot of time waiting for access to the stolen information. 

Also, their IT teams and cybersecurity experts have to spend their time mitigating and dealing with the aftermath of a ransomware attack. This might cause them to fall behind with the rest of their professional duties.

Those are some of the reasons why most companies pay the price of a ransom. However, if you do pay the ransom, this doesn’t guarantee that hackers will give you access to your system or that the attack won’t happen again.

**Ransomware Attack Statistics**

According to research, 10% of breaches include ransomware. Targets of ransomware attacks have been individuals, companies, and even critical infrastructure sectors. 

The Colonial Pipeline ransomware attacks that happened last year saw one of the most widely reported attacks that targeted critical infrastructure. However, CISA suggests that there have been attacks on 14 out of 16 critical infrastructures.

CISA’s overall conclusion has been that there has been an increase in ransomware attacks worldwide. 

Last year, the number of ransom attacks doubled. The FBI reported an astonishing 2,084 complaints about ransomware.

An increase in this type of cyberattack in recent years could be attributed to widespread access to hacking methods and new vulnerabilities that have been caused by remote work. 

Information about how to perform certain attacks has been available on the internet. This means that even inexperienced cyber criminals can follow directions and perform dangerous attacks.

To adapt to remote work, companies had to adjust their systems to allow remote access. As they haven’t used the systems before, they were left with flaws in the system that caused many cyber breaches at the start of the pandemic. 

**Ransomware Attack Starts with Access to Your Device**

Some ways that ransomware malware can find its way to your computer include: 

*   **Email phishing** — if you click the link in the body of an email from an unknown sender or download a virus with the attachment
*   **Adware** — ads on the internet can contain malware and if you click it, you can download it onto your computer
*   **High-risk website** — by visiting an unsafe website, you can download malware on your device that encrypts your data

**Can You Protect Yourself from Ransomware Attacks? **

Yes. Since it’s a kind of malware, ransomware protection tools mitigate this type of attack as with any malicious virus that finds its way to your computer. They scan, detect, and remove it before it causes further damage. 

Some things you can do to protect your devices from ransomware attacks are:  

*   **Updating your software** — outdated software, applications, or systems can create vulnerabilities for your systems and devices.
*   **Having trustworthy anti-malware on your computer** — antivirus software that can detect ransomware and other types of malware is important for your cybersecurity. 
*   **Doing regular backups of your data** — during malware attacks, the key leverage that hackers have over you is withholding the data.

Old versions of applications and software can create flaws in your system because attacks are always changing, and new updated versions of systems are ready for new hacking methods.

Backups of your data should be on an external hard drive so that you can access it even if you become a victim of a ransomware attack.

**Prevent Ransomware Attacks Before They Happen**

Most people think about ransomware when the attack has already happened. Their data is encrypted, and they’re thinking of paying the ransom to regain access to their information.

Paying the ransom also doesn’t guarantee that you won’t be the victim of this type of cybercrime ever again. 

If it’s not patched up after the attack, the same hackers can exploit those same flaws that they’ve found in your system to demand ransom.

The time and money that companies spend following the attacks can be a deathly blow for many businesses — especially if they’re small businesses that didn’t expect that they’ll be the victim of such an attack. 

**More Ransomware Topics**

1.  Android ransomware found extorting credit card details from users
2.  NetWalker ransomware gang member sentenced to 7 years in prison
3.  New Android ransomware uses pornographic posts to infect devices
4.  How To Prevent Growing Issue of Encryption Based Malware (Ransomware)
5.  52 Critical Infrastructure Orgs Hit by Ragnar Locker Ransomware Gang – FBI

Ransomware Attacks: Everything You Need to Know

By Deeba Ahmed
Hackread.com earlier reported a website designed by software engineer Philip Wang that can create realistic faces of people…
This is a post from HackRead.com Read the original post: New Scam Utilizing AI-Generated Images to Represent Fake Law Firm

**Hackread.com earlier reported a website designed by software engineer Philip Wang that can create realistic faces of people who don’t even exist simply by clicking the Refresh button.**

**Non-Existent People Posed as Boston Law Firm**

It may seem like a story straight out of a Hollywood script, but it is indeed true that scammers are using AI-generated images to scam people. According to Ben Dickson of TechTalks, he received an email from a law firm’s attorney, which turned out to be fake, and surprisingly, the sender didn’t even exist.

**Details of the Scam**

In his blog post published in TechTalks, Dickson wrote that on April 13, Nicole Palmer sent an email citing “DMCA Copyright Infringement Notice.” The email introduced Nicole as a Trademark Attorney of Arthur Davidson Legal Services and claimed that the recipient had used an image in TechTalks that belonged to one of her clients.

“Our client is happy for their image to be used and shared across the internet. However, proper image credit is due for past or ongoing usage,” the email supposedly sent by Nicole read.

The email contained references to Section 512(c) of DMCA with a professional signature that made it appear legit. If it wasn’t done, Nicole threatened legal action against Dickson.

![](https://www.hackread.com/wp-content/uploads/2022/04/Nicole-Palmer-fake-email-side-1024x332.jpg)

DMCA Notice (Image: TechTalks)

**How was the Scam Discovered?**

Dickson spent around 7 days adding credit to that image and a homepage to Nicole’s client’s website. But, when he couldn’t be successful, he re-read the email and identified something off. It was a link to an image-sharing website called Imgur. On this site, anyone can upload images without creating a profile.

“So it was perfectly possible that they had downloaded the image from my website, uploaded it on Imgur, and then claimed that their image was there before mine,” Dickson wrote.

Dickson had taken that image from Pexels, a license-free stock photo library. He emailed Nicole with proof that no attribution was needed and waited for a reply. When he didn’t receive a response, he checked out her legal firm Arthur Davidson Legal website, which seemed authentic with profiles of 18 lawyers who graduated from prestigious institutions, 420 cases, and a 90% success rate with 380 wins.

A quick Google search didn’t yield any results of such a well-known law firm either. Red flags were raised when Dickson noted the website domain was set up in February 2022 while the firm was established in 2009.

Later, it turned out that Nicole Palmer didn’t even exist because when Dickson checked her photograph on the website, he learned that a generative adversarial network created the image.

![New Scam Utilizing AI-Generated Images to Represent a Fake Law Firm](https://www.hackread.com/wp-content/uploads/2022/04/fake-nicole-palmer.jpg)

Fake AI-Generated Image of Nicole Palmer (Image: TechTalks)

It is worth noting that in 2019, Hackread.com reported a website (thispersondoesnotexist.com) designed by software engineer Philip Wang that can create realistic faces of people who don’t even exist simply by clicking the Refresh button.

It is quite possible that Palmer’s image was also created using the same website. Nevertheless, watch out for fake emails claiming to represent law firms or threatening people with phony DMCA notices or subpoenas.

1.  AI firm exposes 2.5 million sensitive medical records online
2.  ‘Optical Adversarial Attack’ uses a low-cost projector to trick AI
3.  New Underactor tool reveals pixelated text to expose sensitive data
4.  Ukrainian News Channel Hacked to Run Deepfake video of President Zelensky
5.  These people don’t exist – They were created by tech using Artificial Intelligence

New Scam Utilizing AI-Generated Images to Represent Fake Law Firm

By Deeba Ahmed
T-Mobile has acknowledged the breach which occurred before police arrested some of the Lapsus$ members last month. The…
This is a post from HackRead.com Read the original post: Lapsus$ Hackers Stole T-Mobile’s Source Code and Systems Data

**T-Mobile has acknowledged the breach which occurred before police arrested some of the Lapsus$ members last month.**

The infamous Lapsus$ hacking group managed to steal T-Mobile’s source code in March 2022, days before the group’s prolific members got arrested in the same month. Lapsus$ hackers carried out a series of breaches in March, reported by Krebs on Security’s Brian Krebs. T-Mobile also confirmed the attack on The Verge. 

Lapsus$ is a notorious group of teen hackers that mainly hunts for the source code of high-profile and large tech firms like Samsung, Microsoft, and Nvidia. The group has previously targeted Globant, Okta, and Ubisoft.

In its latest breach against T-Mobile, the Lapsus$ group has reportedly downloaded over 30,000 source code repositories of the carrier.

![T-Mobile Hacked by Lapsus Hackers](https://www.hackread.com/wp-content/uploads/2022/04/t-mobile-bitbucket-source-code-1024x553.jpg)

LAPSUS$ hackers inside T-Mobile’s source code repository at Bitbucket (Image credit: Brian Krebs)

**How Did the Attack Occur?**

Speaking to Brian Krebs, T-Mobile stated that their monitoring tools detected an unauthorized individual trying to access its internal systems using stolen credentials. Reportedly, Lapsus$ hackers managed to buy stolen T-Mobile credentials from dedicated marketplaces like Russian Market and several others.

According to the telecom giant, the hackers also used the carrier’s employees’ credentials and internal devices such as its CMS or Atlas systems that could be used to conduct SIM swaps attacks.

> “Several weeks ago, our monitoring tools detected a bad actor using stolen credentials to access internal systems that house operational tools software. Our systems and processes worked as designed, the intrusion was rapidly shut down and closed off, and the compromised credentials used were rendered obsolete.”
> 
> T-Mobile

Furthermore, the attackers used the access to hack into T-Mobile’s accounts linked with the Department of Defense and the FBI. Still, they weren’t successful because of additional verification measures required to access these accounts.

T-Mobile confirmed that the systems Lapsus$ hackers accessed didn’t contain customer data or government information, or other sensitive information.

![T-Mobile Hacked by Lapsus Hackers](https://www.hackread.com/wp-content/uploads/2022/04/t-mobile-atlas-hacked-lapsus-1024x553.jpg)

LAPSUS$ hackers digging into Department of Defense in T-Mobile’s internal Atlas system (Image credit: Brian Krebs)

**What is SIM Swapping?**

For your information, SIM swapping is also known as SIM Hijacking. It is a kind of identity theft in which an attacker manages to create a new SIM card of any number fraudulently and use it for personal gains, without the knowledge or consent of the original user of the phone number.

To get the duplicate SIM card, the attacker usually calls the telecom firm and convinces their customer support service for being the actual owner of the phone number by providing the target’s personal information. Thus, the telecom firm ports the phone number to a new SIM card that is received by the attacker.

It is due to SIM Swapping attacks users including celebrities and top executives have lost millions of dollars to cybercriminals in the last few years.

**It rains data breaches at T-Mobile**

It is worth noting that T-Mobile has more than 104 million subscribers yet its security measures are highly dubious. In 2021 alone, the company suffered two successful data breaches (1 and 2) in which millions of its customers’ data was stolen and sold on hacking forums.

The hacker who claimed responsibility for one of the attacks called the carrier’s security “awful.” From 2015 to 2021, T-Mobile has made headlines for several other security-related incidents including exposure of customers’ data, a security vulnerability that allowed mass hijacking of customers’ accounts,

In December 2021, the telecom giant was in news again after it announced yet another data breach that exposed users to SIM swapping attacks. _The list goes on…_

**More Telecom Data Breaches**

1.  Spanish telecom giant MasMovil hit by Revil ransomware gang
2.  Telecom giant behind routing SMS discloses 5-year-long data breach
3.  Ukrainian Hacker Hacks Polish Telecom Giant Netia; Leaks Massive Data
4.  Hacker extracts customer data from Canadian Telecom Firm after rebuttal
5.  Croatian Police arrests minor over A1 Telecom data breach & ransom demand

Lapsus$ Hackers Stole T-Mobile’s Source Code and Systems Data

By Deeba Ahmed
Email security provider Avanan revealed in a Thursday report that a new phishing campaign exploits local credit unions…
This is a post from HackRead.com Read the original post: Crooks Spoofing Credit Unions to Steal Funds and Login Credentials

Email security provider Avanan revealed in a Thursday report that a new phishing campaign exploits local credit unions to steal money and data. According to Avanan’s research, phishing emails are masqueraded as legit messages from high-profile companies/businesses. They are sent to lure the recipient into sharing login credentials and sensitive data of the spoofed company.

**A dramatic rise in Credit Union Spoofing Phishing Campaigns**

Check Point firm Avanan claims that since February 2022, there has been a dramatic increase in phishing campaigns impersonating credit unions. The same was observed by the National Credit Union Administration (NCUA), which even advised credit unions to stay cautious about emerging new threats amid the ever-changing geopolitical situation. 

Referring to CISA’s advisory in January regarding Russian state-sponsored cyber threats to critical US infrastructure, NCUA noted that the risk of cyberattacks on US institutions has two-fold.

**Hackers Exploiting Undeveloped Email Security**

Although all financial and banking institutions are vulnerable to spoofed phishing emails but local credit unions are particularly vulnerable to such attacks due to insufficient security measures, researchers claim.

Reportedly, 92% of the credit unions mainly lack proper security, while 66% lack adequate email security, which makes them at risk of phishing campaigns. Furthermore, credit unions generally rank higher than larger banks, so their members are far more likely to trust messages/notifications from them. This has led to an uptick in local credit unions spoofing phishing campaigns.

**Attack Tactics**

Threat actors frequently use tactics like document alerts, wire transfer codes, and incoming payment notifications. The goal, however, is the same, which is to compel the recipient to enter account credentials and perform banking activities.

According to Avanan’s blog post, attackers use several different ways to obtain account details. In one of the phishing emails, the recipient was invited to click on a link for viewing their account statements and documents online.

![](https://www.hackread.com/wp-content/uploads/2022/04/credit-union-spoofing-phishing-campaigns-1024x507.jpg)

One of the phishing emails (Image: Avanan)

Another email contained a link related to an important notice, while a third one interestingly requested money to stop wire transfer. The fourth one offered an ACH debit. In all the cases, the link provided in the email redirected the victim to a fake sign-in page supposedly belonging to the credit union. The user enters credentials on that page, which are sent to the attackers, and they use them to compromise the account and steal funds.

> From the recipient’s perspective, the website appears unresponsive after they type in their username and password.
> 
> Avanan

It is worth noting that credit union attacks like these could have substantial financial repercussions as the risk goes as high as $1.2 million for larger credit unions.

Crooks Spoofing Credit Unions to Steal Funds and Login Credentials

By Owais Sultan
According to Economist, “The world’s most valuable resource is no longer oil, but data” therefore protecting your most…
This is a post from HackRead.com Read the original post: Sensitive Data: Securing Your Most Important Asset

Sensitive Data: Securing Your Most Important Asset

By Deeba Ahmed
LemonDuck cryptomining botnet previously targeted Microsoft Exchange servers. Now it is targeting the world’s leading containerization platform, Docker.…
This is a post from HackRead.com Read the original post: LemonDuck Cryptomining Botnet Hunting for Misconfigured Docker APIs

LemonDuck Cryptomining Botnet Hunting for Misconfigured Docker APIs

By Deeba Ahmed
A virtual private network or simply VPN is a service that protects your privacy online. This article explains…
This is a post from HackRead.com Read the original post: What is a VPN and what does data logging by a VPN means?