By cyberwire
Company Open Sources FHE Libraries to Build Privacy-Preserving Blockchain and AI Applications for the First Time.
This is a post from HackRead.com Read the original post: Zama Secures $73M Series A Lead for Homomorphic Encryption

**Investment secured to bring Fully Homomorphic Encryption (FHE) to the fore, giving developers the ability to address data privacy challenges across blockchain and AI use cases.**

Paris, France, March 7th, 2024, Cyberwire – Zama, an open-source cryptography company building state-of-the-art FHE solutions to protect privacy in blockchain and AI, today announced a $73M Series A round led by Multicoin Capital and Protocol Labs, with participation from Metaplanet, Blockchange Ventures, VSquared, and Stake Capital, as well as blockchain pioneers Juan Benet (founder of Filecoin), Anatoly Yakovenko (co-founder of Solana), and Gavin Wood (co-founder of Ethereum and co-creator of Polkadot).

The funds will be used to hire talented engineers, software developers, and researchers in cryptography to maintain its open-source libraries and collaborate with strategic partners to develop a new class of Fully Homomorphic Encryption (FHE) applications. 

As demand for robust data protection grows internationally, businesses and organizations need a way to protect consumer data without compromising its utility. FHE provides a novel encryption technique that makes it possible to compute over encrypted data for the first time, revolutionizing what’s possible with data privacy for organizations, governments and consumers alike.

Over four years, Zama has built a suite of open-source cryptographic libraries and solutions that make FHE readily available to developers to build privacy-preserving applications. 

“We envision a world where data privacy isn’t an afterthought, but rather guaranteed by design. With the support of our investors, our talented team, and over 3,000 developers in our community, we can make FHE and privacy synonymous and ubiquitous,” said Rand Hindi, CEO of Zama.

“This funding gives us the resources to add to the best and brightest cryptography minds we already have on the team, while also continuing to advance the state of the art of what’s possible in data privacy. Our investors, Multicoin and Protocol Labs, in particular, lend valuable experience as we bring FHE to market in the blockchain sector.”

Zama has been at the vanguard of FHE innovation since its inception in 2020. To date, the company has secured multi-million dollar deals in the blockchain and AI space and has successfully released four cutting-edge FHE solutions.

The company’s most recent solution, fhEVM, is the first confidential smart contract protocol for EVM blockchains. Using FHE, the fhEVM enables on-chain state and transaction data to remain end-to-end encrypted during processing, addressing the core data privacy challenges in the blockchain. 

“FHE is the most important foundational cryptographic primitive for the next decade of computing. Zama’s technology is the key to building multiplayer, privacy-preserving applications,” said Kyle Samani, Managing Partner of Multicoin Capital.

“Zama’s groundbreaking work on open-source FHE tooling is only the beginning. We are proud to help them build the next generation of crypto-enabled, privacy-first applications.”

In addition to addressing data privacy challenges in the blockchain industry, Zama is also building bespoke solutions in the artificial intelligence, healthcare, financial services, and governmental security industries. 

“The potential for FHE in both blockchain confidentiality and AI privacy is massive,” says Pascal Paillier, CTO of Zama. “Being able to share our tools with people who are passionate about the same mission is an incredible privilege, something that has only been possible thanks to continuous support, resources and knowledge provided by our investors and community.”

Zama’s team is made up of over 75 individuals from 22 different nationalities, drawn from the fields of cryptography, machine learning, and blockchain technology. Half of the team hold PhDs in their respective fields and are passionate about ensuring data privacy. 

Zama is an open-source cryptography company building state-of-the-art FHE solutions to protect privacy in blockchain and AI. Their technology enables a broad range of use cases, from confidential smart contracts to encrypted machine learning and privacy-preserving cloud applications. Zama was founded by Dr Pascal Paillier and Dr Rand Hindi and has the largest research team in homomorphic encryption.

****About Multicoin Capital** **

Multicoin Capital is a thesis-driven investment firm that invests in cryptocurrencies, tokens, and blockchain companies. Crypto networks and companies will create trillions of dollars of value over the next decade.

However, investing in tokens is fundamentally different from investing in companies. New tools, heuristics, and security measures are needed to responsibly invest in this ecosystem. We leverage a deep understanding of blockchain technology and crypto markets to deliver exceptional returns.

****About Protocol Labs****

Protocol Labs is an open-source research, development, and deployment laboratory. Their projects include IPFS, Filecoin, libp2p, and many more. They aim to make human existence orders of magnitude better through technology. They were founded in 2014 by Juan Benet as a fully distributed company. Their team of more than 100 members works remotely and in the open to improve the internet — humanity’s most important technology — as they explore new advances in computing and related fields.

****Contact****

*   **PR Consultant**
*   **Kirsty Jarvis**
*   **Luminous PR**
*   **+44 7966 291216**
*   **\[email protected\]**

Zama Secures $73M Series A Lead for Homomorphic Encryption

By Owais Sultan
Explore the world of Prototyping PCB Assembly with our comprehensive guide. Learn, create, and innovate with expert insights. Start your PCB journey today!
This is a post from HackRead.com Read the original post: A Comprehensive Guide To Prototyping PCB Assembly

Prototype PCB assembly is the creation of an initial version of a printed circuit board design for testing and verification in electronics product development, which assesses functionality, signal integrity, and manufacturability. 

In other words, prototype PCB assembly is one of the most crucial steps in electronics product development. Creating a prototype PCB brings circuit schematics to life, marking the initial physical manifestation of the design. Prototype PCB assembly encompasses this entire process.

PCB prototype assembly is the vital process of transforming electronic designs into physical boards with soldered components. 

This crucial step bridges the gap between theoretical schematics and mass production, further allowing early insights and optimisations. It involves both PCB fabrication, creating physical boards from CAD designs, and assembly, soldering components based on bill of materials (BOM) requirements. 

Prototyping helps mitigate risks and uncertainties in technology and manufacturing, providing a cost-effective way to validate functionality, safety, and performance before large-scale production. A good prototype assembly partner is key to the overall success of a product.

****Advantages of Prototyping PCB Assembly****

Exploring PCB prototypes and assemblies offers various advantages over directly engaging in mass production that are described below:

*   Validation of design
*   Assurance of quality
*   Compatibility of components
*   Economical solutions
*   Time-efficient processes

****Validation of Design****

*   Verifies and refines the design before mass production
*   Identifies errors and offers an opportunity for optimization
*   Reflects the final product’s functionality

****Assurance of Quality****

*   Tests and ensures board quality and reliability
*   Confirms compliance with specifications and standards
*   Ensures reliable performance under different conditions

****Component Compatibility****

*   Tests electronic components’ compatibility on the board
*   Ensures efficient and effective collaboration of components
*   Minimizes the risk of failure during operation

****Economical Solutions****

*   Saves costs by identifying design errors early in the process
*   Allows necessary corrections before full-scale manufacturing
*   Minimizes the risk of costly mistakes

****Time-Efficient Processes****

*   Reduces time required for testing, validation, and production
*   Accelerates time-to-market for the final product

****Prototype PCB Assembly: Why Do We Use It?********Verify Design Functionality****

*   Examine real-world performance
*   Testable boards validate the design and detect flaws
*   Mitigates risks before large-scale production

****Accelerate Product Developmen**t**

*   Early verification and issue discovery
*   Optimizes designs, saving over 60% in engineering time
*   Significantly reduces time-to-market

****Facilitate Demonstration And Funding****

*   Showcases viability and technology capacity
*   Builds a business case for hardware startups
*   Attracts early adopters and investor funding

****Refine Designs For Manufacturability****

*   Reflects real-world manufacturing processes
*   Identifies design for manufacturability (DFM) issues
*   Ensures a smooth transition to mass production

****Varieties of Prototype PCB Assembly****

Various assembly methods and categories are employed to attach electronic components to PCB prototypes, addressing diverse production requirements, some of which are categorised below.

*   Manual Assembly vs Automated SMT Assembly
*   Through-Hole vs SMT Assembly
*   Single-sided vs Double-sided Assembly
*   Hybrid Assembly Techniques

****Manual Assembly vs Automated SMT Assembly****

**Manual Assembly**

*   Manual soldering by technicians
*   Suitable for low-volume orders
*   Simplest method

**Automated Assembly**

*   Automated surface mount technology assembly
*   Ideal for complex board productions
*   Higher efficiency
*   Consistency
*   Manufacturability

****Through-Hole vs SMT Assembly****

**Through-Hole Assembly (THA):**

*   Connector pins pass through holes
*   Respective applications
*   Mixed THA parts on primarily SMT boards
*   Absence of advanced features
*   THA has a complex structure

**Surface-Mount Technology (SMT):**

*   Components soldered directly onto surface pads
*   Respective applications
*   Advanced technology allows combining both
*   SMT also has respective applications

****Single-sided vs Double-sided Assembly****

**Single-Sided Assembly:**

*   Components are placed and soldered on one side
*   Suitable for less complex designs

**Double-Sided Assembly**:

*   Parts soldered on both sides, allowing higher component density
*   Ideal for more intricate and densely populated PCBs

****Hybrid Assembly Techniques****

**Advanced Manufacturing Capabilities:**

*   Utilizes state-of-the-art manufacturing capabilities
*   Optimizes production flexibility

**Component Mixtures on Boards:**

*   Combines 0201 size tiny chips with larger SMT parts and some through-hole passives
*   Allows hybrid assembly on double-sided boards

****How To Assemble A Prototype PCB****

Building prototype PCBs involves following standard assembly stages to turn CAD designs into functioning boards. This can be done through automated SMT lines or manual assembly processes. 

****Prototype PCB Assembly Process Steps:****

*   SMT Pick-and-Place Stage
*   SMT Reflow Soldering
*   Cleaning/Washing
*   AOI and Functional Testing
*   Final Programming/Flashing

****SMT Pick-and-Place Stage****

*   Utilizes advanced pick-and-place machines for a precise component population
*   Based on optimised programming and feeder setup
*   Ensures high precision and traceability

****SMT Reflow Soldering****

*   Boards pass through industrial reflow ovens after accurate component positioning.
*   Enables simultaneous precision soldering of SMT parts
*   Carefully optimised thermal profiling for permanent attachment

****Cleaning/Washing****

*   After rework, cleaning solutions wash flux residues off board surfaces
*   Ensures thorough removal for ionic cleanliness

****AOI and Functional Testing****

*   Automated optical inspection checks component placement
*   Rigorous functional testing examines board performance metrics
*   Ensures specification compliance using fixture testing

****Final Programming/Flashing****

*   Downloads optimised software/firmware builds to boards
*   Completes prototype PCB assembly for design validation
*   Precedes shipping to customers

****Final Thoughts****

Prototype PCB assembly is vital for electronics product development, verifying designs and validating concepts. Quality builds impact design optimizations and securing financing. Balancing costs, responsive turnarounds, and technical alignment are crucial. Bittele offers professional turnkey services, reshaping ideas into testable boards for commercial success. With a focus on exceptional quality and responsive support, choosing the right assembly partner is key for impactful innovation trajectories.

****People Also Asked** **

**Q: How do I make a PCB prototype?**

**A:** The PCB prototype assembly involves the following steps:

*   Design
*   Schematic creation
*   BOM generation 
*   Routing design 
*   Thorough checks

**Fabrication includes:**

*   Creating photo films
*   Printing layers
*   Fusing 
*   Drilling
*   Plating
*   Applying finishes 

**The assembly stage includes:**

*   Stencilling 
*   Pick and place
*   Reflow soldering
*   Inspection
*   Inserting through-hole components
*   Conducting functionality tests

****Q: What is a PCB prototyping machine?****

**A:** An eco-friendly PCB machine is utilized throughout the entire PCB production process, ensuring environmentally conscious practices from design validation to board assembly.

1.  Benefits of Rapid Prototyping in Manufacturing
2.  Kotlin app development company – How to choose
3.  5 must-try user flow diagramming tools for UX designing
4.  Importance of Digital Strategy and Automation for Businesses

A Comprehensive Guide To Prototyping PCB Assembly

By Deeba Ahmed
Remote Access Trojan Threat: Beware Malicious Downloads Disguised as Meeting Apps.
This is a post from HackRead.com Read the original post: Fake Skype, Zoom, Google Meet Sites Infecting Devices with Multiple RATs

Android and Windows users, beware of fake online meeting sites such as Google Meet, Zoom, and Skype, infecting devices with malicious malware like SpyNote RAT for Android, NjRAT, and DCRat.

Zscaler’s ThreatLabz cybersecurity researchers have discovered a new scam where Remote Access Trojans (RATs) are distributed through online meeting platforms, targeting Android and Windows users with malware. The purpose is to distribute malware that can steal sensitive data and control infected devices.

Researchers discovered a threat actor creating fraudulent websites for spreading malware, including SpyNote RAT for Android and NjRAT and DCRat for Windows, in December 2023. These RATs can steal confidential information and log keystrokes. Users are lured through fake online meeting sites impersonating brands like Skype, Google Meet, and Zoom. 

The actor used shared web hosting, hosting all fake sites on a single IP address in Russian, and URLs that closely resembled the actual websites. The attackers distributed multiple malware families using these fake websites, posing a significant threat to innocent users.

To download the software, users must either click the Android or Windows buttons. When they click on Android, a malicious APK file gets downloaded, whereas clicking on the Windows button triggers the download of a BAT file, which automates tasks and performs additional actions, such as downloading a RAT payload.

A campaign imitating legitimate online meeting platforms is a significant threat, with fake sites mimicking their appearance and functionality. In December, as noted by Zscaler in a blog post, a fake Skype site, join-skypeinfo, was created to trick users into downloading the application, leading to a BAT file and a WinRAR archive file. 

The fake Google Meet site, online-cloudmeetingpro, was hosted on a subpath resembling a joining link. The fake Zoom sites have URLs with genuine Zoom meeting IDs that increase the risk of falling victim to the scam. 

These fake websites also contained an open directory with NjRAT executable files, suggesting the attacker may use them in other campaigns. 

Fake Skype, Zoom and Google Meets websites identified by researchers (Screenshot via Zscaler)

Such campaigns can have devastating consequences. RATs can compromise devices, allowing attackers to steal sensitive information, monitor user activity, and potentially control the infected device.

To protect yourself, double-check URLs, verify meeting invitations, download software from official sources, and use antivirus and anti-malware software. Beware of fake websites, verify meeting invitations, and download applications from official sources.

1.  Konni RAT Exploiting Word Docs to Steal Data from Windows
2.  Fake Chrome Browser Update Installs NetSupport Manager RAT
3.  Bifrost RAT Variant Targets Linux Devices, Mimics VMware Domain
4.  AsyncRAT Infiltrates Key US Infrastructure Through GIFs and SVGs
5.  Popular Android Screen Recorder iRecorder App Revealed as Trojan

Fake Skype, Zoom, Google Meet Sites Infecting Devices with Multiple RATs

By Uzair Amir
Vulnerability risk management, unlike traditional approaches, factors in vulnerability criticality, exploit likelihood, and business impact, enhancing risk assessment and mitigation strategies.
This is a post from HackRead.com Read the original post: Vulnerability Risk Management for External Assets

With each new cloud application or third-party SaaS account, the external attack surface of pretty much every organization keeps growing day after day, every day. It becomes wider and more vulnerable. Gartner recognized attack surface expansion as the number one security trend of the year back in 2022.

The only way to deal with this is to manage the vulnerabilities that comprise the attack surface. But it’s impossible to patch or mitigate them all at once, though. This is why security professionals came up with something called risk-based vulnerability management.

Risk-based vulnerability management is a cybersecurity process that prioritizes and addresses the most critical vulnerabilities according to the risk they pose to an organization.

As a process, it has certain stages:

*   – asset inventory, 
*   – vulnerability identification, 
*   – risk assessment, 
*   – prioritization, 
*   – remediation and mitigation. 

These stages may seem the same as those of traditional vulnerability management. But there is a difference: vulnerability risk management enables more effective prioritization. It ensures a focus on the most business-critical vulnerabilities first, instead of simply grading them by their severity score.

Unlike traditional vulnerability management, vulnerability risk management considers factors such as vulnerability criticality, exploit likelihood, and business impact. Using vulnerability risk management allows the organization to allocate resources more efficiently, reduce the attack surface where it has the most impact and improve its security posture. All while maintaining regulatory compliance.

****How to Conduct Asset Inventory and Identify Vulnerabilities****

There are various sources of weaknesses in external attack surfaces: it could be compromised websites or web applications, misconfigured cloud infrastructures, weak access controls, or inadequate authentication mechanisms in APIs. All these vulnerabilities provide threat actors with an opportunity to compromise sensitive data and gain unauthorized access to the company’s infrastructure.

To manage all of that, you need to start somewhere. The best starting point is getting a clear understanding of the assets within your organization’s external attack surface. 

External attack surface management (EASM) tools can help you discover and validate (confirm that they belong to your organization) both known and unknown internet-facing assets such as IP addresses, domain names, subdomains, ports, and SSL certificates. You think you are aware of most of them, but a thorough scan can often reveal quite a few that were previously not on the radar.

Basic scanners can also help discover some assets (however, they likely have lower coverage than a good EASM tool) and identify security flaws and vulnerabilities. EASM tools can do all of that and may provide you with asset inventory and offer a more sophisticated analysis of vulnerabilities, remediation suggestions, and continuous monitoring.

****New Vulnerability Prioritization Approach Based on Risk Assessment****

A good EASM tool will certainly discover many CVEs in the infrastructure of any company. And a significant number of them will likely fall into the high or critical categories. However, most of these vulnerabilities never see a working exploit. An even smaller number of threat actors get to actively exploit in the wild. 

That’s why prioritizing vulnerability remediation solely based on their severity classification may not be the most adequate approach. Vulnerability risk management suggests a more effective method: prioritizing vulnerability fixes based on assessing risks that each vulnerability poses for the organization.

A risk-based assessment considers three main factors:

*   How critical is the vulnerable asset?
*   How likely is it that the vulnerability will be exploited?
*   How will patching it affect the business processes?

For the likelihood of exploitation, you can consider the vulnerability CVSS impact score, and also factors like whether a weaponized exploit is available, whether it is used in the wild, and whether it is trending in the dark web. Some EASM tools include a built-in risk-based prioritization system.

The questions of business criticality are for the business departments to answer, and as for how patching affects business processes, consider potential downtimes and the need to restart some services, thus interrupting the normal business flow.

****Remediating & Mitigating Vulnerabilities****

After you’ve assessed the risks and prioritized vulnerabilities, you can either remediate or mitigate them. Remediation involves directly addressing and fixing the vulnerabilities to eliminate associated risks. To confirm the success, validate the fix after application.

Sometimes immediate remediation is not possible. For example, you may need to reboot the whole system to implement an update, and that, of course, cannot be done daily. In this case, mitigation strategies will help reduce the potential impact of exploitation until you can apply a permanent fix.

****Monitoring and Response: Identify, Assess, Prioritize, Remediate, and Repeat****

The process of vulnerability risk management never stops or ends. New vulnerabilities are discovered every day. In January 2024 alone, Microsoft released new patches for 49 vulnerabilities, with 2 of them recognized as critical and 4 as high. 

Moreover, new external assets appear in organizational infrastructures every day. So, the process of risk-based vulnerability management is continuously ongoing.

That is where EASM tools again come in handy. Active use of these tools allows to make vulnerability scanning and asset inventory regular – and mostly automated – procedures.

****EASM Tools Can Help Implement Vulnerability Risk Management Approach****

EASM tools provide companies with the opportunity to adopt vulnerability risk management to address security issues regularly according to organizational risk rather than issue severity.By employing Vulnerability Risk Management, companies can effectively block potential attack paths and safeguard critical attack vectors to reduce their external attack surface most efficiently. 

1.  What Is Incident Management Software?
2.  5 Common Database Management Challenges & Solutions
3.  Cybersecurity Risk: What It Is and How Can It Be Reduced?
4.  Securing SaaS Landscape: Closer Look at Disaster Recovery
5.  Cybersecurity risk assessment: Does Your Company Need It?

Vulnerability Risk Management for External Assets

By Deeba Ahmed
Another day, another Linux malware!
This is a post from HackRead.com Read the original post: New Linux Malware Alert: ‘Spinning YARN’ Hits Docker, Other Key Apps

Linux Users Beware: “Spinning YARN” Malware Campaign Targets Misconfigured Servers Running on Apache Hadoop YARN, Docker, Confluence and Redis.

Cado Security Labs has discovered an emerging Linux malware campaign dubbed Spinning Yarn targeting misconfigured servers running Apache Hadoop YARN, Docker, Confluence, and Redis web-facing services. 

The emergence of the new Linux malware shouldn’t come as a surprise, given the recent surge in threats targeting Linux devices and servers. Just a couple of days ago, an old Linux malware known as Bifrost RAT resurfaced with a new variant that mimics VMware domains.

According to Cado Security’s research research shared with Hackread.com ahead of publication on Wednesday, Spinning Yarn is a malicious campaign that exploits weaknesses in popular Linux software used by businesses across various sectors. 

These services are crucial components in organizations’ IT infrastructure. Docker is critical for developing, deploying, and managing containerized applications. Apache Hadoop allows distributed processing of large datasets. Redis, a widely used in-memory data store, helps in caching real-time applications, and Confluence allows collaboration and knowledge management.

By compromising these applications, attackers can gain unauthorized access to systems, steal sensitive data, disrupt operations, or deploy ransomware, posing a significant threat to servers and critical infrastructure.

In Spinning Yarn, threat actors have used several unique payloads, including four Golang binaries that automate the discovery and infection of hosts and let them exploit code. They use Confluence to exploit common misconfigurations and vulnerabilities, launching Remote Code Execution (RCE) attacks and infecting new hosts.

The attackers exploit CVE-2022-26134, an n-day vulnerability in Confluence, and deploy a container for the Docker compromise. The vulnerability has been exploited since 2022, including by Mirai malware variant V3G4 against IoT devices for DDoS attacks

Further probing revealed a series of shell scripts and standard Linux attack techniques used to deliver a cryptocurrency miner, spawn a reverse shell, and enable persistent access to compromised hosts. They also deploy an instance of the Platypus open-source reverse shell utility to maintain access.

In an attempt to evade detection, multiple user-mode rootkits are deployed. Researchers observed that the shell script payloads employed in this campaign share similarities with those used in previous cloud attacks.

In their blog post, Cado Security Labs detailed initial access activity on a docker Engine API honeypot on this IP address: 47966971. The attacker spawned a new container using Alpine Linux and created a bind mount for the underlying server’s root directory. This technique is common in Docker attacks, allowing attackers to write files to the host and execute a job for the Cron scheduler eventually achieving RCE.

In this campaign, the attacker wrote an executable and registered a Cron job to execute base64-encoded shell commands. Such extensive attack on Linux applications demonstrates attackers’ growing sophistication in targeting web-facing services in cloud environments, keeping abreast of vulnerabilities.

To mitigate the risks from campaigns like Spinning Yarn, regularly update software, enable strong passwords, educate employees on cybersecurity best practices, segment your network to limit potential damage, and deploy security solutions like endpoint security solutions and firewalls to detect and prevent malware infections. This will help protect against known vulnerabilities and ensure a secure environment.

1.  New Linux Malware “Migo” Exploits Redis for Cryptojacking
2.  Free Download Manager Site Pushed Linux Password Stealer
3.  Malicious Ads Infiltrate Bing AI Chatbot in Malvertising Attack
4.  Hamas Hackers Hit Israelis with New BiBi-Linux Wiper Malware
5.  Mirai-based NoaBot Botnet Hits Linux Systems with Cryptominer

New Linux Malware Alert: ‘Spinning YARN’ Hits Docker, Other Key Apps

By Deeba Ahmed
Group-IB Report Warns of Evolving Cyber Threats Including AI and macOS Vulnerabilities and Ransomware Attacks.
This is a post from HackRead.com Read the original post: Report Uncovers Massive Sale of Compromised ChatGPT Credentials

Group-IB report unveils: compromised ChatGPT accounts sold on dark web, highlighting AI security risks, ransomware surge, macOS vulnerabilities. Take action to stay safe.

Group-IB’s Threat Intelligence has released a “Hi-Tech Crime Trends 23/24” report highlighting a dramatic surge in ransomware attacks, macOS system threats, and the growing use of AI by cyber criminals.

The report revealed Asia-Pacific being the primary target for advanced persistent threat groups in 2023, with 523 attacks worldwide. APAC organizations accounted for 34% of global attacks, with Europe and the Middle East ranking second and Africa third.

A 70% rise in public ads selling zero-day exploits was recorded during 2022-2023. Threats like the **CVE-2023-38831** zero-day vulnerability in ZIP file format remained popular among advanced cybercrime groups and nation-state actors for cyber-espionage activities. 

The report also warned of a growing interest in AI systems, **particularly ChatGPT** credentials, for reaching sensitive corporate data as public Large Language Models (LLMs) often do not protect accounts with multi-factor authentication.

AI systems can let attackers access confidential information, including internal source code, financial data, and trade secrets, and access communication history logs between employees and systems, allowing attackers access to sensitive data.

Over 225,000 infostealer logs containing compromised ChatGPT credentials were detected between January-October 2023. Four ChatGPT-style tools were developed since mid-2023 to facilitate such activities, including WolfGPT, DarkBARD, **FraudGPT, and WormGPT**. FraudGPT and WormGPT are popular for social engineering and phishing, while WolfGPT focuses on code or exploits.

Researchers detected around 130,000 compromised hosts with ChatGPT access between June and October 2023, marking a 36% increase from the previous year. The **LummaC2** information stealer breached most logs.

Researchers also detected 4,583 companies with their information, files, and data published on ransomware Distributed Leaks (DLSs), marking a 74% growth from the previous year, with North American companies being the biggest victims. 

Global threat actors, primarily APT groups, are targeting Apple platforms more, with underground sales of macOS information stealers increasing fivefold. Most concerning cyber risks for 2024 include zero-day exploits and malicious service use.

Cybersecurity firms have long been raising alarm over the continuous expansion in the global cyber threats spectrum. In June 2023, Group-IB researchers **discovered** a trend of over 100,000 devices infected with stolen ChatGPT credentials, with 26,802 compromised accounts recorded in May 2023. The Asia-Pacific region had the highest concentration of compromised credentials. ChatGPT’s default settings store user queries and AI responses, exposing confidential information.

In January 2024, Kaspersky Digital Footprint Intelligence **reported** threat actors exploiting AI technologies for illegal activities, sharing jailbreaks and exploiting legitimate tools for malicious purposes, particularly ChatGPT and LLMs, which can be used for malicious purposes, including malware development and illicit language model use.

The latest **report** highlights a significant rise in ransomware attacks targeting manufacturing, real estate, healthcare, government, and military sectors, the growing sophistication of **cybercriminals targeting macOS systems**, and the potential misuse of AI by cybercriminals to automate tasks, personalize attacks, and bypass security measures.

Businesses should invest in robust security solutions like firewalls, endpoint protection software, and intrusion detection systems, along with offering employee training on cyber threats to stay protected.

1.  **OpenAI’s ChatGPT Can Create Polymorphic Malware**
2.  **Malicious Abrax666 AI Chatbot Exposed as Potential Scam**
3.  **Malicious Ads Infiltrate Bing AI Chatbot in Malvertising Attack**
4.  **Following WormGPT, FraudGPT Emerges for AI-Driven Cyber Crime**
5.  **Researcher create polymorphic Blackmamba malware with ChatGPT**

Report Uncovers Massive Sale of Compromised ChatGPT Credentials

By Waqas
Logged out of your Meta Platform services?
This is a post from HackRead.com Read the original post: Meta Platforms Face Outage: Facebook, Instagram, Messenger, Threads Down

You are not alone, Facebook, Instagram, Messenger and Threads are down worldwide.

Users of Meta Platforms’ services, including Facebook, Instagram, Messenger, and Threads, are currently experiencing difficulties accessing their accounts. Reports indicate a widespread outage impacting individuals globally.

Starting around 4:30 PM GMT, a surge in user reports on Downdetector, a platform tracking online outages, signaled login issues across all four platforms. Users attempting to log in have encountered error messages, with some being logged out unexpectedly. The problem appears to be affecting users on both desktop and mobile applications.

Instagram error (screenshot: Hackread.com)

Meta Platforms has yet to acknowledge the outage on its official communication channels officially, but it’s expected that the company is actively investigating the cause of the issue.

The full extent of the outage remains unclear, but it’s evident that it’s not limited to just Facebook. Downdetector is currently swamped with user reports for all four affected platforms, suggesting a significant disruption to Meta’s services.

Here’s what we know so far:

*   **The outage began around 4:30 PM GMT.**
*   **Both desktop and mobile platforms seem to be affected.**
*   **Meta Platforms has not yet officially acknowledged the issue.**
*   **Users across the globe are facing problems accessing Facebook, Instagram, Messenger, and Threads.**

This is a developing story, and we will update this article as more information becomes available. We advise users to monitor Meta’s official channels for further updates and avoid attempting repeated logins to prevent potential account security issues.

1.  Video Chat Website Omegle Permanently Shuts Down
2.  ChatGPT Down? Anonymous Sudan Claims Responsibility
3.  ChatGPT Down? OpenAI Blames Outages on DDoS Attacks

Meta Platforms Face Outage: Facebook, Instagram, Messenger, Threads Down

By Waqas
Researchers have created computer worms with self-propagation capabilities that target GenAI applications.
This is a post from HackRead.com Read the original post: Researchers Test Zero-click Worms that Exploit Generative AI Apps

A new study dubbed ComPromptMized, warns of zero-click worms exploiting generative AI, spreading through systems sans user interaction, and posing data theft risks. Experts stress urgent AI security measures.

Researchers have recently unveiled findings indicating the creation of a computer worm capable of targeting generative AI-powered applications. This revelation comes amidst growing concerns over the **security of artificial intelligence systems**.

In a collaborative effort led by Stav Cohen from Technion – Israel Institute of Technology, Ron Bitton from Intuit, and Ben Nassi from Cornell Tech, the team developed and tested this novel worm against popular AI models, including Gemini Pro (previously **Bard AI**), **ChatGPT**, and LLaVA.

While the study highlights the potential malicious applications of such technology, it also echoes a warning **issued last year** by Europol regarding prompt engineering and jailbreaking of AI chatbots.

The research suggests that attackers could exploit this worm to manipulate AI models into replicating malicious inputs and engaging in harmful activities. One alarming demonstration involved the worm **attacking generative AI** email assistants, effectively stealing email data and distributing spam.

The mechanism behind the worm’s operation is intriguing yet concerning. By introducing specific text into an email, attackers could “poison” the databases of certain email application clients. This manipulation could then prompt models like ChatGPT and Gemini to replicate the malicious input and extract sensitive user data from the context.

In their **study** dubbed ComPromptMized, the researchers explored various scenarios, including both black-box and white-box accesses, and tested the worm’s effectiveness against different types of input data, such as text and images. The findings underscore the potential threats posed by such attacks on the burgeoning **GenAI ecosystems**.

The implications of this research extend beyond theoretical concerns. As more companies integrate generative AI capabilities into their applications, the risk of exploitation becomes increasingly tangible. The ability of malicious actors to leverage AI technology for nefarious purposes underscores the urgent need for robust security measures in AI development and deployment.

**Beth Linker**, Senior Director of AI & SAST at the Synopsys Software Integrity Group, emphasized the significance of this research, stating, “This attack highlights the vulnerability of GenAI-powered proactive agents as a potential target for exploitation. With the proliferation of new AI-driven tools promising to streamline our digital interactions, it is crucial for organizations to carefully consider the permissions granted to these tools and implement robust safety measures.”

While the research provides valuable insights into the vulnerabilities of generative AI systems, it also serves as a call to action for stakeholders across various industries. As we continue to embrace the benefits of AI innovation, it is imperative to remain alert against emerging threats and prioritize the development of strong security protocols.

1.  OpenAI’s ChatGPT Can Create Polymorphic Malware
2.  Malicious Abrax666 AI Chatbot Exposed as Potential Scam
3.  Malicious Ads Infiltrate Bing AI Chatbot in Malvertising Attack
4.  Following WormGPT, FraudGPT Emerges for AI-Driven Cyber Crime
5.  Researcher create polymorphic Blackmamba malware with ChatGPT

Researchers Test Zero-click Worms that Exploit Generative AI Apps

By Deeba Ahmed
The CHAVECLOAK banking Trojan employs PDFs, ZIP downloads, DLL sideloading, and deceptive pop-ups to target Brazil's unsuspecting banking users financial sector. 
This is a post from HackRead.com Read the original post: New CHAVECLOAK Banking Trojan Targets Brazilians via Malicious PDFs

Watch out for the new CHAVECLOAK banking Trojan as it spreads its infection through SMS phishing (SMishing), phishing emails, and compromised websites.

Cybersecurity researchers at FortiGuard Labs have discovered a high-severity Trojan, dubbed CHAVECLOAK, targeting Brazilian banking users. The malware targets Windows devices and accesses online banking platforms, stealing their banking credentials and financial information.

The CHAVECLOAK infection method is under investigation, but researchers suspect potential distribution channels include phishing emails, SMS phishing, and compromised websites.

According to the company’s blog post, the campaign involves malicious emails disguised as legitimate bank communications that could trick users into downloading malware. It then targets unsuspecting users utilising Portuguese language settings, DLL sideloading, and deceptive pop-ups. It actively monitors victims’ interactions with financial portals.

It is worth motioning that DLL sideloading poses a huge security risk because it allows the malware to exploit legitimate processes without raising suspicion or getting detected. 

The malware controls victims’ devices and collects sensitive financial information through a malicious PDF file, claiming to contain contract documents with Portuguese instructions. However, it has a malicious downloader link, which is processed via Goo.su and redirects to a ZIP file, resulting in the MSI file “NotafiscalGFGJKHKHGUURTURTF345.msi.”

When decompressed, the MSI installer revealed multiple TXT files, a legitimate execution file, and a malicious DLL named “Lightshot.dll.” The DLL file’s modified date is more recent than the other files. The installer executes the file “Lightshot.exe” and uses DLL sideloading techniques to execute the malicious DLL. This lets the legitimate executable run the malicious code discreetly, enabling unauthorized activities like data theft. 

Additionally, the malware uses the “GetVolumeInformationW” process to gather file system and volume information, generates a log file, and executes the “Lightshot.exe” program upon user login. It sends HTTP requests, logs data, and monitors the foreground window using the APIs “GetForegroundWindow” and “GetWindowTextW.”

The malware then communicates with its C2 server, facilitating actions to steal a victim’s credentials, blocking their screen, logging keystrokes, and displaying deceptive pop-up windows.

Further, it actively monitors access to financial portals, including Mercado Bitcoin, the largest digital currency exchange in Brazil and Latin America, which combines conventional and cryptocurrency platforms and traditional banks.

The emails with a Docu file containing a malicious PDF file (left) – Alert in Portuguese language stating “Verifying that your computer is secure to access your account.” (right) – Screenshots: FortiGuard Labs

The stolen information is uploaded to different paths. The malware configures account information and sends a POST request. The malware actively monitors victims’ interactions with financial portals, highlighting the sophistication of contemporary banking trojans.

To protect yourself from CHAVECLOAK and similar banking trojans, be cautious with emails and SMS, verify website legitimacy, enable two-factor authentication (2FA), use strong passwords, and regularly update your operating system, web browser, and security software to address known vulnerabilities. Avoid clicking on suspicious links or attachments, and double-check website URLs for typos or minor variations.

1.  TA544 threat actors hit Italian firms with Ursnif banking trojan
2.  New MaliBot Android Malware Found Stealing Personal, Banking Data
3.  European Banking Authority victim in Microsoft Exchange Server hack
4.  Android Banking Malware FjordPhantom Steals Funds Via Virtualization
5.  SpyNote Spyware Returns with SMS Phishing Against Banking Customers

New CHAVECLOAK Banking Trojan Targets Brazilians via Malicious PDFs

By Waqas
Another day, another third-party data breach!
This is a post from HackRead.com Read the original post: American Express Cardholders Impacted by Third-Party Vendor Data Breach

American Express cardholders are advised to be vigilant after a data breach at a third-party vendor potentially exposed some card information. While American Express systems remain secure, the breach may have compromised card numbers, names, expiration dates, and other details.

American Express notified card members today of a data breach impacting some customer information, emphasizing that its systems were not compromised. The breach originated from a third-party service provider used by numerous merchants, potentially exposing customer details including card numbers, names, and expiration dates.

****What Happened:****

American Express discovered unauthorized access to a system utilized by a third-party service provider engaged by various merchants. This incident may have compromised the account information of some American Express card members.

American Express has filed a data breach notification with the state of Massachusetts regarding potential impacts on cardholder information, which may include current or previously issued American Express card numbers, cardholder names, and card information such as expiration dates.

> _“At this time, we have been informed that your current or previously issued American Express Card account number, your name and other Card information such as the expiration date, may have been compromised. Please be aware that you may receive additional letters from us if more than one of your American Express Card accounts were involved.”_
> 
> American Express

In response to this situation, American Express has taken several measures to address the issue. The company has affirmed the security of its own systems and is actively monitoring accounts for any signs of fraudulent activity.

Additionally, cardholders are reassured that they are not liable for unauthorized charges. American Express has provided resources and information on fraud protection through its Security Center website.

For insights into this, we reached out to Piyush Pandey, CEO at Pathlock who stated, “Over the last few years, we’ve seen a significant uptick in third-party data breaches. In this example, there are multiple parties, or what we call “nth party” risk. This places a much greater emphasis on organizations to vet their third parties during onboarding to minimize access risk.”

Piyush also cautioned businesses about the importance of scrutinizing third parties before entering into business partnerships with them. “Organizations must also ensure that the third-party partners of the third parties they are doing business with are assessed for access risk. It should become part of standard third-party contracts to specify breach response responsibilities,” he explained. “Masking data to provide only what is needed by third parties to provide services must be a best practice.”

Nevertheless, American Express card members are advised to review their account statements for any suspicious activity, especially over the next 12-24 months. They are also encouraged to enable account notifications via the American Express Mobile app or through email/text messaging for added security.

Furthermore, updating contact information with American Express is recommended to ensure smooth communication if necessary.

****Rising Incidents of Third-Party Data Breaches****

The beginning of 2024 has witnessed a noticeable uptick in data breaches affecting diverse sectors, including corporate entities and governmental organizations. On February 23 2024, a threat actor using the alias IntelBroker leaked 2.4 million data belonging to private plane owners linked to the Los Angeles International Airport.

In August 2023, an IT contractor employed by the Metropolitan Police Force experienced a cyberattack that impacted over 50,000 MET police personnel.

In September 2023, a third-party contractor experienced a data breach that affected over 8,000 Greater Manchester Police Officers. In October 2023, another contractor inadvertently exposed their database, resulting in the leakage of sensitive details about 500,000 Irish Police vehicle seizure records.

1.  **23andMe blames its users for the massive data breach**
2.  **AnyDesk Urges Password Change Amid Security Breach**
3.  **Defunct Ambulance Service Data Breach Impacts 1 Million**
4.  **Cloudflare Hacked After State Actor Leverages Okta Breach**
5.  **RingGo Owner EasyPark Hit by Data Breach, User Data Stolen**
6.  **LockBit Ransomware Claims Data Breach at SpaceX Contractor**
7.  **CutOut.Pro AI Tool Data Breach: Hacker Leak 20 Million User Info**