WhatsApp users, here's something to remember - A vulnerability (in desktop app) could allow the spread of malware

. It could also  impact WhatsApp for iPhone, if we don’t update our desktop and mobile apps, and if we don’t use newer versions of the Chrome browser.

https://threatpost.com/whatsapp-bug-malicious-code-injection-rce/152578/

We might not be up-to-date on current events but, cybercriminals are and they are quick to capitalize on them. The latest being "CoronaVirus"

One important behaviour pattern cybercriminals depend on is that if, an email sounds scary / urgent then we might click on the link or attachment. The new botnet campaign targets geographic regions that may be more impacted by the outbreak given their locations in Asia to spread Emotet trojan.IBM X-Force warned that Emotet operators will probably expand their targeting beyond Japan soon.

https://threatpost.com/coronavirus-propagate-emotet/152404/

Smart people (you) setup Google Alerts , Smarter people (Hackers) use your alerts to hook victims into scams or push malware.

When the alert is clicked in the email, or even if the malicious page is clicked in a Google search, the target is taken to a malicious site.

“The best way to protect yourself from these types of low quality and malicious sites, is to specify you only want the “best results” when creating the alert. This can be configured under the alert options at the top of the Google Alerts page,” Abrams suggested


https://www.scmagazine.com/home/email-security/scammers-using-google-alerts-to-spread-malware-fraud-2/

Malware watches Porn - I mean, it records screen activity while you are watching Porn

Its prime target is Windows-based computers where once the device is infected it steals login credentials, financial details, and recording screen activities while its victim “enjoys” x-rated content.
Question - How does it know that you are watching PORN?
and
I guess there will be a new version that adds another feature  that  records you while you are watching PORN so that you can be blackmailed later"

https://www.hackread.com/malware-records-screen-activity-victim-watches-porn/

Logic Bomb incident (Real and Not funny) - David Tinley was indicted in May 2019 and just last week pledged guilty to one count of intentional damage to a protected computer. He is now facing up to 10 years imprisonment along with a fine of up to $ 250,000

Tinley intentionally and without the company's knowledge or authorization inserted "logic bombs" into computer programs that caused glitches in the spreadsheet after the expiration of a certain date.

Tinley would just fix the issue by resetting the clock, invoice for his time, and then wait for the program to go wrong again, Law360 reports.

https://thehackernews.com/2019/07/siemens-logic-bomb.html

Everyone is preparing for AI but, how many of us are thinking about AI Malware?

• The baseline for defending against these attacks will lie in ensuring all parts of the organization are visible and continually monitored.  
• A couple promising areas for implementing defensive AI include threat intelligence mining and autonomous response.

https://www.securityweek.com/get-ready-first-wave-ai-malware

Welcome news - Finally one company (Kaspersky) has decided to flag stalkerware as malware. Thanks to Eva Galperin, the head of cybersecurity at the Electronic Frontier Foundation for persuading them. Motherboard. Galperin has studied stalkerware and helped domestic abuse victims and human rights activists for years.

She'll also ask Apple to take measures to protect iPhone users from stalkerware, given that the company doesn't allow antivirus apps into its App Store. 

Finally, and perhaps most drastically, she says she'll call on state and federal officials to use their prosecutorial powers to indict executives of stalkerware-selling companies on hacking charges.

https://www.wired.com/story/eva-galperin-stalkerware-kaspersky-antivirus/

Do you know how many employees in your organization use TeamViewer. More importantly, are you sure they are NOT USING a malicious version of TeamViewer?

Trend Micro researchers have discovered a Trojan spyware disguising as TeamViewer to collect and steal user data

https://www.hackread.com/hackers-using-malicious-teamviewer-tool-to-spread-malware

Why is it that bad guy seem to be more innovative in the Security Space - New technique to detect Sandbox

 malicious Android apps in the official Google Play Store are using the motion-sensors of infected devices. If the apps fail to detect any movement (which is - of course - unlikely in a sandbox environment in a research lab!), they refuse to activate their malicious payload.
If, however, there has been movement, the apps display a fake system update dialog which attempts to trick the poor user into installing a piece of banking malware called Anubis

https://www.grahamcluley.com/android-malware-motion-sensor/

VPN is safe , not if you are using free HolaVPN.

1. It could provide a gateway into the enterprise network for malicious software of many varieties
2. It Uses customer computers and devices as exit points for spam and  phishing message.
3. The software for HolaVPN failed to provide encryption for users depending on the service to protect their data from theft
4. 85% of the HolaVPN traffic they analyzed was concerned with mobile ads and other mobile-related domains and software.

https://www.darkreading.com/network-and-perimeter-security/trend-micro-finds-major-flaws-in-holavpn/d/d-id/1333515

Resurrection of the Worm - Fileless version of the malicious remote access tool njRAT that propagates as a worm via removable drives. It looks like Malwares (old and new) are going to behave like worm. Is it time to disable removable media and monitor Powershell?. It also time to revisit old school best practices like Segmentation and endpoint isolation.

This particular variant, identified as Worm.Win32.BLADABINDI.AA, leverages AutoIt, a free automation script language for Windows, to compile the final payload and the main script into one executable. The technique makes the ultimate payload difficult to detect

“The worm’s payload, propagation, and technique of filelessly delivering the backdoor in the affected system make it a significant threat,” the blog post concludes. “Users and especially businesses that still use removable media in the workplace should practice security hygiene. Restrict and secure the use of removable media or USB functionality, or tools like PowerShell


https://www.scmagazine.com/home/security-news/cybercrime/malicious-developer-creates-wormable-fileless-variant-of-njrat/

L0rdix - A New malware with lethal combination of data stealing, cryptomining, and snooping capabilities. You can buy it for 4000Ruble ($60.96)

L0rdix also infects removable drives on the PC and maps itself to their icons while the original drive files and directories stay hidden

The malware allows attackers to get full information about the targeted PC. After receiving the required information, the attackers can execute commands, upload files, and perform other malicious activities including uploading mining modules

The primary objective behind designing this malware is to mine for cryptocurrency without getting detected

https://www.hackread.com/l0rdix-dark-web-malware-steals-data-mines-crypto-botnet/

Malvertisement evolution - Perform three checks before forwarding the victim to a malicious website.

1. The user agent must be mobile-specific - Sites being targeted by the malware are all optimized to be viewed primarily via mobile device.
2. Battery level must be between 20 and 76 percent - To avoid detection from scanners
3. HTTP referrer must be specified - avoid detection by known security vendors

https://www.scmagazine.com/home/security-news/assault-and-battery-malvertising-campaign-checks-user-device-charge-as-anti-detection-technique/

If you are using KODI media player then you should know that it could be used as a malware distribution platform for cybercriminals.

Researchers from ESET said that malware can spread through Kodi in three different ways. 

1. They could add the URL of a malicious repository to their Kodi installation, which would download add-ons whenever they update their Kodi installations 
2. They could install a ready-made Kodi build that includes the URL of a malicious repository. 
3. Users could install a ready-made Kodi build that contains a malicious add-on but no link to a repository for updates.

“Cybercriminals are increasingly abusing add-ons and scripting functionalities in response to the tightening of security measures for operating systems

The top five countries affected by the threat, according to ESET’s telemetry, are the United States, Israel, Greece, the United Kingdom and the Netherlands.

https://threatpost.com/cybercriminals-target-kodi-media-player-for-malware-distribution/137670/

We know free apps make money by selling your info, how about one (Adware Doctor) that is paid to protect you actually, pilfers data secretly to a server in China (bypassing App store sandbox restrictions).

Adware Doctor
The app sidesteps Apple's sandbox and covertly collects users' browser histories and then transfers it to a server in China—which is blatant violations of Apple's developer guidelines.

Adware Doctor collects sensitive users' data—primarily any website you've visited or searched for—from all the popular web browsers including Chrome, Firefox, and Safari, and then sends that data to Chinese server at hxxp://yelabapp.com/ run by the app's makers

What's more? Adware Doctor originally was named "Adware Medic," which was clearly designed to mimic a different AdwareMedic app acquired and rebranded by MalwareBytes in 2015

Wardle contacted Apple weeks ago about the issue, but the company did nothing about it

https://thehackernews.com/2018/09/mac-adware-removal-tool.html

Are you sure that the app on your Android device is not a Trojan? - "Triout" spyware when repackaged with a valid version of the Android app keeps the appearance and feel of the original app and function exactly like it.

According to the researcher, Triout can perform many spying operations once it compromises a system, including:

• Recording every phone call, saving it in the form of a media file, and then sending it together with the caller id to a remote C&C server.
• Logging every incoming SMS message to the remote C&C server.
• Sending all call logs (with name, number, date, type, and duration) to the C&C server.
• Sending every picture and video to the attackers whenever the user snaps a photo or record video, either with the front or rear camera.
• Capability to hide itself on the infected device.

https://thehackernews.com/2018/08/android-malware-spyware.html

"Dark Tequila" - Advanced Keylogger that as been targeting customers of several Mexican banking institutions since at least 2013 and was discovered recently

Dark Tequila has primarily been designed to steal victims’ financial information from a long list of online banking sites, as well as login credentials to popular websites, ranging from code versioning repositories to public file storage accounts and domain registrars

The list of targeted sites includes "Cpanels, Plesk, online flight reservation systems, Microsoft Office 365, IBM Lotus Notes clients, Zimbra email, Bitbucket, Amazon, GoDaddy, Register, Namecheap, Dropbox, Softlayer, Rackspace, and other services,"

Once executed, a multi-stage payload infects the victim's computer only after certain conditions are met, which includes checking if the infected computer has any antivirus or security suite installed or is running in an analysis environment.

Besides this, "the threat actor behind it strictly monitors and controls all operations. If there is a casual infection, which is not in Mexico or is not of interest, the malware is uninstalled remotely from the victim’s machine," the researchers say.


https://thehackernews.com/2018/08/mexico-banking-malware.html

Virus Attack - We have heard that before , how about this, the company expects the virus to Inflict 250 Million Loss in Revenue (does this get your attention?)

The world's largest makers of semiconductors and processors TSMC lost an entire day of production after several of its factories systems were halted by a computer virus in the middle of the ramp-up for chips to be used by Apple's future lines of iPhones.

TSMC expects the shutdown will result in shipment delays and additional costs, and estimated that two days of outages will impact revenue by about 3 percent (approx. 250 Million)


https://thehackernews.com/2018/08/tsmc-iphone-computer-virus.html

A new malware uses stolen digit certs (to evade AV and whitlisting tools) to collect saved passwords from Google Chrome, Microsoft Internet Explorer, Microsoft Outlook, and Mozilla Firefox.

The first malware, dubbed Plead, is a remotely controlled backdoor designed to steal confidential documents and spy on users.

The second malware is also a related password stealer designed to collect saved passwords from Google Chrome, Microsoft Internet Explorer, Microsoft Outlook, and Mozilla Firefox.

Security researchers from ESET have recently identified two malware families, previously associated with cyberespionage group BlackTech, that have been signed using valid digital certificates belonging to D-Link networking equipment manufacturer and another Taiwanese security company called Changing Information Technology.

most antivirus software fails to check the certificate's validity even when companies revoke the signatures of their certificates, the BlackTech hackers are still using the same certificates to sign their malicious tools.

https://thehackernews.com/2018/07/digital-certificate-malware.html

WOW - Malware that can automatically decide to download a cryptominer or to launch a Ransomware or to become a worm.

The decision to download the cryptor or the miner depends on the presence of the folder %AppData%\Bitcoin. If the folder exists, the downloader decides to download the cryptor. If the folder doesn’t exist and the machine has more than two logical processors, the miner will be downloaded. If there’s no folder and just one logical processor, the downloader jumps to its worm component.

Researchers identified a new variant of the remote execution downloader that queries the victim's system on a number of factors, from the existence of Bitcoin storage to the presence of certain virtual machine managers, before downloading either an encryption payload or one that begins mining Monero coins


Full details here:
https://securelist.com/to-crypt-or-to-mine-that-is-the-question/86307/