Site iconSite icon ForkLog

Gadget reboot triggered by YouTube clip, Trezor phishing attack and other cybersecurity news

ForkLog
Gadget reboot triggered by YouTube clip, Trezor phishing attack and other cybersecurity news

We round up the week’s most important cybersecurity news.

  • Trezor users fell victim to a mass phishing campaign.
  • Hackers hid a Monero miner in pirated macOS software.
  • A YouTube video caused Pixel smartphones to reboot.
  • The Dota 2 developer baited and caught more than 40,000 cheaters.

Trezor users fall victim to a mass phishing campaign

Starting February 27, attackers have targeted Trezor hardware wallet users via email and SMS messages about a purported data breach. Security researcher Mich noted this.

Phishing messages purportedly from the company urge recipients to click the link to protect their device. 

Data: Mich.

A fake site displays a warning that user assets may be at risk. After pressing the Start button, a seed phrase is requested supposedly to restore access to the account. In reality the attackers gain access to the funds in the wallet this way.

Landing page of the phishing site. Data: Urlscan.

Developers at Trezor have acknowledged the phishing campaign and urged users to stay vigilant. They also said they found no evidence of a recent data breach in their internal systems.

Postal addresses and phone numbers of Trezor customers were apparently obtained by the attackers via a marketing list stolen in a MailChimp breach in March 2022.

Data thieves attacked cloud services under the guise of a crypto miner

Sysdig researchers uncovered a large-scale hacking campaign, SCARLETEEL, targeting cloud services.

In compromised cloud environments, attackers deployed cryptominers. However, experts say the cryptojacking attack is a mere sideshow compared with the real goals: stealing proprietary software.

According to Sysdig, the hackers used a vulnerable public service in a self-managed Kubernetes cluster hosted on Amazon Web Services. They installed the XMRig miner and a credential-extraction script.

The obtained data later helped attackers create backdoor users and groups for propagation in the company’s cloud environment.

Hackers hid a Monero miner in pirated macOS software

Malicious versions of some macOS programs, distributed including through pirated torrents, were found to be infected with a hidden Monero miner, according to researchers at Jamf Threat Labs.

They found a The Pirate Bay forum user nicknamed wtfisthat34698409672, who has published malicious apps since 2019, including Adobe Photoshop, Logic Pro X, Final Cut Pro and others.

Screenshot from The Pirate Bay. Data: Jamf Threat Labs.

The latest version of the malware contains a special script that terminates malicious processes when the system utility Activity Monitor starts, allowing it to stay hidden longer.

Apple said they are aware of the problem and are working on updates to effectively block the malware.

YouTube video rebooted Pixel smartphones

Reddit users noted that Pixel devices powered by Google Tensor processors reboot when trying to watch a 4K HDR clip from the movie ‘Alien’.

A discussion participant under the nickname OGPixel5 identified the issue on Google Pixel 6, 6a and 7. Others added that after this crash mobile service stops working and to re-enable it you need to reboot the device again, but manually.

They speculated that something in the video format triggers the phones’ error. The exact cause remains unknown. 

According to ArsTechnica, Google has already remotely fixed the bug, without releasing any update or patch.

The Dota 2 developer nabbed more than 40,000 cheaters with a lure

Valve created a special patch honeypot, through which it identified and blocked more than 40,000 cheaters in Dota 2.

Developers added a data-section in the game client that ordinary players did not read, but that triggered when using third-party cheating tools and exploits aimed at locating internal data.

This wave of bans was among the most widespread in history. Valve added that after the cleanup they closed the hole exploited by cheaters. 

BidenCash carders exposed data for 2.1 million bank cards

The BidenCash operators freely posted on a hacker forum a file containing information on 2.1 million compromised bank cards. 

According to Flashpoint researchers, the dump includes:

The expiration date on about 70% of the leaked cards expires in 2023. 50% of the cards belong to individuals or entities from the US, with another about 5% stolen from users in China and the United Kingdom.

Mostly card data was obtained from web skimmers — malicious scripts attackers embed on checkout pages of online stores.

BidenCash ranks among the top five carding shops by card count.

Data: Flashpoint.

Although the freely available dump is among the largest in the past year, researchers believe that the expiration dates of most of the disclosed cards will soon pass, or financial institutions already know about the related fraud.

Also on ForkLog:

What to read this weekend?

In the Cryptorium educational section we explain why deepfakes are dangerous and how to spot them.

Exit mobile version