Security News
![Microsoft seizes websites used to sell phony email accounts to Scattered Spider and other crims](/static/build/img/news/microsoft-seizes-websites-used-to-sell-phony-email-accounts-to-scattered-spider-and-other-crims-small.jpg)
Microsoft has taken down US-based infrastructure and websites used by a cybercrime group to sell fraudulent online accounts to other crooks including Scattered Spider, the infamous social-engineering and extortion crew that hacked two Las Vegas casinos over the summer. The gang, Storm-1152, is the "Number one seller and creator of fraudulent Microsoft accounts" and has listed for sale 750 million of these, according to Amy Hogan-Burney, Microsoft's associate general counsel for cybersecurity policy and protection.
![Ubiquiti users report having access to others’ UniFi routers, cameras](/static/build/img/news/ubiquiti-users-report-having-access-to-others-unifi-routers-cameras-small.jpg)
Since yesterday, users of Ubiquiti networking devices, ranging from routers to security cameras, have reported seeing other people's devices and notifications through the company's UniFi cloud services. Ubiquiti is a popular networking device manufacturer offering a cloud-based UniFi platform where admins can manage all their devices from a single cloud portal.
![US detains suspects behind $80 million 'pig butchering' scheme](/static/build/img/news/us-detains-suspects-behind-80-million-pig-butchering-scheme-small.jpg)
The U.S. Department of Justice charged four suspects for their alleged involvement in a pig butchering fraud scheme that resulted in more than $80 million in victim losses. Criminals behind pig butchering scams approach victims via various messaging apps, dating platforms, or social media platforms, build trust, and introduce them to investment schemes that eventually allow them to drain the targets' cryptocurrency wallets.
![Ten new Android banking trojans targeted 985 bank apps in 2023](/static/build/img/news/ten-new-android-banking-trojans-targeted-985-bank-apps-in-2023-small.jpg)
This year has seen the emergence of ten new Android banking malware families, which collectively target 985 bank and fintech/trading apps from financial institutes across 61 countries. Banking trojans are malware that targets people's online bank accounts and money by stealing credentials and session cookies, bypassing 2FA protections, and sometimes even performing transactions automatically.
![Discord adds Security Key support for all users to enhance security](/static/build/img/news/discord-adds-security-key-support-for-all-users-to-enhance-security-small.jpg)
Discord has made security key multi-factor authentication available for all accounts on the platform, bringing significant security and anti-phishing benefits to its 500+ million registered users. Discord has now brought the WebAuthn feature to all Discord users, allowing users to replace the legacy MFA system that relies on time-based one-time passwords, 8-digit one-time backup codes, and SMS messages carrying a 6-digit verification code.
![U.S. nuclear research lab data breach impacts 45,000 people](/static/build/img/news/u-s-nuclear-research-lab-data-breach-impacts-45000-people-small.jpg)
The research lab says in breach notification letters filed with the Maine Attorney General's Office this week that the attackers exfiltrated the data of 45,047 current and former employees, as well as their dependents and spouses. "The event did not impact INL's own network, or other networks or databases used by employees, lab customers or other contractors. The breach only impacted the cloud-based Oracle HCM test environment that resides off-site."INL said.
![Surveillance Cameras Disguised as Clothes Hooks](/static/build/img/news/alt/web-statistics-small.jpg)
About Bruce Schneier I am a public-interest technologist, working at the intersection of security, technology, and people. I've been writing about security issues on my blog since 2004, and in my monthly newsletter since 1998.
![Ledger dApp supply chain attack steals $600K from crypto wallets](/static/build/img/news/ledger-dapp-supply-chain-attack-steals-600k-from-crypto-wallets-small.jpg)
Ledger is warnings users not to use web3 dApps after a supply chain attack on the 'Ledger dApp Connect Kit' library was found pushing a JavaScript wallet drainer that stole $600,000 in crypto and NFTs. Ledger is a hardware wallet that lets users buy, manage, and securely store their digital assets offline, supporting multiple cryptocurrencies, including Bitcoin and Ethereum. The company offers a library called the "Ledger dApps Connect Kit" that allows web3 apps to connect to Ledger hardware wallets.
![Photos: CyberMarketingCon 2023](/static/build/img/news/photos-cybermarketingcon-2023-small.jpg)
Help Net Security sponsored and attended Cybersecurity Marketing Society’s CyberMarketingCon 2023 in Austin, TX. Over the three days of the conference, there were 35 speakers, keynotes, and 15...
![116 Malware Packages Found on PyPI Repository Infecting Windows and Linux Systems](/static/build/img/news/116-malware-packages-found-on-pypi-repository-infecting-windows-and-linux-systems-small.jpg)
Cybersecurity researchers have identified a set of 116 malicious packages on the Python Package Index (PyPI) repository that are designed to infect Windows and Linux systems with a custom...