Collecting Cyber-News from over 60 sources

Tag: theft

Attorney Generals go after Bitcoin ATMs for supporting Fraud

Sep 14, 2025 5:16 AM

Tags: crypto, data, fraud, international, phone, scam, theft

On 08SEP2025, the District of Columbia’s Attorney General filed a lawsuit against Athena, a “Bitcoin ATM machine” provider with 4100+ BTMs installed. Athena charges as much as a 26% fee when someone deposits cash to buy cryptocurrency. More importantly, the lawsuit claims that 93% of all deposits into Athena “BTMs” in the DC area were…
FBI warns of Salesforce attacks by UNC6040 and UNC6395 groups

Sep 13, 2025 10:16 PM

Tags: attack, cybercrime, data, group, malicious, theft

The U.S. FBI issued a flash alert to warn of malicious activities carried out by two cybercriminal groups tracked as UNC6040 and UNC6395. The FBI issued a FLASH alert with IOCs for cybercriminal groups UNC6040 and UNC6395, which are increasingly targeting Salesforce platforms for data theft and extortion. >>The Federal Bureau of Investigation (FBI) is…
FBI Warns of UNC6040 and UNC6395 Targeting Salesforce Platforms in Data Theft Attacks

Sep 13, 2025 12:16 PM

Tags: access, attack, cybercrime, data, extortion, group, theft

The U.S. Federal Bureau of Investigation (FBI) has issued a flash alert to release indicators of compromise (IoCs) associated with two cybercriminal groups tracked as UNC6040 and UNC6395 for a string of data theft and extortion attacks.”Both groups have recently been observed targeting organizations’ Salesforce platforms via different initial access mechanisms,” the FBI said.UNC6395 is…
Finnish Vastaamo Hacker Freed While Appealing Conviction

Sep 13, 2025 12:16 AM

Tags: hacker, hacking, theft

Vastaamo Hacker Aleksanteri Kivimäki Is Free, For Now. A Helsinki court ordered the release of Finland’s most notorious hacker pending the resolution of his appeal of a conviction stemming from the theft of psychotherapy records of 33,000 individuals. Aleksanteri Kivimäki was convicted last year for hacking into now-defunct psychotherapy chain Vastaamo. First seen on govinfosecurity.com…
VoidProxy phishing-as-a-service operation steals Microsoft, Google login credentials

Sep 12, 2025 11:16 PM

Tags: 2fa, access, ai, attack, authentication, awareness, breach, credentials, cybersecurity, data, defense, email, endpoint, finance, google, Hardware, infrastructure, login, mfa, microsoft, monitoring, okta, passkey, password, phishing, risk, sans, service, social-engineering, theft, tool, training

Credentials go to adversary-in-the-middle server: If a victim is unwise enough to enter their primary Microsoft or Google credentials on the phishing page, the data is sent to VoidProxy’s core AitM proxy server. It’s here that the sophisticated, multi-layered nature of VoidProxy comes into play, says Okta.Federated users are redirected to additional second-stage landing pages…
Chinese Guarantee Syndicates and the Fruit Machine

Sep 12, 2025 8:16 PM

Tags: apple, business, china, country, credit-card, crime, data, finance, group, iphone, mobile, organized, phishing, phone, theft

When I was speaking to a group of Bank Security people in New York City yesterday, I mentioned “machine rooms” — which are rooms full of Apple iPhones that are used to send iMessage phishing spam. Someone in the audience asked “Where would they get that many phones?” The kids like to use the acronym…
Stealthy AsyncRAT flees the disk for a fileless infection

Sep 12, 2025 2:16 PM

Tags: access, best-practice, control, credentials, infection, malicious, malware, monitoring, phishing, powershell, rat, theft, threat, update, windows

RAT with evasion and persistence: Once AsyncRAT was loaded, the attackers took steps to disrupt Windows defenses. The report notes techniques such as disabling Anti-malware Scan Interface (AMSI) and tampering with Event Tracking for Windows (ETW), both critical features for runtime detection. To maintain persistence, they created a scheduled task disguised as “Skype Update,” ensuring…
Buterat Backdoor Campaigns Targeting Enterprise Endpoint Control

Sep 12, 2025 12:16 PM

Tags: access, authentication, backdoor, control, cyber, data, endpoint, malicious, malware, software, theft, unauthorized

Backdoor malware is a covert type of malicious software designed to bypass standard authentication mechanisms and provide persistent, unauthorized access to compromised systems. Unlike conventional malware that prioritizes immediate damage or data theft, backdoors focus on stealth and longevity, enabling attackers to control infected endpoints remotely, deploy additional payloads, exfiltrate sensitive information, and move laterally…
Docker malware breaks in through exposed APIs, then changes the locks

Sep 11, 2025 3:16 PM

Tags: access, api, attack, browser, chrome, container, credentials, data, data-breach, docker, exploit, firewall, jobs, linux, malware, service, theft

The variant has creative twists: Setting the variant apart is its move to deny others access to the same Docker API, effectively monopolizing the attack surface. It tries to modify firewall settings (iptables, nft, firewall-cmd, etc.) via a cron job to drop or reject incoming connections to port 2375. A cron job is a scheduled…
PoisonSeed Threat Actor Strengthens Credential Theft Operations with New Domains

Sep 11, 2025 12:16 PM

Tags: captcha, credentials, cyber, email, theft, threat

Spoof the email delivery platform SendGrid and employ fake Cloudflare CAPTCHA interstitials to lend legitimacy before redirecting unsuspecting users to credential harvesting pages. Since June 1, 2025, DomainTools Investigations has identified 21 newly registered domains exhibiting hallmarks of the eCrime actor known as PoisonSeed. Although specific victims have not been confirmed, PoisonSeed’s historical focus on…
Ransomware insurance losses spike despite fewer claims: Resilience

Sep 10, 2025 6:22 PM

Tags: ai, attack, insurance, phishing, ransomware, resilience, tactics, theft

AI-powered phishing, “double extortion” tactics and insurance policy theft are fueling more destructive, costly ransomware attacks, the;cybersecurity firm said. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/ransomware-insurance-losses-spike-claims-resilience-ai-phishing/759626/
New Fileless Malware Attack Uses AsyncRAT for Credential Theft

Sep 10, 2025 6:22 PM

Tags: attack, credentials, malware, theft

LevelBlue Labs reports AsyncRAT delivered through a fileless attack chain using ScreenConnect, enabling credential theft and persistence. First seen on hackread.com Jump to article: hackread.com/fileless-malware-attack-asyncrat-credential-theft/
Jaguar Land Rover confirms data theft after recent cyberattack

Sep 10, 2025 6:02 PM

Tags: cyberattack, data, theft

Jaguar Land Rover (JLR) confirmed today that attackers also stole “some data” during a recent cyberattack that forced it to shut down systems and instruct staff not to report to work. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/jaguar-land-rover-jlr-confirms-data-theft-after-recent-cyberattack/
How to Protect Your Enterprise Against Account Takeover Attacks

Sep 10, 2025 5:16 PM

Tags: attack, breach, credentials, hacker, identity, login, theft

At this very moment, there are at least 16 billion recently stolen login credentials available to hackers in various dark corners of the internet. That is, according to the Cybernews researchers who uncovered the massive breach, “a blueprint for mass exploitation”¦. account takeover, identity theft, and highly targeted phishing.” While account takeover (ATO) attacks can……
6 hot cybersecurity trends

Sep 10, 2025 5:16 PM

Tags: access, ai, attack, automation, awareness, breach, ceo, chatgpt, cisco, ciso, cloud, compliance, credentials, crowdstrike, cyber, cybersecurity, data, data-breach, deep-fake, edr, email, endpoint, finance, firewall, google, group, hacker, ibm, identity, incident response, infrastructure, intelligence, jobs, law, LLM, malicious, mfa, monitoring, network, open-source, password, phishing, phone, radius, RedTeam, risk, risk-assessment, sans, skills, sophos, strategy, supply-chain, theft, threat, tool, training, unauthorized, update, vulnerability, zero-trust

2. Protecting AI from attacks: AI can help CISOs protect their IT infrastructure, but who’s protecting the AI?”While 2024 saw a surge in proof-of-concept (POC) projects for gen AI, many organizations are moving these projects into production without conducting comprehensive risk assessments,” IDC concludes in its 2025 Security and Trust FutureScape.”Companies may face significant vulnerabilities…
6 hot cybersecurity trends

Sep 10, 2025 5:16 PM

Tags: access, ai, attack, automation, awareness, breach, ceo, chatgpt, cisco, ciso, cloud, compliance, credentials, crowdstrike, cyber, cybersecurity, data, data-breach, deep-fake, edr, email, endpoint, finance, firewall, google, group, hacker, ibm, identity, incident response, infrastructure, intelligence, jobs, law, LLM, malicious, mfa, monitoring, network, open-source, password, phishing, phone, radius, RedTeam, risk, risk-assessment, sans, skills, sophos, strategy, supply-chain, theft, threat, tool, training, unauthorized, update, vulnerability, zero-trust

2. Protecting AI from attacks: AI can help CISOs protect their IT infrastructure, but who’s protecting the AI?”While 2024 saw a surge in proof-of-concept (POC) projects for gen AI, many organizations are moving these projects into production without conducting comprehensive risk assessments,” IDC concludes in its 2025 Security and Trust FutureScape.”Companies may face significant vulnerabilities…
European crypto platform SwissBorg to reimburse users after $41 million theft

Sep 10, 2025 5:16 PM

Tags: breach, crypto, theft

Nearly 200,000 Solana coins were stolen from SwissBorg, or about 2% of its assets, according to the platform’s CEO. The company pledged to pay users back. First seen on therecord.media Jump to article: therecord.media/swissborg-platform-solana-cryptocurrency-stolen
Massive npm supply chain attack hits 18 popular packages with 2B weekly downloads

Sep 9, 2025 3:09 PM

Tags: api, attack, blockchain, breach, crypto, data, detection, email, finance, github, malicious, malware, monitoring, network, open-source, phishing, risk, strategy, supply-chain, theft, tool, update, vulnerability

Financial impact surprisingly limited: Despite affecting packages with 2 billion weekly downloads, the actual financial impact was surprisingly modest. “We were tracking approximately $970 in stolen funds to attacker-controlled wallets,” Eriksen said, highlighting a significant disconnect between the attack’s potential reach and its realized damage.This limited financial impact reflected both the attackers’ operational carelessness and…
Massive npm supply chain attack hits 18 popular packages with 2B weekly downloads

Sep 9, 2025 3:09 PM

Tags: api, attack, blockchain, breach, crypto, data, detection, email, finance, github, malicious, malware, monitoring, network, open-source, phishing, risk, strategy, supply-chain, theft, tool, update, vulnerability

Financial impact surprisingly limited: Despite affecting packages with 2 billion weekly downloads, the actual financial impact was surprisingly modest. “We were tracking approximately $970 in stolen funds to attacker-controlled wallets,” Eriksen said, highlighting a significant disconnect between the attack’s potential reach and its realized damage.This limited financial impact reflected both the attackers’ operational carelessness and…
SessionReaper Vulnerability Puts Magento Adobe Commerce Sites in Hacker Crosshairs

Sep 9, 2025 2:08 PM

Tags: adobe, api, cve, cyber, data, hacker, open-source, theft, update, vulnerability

Adobe has broken its regular patch schedule to address CVE-2025-54236, a critical vulnerability in Magento Commerce and open-source Magento installations. Dubbed “SessionReaper,” this vulnerability allows attackers to bypass input validation in the Magento Web API, enabling automated account takeover, data theft, and fraudulent orders without requiring valid session tokens. Adobe will release an emergency fix…
SessionReaper Vulnerability Puts Magento Adobe Commerce Sites in Hacker Crosshairs

Sep 9, 2025 2:08 PM

Tags: adobe, api, cve, cyber, data, hacker, open-source, theft, update, vulnerability

Adobe has broken its regular patch schedule to address CVE-2025-54236, a critical vulnerability in Magento Commerce and open-source Magento installations. Dubbed “SessionReaper,” this vulnerability allows attackers to bypass input validation in the Magento Web API, enabling automated account takeover, data theft, and fraudulent orders without requiring valid session tokens. Adobe will release an emergency fix…
Salesloft Drift Hack Claims New Victims in Tenable, Qualys

Sep 9, 2025 12:08 AM

Tags: access, attack, authentication, cybersecurity, github, hacker, service, software, theft, tool

Salesloft Says Hackers Broke Into Its GitHub Repository. Cybersecurity firms Tenable and Qualys fell to attacks stemming from hacker theft of authentication tokens from a third-party tool often integrated into Salesforce. The firms disclosed their exposure to the attack that lifted access tokens from marketing-as-a-service software provider Salesloft. First seen on govinfosecurity.com Jump to article:…
Salesloft Drift Hack Claims New Victims in Tenable, Qualys

Sep 9, 2025 12:08 AM

Tags: access, attack, authentication, cybersecurity, github, hacker, service, software, theft, tool

Salesloft Says Hackers Broke Into Its GitHub Repository. Cybersecurity firms Tenable and Qualys fell to attacks stemming from hacker theft of authentication tokens from a third-party tool often integrated into Salesforce. The firms disclosed their exposure to the attack that lifted access tokens from marketing-as-a-service software provider Salesloft. First seen on govinfosecurity.com Jump to article:…
Hackers breached Salesloft ‘s GitHub in March, and used stole tokens in a mass attack

Sep 8, 2025 10:09 PM

Tags: attack, authentication, data, github, hacker, theft, threat

Hackers breached Salesloft’s GitHub in March, stole tokens, and used them in a mass attack on several major tech customers. Salesloft revealed that the threat actor UNC6395 breached its GitHub account in March, stealing authentication tokens that were later used in a large-scale attack against several major tech customers. Salesforce data theft attacks impacted major…
Salesloft says Drift customer data thefts linked to March GitHub account hack

Sep 8, 2025 8:09 PM

Tags: breach, data, github, theft

The breach, now known to have begun in March, raises questions about why it took six months for Salesloft to detect the breach. First seen on techcrunch.com Jump to article: techcrunch.com/2025/09/08/salesloft-says-drift-customer-data-thefts-linked-to-march-github-account-hack/
Salesloft: March GitHub repo breach led to Salesforce data theft attacks

Sep 8, 2025 6:08 PM

Tags: attack, breach, data, github, theft

Salesloft says attackers first breached its GitHub account in March, leading to the theft of Drift OAuth tokens later used in widespread Salesforce data theft attacks in August. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/salesloft-march-github-repo-breach-led-to-salesforce-data-theft-attacks/
Salesloft: March GitHub repo breach led to Salesforce data theft attacks

Sep 8, 2025 6:08 PM

Tags: attack, breach, data, github, theft

Salesloft says attackers first breached its GitHub account in March, leading to the theft of Drift OAuth tokens later used in widespread Salesforce data theft attacks in August. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/salesloft-march-github-repo-breach-led-to-salesforce-data-theft-attacks/
APT37 Targets Windows with Rust Backdoor and Python Loader

Sep 8, 2025 5:08 PM

Tags: api, attack, backdoor, cctv, cloud, computer, control, data, detection, exploit, government, group, infection, injection, jobs, korea, malicious, malware, microsoft, monitoring, north-korea, organized, password, phishing, powershell, programming, rust, service, social-engineering, spear-phishing, startup, tactics, theft, threat, tool, update, vulnerability, windows

IntroductionAPT37 (also known as ScarCruft, Ruby Sleet, and Velvet Chollima) is a North Korean-aligned threat actor active since at least 2012. APT37 primarily targets South Korean individuals connected to the North Korean regime or involved in human rights activism, leveraging custom malware and adopting emerging technologies.In recent campaigns, APT37 utilizes a single command-and-control (C2) server…
APT37 Targets Windows with Rust Backdoor and Python Loader

Sep 8, 2025 5:08 PM

Tags: api, attack, backdoor, cctv, cloud, computer, control, data, detection, exploit, government, group, infection, injection, jobs, korea, malicious, malware, microsoft, monitoring, north-korea, organized, password, phishing, powershell, programming, rust, service, social-engineering, spear-phishing, startup, tactics, theft, threat, tool, update, vulnerability, windows

IntroductionAPT37 (also known as ScarCruft, Ruby Sleet, and Velvet Chollima) is a North Korean-aligned threat actor active since at least 2012. APT37 primarily targets South Korean individuals connected to the North Korean regime or involved in human rights activism, leveraging custom malware and adopting emerging technologies.In recent campaigns, APT37 utilizes a single command-and-control (C2) server…
APT37 Targets Windows with Rust Backdoor and Python Loader

Sep 8, 2025 5:08 PM

Tags: api, attack, backdoor, cctv, cloud, computer, control, data, detection, exploit, government, group, infection, injection, jobs, korea, malicious, malware, microsoft, monitoring, north-korea, organized, password, phishing, powershell, programming, rust, service, social-engineering, spear-phishing, startup, tactics, theft, threat, tool, update, vulnerability, windows

IntroductionAPT37 (also known as ScarCruft, Ruby Sleet, and Velvet Chollima) is a North Korean-aligned threat actor active since at least 2012. APT37 primarily targets South Korean individuals connected to the North Korean regime or involved in human rights activism, leveraging custom malware and adopting emerging technologies.In recent campaigns, APT37 utilizes a single command-and-control (C2) server…