To evade detection, hackers are requiring targets to complete CAPTCHAs

CAPTCHAs, those puzzles with muffled sounds or blurred or squiggly letters that websites use to filter out bots (often unsuccessfully), have been annoying end users for more than a decade. Now, the challenge-and-response tests are likely to vex targets in malware attacks. Microsoft recently spotted an attack group distributing a malicious Excel document on a site requiring users to complete a CAPTCHA, most likely in an attempt to thwart automated detection by good guys. The Excel file contains macros that, when enabled, install GraceWire, a trojan that steals sensitive information such as passwords. The attacks are the work of a group Microsoft calls Chimborazo, which company researchers have been tracking since at least January.

Sharp Rise in Web Attacks on Gamers

Cyber-criminals stepped up their efforts to victimize gamers while millions of people stayed at home this spring to slow the spread of COVID-19. New research published today by Kaspersky found that in April, the daily number of blocked attempts to direct users to malicious gaming-themed sites increased by 54%, compared to January 2020. In the same month, the number of blocked attempts to force gamers onto phishing pages for one of the most popular gaming platforms also increased by a whopping 40% compared to February 2020. Kaspersky researchers took a special interest in threats to gamers after lockdown measures saw millions turn to video games as a source of entertainment. Beginning in March, online gaming platform SteamDB saw a record number of users, with 20.3 million people in-game simultaneously over one weekend. 

Hackers have turned Discord into an account stealer

Researchers have uncovered a new malware campaign that turns popular gaming chat service Discord into a dangerous account stealer. Discovered by MalwareHunterTeam, the NitroHack malware masquerades as a software crack that gives users free access to Discord Nitro, the service’s premium subscription tier. However, upon installation, the malware modifies the Discord client for Windows, turning it into a trojan capable of stealing account credentials and financial information, and then attempts to transmit itself to the victim’s friends and communities.

Apple WWDC live stream: start time, how to watch, iOS 14, iPadOS, ARM Macs and more

Apple’s next big keynote event is coming up on Monday June 22nd at 10am PDT/1pm EDT/6pm BST/7pm CEST. This is the kick-off for WWDC 2020, which is Apple’s big (multi-day) event focusing mostly on developers making software for its platforms – that means we can expect the keynote to cover what’s coming in iOS 14, iPadOS 14, watchOS 7 and a new version of macOS. But that’s not all; new hardware regularly appears at WWDC – especially productivity tools, including new Mac models. The big rumour this year is that Apple will finally put its own-brand processors into Macs, replacing the Intel chips currently used. 

Oracle’s BlueKai tracks you across the web. That data spilled online

Tech giant Oracle is one of a few companies in Silicon Valley that has near-perfected the art of tracking people across the internet. The company has spent a decade and billions of dollars buying startups to build its very own panopticon of users’ web browsing data. One of those startups, BlueKai,  which Oracle bought for a little over $400 million in 2014, is barely known outside marketing circles, but it amassed one of the largest banks of web tracking data outside of the federal government. BlueKai uses website cookies and other tracking tech to follow you around the web. By knowing which websites you visit and which emails you open, marketers can use this vast amount of tracking data to infer as much about you as possible — your income, education, political views, and interests to name a few — in order to target you with ads that should match your apparent tastes. If you click, the advertisers make money.