16 Sep 2025
By Mary

InfoSec News Nuggets 9/16/2025

S1ngularity/nx attackers strike again  This morning, we were alerted to a large-scale attack against npm. This appears to the be work of the same threat actors behind the Nx attack on August 27th 2025. This was originally published by Socket and StepSecurity who noted 40 packages had been comrpomised, since then an additional 147 packages have been infected with malware including packages from CrowdStrike. The scale, scope and impact of this attack is significant. The attackers are using the same…
Read More
28 Apr 2025
By Mary

InfoSec News Nuggets 4/28/2025

Top employee monitoring app leaks 21 million screenshots on thousands of users A major time-tracking company has been leaking sensitive screenshots on the open internet, putting countless people and organizations at risk of identity theft, data breaches, wire fraud, scams, and more. Cybersecurity researchers at Cybernews found an archive of “millions of real-time screenshots” generated by WorkComposer, which calls itself an “employee productivity monitoring tool”. These screenshots show what the employee is working on at any given time,…
Read More
24 Apr 2025
By Mary

InfoSec News Nuggets 4/24/2025

Bug hunter tricked SSL.com into issuing cert for Alibaba Cloud domain in 5 steps Certificate issuer SSL.com’s domain validation system had an unfortunate bug that was exploited by miscreants to obtain, without authorization, digital certs for legit websites. With those certificates in hand, said fraudsters could set up more-convincing malicious copies of those sites for things like credential phishing, or decrypt intercepted HTTPS traffic between those sites and their visitors. And since learning of that…
Read More
14 Oct 2024
By Mary

InfoSec News Nuggets 10/14/2024

Lamborghini Carjackers Lured by $243M Cyberheist The parents of a 19-year-old Connecticut honors student accused of taking part in a $243 million cryptocurrency heist in August were carjacked a week later — while out house-hunting in a brand new Lamborghini. Prosecutors say the couple was beaten and briefly kidnapped by six young men who traveled from Florida as part of a botched plan to hold the parents for ransom. Late in the afternoon of Aug.…
Read More
14 Aug 2024
By Mary

InfoSec News Nuggets 8/14/2024

Justice Department Disrupts North Korean ‘Laptop Farm’ Operation  Law enforcement authorities in the U.S. have arrested a Tennessee man accused of running a “laptop farm” that helped North Korean IT workers secure remote jobs at American companies. According to court documents, 38-year-old Matthew Isaac Knoot operated a scheme that assisted North Koreans posing as U.S.-based IT professionals by using the stolen identity of an American citizen.    NIST Formalizes World's First Post-Quantum Cryptography Standards  The world’s first post-quantum…
Read More
10 May 2024
By Mary

InfoSec News Nuggets 5/10/2024

Ascension warns of suspected cyberattack; clinical operations disrupted Hospital operator Ascension reported disruptions to its clinical operations on Wednesday due to a suspected cybersecurity incident and advised business partners to temporarily disconnect from its systems. Earlier this year, UnitedHealth (UNH.N), opens new tab, the largest U.S. health insurer, had reported a cyberattack at its technology unit - one of the worst hacks to hit American healthcare - that caused widespread disruptions in payments to doctors and health facilities.…
Read More
05 Feb 2024
By Mary

InfoSec News Nuggets 2/5/2024

FBI removes malware from hundreds of routers across the US The FBI has used a court order to remove malware from hundreds of routers across the US, and alter the routers’ settings to prevent reinfection. The routers are malware-infected NetGear and Cisco small office/home office (SOHO) devices that no longer receive updates because they have reached their End-of-Life. The FBI did this because it believed the threat actor behind the botnet of routers is an…
Read More
29 Sep 2023
By Mary

InfoSec News Nuggets 09/29/2023

Divided oversight panel recommends new limits for Section 702 searches  A key government oversight board is divided along partisan lines about placing new restrictions on a controversial foreign surveillance tool before it lapses at the end of the calendar year. The recommendations from the Privacy and Civil Liberties Oversight Board (PCLOB) could pose a new headache for the Biden administration, which desperately wants to renew the authority known as Section 702 of the Foreign Intelligence Surveillance…
Read More
19 Sep 2023
By Mary

InfoSec News Nuggets 09/19/2023

The tech companies scanning your face while you shop  If you happen to miss the camera above the entrance, the sign will inform you. “FACIAL RECOGNITION & CCTV IN OPERATION ON THIS SITE” it declares in black letters as the automatic door slides to one side. When you enter, the camera scans the contours of your face, instantly cross-referencing it against a database of known shoplifters. Since you are a law-abiding citizen, the computer finds nothing. The…
Read More
28 Apr 2023
By Mary

InfoSec News Nuggets 04/28/2023

Continuous Scanning Is Imperative for Effective Web Application Security Software moves fast. With so many Web applications and APIs being built and modified in increasingly complex IT environments, securing your attack surface — which can change hourly or multiple times a day — is a challenge. Traditional approaches to security, like one-off tests or periodic scans, are no longer enough to get the job done and done well. Attackers are zeroing in on these apps…
Read More
21 Feb 2023
By Mary

InfoSec News Nuggets 02/21/2023

GoDaddy: Hackers stole source code, installed malware in multi-year breach  Web hosting giant GoDaddy says unknown attackers have stolen source code and installed malware on its servers after breaching its cPanel shared hosting environment in a multi-year attack. While GoDaddy discovered the security breach in early December 2022 following customer reports that their sites were being used to redirect to random domains, the attackers had access to the company's network for multiple years. "Based on our investigation,…
Read More
16 Nov 2022
By Mary

InfoSec News Nuggets 11/16/2022

Twitter Users Warn Others Using Two-Factor Authentication Not To Sign Out As 2FA Texts Aren't Arriving Elon Musk's acquisition of Twitter has proven controversial, confusing, amusing, and sometimes even frustrating. This week appears to be falling in the frustrating category, as some users are warning others that they've encountered a bug that is locking them out of their accounts. The claims have surfaced amid concerns about Twitter's drastically reduced workforce and the ways Musk went…
Read More
21 Oct 2022
By Mary

InfoSec News Nuggets 10/21/2022

FBI Warns Students Against Loan Forgiveness Scammers  The Federal Bureau of Investigation (FBI) has released a new public service announcement warning against fraudulent websites, emails, texts or phone scams aiming to defraud individuals seeking federal student loan forgiveness. According to the document, scammers are attempting to solicit personally identifiable information (PII), financial information or payment from potential victims. The warning comes amidst the backdrop of the recently released Student Loan Debt Relief Plan, which will provide targeted student debt cancellation…
Read More
20 Oct 2022
By Mary

InfoSec News Nuggets 10/20/2022

How the FBI Stumbled in the War on Cybercrime  Investigating cybercrime was supposed to be the FBI’s third-highest priority, behind terrorism and counterintelligence. Yet, in 2015, FBI Director James Comey realized that his Cyber Division faced a brain drain that was hamstringing its investigations. Retention in the division had been a chronic problem, but in the spring of that year, it became acute. About a dozen young and midcareer cyber agents had given notice or were…
Read More
31 Aug 2022
By Mary

InfoSec News Nuggets 08/31/2022

Singapore clocks higher ransomware attacks, warns of IoT risks Ransomware and phishing attacks continue to climb in Singapore, hitting small and midsize businesses (SMBs) and social media platforms. Cybercriminals also are expected to turn their attention to Internet of Things (IoT) devices and crypto-based transactions, leveraging the lack of security safeguards on these platforms.  Some 55,000 local-hosted phishing URLs were identified last year, up 17% from 2020, with social media companies accounting for more than…
Read More
24 Mar 2022
By Mary

InfoSec News Nuggets 03/24/2022

Android app downloaded 100,000 times from Google Play Store contained password-stealing malware, say security researchers Google has removed an app with over 1000,000 downloads from its Play Store after security researchers warned that the app was able to harvest the Facebook credentials of smartphone users. Researchers at French mobile security firm Pradeo said the app embeds Android trojan malware known as "Facestealer" because it dupes victims into typing in their Facebook credentials to a web…
Read More
21 Mar 2022
By Mary

InfoSec News Nuggets 03/21/2022

1 - The German BSI agency recommends replacing Kaspersky antivirus software The German Federal Office for Information Security agency, aka BSI, recommends consumers uninstall Kaspersky anti-virus software. The Agency warns the cybersecurity firm could be implicated in hacking attacks during the ongoing Russian invasion of Ukraine. According to §7 BSI law, the BSI warns against the use of Kaspersky Antivirus and recommends replacing it asap with defense solutions from other vendors. “The Federal Office for…
Read More
14 Mar 2022
By Mary

InfoSec News Nuggets 03/14/2022

1 - Extortion scheme impersonates government officials, law enforcement The FBI issued a public warning this week about a fraud scheme wherein scammers impersonate government officials and law enforcement personnel. According to the PSA, the scammers spoof legitimate numbers and names and use fake credentials of well-known members of the government and law enforcement agencies. The scam starts off either as a call from the “police” or a text message from a “government agency”. The content…
Read More
24 Sep 2021
By Mary

InfoSec News Nuggets 09/24/2021

A new APT is targeting hotels across the world A new advanced persistent threat (APT), a term used to describe state-sponsored cyber-espionage groups, has been spotted mounting attacks against hotels across the world. Codenamed FamousSparrow, this new APT was discovered by Slovak security firm ESET, which said it’s been tracking its attacks as far back as 2019. “FamousSparrow’s victims are located in Europe (France, Lithuania, the UK), the Middle East (Israel, Saudi Arabia), the Americas (Brazil,…
Read More
14 Apr 2021
By Mary

InfoSec News Nuggets 04/14/2021

1 - Clubhouse CEO says user data was not leaked, contrary to reports Clubhouse CEO Paul Davison said Sunday that a report claiming personal user data had been leaked was “false.” Cyber News reported a SQL database with users’ IDs, names, usernames, Twitter and Instagram handles and follower counts were posted to an online hacker forum. According to Cyber News, it did not appear that sensitive user information such as credit card numbers were among the leaked info. Clubhouse did…
Read More
19 Mar 2021
By Mary

InfoSec News Nuggets 03/19/2021

FBI: Cybercrime losses exceeded $4.2 billion in 2020 According to the 2020 Internet Crime Report [PDF], the FBI said it received 791,790 internet and cybercrime complaints in 2020, more than 69% than the 467,361 reports it received in 2019. Total losses were also up. The FBI said victims reported more than $4.2 billion in lost funds last year, 20% up from the $3.5 billion reported in 2019. Both figures —complaints and total losses— represent the…
Read More
23 Oct 2020
By Mary

InfoSec News Nuggets 10/23/2020

Quibi is shutting down Quibi — the shortform mobile-focused streaming service — is shutting down after just over six months of operation, making it one of the shortest-lived streaming services to date, according to The Wall Street Journal. The company since confirmed that it’ll be shutting down in a Medium post from Jeffrey Katzenberg and Meg Whitman. “We feel that we’ve exhausted all our options. As a result we have reluctantly come to the difficult decision to wind down the…
Read More
02 Oct 2020
By Mary

InfoSec News Nuggets 10/02/2020

FCC commissioner calls for new scrutiny of undersea data cables A member of the U.S. Federal Communications Commission on Wednesday called for new scrutiny of undersea cables that transmit nearly all the world’s internet data traffic. “We must take a closer look at cables with landing locations in adversary countries,” FCC Commissioner Geoffrey Starks said Wednesday at a commission meeting. “This includes the four existing submarine cables connecting the US and China, most of which…
Read More
23 Sep 2020
By Mary

InfoSec News Nuggets 09/23/2020

FBI hopes a more aggressive cyber strategy will disrupt foreign hackers Last week saw a flurry of U.S. indictments of alleged Chinese and Iranian hackers as part of a multi-agency crackdown on foreign intelligence services. The Department of Treasury issued sanctions, the Department of Homeland Security advised companies on how to fend off hackers and U.S. intelligence agencies likely kept a close eye on possible reactions from Beijing and Tehran. At the center of the coordinated crackdowns, though, were…
Read More
27 Aug 2020
By Mary

InfoSec News Nuggets 08/27/2020

Tomorrow’s Fortnite Update Won’t Be Coming for Apple Users, Epic Says It’s a 'Matter of Principle' In its first statement since Monday’s captivating hearing, this morning Epic Games sought to further clarify its position against Apple while also admitting that the latest chapter of Fortnite would not be appearing on either iOS or macOS when it launches August 27. If you listened in on Monday’s trial, Epic’s latest statement will sound like a refrain. “Apple is asking that Epic…
Read More
21 Jul 2020
By Mary

InfoSec News Nuggets 7/21/2020

Seven 'no log' VPN providers accused of leaking A string of "zero logging" VPN providers have some explaining to do after more than a terabyte of user logs were found on their servers unprotected and facing the public internet. This data, we are told, included in at least some cases clear-text passwords, personal information, and lists of websites visited, all for anyone to stumble upon. It all came to light this week after Comparitech's Bob…
Read More
16 Jul 2020
By Mary

InfoSec News Nuggets 7/16/2020

Twitter lost control of its internal systems to Bitcoin-scamming hackers Twitter lost control of its internal systems to attackers who hijacked almost a dozen high-profile accounts, in a breach that raises serious concerns about the security of a platform that’s growing increasingly influential. The first signs of compromise occurred around 1 PM California time when hijacked accounts—belonging to Vice President Joe Biden, Elon Musk, Bill Gates, and other people with millions or tens of millions of…
Read More
01 Jul 2020
By Mary

InfoSec News Nuggets 7/1/2020

Roblox accounts being hacked in support of Trump reelection A hacking campaign is targeting Roblox accounts to support President Trump in the upcoming U.S. Presidential elections in November. Roblox is an online gaming platform that allows members to create games and publish them for others to play. With over 100 million monthly active users and consistently in the top hundred sites globally, Roblox is an immensely popular gaming platform. While used by people of all…
Read More
13 May 2020
By Mary

InfoSec News Nuggets 5/13/2020

Scrabble fans slam 'sparkly abomination' new app Scrabble Go, a new game which will replace the existing official Scrabble mobile app made by Electronic Arts (EA) has sparked hundreds of complaints. Its vivid colours, treasure-style rewards and in-app purchase model has angered long-time players. The EA game will be discontinued on 5 June because the official franchise is now owned by games firm Scopely. Scrabble Go was launched on 5 March and had been downloaded…
Read More
23 Apr 2020
By Mary

InfoSec News Nuggets 4/23/2020

ITU-WHO Joint Statement: Unleashing information technology to defeat COVID-19 The World Health Organization, the International Telecommunication Union (ITU) with support from UNICEF are set to work with telecommunication companies to text people directly on their mobile phones with vital health messaging to help protect them from COVID-19. These text messages will reach billions of people that aren’t able to connect to the internet for information. Now more than ever, technology must ensure that everyone can…
Read More
21 Apr 2020
By Mary

InfoSec News Nuggets 4/21/2020

IT services giant Cognizant suffers Maze Ransomware cyber attack Information technologies services giant Cognizant suffered a cyber attack Friday night allegedly by the operators of the Maze Ransomware, BleepingComputer has learned. Cognizant is one of the largest IT managed services company in the world with close to 300,000 employees and over $15 billion in revenue. As part of its operations, Cognizant remotely manages its clients through end-point clients, or agents, that are installed on customer's workstations…
Read More
08 Apr 2020
By Mary

InfoSec News Nuggets 4/8/2020

Firefox's revamped address bar is designed to make searching a lot faster Mozilla has given Firefox’s address bar a refreshed look and a couple of updates that can make searches go faster. To start with, the browser will now enlarge the address bar whenever you want to do a search and will show the popular sites that show up when you type with larger fonts and shorter URLs. It has also introduced “smarter searches,” which shows additional bolded keywords…
Read More
13 Mar 2020
By Mary

InfoSec News Nuggets 3/13/2020

1 - New action to disrupt world’s largest online criminal network Today, Microsoft and partners across 35 countries took coordinated legal and technical steps to disrupt one of the world’s most prolific botnets, called Necurs, which has infected more than nine million computers globally. This disruption is the result of eight years of tracking and planning and will help ensure the criminals behind this network are no longer able to use key elements of its infrastructure…
Read More
06 Mar 2020
By Mary

InfoSec News Nuggets 3/6/2020

1 - Backdoor malware is being spread through fake security certificate alerts Backdoor and Trojan malware variants are being distributed through a new phishing technique that attempts to lure victims into accepting an "update" to website security certificates.  Certificate Authorities (CAs) distribute SSL/TLS security certificates for improved security online by providing encryption for communication channels between a browser and server -- especially important for domains providing e-commerce services -- as well as identity validation, which…
Read More
26 Feb 2020
By Mary

InfoSec News Nuggets 2/26/2020

1 - Google denies claims that free school Chromebooks are illegally collecting student data Google has branded claims made in a new lawsuit that free school Chromebooks are harvesting student information in violation of COPPA as "factually wrong." The lawsuit, filed against the tech giant on Thursday by New Mexico Attorney General Hector Balderas, alleges that Google is illegally collecting data belonging to minors. According to the complaint (.PDF), Chromebooks offered to schools in the area for free…
Read More
31 Jan 2020
By Mary

InfoSec News Nuggets 1/31/2020

1 - Avast Antivirus Is Shutting Down Its Data Collection Arm, Effective Immediately Avast, an antivirus program with more than 435 million users worldwide, said it will stop collecting and selling the private web browsing histories of its users following a joint investigation by Motherboard and PCMag into the sale of that data. In addition, Avast said it will completely shut down Jumpshot, the subsidiary company it used to sell this data. Our investigation found that Avast,…
Read More
21 Jan 2020
By Mary

InfoSec News Nuggets 1/21/2020

1 - Hacker leaks passwords for more than 500,000 servers, routers, and IoT devices A hacker has published this week a massive list of Telnet credentials for more than 515,000 servers, home routers, and IoT (Internet of Things) "smart" devices. The list, which was published on a popular hacking forum, includes each device's IP address, along with a username and password for the Telnet service, a remote access protocol that can be used to control devices…
Read More
15 Jan 2020
By Mary

InfoSec News Nuggets 1/15/2020

1 - Texas school district falls for email scam, hands over $2.3 million A successful phishing scam has left a Texan school district $2.3 million out of pocket. Last week, the Manor Independent School District, in Manor, Texas, said an inquiry is underway to track down the cybercriminals responsible for the fraudulent email campaign. Phishing emails were sent to the organization in November, leading to three separate transactions taking place. An employee uncovered the scheme a month later,…
Read More
04 Dec 2019
By Mary

InfoSec News Nuggets 12/04/2019

1 - Apple's tap-and-go Express payments come to London public transport Paying for daily necessities using your phone might feel like the future, but the reality can sometimes be slower as mobile payments require authentication that can take time to approve. To combat this issue, Apple has brought its Express feature to London, making it far quicker and easier to use Apple Pay on services like the Tube. Apple's Express Mode can now be used on all Transport…
Read More
25 Nov 2019
By Mary

InfoSec News Nuggets 11/25/2019

1 - Google ups bug bounties for Android flaws, exploits ASR covers security vulnerabilities discovered in the latest available Android versions for Pixel phones and tablets, which are currently Pixel 4, Pixel 3a and Pixel 3a XL, and Pixel 3 and Pixel 3 XL. “Eligible bugs include those in AOSP code, OEM code (libraries and drivers), the kernel, the Secure Element code, and the TrustZone OS and modules. Vulnerabilities in other non-Android code, such as…
Read More
10 Oct 2019
By Mary

InfoSec News Nuggets 10/10/2019

Twitter says user data meant for security purposes may have been used for advertising Twitter said on Tuesday email addresses and phone numbers uploaded by users to meet its security requirements may have been ‘inadvertently’ used for advertising purposes. The micro-blogging site said the issue was rectified as of Sept. 17, without disclosing how many users were impacted. “This was an error and we apologize,” the company said in a blog post. Social media companies, including Twitter and Facebook,…
Read More
12 Sep 2019
By Mary

InfoSec News Nuggets 9/12/2019

‘Cobalt Dickens’ group is phishing universities at scale again, researchers say An Iran-linked hacking group whose operatives the U.S. government indicted last year has launched a phishing operation to steal login credentials against computer users at over 60 universities in the United States, the United Kingdom, and elsewhere, researchers said Wednesday. The campaign sees victims redirected to spoofed login pages, where their passwords are stolen, said Secureworks, a Dell-owned cybersecurity company that uncovered the activity.…
Read More