We use cookies to improve your experience. Do you accept?

Cyware Daily Threat Intelligence, November 21, 2024

shutterstock 2158288887

Daily Threat Briefing • Nov 21, 2024

With advanced techniques and creative exploits, cybercriminals are escalating their attacks on users' digital and financial lives. A revamped version of NodeStealer is targeting Facebook Ads Manager accounts to extract sensitive information and steal credit card data from web browsers. The malware employs sophisticated methods to access credit card details, which are then exfiltrated via Telegram. 

The WorkflowKit Race Vulnerability in macOS has exposed users to potential data breaches and remote code execution. The flaw arises from a race condition during the shortcut extraction process, allowing malicious apps to intercept and modify shortcuts during import. Apple addressed this critical issue in macOS 14.5 with enhanced sandbox restrictions.

Adding to these growing concerns, criminals have devised a new scam known as Ghost Tap, exploiting NFC technology in mobile payment services. Using phishing tactics and mobile banking malware, attackers capture victims’ card credentials, link them to mobile wallets, and deploy mules to make fraudulent purchases at physical stores. 

Top Malware Reported in the Last 24 Hours

NodeStealer targets Facebook Ad accounts

A new version of NodeStealer has emerged to extract sensitive information from victims' Facebook Ads Manager accounts and steal credit card data from web browsers, potentially opening doors for malicious advertising. The updated NodeStealer uses various techniques, such as unlocking browser database files through Windows Restart Manager and generating Python scripts with batch files. Additionally, some NodeStealer samples unlock SQLite database files to access credit card data, with this information being sent through Telegram, a platform commonly used by cybercriminals. 

Lumma Stealer Distribution on Telegram

Telegram is becoming a popular platform for spreading malware, with Lumma Stealer being distributed through the messaging app. Two Telegram channels with thousands of subscribers are distributing Lumma Stealer disguised as benign apps like CCleaner. The first channel is VIP HitMaster Program with over 42,000 subscribers and the second is named MegaProgram + with 8660 subscribers. The malware connects to a Steam account for command and control, making it harder to detect. 

Top Vulnerabilities Reported in the Last 24 Hours

Bug in AnyDesk's Allow Direct Connections

A security researcher discovered a vulnerability in AnyDesk remote desktop software that could expose users' IP addresses, putting their privacy at risk. The flaw, identified as CVE-2024-52940, affects AnyDesk versions 8.1.0 and older on Windows systems. When the "Allow Direct Connections" feature is enabled with the connection port set to 7070, attackers can retrieve a target's public IP address using only their AnyDesk ID. This vulnerability could be exploited for malicious purposes, such as launching targeted phishing campaigns or DoS attacks. No official fix is currently available, so users are advised to be cautious and consider disabling the feature until AnyDesk releases a patch.

WorkflowKit Race flaw in macOS

The WorkflowKit Race Vulnerability (CVE-2024-27821) exposes users to potential data breaches or remote code execution by allowing malicious apps to intercept and modify shortcut files during import. This flaw arises from a race condition in WorkflowKit’s shortcut extraction process. Apple addressed the issue in macOS 14.5 by implementing enhanced sandbox restrictions to prevent unauthorized access to temporary directories. Users are strongly advised to update to macOS 14.5 or later to mitigate these risks effectively.

Top Scams Reported in the Last 24 Hours

Beware of the “Sad Announcement” email scam

Tech support scammers are employing a new email scheme that pretends to inform recipients about the death of someone they know. The emails begin with the subject line “Sad announcement” and include the name of a familiar individual, making it seem like it’s from that person. The emails have various formats but follow a pattern that quickly grabs the reader’s interest with phrases implying shared photos or memories. Each email contains links that lead to domains, mostly short-lived and registered with NameCheap, that are aimed at tricking users. The websites linked in these emails often mimic the appearance of legitimate security alerts, claiming to scan for threats on your computer, but they actually showcase false results to instill fear. 

Hackers exploit Ghost Tap for NFC scam

Criminals are now using a new method, referred to as Ghost Tap, to steal funds from victims by using NFC technology in mobile payment services like Google Pay and Apple Pay. The criminals trick victims into downloading mobile banking malware that captures their banking credentials or use voice phishing to gain access to the victim's card details. The stolen card details are then linked to Google Pay or Apple Pay and sent to a mule, who makes fraudulent purchases at stores to avoid detection. These attacks evade anti-fraud mechanisms by appearing as if they originate from the same device and can occur even if the device is in airplane mode.

Related Threat Briefings

Nov 20, 2024

Cyware Daily Threat Intelligence, November 20, 2024

Cybercriminals and nation-state actors are fine-tuning their craft, targeting everything from IoT devices to global telecom networks. The Ngioweb malware has been used to assemble a botnet of over 35,000 compromised IoT devices and SOHO routers, to sell residential proxies on platforms like NSOCKS. A China-linked group, LIMINAL PANDA, has been conducting cyberespionage against telecommunications entities in South Asia and Africa since 2020. Armed with custom malware like SIGTRANslator and PingPong, they exploit telecom protocols to exfiltrate data and maintain persistent access, employing advanced tactics. Meanwhile, the CISA has issued warnings about three actively exploited vulnerabilities in networking products. These include a critical Kemp LoadMaster OS flaw and two Palo Alto PAN-OS vulnerabilities. The vulnerabilities have been added to the the KEV catalog.

Nov 19, 2024

Cyware Daily Threat Intelligence, November 19, 2024

As cyber threats grow more sophisticated, attackers are leveraging tailored tactics to exploit both individuals and organizations. BabbleLoader, a stealthy malware loader, is delivering information stealers like WhiteSnake and Meduza, targeting users searching for cracked software and professionals in finance and administration by disguising itself as accounting software. Its advanced evasion techniques bypass antivirus and sandbox defenses, disrupting analysis and detection. Critical vulnerabilities are also under scrutiny. The LibreNMS project revealed CVE-2024-51092, a flaw in its network monitoring platform that allows authenticated attackers to execute OS commands and potentially take over servers. Users are strongly advised to update to version 24.10.0 to mitigate these risks. Meanwhile, phishing campaigns continue to escalate. DocuSign phishing attacks targeting state and municipal contractors have surged by 98% in just one week. Exploiting licensing cycles and spoofing government agencies like the Department of Health, these campaigns aim to trick businesses into signing fake documents for financial gain.

Nov 18, 2024

Cyware Daily Threat Intelligence, November 18, 2024

Threat actors are employing sophisticated techniques to breach defenses across industries, from maritime manufacturing to WordPress websites and software impersonation campaigns. A DONOT APT campaign has been targeting Pakistan’s manufacturing sector supporting maritime and defense operations. The attackers use malicious LNK files disguised as RTF documents, leveraging dynamic domain generation and updated encryption to maintain persistence and evade detection. Meanwhile, a critical authentication bypass vulnerability in the Really Simple Security WordPress plugin is putting over four million sites at risk, granting attackers full administrative access. Another vulnerability in the WPLMS Learning Management System exposes sites to arbitrary file reading and deletion, prompting emergency patches and forced updates by WordPress. On the social engineering front, researchers highlighted the rise of ClickFix campaigns, impersonating trusted software to deliver malware like AsyncRAT and Lumma Stealer. A fake CAPTCHA variant in these campaigns recently tricked users into executing malicious payloads, impacting hundreds of organizations globally.

Nov 15, 2024

Cyware Daily Threat Intelligence, November 15, 2024

From app stores to online shopping platforms, cybercriminals are exploiting trust to infiltrate systems and steal sensitive data. Eight trojan-infected Android apps were spotted on the Google Play Store, downloaded over two million times. These apps, containing Android.FakeApp.1669, connect to malicious DNS servers to display deceptive links. Meanwhile, the CISA has issued a warning about two critical vulnerabilities in Palo Alto Networks Expedition software, citing active exploitation. These flaws allow attackers to execute commands as root and access sensitive database contents. In another alarming campaign, Chinese threat actor SilkSpecter has created over 4,500 fake domains impersonating brands like North Face and Ikea to steal credit card details from shoppers in the U.S. and Europe.

Nov 14, 2024

Cyware Daily Threat Intelligence, November 14, 2024

The lines between digital espionage and warfare blur as state-sponsored threat actors employ increasingly advanced methods to compromise their targets. China’s APT41 has launched a cyberespionage campaign targeting organizations in South Asia, utilizing the DeepData Framework. This Windows-based toolkit consists of 12 malicious plugins that are designed to harvest a wide range of sensitive data. Meanwhile, the Lazarus Group has turned its sights on macOS users with a new malware strain, RustyAttr. Built using the Tauri framework, the malware exploits extended file attributes to execute a malicious shell script that loads a Rust-based backend via a fake webpage. In another wave of attacks, a critical zero-day vulnerability is being exploited to target Windows systems in Ukraine. This vulnerability allows attackers to take control of systems when users interact with malicious URL files delivered through phishing emails.

Nov 13, 2024

Cyware Daily Threat Intelligence, November 13, 2024

From deceptive apps to vulnerabilities and developer-targeted tools, attackers are exploiting every corner of the digital landscape. SpyNote is posing as a fake antivirus, giving attackers full control over Android devices, stealing credentials, and targeting cryptocurrency users. In its November Patch Tuesday, Microsoft patched 89 security flaws, including two actively exploited vulnerabilities, urging immediate updates. Meanwhile, a new tool named GoIssue is being sold to attackers, allowing bulk theft of developer credentials from GitHub profiles, enabling supply chain attacks.

Oct 1, 2024

Cyware Daily Threat Intelligence

What started as a seemingly harmless download turned into an eight-day siege, as attackers infiltrated networks with Nitrogen malware, only to end with BlackCat ransomware locking down the entire domain. After gaining initial access, the attackers de

Sep 23, 2024

Cyware Daily Threat Intelligence

Splinter, a new post-exploitation tool, is tearing through victims' IT environments, enabling attackers to achieve multiple objectives with alarming efficiency. Written in Rust, Splinter self-deletes after leaving a trail of chaos in its wake. A

Sep 20, 2024

Cyware Daily Threat Intelligence

Vanilla Tempest is wreaking havoc in U.S. healthcare, slipping through the cracks via Storm-0494 to unleash the INC ransomware. With tools like Gootloader and Supper in its arsenal, this group remains a persistent menace. UNC1860, the shadowy Ir

Sep 19, 2024

Cyware Daily Threat Intelligence

PondRAT is lurking in poisoned Python packages, quietly infiltrating Linux and macOS systems through PyPI downloads. Linked to the Gleaming Pisces group, this campaign targets developers’ endpoints in a clever bid to compromise software supply chain

Sep 18, 2024

Cyware Daily Threat Intelligence

UNC2970 is turning job hunting into a minefield, using fake job offers from major energy and aerospace companies to deliver a trojanized PDF reader. The North Korean group has been using a new backdoor, MISTPEN, for this purpose. A subtle flaw i

Sep 17, 2024

Cyware Daily Threat Intelligence

Clipper malware are back in action and the attackers are hunting for cryptocurrency wallets. Binance has issued a warning after detecting a surge in ClipBanker attacks, which swap wallet addresses from clipboards, leading to financial losses for unsu