Cybercriminals are finding new ways to trick people into compromising their own devices and accounts. One campaign used a sponsored ad on X to target Mac users, while another technique, dubbed ConsentFix, steals Microsoft 365 accounts without installing malware.
Researchers have discovered a ClickFix-style attack running as a sponsored advertisement on X. The ad was posted from a verified account, adding an extra layer of credibility to the scam.
ClickFix campaigns use convincing lures—historically fake “human verification” screens, and now a fake download for DynamicLake, a legitimate macOS utility that turns your MacBook’s notch into an unofficial but functional version of Apple’s Dynamic Island. This type of attack requires the user to paste a command from the clipboard, making it depend heavily on user interaction.
Read more…
Source: MalwareBytes Labs
Sign up for the Cyber Security Review Newsletter
The latest cyber security news and insights delivered right to your inbox
Related:
- Identifying Group Policy attacks
November 8, 2023
In this post Sophos researchers will be discussing Group Policy attacks, basing the threat hunt on a ransomware investigation undertaken by the Sophos X-Ops Incident Response team earlier this year. They will cover malicious behaviors associated with Active Directory and Group Policy attacks, showing you how to investigate and remediate some of these threats. Read more… Source: ...
- UK: Cyber attack hits island council computer systems
November 8, 2023
A suspected ransomware attack has caused significant disruption to IT systems at Western Isles local authority, Comhairle nan Eilean Siar. The council said access to its systems had been affected. The Scottish government and computer company Dell have been helping Comhairle nan Eilean Siar deal with the situation. Read more… Source: MSN News
- Indian hackers launch cyber attacks on Qatar to avenge death penalty of former Navy officers
November 8, 2023
An Indian hacker group, named ‘Indian Cyber Force’ launched cyber attacks on Qatar in response to the death sentence handed to eight former Indian Navy officers by a Qatari court in Espionage case. The Indian hackers claimed of carrying out cyber attacks on Qatar on November 7. They also alleged of executing unauthorised server access, leaked ...
- Personal data of 665,000 Marina Bay Sands lifestyle rewards members accessed in data security breach
November 7, 2023
The personal data of 665,000 Marina Bay Sands customers was accessed in a data security breach in October. The “unauthorised access” took place on Oct 19 and Oct 20 and involved the data of some Sands LifeStyle rewards programme members, said a Marina Bay Sands (MBS) spokesperson on Tuesday (Nov 7). MBS said in response ...
- Okta breach happened after employee logged into personal Google account
November 7, 2023
Okta has revealed details about a recent breach which exposed files belonging to customers. As Malwarebytes explained in their article about 1Password being a victim of this breach, it’s normal for Okta support to ask customers to upload a file known as an HTTP Archive (HAR) file. Having this file allows the team to troubleshoot ...
- Gaming-related cyberthreats in 2023: Minecrafters targeted the most
November 6, 2023
The gaming industry continues growing. The Newzoo report for 2023 reveals that two in five – more than three billion – across the globe are gamers, which is 6.3 percent more than last year. Globally, gaming revenue amounts to an estimated US$242.39 billion, with almost half of that generated by the Asia Pacific. By the ...