Home » Latest Cyberthreats and Advisories – December 2, 2022

Latest Cyberthreats and Advisories – December 2, 2022

by Cybersecurity Insiders
0 comment

World Cup fraud, Chinese tech bans and a social media cyberstorm hit headlines this week. Here are the latest threats and advisories for the week of December 2, 2022.
Threat Advisories and Alerts

NCSC Urges Christmas Shoppers to be Vigilant

As Christmas shopping kicks into gear, the UK’s National Cyber Security Centre (NCSC) has launched a campaign releasing a series of secure online shopping articles to spread awareness about cybercrime this festive season. During this same time last year, thousands of holiday shoppers were scammed, resulting in ?15.3m being stolen and victims losing on average ?1,000 per person. Shoppers can protect themselves by setting up two-step verification where it’s offered, researching online retailers and using credit cards that protect online purchases.

Source: https://www.ncsc.gov.uk/news/festive-shoppers-urged-to-be-cyber-aware

SingCERT Releases Report on the Rise of Data Breaches

With more and more data breaches affecting businesses around the globe, the Singapore Computer Emergency Response Team (SingCERT) has released a report documenting important findings from this trend. The report highlights the most common causes of data breaches, how to prevent them and includes a list of major data breaches from the past decade, including Sony Pictures in 2014, Yahoo in 2016 and this year’s Optus breach.

Source: https://www.csa.gov.sg/singcert/Publications/data-breaches

Advisory Points to GitHub Change Management Vulnerability

Researchers at security firm Legit Security have issued an advisory regarding a vulnerability found within software development workspace GitHub. It found that an attacker submitting changes to an open-source repository on GitHub could cause downstream software projects that include the latest version of a component to compile updates with malicious code. GitHub confirmed the issue and paid a bounty for the information. It has also updated its GetArtifact and ListArtifacts APIs.

Source: https://www.darkreading.com/application-security/artifact-poisoning-github-actions-malware-software-pipelines
Emerging Threats and Research

World Cup Cyberattacks Target Fans

As the second round of the World Cup kicks off this weekend, cybercriminals are in full swing attempting to cash in on the excitement surrounding the tournament. Some of their tactics include duping fans with FIFA-themed fake sites to steal credit cards, sharing techniques to forge Hayya cards (FIFA entry permits) and selling fake World Cup themed cryptocurrencies. Cybersecurity company Group-IB has reportedly tracked more than 16,000 scam domains and 40 malicious apps using World Cup branding to swindle victims.

Source: https://www.helpnetsecurity.com/2022/11/29/fifa-world-cup-themed-cyberattacks/

Meta Fined EUR265 Million by Ireland’s DPC

The Irish Data Protection Commission (DPC) has hit Meta with a EUR265 million fine for a data scraping incident that exposed the information of 533 million Facebook users. While Meta has cooperated with the DPC and corrected the issue, the latest fine has prompted fresh questions regarding how serious Meta is about protecting users’ privacy. Meta has now paid EUR1 billion in data privacy fines within Europe, including a EUR405 million GDPR fine against Instagram in September.

Source: https://www.itpro.co.uk/business/policy-legislation/369609/unacceptable-data-scraping-lands-meta-228m-fine

Twitter Data Leak Could Affect Over Five Million Accounts

Just as Elon Musk is getting comfy in his Twitter CEO chair, a data breach may be ruffling his feathers. More than five million Twitter accounts have been compromised, according to cybersecurity expert Chad Loder. Accounts with the “Let others find you by your phone” setting enabled were reportedly affected. Leaked data may include Twitter IDs, login names, phone numbers, email addresses and other personal information.

Source: https://www.infosecurity-magazine.com/news/millions-twitter-accounts/

Naked TikTokers Used as Lure for Sneaky Malware

Cybercriminals are taking advantage of TikTok’s trending “Invisible Challenge” to install malware on thousands of users’ devices. The challenge requires users to film themselves naked while using TikTok’s “Invisible Body” filter, which replaces the body of the individual with a blurry background. Threat actors have created malware disguised as software that falsely claims to remove the filter and expose the naked bodies of the TikTokers. If the malware is successfully installed, it can steal credit cards, cryptocurrency wallets and passwords.

Source: https://www.bleepingcomputer.com/news/security/tiktok-invisible-body-challenge-exploited-to-push-malware/

Chinese Telecom Imports Banned by US

The United States’ Federal Communications Commission (FCC) has banned the use of electronic equipment from Chinese telecom and video surveillance companies due to national security concerns. The five companies affected by the new rules are ZTE, Huawei, Hytera Communications, Hikvision and Dahua. The news from the FCC follows the UK government implementing its own ban on Chinese CCTV cameras.

Source: https://www.theregister.com/2022/11/27/fcc_china_equipment_authorization_ban/

To stay updated on the latest cybersecurity threats and advisories, look for weekly updates on the (ISC)? blog. Please share other alerts and threat discoveries you’ve encountered and join the conversation on the (ISC)? Community Industry News board.

The post Latest Cyberthreats and Advisories – December 2, 2022 appeared first on Cybersecurity Insiders.

Source: Read More

You may also like

Leave a Comment

CyberNonStop

Cybernonstop is created to bring news and knowledge through articles to visitors.

Do not forget to subscribe.

Laest News

@2021 – All Right Reserved. Designed and Developed by PenciDesign