A Little Sunshine – Computer Security Articles

Credit to Author: BrianKrebs| Date: Thu, 24 Jul 2025 17:57:06 +0000

KrebsOnSecurity recently heard from a reader whose boss’s email account got phished and was used to trick one of the company’s customers into sending a large payment to scammers. An investigation into the attacker’s infrastructure points to a long-running Nigerian cybercrime group that is actively targeting established companies in the transportation and aviation industries.

Independent Krebs

July 25, 2025 admin

Poor Passwords Tattle on AI Hiring Bot Maker Paradox.ai

Credit to Author: BrianKrebs| Date: Fri, 18 Jul 2025 01:23:20 +0000

Security researchers recently revealed that the personal information of millions of people who applied for jobs at McDonald’s was exposed after they guessed the password (“123456”) for the fast food chain’s account at Paradox.ai, a company that makes artificial intelligence based hiring chatbots used by many Fortune 500 companies. Paradox.ai said the security oversight was an isolated incident that did not affect its other customers, but recent security breaches involving its employees in Vietnam tell a more nuanced story.

Independent Krebs

July 25, 2025 admin

DOGE Denizen Marko Elez Leaked API Key for xAI

Credit to Author: BrianKrebs| Date: Tue, 15 Jul 2025 01:23:43 +0000

Marko Elez, a 25-year-old employee at Elon Musk’s Department of Government Efficiency (DOGE), has been granted access to sensitive databases at the U.S. Social Security Administration, the Treasury and Justice departments, and the Department of Homeland Security. So it should fill all Americans with a deep sense of confidence to learn that Mr. Elez over the weekend inadvertently published a private key that allowed anyone to interact directly with more than four dozen large language models (LLMs) developed by Musk’s artificial intelligence company xAI.

Independent Krebs

July 25, 2025 admin

Big Tech’s Mixed Response to U.S. Treasury Sanctions

Credit to Author: BrianKrebs| Date: Thu, 03 Jul 2025 16:06:05 +0000

In May 2025, the U.S. government sanctioned a Chinese national for operating a cloud provider linked to the majority of virtual currency investment scam websites reported to the FBI. But more than a month later, the accused continues to openly operate accounts at a slew of American tech companies, including Facebook, Github, LinkedIn, PayPal and Twitter/X.

Independent Krebs

July 25, 2025 admin

Senator Chides FBI for Weak Advice on Mobile Security

Credit to Author: BrianKrebs| Date: Mon, 30 Jun 2025 17:33:59 +0000

Agents with the Federal Bureau of Investigation (FBI) briefed Capitol Hill staff recently on hardening the security of their mobile devices, after a contacts list stolen from the personal phone of the White House Chief of Staff Susie Wiles was reportedly used to fuel a series of text messages and phone calls impersonating her to U.S. lawmakers. But in a letter this week to the FBI, one of the Senate’s most tech-savvy lawmakers says the feds aren’t doing enough to recommend more appropriate security protections that are already built into most consumer mobile devices.

Independent Krebs

July 25, 2025 admin

Inside a Dark Adtech Empire Fed by Fake CAPTCHAs

Credit to Author: BrianKrebs| Date: Thu, 12 Jun 2025 22:14:00 +0000

Late last year, security researchers made a startling discovery: Kremlin-backed disinformation campaigns were bypassing moderation on social media platforms by leveraging the same malicious advertising technology that powers a sprawling ecosystem of online hucksters and website hackers. A new report on the fallout from that investigation finds this dark ad tech industry is far more resilient and incestuous than previously known.

Independent Krebs

May 22, 2025 admin

Oops: DanaBot Malware Devs Infected Their Own PCs

Credit to Author: BrianKrebs| Date: Thu, 22 May 2025 21:53:21 +0000

The U.S. government today unsealed criminal charges against 16 individuals accused of operating and selling DanaBot, a prolific strain of information-stealing malware that has been sold on Russian cybercrime forums since 2018. The FBI says a newer version of DanaBot was used for espionage, and that many of the defendants exposed their real-life identities after accidentally infecting their own systems with the malware.

Independent Krebs

May 20, 2025 admin

KrebsOnSecurity Hit With Near-Record 6.3 Tbps DDoS

Credit to Author: BrianKrebs| Date: Tue, 20 May 2025 21:30:30 +0000

KrebsOnSecurity last week was hit by a near record distributed denial-of-service (DDoS) attack that clocked in at more than 6.3 terabits of data per second (a terabit is one trillion bits of data). The brief attack appears to have been a test run for a massive new Internet of Things (IoT) botnet capable of launching crippling digital assaults that few web destinations can withstand. Read on for more about the botnet, the attack, and the apparent creator of this global menace.