Threatpost

Featured news

InterPlanetary Storm Botnet Infects 13K Mac, Android Devices

In addition to Windows and Linux machines, a new variant of the malware now targets Mac and Android devices.

NFL, NBA Players Hacked in Would-Be Cyber-Slam-Dunk

by Tara Seals

October 1, 2020

Federal prosecutors charged two men with crimes that carry up to 20 years in prison.

Spammers Smuggle LokiBot Via URL Obfuscation Tactic

Researchers say that the campaign sidesteps end user detection and security solutions.

CAPTCHA phishing attack microsoft office 365

Microsoft Office 365 Phishing Attack Uses Multiple CAPTCHAs

Cybercriminals set up three different CAPTCHAs that Office 365 targets must click through before the final phishing page.

Latest news

Emotet Emails Strike Thousands of DNC Volunteers

by Lindsey O'Donnell

October 1, 2020

Hundreds of U.S. organizations on Thursday received emails purporting to come from the Democratic National Committee, in a new politically charged Emotet spear-phishing attack.

QR Codes: A Sneaky Security Threat

October 1, 2020

What to watch out for, and how to protect yourself from malicious versions of these mobile shortcuts.

OAuth Consent Phishing Ramps Up with Microsoft Office 365 Attacks

by Tara Seals

September 30, 2020

Attackers gain read-only permissions to snoop around Office 365 accounts, including emails, contacts and more.

two tailed scorpion Android/SpyC23.A malware

Android Spyware Variant Snoops on WhatsApp, Telegram Messages

by Lindsey O'Donnell

September 30, 2020

The Android malware comes from threat group APT-C-23, also known as Two-Tailed Scorpion and Desert Scorpion.

Facebook Small Business Grants Spark Identity-Theft Scam

by Tara Seals

September 30, 2020

The cybercrooks spread the COVID-19 relief scam via Telegram and WhatsApp, and ultimately harvest account credentials and even pics of IDs.

Critical Industrial Flaws Pose Patching Headache For Manufacturers

When it comes to patching critical flaws, industrial firms face various challenges – with some needing to shut down entire factories in order to apply updates.

Vulnerability Disclosure: Ethical Hackers Seek Best Practices

Cybersecurity researchers Brian Gorenc and Dustin Childs talk about the biggest vulnerability disclosure challenges in IoT and the industrial vertical.

Disinformation Spurs a Thriving Industry as U.S. Election Looms

Threat actors are becoming increasingly sophisticated in launching disinformation campaigns – and staying under the radar to avoid detection from Facebook, Twitter and other platforms.

News Wrap: AWS Cryptojacking Worm, IBM Privacy Lawsuit and More

Threatpost editors discuss a cryptomining malware targeting AWS systems, a recent development in a lawsuit against the IBM-owned Weather Channel app, and more.

Researchers Warn of Active Malware Campaign Using HTML Smuggling

A recently uncovered, active campaign called “Duri” makes use of HTML smuggling to deliver malware.

New Global Threat Landscape Report Reveals ‘Unprecedented’ Cyberattacks

Fortinet’s recently released Global Threat Landscape Report shows how the perimeter is extending to the home in the first half of 2020 – and what that means for cybercrime.

Podcast: Learning to ‘Speak the Language’ of OT Security Teams

Andrew Ginter, VP Industrial Security at Waterfall Security Solutions, talks about the differing priorities between IT and OT security teams as industrial control systems become connected.

Black Hat USA 2020 Preview: Election Security, COVID Disinformation and More

Threatpost editors break down the top themes, speakers and sessions to look out for this year at Black Hat 2020 – from election security to remote work and the pandemic.

Podcast: Security Lessons Learned In Times of Uncertainty

Derek Manky, Chief, Security Insights & Global Threat Alliances at Fortinet’s FortiGuard Labs, discusses the top threats and lessons learned from the first half of 2020.

View all podcasts

A Cyber ‘Vigilante’ is Sabotaging Emotet’s Return

During Black Hat USA 2020, Threatpost talks to Sherrod DeGrippo, with Proofpoint, about Emotet’s recent return -and how a cyber vigilante is attempting to thwart the malware’s comeback.

Black Hat USA 2020: Critical Meetup.com Flaws Reveal Common AppSec Holes

With Black Hat USA 2020 kicking off this week, Erez Yalon with Checkmarx talks about newly disclosed, critical vulnerabilities in Meetup.com – and why they are the “holy grail” for attackers.

Encryption Under ‘Full-Frontal Nuclear Assault’ By U.S. Bills

The U.S. government and tech companies continue to butt heads over the idea of encryption and what that means for law enforcement.

Chris Vickery: AI Will Drive Tomorrow’s Data Breaches

Chris Vickery talks about his craziest data breach discoveries and why “vishing” is the next top threat no one’s ready for.

The Enemy Within: How Insider Threats Are Changing

Insider-threat security experts unravel the new normal during this time of remote working, and explain how to protect sensitive data from this escalating risk.

BEC Gang Exploits G Suite, Long Domain Names in Cyberattacks

BEC gangs like “Exaggerated Lion” are using tricky tactics – like exploiting G Suite – to scam companies out of millions.

Fake Skype, Signal Apps Used to Spread Surveillanceware

Threat groups are increasingly relying on trojanized apps pretending to be legitimate – such as Skype or Signal – but are really spreading surveillanceware.

Tokyo Olympics Postponed, But 5G Security Lessons Shine

Threatpost Senior Editor Tara Seals is joined by Russ Mohr, engineer and Apple evangelist at MobileIron along with Jerry Ray, COO at SecureAge, for a discussion about the now postponed Tokyo Games and its use of 5G and the myriad of security concerns Japan is preparing for.