News of the Cyber World

[kyonides]

Fears aka insider information came true guys!

Update on Meta’s Year of Efficiency

Here’s the timeline you should expect: over the next couple of months, org leaders will announce restructuring plans focused on flattening our orgs, canceling lower priority projects, and reducing our hiring rates. With less hiring, I’ve made the difficult decision to further reduce the size of our recruiting team. We will let recruiting team members know tomorrow whether they’re impacted.

We expect to announce restructurings and layoffs in our tech groups in late April, and then our business groups in late May. In a small number of cases, it may take through the end of the year to complete these changes. Our timelines for international teams will also look different, and local leaders will follow up with more details. Overall, we expect to reduce our team size by around 10,000 people and to close around 5,000 additional open roles that we haven’t yet hired.

So we could simplify it quite a bit by claiming there will be 15,000 jobs lost this year.

Microsoft Warns of Large-Scale Use of Phishing Kits
to Send Millions of Emails Daily

An open source adversary-in-the-middle (AiTM) phishing kit has found a number of takers in the cybercrime world for its ability to orchestrate attacks at scale.
...
An AiTM phishing attack typically involves a threat actor attempting to steal and intercept a target's password and session cookies by deploying a proxy server between the user and the website.

Such attacks are more effective owing to their ability to circumvent multi-factor authentication (MFA) protections.
...
The service-based economy that fuels such offerings can also result in double theft, wherein the stolen credentials are sent to both the phishing-as-a-service provider as well as their customers.
...
[The malware] comes with features that make it possible to set up phishing landing pages mimicking Microsoft Office and Outlook, not to mention manage campaigns from mobile devices and even use CAPTCHA checks to evade detection.
...
Microsoft said it has detected numerous high-volume phishing campaigns spanning millions of phishing emails per day from various actors that leverage the tool.

This is how it works:

• You open an email with a PDF attached to it.
  
• If opened, it will send you to a fake MS login website.
  
• It asks you to pass a Captcha challenge.
  

It's weird to see how they've included a Captcha step in their phishing scheme, but I guess many people wouldn't suspect anything from it for they've got used to clicking on pictures for several years now.

Fake ChatGPT Chrome Extension
Hijacking Facebook Accounts for Malicious Advertising

[It] creates rogue admin accounts, highlighting one of the different methods cyber criminals are using to distribute malware.

"By hijacking high-profile Facebook business accounts, the threat actor creates an elite army of Facebook bots and a malicious paid media apparatus," Guardio Labs researcher Nati Tal said in a technical report.

"This allows it to push Facebook paid ads at the expense of its victims in a self-propagating worm-like manner."

The "Quick access to Chat GPT" extension, which is said to have attracted 2,000 installations per day since March 3, 2023, has since been pulled by Google from the Chrome Web Store as of March 9, 2023.
...
The browser add-on is promoted through Facebook-sponsored posts, and while it offers the ability to connect to the ChatGPT service, it's also engineered to surreptitiously harvest cookies and Facebook account data using an already active, authenticated session.

This is achieved by making use of two bogus Facebook applications – portal and msg_kig – to maintain backdoor access and obtain full control of the target profiles. The process of adding the apps to the Facebook accounts is fully automated.
...
Fraudulent ChatGPT apps distributed via the Google Play Store and other third-party Android app stores have also been spotted pushing SpyNote malware onto people's devices.

AI-generated YouTube Video Tutorials Spreading Infostealer Malware

Threat actors have been increasingly observed using AI-generated YouTube Videos to spread a variety of stealer malware such as Raccoon, RedLine, and Vidar.

"The videos lure users by pretending to be tutorials on how to download cracked versions of software such as Photoshop, Premiere Pro, Autodesk 3ds Max, AutoCAD, and other products that are licensed products available only to paid users," CloudSEK researcher Pavan Karthick M said.
...
The information stealer ecosystem also consists of threat actors known as traffers who are recruited to spread the malware using different methods.

One of the popular malware distribution channels is YouTube, with CloudSEK witnessing a 200-300% month-over-month increase in videos containing links to stealer malware in the description section.

These links are often obfuscated using URL shorteners like Bitly and Cuttly, or alternatively hosted on MediaFire, Google Drive, Discord, GitHub, and Telegram's Telegra.ph.

In several instances, threat actors leverage data leaks and social engineering to hijack legitimate YouTube accounts and push malware, often targeting popular accounts to reach a large audience in a short span of time.