Android: DoubleLocker ransomware encrypts data and changes PINs
A new breed of Android ransomware has been discovered that hits victims with a double whammy. DoubleLocker not only encrypts data as all ransomware does, it also changes the PIN on the target device.
DoubleLocker was discovered by security researchers at ESET. They say that the ransomware abuses Android accessibility settings, and is the first to use a double-lock approach. Based on previously released banking malware, it is though that a test version of DoubleLocker could have been in the wild since as early as May.
FormBook malware attacks target US and South Korea
High-volume FormBook malware distribution campaigns have targeted businesses in the aerospace, defense contractor and manufacturing sectors according to new research from cybersecurity company FireEye.
The attackers behind these campaigns employed a variety of delivery methods to distribute this information stealing malware including PDFs with download links, DOC and XLS files which contained malicious macros and ZIP, RAR, ACE and ISO archive files containing executable payloads.
PornHub users hit by sustained, targeted malvertising campaign
Millions of PornHub users in the US, UK, Canada and Australia were targeted by a malicious advertising campaign lasting for more than a year. The malvertising attack tried to trick users of the world's most popular porn site into installing fake browser updates.
Security researchers from Proofpoint found that PornHub users had been exposed to Kovter ad fraud malware for over a year. The KovCoreG group is believed to be responsible for distributing the Kovter ad fraud malware, so if you've visited PornHub recently, it might be a good idea to check your system for signs of infection.
Cloudflare ditches sites that use Coinhive mining code after classing it as malware
Bitcoin has been in the news for some time now as its value climbs and drops, but most recently interest turned to mining code embedded in websites. The Pirate Bay was one of the first sites to be seen using Coinhive code to secretly mine using visitors' CPU time, and then we saw similar activity from the SafeBrowse extension for Chrome.
The discovery of the code was a little distressing for visitors to the affected sites, and internet security and content delivery network (CDN) firm Cloudflare is taking action to clamp down on what it is describing as malware.
Dirty COW Linux vulnerability reappears as ZNIU malware threat to Android users
It has been quite some time -- nearly a year in fact -- since we were talking about the Dirty COW vulnerability affecting the Linux kernel. Now the vulnerability is back, but this time it is Android users who need to be concerned.
The privilege escalation vulnerability has been exploited by a piece of malware by the name of ZNIU, or AndroidOS_ZNIU. The malware uses the Dirty COW exploit to root devices and install a backdoor which can then be used to collect data and also generate profit for the attackers through a premium rate phone number.
Ransomware attacks affect five percent of SMBs
Five percent of all small and medium-sized companies in the entire world were victims of a ransomware attack in 2016 alone, with the money paid out to reclaim data reaching new highs, new research has revealed.
Datto's new State of the Channel Ransomware Report found that an estimated $301 million (£222 million) was paid to ransomware hackers from 2016-2017.
Security warning: Hackers compromised CCleaner and installed a backdoor
Users of cleanup, privacy and optimization tool CCleaner are being warned to update their software after it emerged the tool was compromised by hackers. Security researchers at Cisco Talos say that there are a "vast number of machines at risk."
CCleaner is produced by Piriform, now a subsidiary of security firm Avast, making the compromise not only serious, but also embarrassing. With 2 billion downloads -- a number that's rising at a rate of 5 million per week -- the software was targeted by hackers who added a backdoor that could be used to download malware, ransomware and keyloggers. The problem is being compared to the NotPetya ransomware threat.
Hurricanes lead to drop in malware infections
An interesting side effect of the recent hurricanes Harvey and Irma is that malware infections in the Florida and Texas areas have seen a dramatic fall.
Data released by Enigma Software Group, makers of the SpyHunter anti-malware software, shows that infections in the Houston area showed a 52.5 percent drop from the average on August 29th.
'Your Windows Has Been Banned' malware makes an unwelcome return
"Your Windows Has Been Banned" is a nasty piece of malware that first surfaced in 2016. It locks your computer screen and displays a message stating "This PC has been banned for terms of use violations."
It doesn’t go into specifics for the ban -- because, obviously, it’s not a real ban -- but simply says that your PC has been locked in order to "protect the Windows service and its members," adding "Microsoft does not provide details about specific PC bans."
Bashware attack makes Linux a security threat to Windows 10
While many people welcomed the arrival of Windows Subsystem for Linux (WSL) in Windows 10, it has been found to be a potential security issue. A new technique known as a Bashware has been discovered by security researchers that makes it possible for malware to use the Linux shell to bypass security software.
While administrator access is needed to execute a Bashware attack, this is fairly easily obtained, and the technique can be used to disguise malicious operations from antivirus software and other security tools. Researchers from Check Point Research point out that the danger stems from the fact that "existing security solutions are still not adapted to monitor processes of Linux executables running on Windows."
TheShadowBrokers group returns with NSA UNITEDRAKE hacking malware and promises more leaks
It feels as though it has been a while since we heard anything from the hacking group TheShadowBrokers. The group's latest data dump sees the release of the NSA's UNITEDRAKE exploit tool, and there's also a promise of two data dumps a month moving forward.
UNITEDRAKE is a remote access hacking tool that can be used to target Windows machines. Modular in nature, the malware can be expanded through the use of plugins to increase its capabilities so it can capture footage from webcams, tap into microphones, capture keystrokes, and more.
Google Play apps spread malware through advertising SDK
Through the use of an advertising software development kit contained in 500 apps on the Google Play Store, cybercriminals were able to spy on users and even infect their mobile devices with malware.
That's according to security firm Lookout, which discovered that the Android apps in question all had the lgexin ad SDK built into them which gave unauthorized third parties access to user devices.
PowerPoint vulnerability enables malware spreading
Researchers have discovered that cyber attackers are exploiting a vulnerability that allows them to elude antivirus software to deliver malware via Microsoft PowerPoint.
The flaw itself exists in the Windows Object Linking and Embedding (OLE) interface and attackers have previously used it to deliver infected Rich Text File (.RTF) documents. Trend Micro's researchers noticed that attackers have now infected PowerPoint files to deliver malicious code.
Malware attacks rising thanks to leaked exploits
Malware threats have reached dangerously high levels, according to a new report that highlights the sheer scale of threats facing businesses today.
The latest Kaspersky Lab Malware report, covering the three months of Q2 2017, claims that Kaspersky Lab's products blocked more than five million attacks involving exploits in this time period.
Researchers hack a computer using malware injected into DNA
Security researchers have managed to infect a computer with malware embedded in a strand of human DNA.
The news sounds like a science-fiction writer's dream, but when biologists want to handle large amounts of DNA samples, they need to digitize them and process them on their computers. But the software that they use to process these samples is usually open-source and often doesn't follow security best practices.
Recent Headlines
BetaNews, your source for breaking tech news, reviews, and in-depth reporting since 1998.
Regional iGaming Content
© 1998-2025 BetaNews, Inc. All Rights Reserved. About Us - Privacy Policy - Cookie Policy - Sitemap.