We’ve seen QR codes in scams before, but those relied on people scanning them. @socket.dev's new discovery shows malware using QR codes to talk to its C2 server — traffic that to security tools looks like harmless image exchanges. www.bleepingcomputer.com/news/securit... #malware #opensource #npm

Self-propagating supply chain attack on 187 npm projects also hit CrowdStrike's namespace. Statement from CrowdStrike 👇 www.bleepingcomputer.com/news/securit...

Google has disputed a widely reported story about the company warning all Gmail users to reset their passwords due to a recent data breach that also affected some Workspace accounts.

Booking[.]com phishing campaign uses sneaky 'ん' character, which can look like '/~' in some fonts, to trick you and deliver #malware. Another creative use of homoglyphs by threat actors. www.bleepingcomputer.com/news/securit...

Law enforcement has delivered a $1 million-sized headache to a Russian ransomware gang. BlackSuit (formerly "Royal") has been tormenting over 450 US organisations across critical sectors such as healthcare, education, public safety, energy, manufacturing, and government.

Looking like a busy Wednesday for National Bank www.bleepingcomputer.com/news/technol...

npm has "accidentally" taken down all versions of the legitimate Stylus library and replaced them with a "security holding" page, breaking pipelines and builds worldwide. bleepingcomputer.com/news/securit... #opensource #supplychain #javascript

New, by me: Scott Zuckerman, a spyware founder who was banned from the surveillance industry by the FTC after one of his spyware companies had a data breach, now wants the FTC to *unban* him. Zuckerman claims the cybersecurity requirements put on him after the breach are an "unnecessary burden."

🎞️ All day: Exposing cybercrime and the latest hacks targeting real people for Rip-Off Britain @ BBC Studios, MediaCityUK.

Exclusive: Instagram ads appearing to be from Bank of Montreal (BMO) are using AI deepfake videos of finance experts to scam consumers into investment fraud. Ads for 'EQ Bank' take users to phishing domains to collect their banking information. www.bleepingcomputer.com/news/securit...

The £2M scam operation that conned British people looking to get European EHIC health coverage cards that are otherwise free. 🎬 Watch on-demand or online @ Channel 5 UK: 📺 Scams: Don't Get Caught Out. Season 3.

Google has announced that it's retiring separate country code top-level domain names like google.co.uk or google.com.br and redirecting users to Google.com.

Atlassian users are experiencing degraded performance amid an 'active incident' affecting multiple Jira products since morning hours today. Jira, Jira Service Management, Jira Work Management and Jira Product Discovery are among the impacted products.

Fake VS Code extension on npm uses altered ScreenConnect utility as spyware www.sonatype.com/blog/fake-vs... #malware #opensource #npm

A new campaign dubbed 'SparkCat' has been uncovered, targeting the cryptocurrency wallet recovery phrases of Android and iOS users using optical character recognition (OCR) stealers.

European Space Agency's online shop hacked this week to quietly load JavaScript that generates fake Stripe payment form at checkout 💳 via @sans.ec @ionila.bsky.social www.bleepingcomputer.com/news/securit...

npm packages from Rspack and Vant compromised via compromised #npm tokens. Ensure you are not running a compromised version and remember to scan your systems for signs of compromise. www.sonatype.com/blog/npm-pac...

Exclusive: The backdoor inserted in v1.95.7 adds an "addToQueue" function which exfiltrates the private key through seemingly-legitimate CloudFlare headers. Calls to this function are then inserted in various places that (legitimately) access the private key.

UK completes its rollout of e-visas. Biometric Residence Permit (BRP) holders should switch to an e-visa ASAP. "Expired documents will be valid for international travel for a limited time into 2025" advises Home Office to the press. www.gov.uk/get-access-e...

Let's see how this one goes 🍿 news.sky.com/story/austra... "The law will make social media platforms liable for fines of up to 50 million Australian dollars (£25m) if they don't systemically stop children younger than 16 from holding accounts."

We found X is allowing blue-ticked users to promote links to websites apparently selling child sex abuse videos. Verified users pay a monthly fee to boost their profiles in the algo. X says verification is done to ensure “the integrity” of the site but these accounts got tens of thousands of views.

💡Enjoy a Free Forum as part of Free Post Friday Forum: ReBreached Clearnet: rebreached[.]vc Dark Web: rebreachkpk2puirm3gwje7hatarklyyvddmose74vycsjvfitnousyd[.]onion

No one gets promoted for removing chaos or saying no to prematurely built artifacts that are guaranteed to drag the company down. Until this culture doesn't change, I don't expect anything to change.

It didn't take long for crypto scammers to infiltrate BlueSky as the platform crosses 20M mark. BlueSky Safety team confirms being slammed with 3,000 user reports an hour as it moderates unwanted content. www.bleepingcomputer.com/news/securit...

Amazon, Amazon Music, and Audible, an Amazon-owned online audiobook and podcast service, have been flooded with bogus listings that push dubious "forex trading" sites, Telegram channels, and suspicious links claiming to offer pirated software. www.bleepingcomputer.com/news/securit...

Spotify playlists are being abused to push pirated software, game cheats, and illicit "warez" sites. Threat actors also benefit from SEO boost for their dubious online properties, since #Spotify's web player results appear in search engines like Google. www.bleepingcomputer.com/news/securit...

The client-side 1,000 character limit bypass though 😬🔥 Actively abused by sextortion scammers. www.bleepingcomputer.com/news/securit...

GitHub projects targeted with malicious commits to frame security researcher www.bleepingcomputer.com/news/securit...

Seeing Google's search[.]app links on your Android and iPhone? Here's why www.bleepingcomputer.com/news/securit...

Anybody here?