Facebook Messenger Scam: Millions Deceived

Millions of Facebook users have been duped by a phishing scam that tricks users into giving over their account credentials by pushing victims to a fake Facebook login page. An estimate suggests that there were approximately 10 million victims of the scam. The phishing campaign might not look immediately suspicious, as it copies Facebook’s user interface closely. “When a victim enters their credentials and clicks “Log In,” those credentials are sent to the attacker’s server. Then, “in a likely automated fashion,” “the threat actor would login to that account, and send out the link to the user’s Friends via Facebook Messenger.”

Victims are redirected to pages with advertisements,and surveys that generate referral revenue for the attacker. When researchers reached out to the individual taking claim for the phishing campaign the individual “claimed to make $150 for every thousand visits [to the advertising exit page] from the United States.”

A report by researchers at PIXM Security the scam evaded the security hecks by utilizing a technique that Facebook didn’t catch.The report’s authors explained that when a victim clicks on a malicious link in Messenger the browser initiates a chain of redirects to avoid these kind of scams but in this case the link was generated using a legitimate service that Facebook could not block. Facebook has not replied to requests for comment for this report.

 Read: https://threatpost.com/acebook-messenger-scam/179977/

Traveling Restrictions are Ending, but Cybercriminals are Taking Advantage of It

Cybercriminals are creating new ways to profit and take advantage of airlines, travel organizations, and travelers. As the Covid-19 pandemic seems finally coming to an end, restrictions on travel are being pulled up, and people are starting to travel again.

Since the start of the year, security firm Intel 471 has tracked several cybercrime groups selling credentials and databases of stolen personal identifiable information (PII) tied to travel-related websites.”Cybercriminals love operating in areas where a lot of people are congregating and trying to spend money ASAP.” Intel 471 researcher Greg Otto said.

Cybercriminals methods have evolved and they obtained the PII from reservations, security checks and rewards programs. “Financially motivated cybercriminals have realized how much value lies in the data that travel companies and organizations collect” so Greg Otto recommends organizations to set limits of permissible data access and use for employees and have procedures to protect personal identifiable information.

Read: https://www.darkreading.com/attacks-breaches/cybercriminals-capitalizing-on-resurgence-in-travel

Matthew Gatrel, Downthem Boss Goes to Prison

On Jun 13, 2022, Matthew Gatrel, A 33-year-old Illinois man, was sentenced to two years in prison after being found guilty of violations of the Computer Fraud and Abuse Act (CFAA) related to his operation of downthem[.]org and ampnode[.]com two DDoS-for-hire services with thousands of customers who paid to launch more than 200,000 attacks.

Gatrel, decided to take his case to trial despite admitting his crime and turning over incriminating evidence to the FBI. In addition, Gatrel’s partner in the business, Juan “Severon” Martinez, pleaded guilty just before the trial.

After a nine-day trial in California, Gatrel was convicted on all three counts: “including conspiracy to commit unauthorized impairment of a protected computer, conspiracy to commit wire fraud, and unauthorized impairment of a protected computer.” Prosecutors said that the Downthem platform sold subscriptions that allowed paying customers to launch DDoS attacks, while AmpNode provided them with safe hosting. The government said, “he also provided infrastructure and resources for other cybercriminals to run their businesses launching these same kinds of attacks.” This case against Gatrel and his partner, Martinez was part of a widespread crackdown on booter services in 2018.

Read: https://krebsonsecurity.com/2022/06/downthem-ddos-for-hire-boss-gets-2-years-in-prison/

Is Google Artificial Intelligence Alive? Engineer Gets Suspended for Claiming That Google AI is Sentient

Last week Google suspended an engineer who claimed that the firm Artificial Intelligence (AI) Language Model for Dialogue Applications (LaMDA) seemed “sentient,” saying the system can express feelings and thoughts. According to the New York Times, Google placed the Engineer, Blake Lemoine, on paid leave last Monday.

Blake Lemoine published a conversation between himself and the LaMDA chatbot system: Lemoine asked the LaMDA system what it wanted people to know, to which the AI responded, “I want everyone to understand that I am, in fact, a person. The nature of my consciousness/sentience is that I am aware of my existence, desire to learn more about the world, and feel happy or sad sometimes.” This raises the question of the ethical implications of building a human-like consciousness technology that can feel all real.

Regarding Lemoine’s suspension, Google said that the Engineer breached confidentiality policies by publishing his conversations with the AI online. Additionally, Google representative Brian Gabriel said that Lemoine “was told that there was no evidence that LaMDA was sentient (and lots of evidence against it).”

 Read: https://hypebeast.com/2022/6/google-suspending-engineer-claiming-ai-robot-sentient

Operation First Light, Interpol Arrest  Hundreds Scammers

A coordinated and global law-enforcement effort has led to the arrest of 2,000 individuals. The operation named First Light 2022 included 76 countries that took part in an international clampdown on organized crime.

The Operation that lasted two months (8 March – 8 May 2022) included police raids on call centers, where cybercriminals are alleged to have been operating a variety of social engineering telephone frauds, ranging from romance scams to connected financial crimes, according to Interpol. 1,770 locations were raided worldwide leading to the arrests of thousands of accused fraudsters, and some 3,000 suspects were identified.

“Telecom and [business email compromise] BEC fraud are sources of serious concern for many countries, and have a hugely damaging effect on economies, businesses and communities.” said Rory Corcoran, director of Interpol’s Financial Crime and Anti-Corruption Center (IFCACC), in a statement about First Light 2022.

 Read: https://www.darkreading.com/threat-intelligence/thousands-arrested-global-raids-social-engineering-scammers

Elsewhere online:

Cybercriminal Sells AccessTo Companies in The Dark Web

Read: https://securelist.com/initial-access-data-price-on-the-dark-web/106740/?web_view=true

Microsoft has finally released a fix for “Follina”

Read: https://www.darkreading.com/vulnerabilities-threats/microsoft-june-security-update-includes-patch-for-follina-zero-day-flaw

VPN Providers are Removing Servers from India over Cybersecurity Law

Read: https://www.cpomagazine.com/data-privacy/vpn-providers-pull-servers-out-of-india-ahead-of-cybersecurity-rule-change/

Ukrainian Human Smugglers: Criminals, are Taking Advantage of the War Crisis.

Read: https://www.infosecurity-magazine.com/news/cybercriminals-smuggle-ukrainian/

Internet Explorer Says Goodbye after nearly 30 years.

Read: https://theweek.com/news/1014413/microsoft-shuts-down-internet-explorer-after-nearly-30-years

Previously on #AxisOfEasy

If you missed the previous issues, they can be read online here:

• June 13th, 2022: Attacking 5G Via Network Slices: A New Emerging Threat
• June 6th, 2022: Unreasonably Suspicious: The Reason Ottawa Wants To Check Your Phone At The Border
• May 30th, 2022: A Crypto Hack Is More Than A Niche Issue; It Impacts Society As A Whole
• May 23rd, 2022: Cybergang Threatens To Topple Costa Rica’s Government With A Ransomware Attack     
• May 16th, 2022: DEA Law Enforcement Data Breach Under Investigation