← Cybersecurity Today
Cybersecurity Today
New Phishing Scam Uses Authentic PayPal Address: Cyber Security Today February 26, 2025
00:09:59
In this episode, host Jim Love covers a $1.5 billion Ethereum heist attributed to the North Korean Lazarus Group, Google's shift from SMS to QR codes for multifactor authentication, a massive botnet targeting Microsoft 365 accounts, and new phishing...
Loading summary
Transcript1 lines
- [00:01]
Jim Love
Hey, just a heads up, I'm off on holiday for the next week. I have a long weekend of nothing but playing and writing music. I should have the weekend show pre recorded but there will be no Friday or Monday podcast. I'll be back on March 5th with our regular show 1.5 billion bybit heist attributed to North Korean Lazarus Group Google replaces SMS authentication with QR codes to enhance security massive botnet targets Microsoft365 accounts with stealthy password spraying attacks and scammers exploit PayPal's new address feature to send phishing emails. This is Cybersecurity Today. I'm your host Jim Love. In a record setting Cyber Heist, approximately $1.5 billion in Ethereum was stolen from the cryptocurrency exchange Bybit. Investigations have linked the attack to North Korea's notorious Lazarus Group. The breach occurred during a routine transfer of Ethereum from Bybit's cold wallet to a warm wallet. Now for those who don't know, and I might be oversimplifying, cold wallets are offline storage, often kept isolated from the Internet, except for transfers of this type to the warm wallets that are used for regular transactions. Now, somehow the attackers manipulated the user interface, making it appear that the funds were being sent to the correct address. But they alter the underlying smart contract logic, redirecting the assets to an address under their control. Security firm Check Point suggests that the hackers might have compromised devices of multisig signers, those authorized to approve transactions, possibly through malware, phishing or even supply chain attacks. Bybit has assured its users that their assets remain secure and that the company maintains full solvency. To date, nearly $43 million of the stolen funds have been recovered, thanks to the SW action of various cryptocurrency services who froze the illicit assets. And Bybit has also launched a recovery bug bounty program, offering up to 10% of the reclaimed amount to individuals who assist in retrieving the stolen funds. Multiple cybersecurity firms and experts have attributed the heist to the Lazarus Group, a hacking collective with strong ties to the North Korean government. This group has a notorious history of executing significant cryptocurrency thefts, often to fund state activities. So this incident underscores the vulnerabilities inherent in digital asset platforms, even those employing cold wallets and multi signature authorization. It highlights the necessity for continuous advancements in security protocols to safeguard against increasingly sophisticated cyber threats. Not only do these exchanges have to revisit their security infrastructure, the speed at which these stolen assets can be transferred, and Laundered requires some means of ensuring collaboration and maybe even policing these various exchanges. Google is phasing out SMS text messages for multi factor authentication in favor of more secure QR codes. The change aims to address the security vulnerabilities associated with SMS based authentication. Introduced in 2011, SMS based one time passcodes have been a staple for Gmail users. However, the method has faced criticism due to security concerns. Attackers have exploited weaknesses in the signaling system 7 protocol to intercept SMS messages and SIM swapping attacks have allowed fraudsters to hijack phone numbers, gaining unauthorized access to accounts. In 2016, the National Institute of Standards and Technology or NIST, recommended discontinuing SMS for multi factor authentication due to these vulnerabilities. Beyond security issues, SMS authentication has been susceptible to traffic pumping schemes. In these scams, malicious actors generate unnecessary SMS messages to numbers they control, incurring significant costs for service providers. Elon Musk reportedly highlighted this issue in 2024, noting that such schemes cost Twitter $60 million annually in SMS fees. So to combat these challenges, Google will implement QR code based authentication over the next few months. Instead of receiving a six digit code via sms, users will scan a QR code with their smartphone's camera app to verify their identity. This method reduces reliance on potentially vulnerable SMS channels and enhances overall account security. While SMS may still be used in certain scenarios for identity confirmation, the primary authentication process will transition to QR codes. A botnet comprising over 130,000 compromised devices is executing a large scale password spraying attack against Microsoft365 accounts exploiting non interactive sign ins with basic authentication. This allows attackers to bypass multi factor authentication and evade detection by security teams. Non interactive sign ins operate in the background to keep users logged in for things like mobile applications, web applications and across multiple web pages and even desktop apps that require continuous access to cloud resources. We don't see them and we don't think about them, but those that pass just a text for a login are inherently insecure and password spraying involves attempting common passwords across numerous accounts, aiming to gain unauthorized access without triggering account lockouts. Now, by utilizing these non interactive sign ins, the process where automated systems authenticate without direct user input, attackers can perform high volume attempts undetected. The tactic is particularly concerning as it can bypass MFA and conditional access policies even in well secured environments. The infrastructure supporting this botnet includes command and control servers hosted in the United States with proxies operated through cloud providers linked to China. The botnet systematically uses stolen credentials from infostealer logs to target a wide range of M365 accounts, minimizing account lockouts while maximizing the probability of compromise. Security Scorecard, who detected and reported this activity after inspecting the failed login says, as we have seen direct evidence of this behavior in our non interactive sign in logs, we encourage Anyone operating an M365 tenant to immediately verify whether they're affected and if so, to rotate credentials belonging to any organization accounts in the logs. Microsoft, who began replacing basic authentication in 2021, say they will have it fully replaced by September 2025. Cybercriminals have found a way to misuse PayPal's new address feature, sending legitimate looking emails from serviceay to unsuspecting users. In fact, they use this actual address to get by automated checking, these emails falsely confirm the addition of a new shipping address and mention a high value purchase. An example is usually something like a MacBook M4. That's enough to get people concerned, and recipients are urged to call a provided phone number if they did not authorize the transaction. When you get the person on the line, you'd be tricked into downloading a software program, which leads to your eventual compromise. But how do they do this? The folks at Bleeping Computer dug into it and found that scammers log into their own PayPal accounts and they add a new shipping address in the address fields. They insert the fraudulent message about high value purchase and include a phone number controlled by the scammer. PayPal automatically sends a confirmation email to the scammer's registered email address acknowledging the addition of the new address. Now here's where they've been really clever. The scammer's email account is set to automatically forward confirmation emails to a mailing list of potential victims. Now, since the original email comes directly from PayPal's servers, it now appears authentic and bypasses spam filters and other protection. Concerned recipients, believing their account has been compromised, call the provided phone number. Then scammers use that to gain remote access to the victim's device under the guise of assisting with account security. Now this is a pretty tough one to spot, but it could be avoided if proper cybersecurity vigilance was in place. Our colleagues need to be trained. You never use the number provided in an email, nor do you follow a link in an email. You always go back directly to the real app or service. And of course, nobody should ever be allowed to be talked into loading software onto their machine unless they are absolutely certain it's legitimate. There's a saying in carpentry which is measure twice, cut once. And that maybe could be applied to cybersecurity. Validate twice before you do anything. And if it feels vaguely uncomfortable, validate again. And that's our show. Remember, I'll be off till mid next week, but I'll talk to you again next Wednesday morning. Fresh and back from the land of rock and roll. I'm your host, Jim Love. Thanks for listening.