← Risky Bulletin
Loading summary
Transcript1 lines
- [00:04]
Clair Aird
The Kaleidoscope ad fraud network infects two and a half million devices a month. Germany seizes the ECKS crypto mining service, the US takes down the any proxy botnet and Chrome will use on device AI to detect tech support scams. This is the risky bulletin prepared by Catalyn Kimpanu and read by me Clair Aird today. Today is the 12th of May and this podcast episode is brought to you by Corelight. A mobile ad fraud network is installing ad fraud software on more than 2.5 million Android phones every month. The operators of the Kaleidoscope botnet have developed and published legitimate ad supported apps to Google's Play Store, but it also distributes ad fraud enabled versions of those apps via third party stores. These fraud enabled apps collect payment for ad impressions that never happened, with the fraudulent impression appearing to come from the legitimate apps. Kaleidoscope is the second ad fraud network to adopt this technique. The Confetti botnet first used it last year. In other news, German authorities have seized the service of the X cryptocurrency mining service. Blockchain investigations Firm Elliptic says 98% of funds that passed through the service were linked to criminal activity. German police expedited the seizure after the mixer announced it would shut down. Officials say they seized 8 terabytes of data and 34 million euros worth of assets. The FBI has seized the AnyProxy botnet's domain infrastructure. Authorities have also charged three Russians and a Kazakh national with allegedly running the botnet. The four are accused of hacking home routers and using them to operate the proxy service. They're believed to have made more than $46 million over two decades, according to Lumen's Black Lotus Labs, and the botnet had more than 7,000 proxies available on any given day. NATO's cyber chief says Russian cybercriminals are working with the Kremlin to cause havoc. NATO CCDCOE director Mart Norma told Estonian TV that the Kremlin uses criminal groups to make attribution difficult. He said the aim is to damage infrastructure, steal money and reduce citizens trust in local government. A threat actor has hacked the student engagement platform iClicker and added a malicious CAPTCHA to US university websites. The captcha instructed visitors to copy and paste commands into the Windows command prompt. The captcha was live on all iClicker portals for five days in April. Recent hacks against Japanese brokerage accounts have resulted in fraudulent trades of close to $2 billion. Hackers have been breaking into accounts to manipulate stock prices, using the account holders assets. Japanese financial authorities say. More more than 6,000 accounts have been hacked this year. The volume of trades is triple the $700 million figure that was initially reported in April. Meanwhile, hackers have stolen data from education platform Pearson. The incident took place in early May, and the company says it appears most of the stolen data was old. This is the company's second security breach this year. Google will pay Texas a $1.4 billion settlement for collecting biometric data and tracking users, geolocation and incognito sear researchers. The settlement agreement puts an end to two lawsuits filed by Texas in 2022. The state also secured a $1.4 billion settlement from Meta last year after the company collected facial scans from users without their permission. The Wikimedia foundation has filed a lawsuit against the UK government over its implementation of the Online Safety Act. The law will require Wikimedia to verify the identity of Wikipedia users starting next year. The foundation privacy is essential to keeping users safe, it said. Some users rely on anonymity in countries with authoritarian governments. Philippine authorities have detained 31 people in a raid of an online scam centre in Makati City. All suspects are foreigners and most are Chinese nationals. Officials said they were acting on a presidential directive to crack down on international cybercrime syndicates that have been setting up in the country. Irish authorities have sentenced a 43 year old man to two years in prison on cybercrime charges. Suleman Mazar ran a website that sold malware, ransomware and fake bank and credit card data. Officials arrested Mazzar in 2022. He's also pleaded guilty to money laundering. More than 8,000 automated fuel tank gauge systems are exposed on the Internet without authentication. The systems automate the monitoring of fuel tank levels, temperature and pressure. Most of the exposed system from Vitaroot, a major supplier in the US security organisation divd, says it's notified vendors and is working to advise on proper security controls. And finally, Google will use on device LLMs to detect potential tech support scams and alert Chrome users. The company says On Device LLMs will help it detect these sites faster. The current process of adding scams to the safe browsing system can take hours. The new feature is scheduled to arrive with Chrome 13037 later this month. And that is all for this podcast edition. Today's show was brought to you by our sponsor Corelight. Find them@corelight.com thanks for your company.