Stalkerware dealer mSpy breached for the third time • Sign in

Infosec in brief Industrial spyware maker mSpy has once again been breached and the leaked data may have exposed hundreds of thousands of customers as well.

mSpy confirmed on Have I Been Pond on July 11, in which the web page revealed that hacktivists were responsible for the plundering of thousands and thousands of Zendesk support tickets from patrons unable to use the tool.

mSpy is commercially advertised for programs, including allowing parents and partners to eavesdrop on the agent to their group members. Due to its availability as a smartphone app, it is often called a “stalkerware” app.

The mSpy access on Have I Been Pwned reads, “Containing over 142GB of user data and support tickets, as well as 176GB of over half a million attachments, the data includes 2.4M unique email addresses, IP addresses names and photos.” Web page attachments included display screen photos of economic transactions, bank card photos or even some nude selfies.

Several other people on the breach checklist were contacted and the validity of their information was confirmed, as has been reported elsewhere.

The mSpy breach so far in 2015 saw nearly 400,000 customers’ information published on the black internet – messages, payment details, account credentials, pictures and more were dumped online. In 2018 the company was once again breached, exposing several million additional customer data.

mSpy isn’t the only stalkerware corporate to undergo an information breach: LetMeSpy’s clash was so draining in 2023 that it poorly shut down, and a similar fate befell pcTattletale, which closed store on the same day with a matching experience. done.

Well-oops: Linksys routers are sending plain-text information to Amazon

One might expect that a $170 Wi-Fi mesh router would be available in such quantities that it could not broadcast SSIDs, passwords, and access tokens in the slightest text around the world – but here we are.

According to consumer advocates at Belgian non-profit Test Oncoop, the Linksys Velop Pro Wi-Fi 6E and 7 series routers are doing just that, and have been observed sending all that data in one simple text to all routers in Belgium. For AWS servers in the US.

Those consultation tokens are particularly concerning, take a look at Ankuap as mentioned, as they can be easily exploited with a man-in-the-middle attack.

If you have one of the most compromised routers, it’s best to change that SSID and password asap, and if you’re doing that why not update your router firmware too?

Twilight Pattern…Black Patterns All Over

A global overview of the “dark patterns” that show up in the information and privacy that customers leave on apps and Internet sites has found what you can probably already guess: They’re all over.

“Nearly 76 percent of the sites and apps examined as part of the review used at least one potential dark pattern, and nearly 67 percent used multiple,” the FTC warned in a forthcoming overview with its friends at World Client Coverage. Possible dark pattern used.” enforcement community and the international privacy enforcement community.

The trio reviewed 642 Internet sites and apps in more than one language, finding that two patterns were dominant. The FTC claims that secretive practices, withholding very important knowledge within the process until too late, would make future interface interventions unremarkable even when potential options are framed in a way that directs patrons.

The file did not decide whether any of the patterns uncovered rose to the extent of illegality, so the prosecution would not take up the exercise.

Malware Necromancer revives IE in brochure attack

When we reported a vulnerability in Windows MSHTML Patched Ultimate Speed ​​that was under active exploitation, we didn’t realize it was a brochure trick to do so, but according to Checkpoint that is exactly the case.

The flaw that is being exploited – a spoofing vulnerability that provides attacker code execution features on the victim’s device – is carried out by elevating Internet Explorer from its residence inside Windows and using it through less-than-secure access. going. The nature of inserting rogue HTML software.

Even worse than using IE for your disgusting painting is the fact that Checkpoint mentions that it discovered the article as early as 2023 – so it is on the market for the foreseeable future.

Akira ransomware team targets Latin American airlines

BlackBerry security researchers are delivering an ultimatum of a potentially untouched target for ransomware actor Akira: Latin American Airways.

BlackBerry reported on the move that a blackmail actor armed with Akira ransomware (it is offered as a provider) infiltrated the programs of an unnamed airline, stole a lot of information and held the programs ransom. BlackBerry’s file did not mention whether the ransom was paid.

The researchers said the general goal of the attack “highlights the group’s desire to target other regions if an organization fails to patch exposed exploits used by the actor.”

As mentioned, it’s worth noting how the breach occurred: BlackBerry said, “The internal software was also seriously out of date, leaving major vulnerabilities that were exploited by the threat actor following the Perimeter breach.” ”

Please just keep your programs in your pocket. We’d hate to write about what happens when you don’t.