stolen data Archives

Tech Optimizer

June 7, 2025

CISA Warns of Rising Play Ransomware Threat to Infrastructure

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued a critical advisory on December 18, 2023, regarding the rising threat of Play Ransomware, which targets various organizations, particularly critical infrastructure and public sector entities. The advisory details the tactics used by Play Ransomware actors, including exploiting unpatched systems and phishing campaigns, leading to severe consequences like data encryption and high ransom demands. The ransomware can disable antivirus software and exfiltrate sensitive data before encryption. Play Ransomware employs double extortion tactics, threatening to leak stolen data if ransoms are not paid. CISA recommends organizations prioritize patch management, implement multi-factor authentication, train employees to recognize phishing attempts, and maintain regular offline data backups. The advisory calls for collaboration between public and private sectors to combat this threat and emphasizes the importance of information sharing to stay ahead of ransomware tactics.

Tech Optimizer

May 23, 2025

Cloudflare, Microsoft & police disrupt global malware service

Cloudflare, in collaboration with Microsoft and international law enforcement, has dismantled the infrastructure of LummaC2, an information-stealing malware service. This initiative led to the seizure and blocking of malicious domains and disrupted digital marketplaces used by criminals. Lumma Stealer operates as a subscription service providing threat actors access to a central panel for customized malware builds and stolen data retrieval. The stolen information includes credentials, cryptocurrency wallets, and sensitive data, posing risks of identity theft and financial fraud. Lumma Stealer was first identified on Russian-language crime forums in early 2023 and has since migrated to Telegram for distribution. Its proliferation is facilitated by social engineering campaigns, including deceptive pop-ups and bundled malware in cracked software. Cloudflare implemented measures to block access to Lumma's command and control servers and collaborated with various authorities to prevent the criminals from regaining control. Mitigation strategies for users include restricting unknown scripts, limiting password storage in browsers, and using reputable endpoint protection tools. The operation has significantly hindered Lumma's operations and aims to undermine the infostealer-as-a-service model contributing to cybercrime.

Winsage

May 22, 2025

Microsoft says Lumma password stealer malware found on 394,000 Windows PCs

Microsoft, in collaboration with law enforcement, has taken legal action against the Lumma malware operation, which has affected over 394,000 Windows PCs globally, particularly in Brazil, Europe, and the United States. A federal court authorized the seizure of 2,300 domains used as command and control servers for Lumma, and the Justice Department confiscated five additional domains related to its infrastructure. Lumma is primarily spread through questionable games or cracked applications and extracts sensitive information such as logins, passwords, credit card details, and cryptocurrency wallets, which is then sold to other cybercriminals. Lumma also facilitates the deployment of additional malware, including ransomware, and has been linked to significant cyberattacks on major tech companies like PowerSchool and Snowflake, resulting in substantial data theft.

AppWizard

May 8, 2025

Messaging App Used by Trump Admin Hacked – Attacker May Have Stolen Data From Hundreds of Government Employees: Report

A hacker breached TeleMessage, a messaging app used by members of the Trump administration and US government officials, in a quick attack that reportedly took 15 to 20 minutes. The breached materials included sensitive data related to Customs and Border Protection (CBP) and cryptocurrency exchange Coinbase. A screenshot from the control panel showed names, phone numbers, and email addresses of CBP employees, indicating access to data of hundreds of US government personnel. Michael Waltz, the recently dismissed national security adviser, was noted to have used TeleMessage during a cabinet meeting.

Winsage

May 7, 2025

Play ransomware exploited Windows logging flaw in zero-day attacks

The Play ransomware gang exploited a critical vulnerability in the Windows Common Log File System, identified as CVE-2025-29824, to execute zero-day attacks, gaining SYSTEM privileges and deploying malware. Microsoft recognized this flaw and issued a patch during last month's Patch Tuesday. The gang targeted sectors including IT and real estate in the U.S., the financial sector in Venezuela, a Spanish software company, and retail in Saudi Arabia. They used the PipeMagic backdoor malware to deploy the CVE-2025-29824 exploit and install ransomware payloads. Symantec's Threat Hunter Team linked these activities to the Play ransomware-as-a-service operation, noting the use of the Grixba infostealer tool. The Play ransomware group, active since at least June 2022, employs double-extortion tactics and has compromised approximately 300 organizations globally as of October 2023. Notable victims include Rackspace, Arnold Clark, the City of Oakland, Dallas County, Antwerp, and Microchip Technology.

Tech Optimizer

April 18, 2025

Breached Identities and Infostealers: One of the Largest Ongoing Data Leak in History

Breached identities due to infostealer malware are a significant threat to corporate information security in 2024. Infostealers are a type of remote access trojan that exfiltrate sensitive data, including saved credentials, session cookies, browser history, crypto wallet information, screen captures, and host data. Infections often stem from downloading cracked software, malicious advertising, fake Windows updates, and repackaged games. Infostealers do not require local administrative privileges, making them easy to execute. Threat actors primarily aim to profit from breached bank accounts and crypto wallets, often bypassing multi-factor authentication by targeting session cookies. They also seek credentials for subscription services and corporate access. Research shows that 90% of breached companies had leaked corporate credentials in a stealer log, with 78% experiencing leaks within six months of a breach. In comparison, 76% of similar companies without breaches had experienced a corporate stealer log compromise. The investigation identified high-criticality credentials from various corporate applications, indicating that a single user often has access to multiple credentials. The rise of infostealer malware represents a broad threat, encompassing a wide range of sensitive data. Organizations are advised to implement strategies such as restricting download privileges, avoiding illegal content, disabling macros, and regularly updating software to mitigate risks associated with infostealer malware.

AppWizard

April 1, 2025

Google’s Play Store Warning—Do Not Update This Setting

A sophisticated trojan named TsarBot is targeting over 750 legitimate banking and shopping applications on Android devices. It overlays a counterfeit login screen on real apps to capture user credentials. TsarBot is believed to have Russian origins and can remotely control the device's screen, simulating user interactions and capturing device lock credentials through a deceptive lock screen. The trojan is typically installed from phishing websites, where a dropper application delivers the TsarBot APK file. Once installed, it disguises itself as the Google Play Services app and urges users to enable Accessibility services. Users are advised to avoid installing apps from outside the Google Play Store, ensure Play Protect is enabled, and only enable Accessibility Services when necessary to mitigate risks.

AppWizard

March 26, 2025

Devious new Android malware uses a Microsoft tool to avoid being spotted

Cybercriminals are using legitimate software tools to create deceptive Android applications that steal sensitive user information. McAfee's findings indicate that hackers are exploiting the .NET MAUI framework to develop sophisticated malware that can evade traditional antivirus detection. The malware uses a multi-stage dynamic loading process, incrementally loading and decrypting code, making it difficult for security software to identify the applications' true nature. Hackers add extraneous settings and permissions to confuse security scanners and use encrypted communications for data transmission instead of standard internet requests. These malicious applications are not found in reputable app stores like Google Play but are distributed through unofficial app stores, often accessed via phishing links. Examples include a counterfeit banking app and a fraudulent social networking service targeting the Chinese-speaking community. The main goal of these apps is to secretly extract user data and send it to the attackers' servers. Users are advised to download apps only from official repositories and to be cautious by reviewing user feedback before installation.

AppWizard

March 11, 2025

PlayPraetor Malware Targets Android Users via Fake Play Store Apps to Steal Passwords

A malware campaign called PlayPraetor has been identified by cybersecurity firm CTM360, involving counterfeit Google Play Store websites that trick users into downloading malicious Android applications. These apps are advanced banking Trojans that steal sensitive information, including banking credentials and clipboard data. The operation spans over 6,000 fraudulent web pages designed to mimic the official Play Store, prompting users to install APK files that contain the PlayPraetor Trojan. This malware can log keystrokes, capture screen content, and monitor clipboard activity. Distribution occurs mainly through Meta Ads and SMS messages, exploiting psychological triggers to deceive users. The malware communicates with a command and control server to target specific banking and cryptocurrency wallet applications. The attackers aim for financial gain by draining compromised accounts, executing unauthorized transactions, and potentially engaging in ad fraud. The operation is particularly focused on South-East Asia, and users are advised to download apps only from the official Google Play Store and to maintain updated security software.

Winsage

February 19, 2025

Snake Keylogger Variant Hits Windows, Steals Data via Telegram Bots

Cybersecurity experts at FortiGuard Labs have identified a new variant of the Snake Keylogger, known as AutoIt/Injector.GTY!tr, which targets Windows users and has blocked over 280 million infection attempts worldwide, particularly in China, Turkey, Indonesia, Taiwan, and Spain. The malware spreads primarily through phishing emails with malicious attachments or links and focuses on popular web browsers to steal sensitive information by logging keystrokes, capturing credentials, and monitoring clipboard activity. It exfiltrates data to its command-and-control server via email and Telegram bots. The malware uses AutoIt scripting to create standalone executables that evade antivirus detection. It installs itself by dropping "ageless.exe" in the %Local_AppData%supergroup folder and "ageless.vbs" in the %Startup% folder to ensure persistence. The malware employs process hollowing to inject its payload into a legitimate .NET process, allowing it to hide from detection. Additionally, the Snake Keylogger can retrieve the victim’s geolocation and extract sensitive information from browser autofill systems, including credit card details. It utilizes various techniques for data collection, credential access, defense evasion, and exfiltration, posing a significant threat to Windows users.