The Matanbuchus malware has been reported to initiate a new campaign, exploiting XLS files to compromise Windows machines.
This sophisticated threat, known for its loader-as-a-service model, has been active for several years and poses a risk to users worldwide.
Matanbuchus, a name that has become increasingly familiar among cybersecurity experts, has found a new method to infiltrate systems.
By leveraging malicious XLS files, the malware fetches a JavaScript (JS) file, which subsequently downloads a malicious Dynamic Link Library (DLL), marking the beginning of a potential cascade of infections.
This technique underscores the evolving nature of cyber threats and the continuous need for vigilance.
A Closer Look at Matanbuchus
Originally surfacing in 2021, Matanbuchus has not only persisted but evolved, showcasing the adaptability and persistence of cybercriminals.
DocumentIntegrate ANY.RUN in your company for Effective Malware Analysis
Malware analysis can be fast and simple. Just let us show you the way to:
Interact with malware safely
Set up virtual machine in Linux and all Windows OS versions
Work in a team
Get detailed reports with maximum data
If you want to test all these features now with completely free access to the sandbox:
As a loader, its primary function is to facilitate the download and execution of other malicious payloads, effectively acting as a gateway for further exploitation.
Its capabilities are notably sophisticated, allowing for direct memory execution of .exe or .dll files, task schedule modifications, custom PowerShell command execution, and standalone executables to load additional malicious DLLs.One of the more alarming aspects of Matanbuchus is its association with Cobalt Strike beacons.
While a legitimate penetration testing tool, Cobalt Strike has been co-opted by threat actors for malicious purposes.
The malware’s ability to drop these beacons on compromised machines significantly enhances the threat actors’ control over the infected system, enabling a wide range of malicious activities.
Broadcom has recently disclosed the Matanbuchus campaign, which involves the use of a malicious XLS file.
This campaign is designed to exploit vulnerabilities in Microsoft Excel and potentially allow threat actors to execute malicious code on target systems.
Specific identifiers such as ACM.Ps-Rd32!g1, Scr.Malcode!gen, Trojan.Gen.MBT, and Trojan. Mdropper, among others, has been deployed to recognize and neutralize threats posed by Matanbuchus.
The Importance of Vigilance
The resurgence and evolution of Matanbuchus underscore the dynamic and persistent nature of cyber threats.
Users and organizations are urged to stay informed about the latest cybersecurity developments and to adopt robust security measures to protect against such sophisticated threats.
Regular updates, cautious email handling, and the use of reputable security solutions are fundamental to maintaining a strong defense against the ever-changing tactics of cybercriminals.
You can block malware, including Trojans, ransomware, spyware, rootkits, worms, and zero-day exploits, with Perimeter81 malware protection. All are incredibly harmful, can wreak havoc, and damage your network.
Stay updated on Cybersecurity news, Whitepapers, and Infographics. Follow us on LinkedIn & Twitter.
March 8, 2024 – The flaws could allow an attacker with privileged access to a guest VM to access the hypervisor on the host.
March 8, 2024 – Users of JetBrains TeamCity on-prmises server need to deal with two serious vulnerabilities.
March 7, 2024 – Pet retail company PetSmart has emailed customers to alert them to a recent attack that used reused passwords.
March 7, 2024 – The US Treasury Department has sanctioned Predator spyware vendor Intellexa Consortium, and banned the company from doing business in the US.
March 6, 2024 – The ALPHV gang’s attempt to cover up an exit scam isn’t going well.
In a recent blog post, Meta has explained how third-party messengers will interlink with Messenger and WhatsApp. The company’s initiation into this venture follows the release of the Digital Markets Act (DMA) by the European Union, a regulation that takes effect this week. Meta says it will use its existing client/server architecture to achieve interoperability.
Meta explains how third-party messengers will safely integrate with WhatsApp
The firm claimed that this method not only meets the DMA’s requirements but also offers user security and privacy for other providers integrating with Meta. The interoperability framework has been in the works in collaboration with the European Commission for over two years.
Engadget notes that Meta will initially keep the system limited to text-based messaging, sharing images, voice notes, videos, and other document files. Group chats, calling features, and third-party app interoperability may come later.
Third-party developers looking to connect with Messenger and WhatsApp will likely have to use the Signal protocol for now. Meta currently uses Signal for end-to-end encryption (E2EE) in both apps as it is considered an industry standard. Developers may use compatible protocols if they can show they offer equivalent security guarantees to Signal.
Meta recommends caution and explains when messages remain within either the WhatsApp or Messenger ecosystems, the company controls both sending and receiving clients. This way, Meta ensures content is visible only to intended recipients. However, when messages go through third-party apps from other endpoints outside these ecosystems, Meta does not control them and cannot guarantee security.
Developers will face these limitations before crossing with WhatsApp
To integrate their apps with Messenger and WhatsApp, developers must host media files they send on their servers; WhatsApp or Messenger will then download these files via a Meta proxy service. The makers of a third-party messaging app must sign an agreement with Meta to enable interoperability.
The company commits that once it has received an onboarding request from a developer, it will try to activate interoperability with that service within three months. However, the functionality could take longer before going official publicly. Meta plans on enabling a seamless connection between its messaging apps and those from other developers while prioritizing user privacy and security. By including interoperability within its ecosystem, developers and users will have more opportunities at their disposal.
To show its prowess in the Android chipset market, MediaTek has now successfully partnered with every Android brand in the industry except Google. The Taiwanese semiconductor manufacturer has garnered its reputation with mid-range and budget Helio chipsets. Now, the company is shifting priorities, focusing mainly on high-end 5G-enabled SoCs.
MediaTek has successfully partnered with every Android manufacturer, except for Google
With previous doubts about their ability to compete against Qualcomm in the flagship market, a new report from the Economic Times suggests MediaTek’s comeback. With 15 different chipset designs created specifically for Android manufacturers (an expanded portfolio), MediaTek looks set to give Qualcomm a run for its money, especially at its most expensive prices.
Anku Jain, the Managing Director of MediaTek India, says that they now have deals with Samsung and Nothing. The only exception is Google. According to reports, Google itself is currently developing its in-house chipset called Tensor G4, which looks to be a prime component for the Pixel 9 series. However, this hasn’t stopped MediaTek’s ambition or belief that they can replace Qualcomm as the top dog.
MediaTek had an impressive first quarter of this year outpacing Qualcomm in terms of chips shipped according to a report by Economic Times. On top of that, they’re also working on a Dimensity 9400 Chipset, which should pose a serious threat to Qualcomms Snapdragon 8 Gen 4 when it launches.
Qaulcomm’s hiking prices may cause MediaTek to leap ahead in the competition
Earlier, an X leak reported that Qualcomm may be raising prices for its new chipset set to launch early next year. Resultantly, this price hike opens the door further for MediaTek’s new Dimensity 9400 Chipset, which is due for launch later this year and could offer better value for money than Qualcomm’s Snapdragon 8 Gen 4.
Morgan Stanley analyst speculates that about 35% of global smartphone chipsets will be powered by MediaTek by 2024. So it appears that Qualcomm might face some tough competition in the near future. The new entrant in the market seems to be worth considering, and it might make Qualcomm rethink its strategies.
Artificial intelligence seems to have become the main focus of many tech companies. Everyone has a chatbot these days and while this is certainly not a bad thing, it’s probably going to take some time before the AI will be used for truly meaningful tasks like discovering treatments for diseases or solutions to prevent global warming.Opera is one of the companies that invested heavily in AI. Opera One, its rather new AI-focused browser, is an attempt to offer users an innovative experience to those looking for such a product.
Over the weekend, Opera announced it’s starting an AI Feature Drops program to provide users with even more AI-powered features. Opera One’s developer version will allow users to test new AI features on a bi-weekly basis thanks to this new AI Feature Drops initiative.
AI is moving fast and so are we. We’ve started the AI Feature Drops Program to allow people to test our newest AI explorations that either will or won’t make it to the official version of Opera One. We are excited to let our most engaged users test and share their feedback and suggestions with us
Unlike other AI-centric browsers, Opera One features a native browser AI, which promises to improve the users’ browsing experience without the need for additional paid services or extensions.
Dubbed Aria, the Opera One integrated native AI offers free access to a GPT-based solution and real-time web data. Aria can also be trained to write in the user’s unique style.
Beware of phishing and malspam scams targeting your Software-as-a-Service (SaaS) logins! Cybercriminals are using fake Dropbox emails to steal login credentials. Learn how to protect yourself from this new attack and keep your data safe.
Cybersecurity firm Darktrace is warning users about a notorious new phishing and Malspam campaign targeting customers of popular Software-as-a-Service (SaaS) platforms by exploiting Dropbox emails.
Cambridge, UK-based cybersecurity firm Darktrace’s latest research reveals a new Dropbox phishing attack successfully bypassing MFA (multi-factor authentication) protocols. This exploit aims to trick users into downloading malware and exposing their login credentials.
It’s been observed that attackers send seemingly harmless emails originating from a legitimate Dropbox address, containing a malicious link. On January 25, 2024, researchers detected a suspicious email sent to 16 internal users of the Darktrace SaaS environment, originating from a legitimate email address- ‘no-reply@dropboxcom’.
Screenshot credit: Darktrace
The email contained a link to a PDF file hosted on Dropbox, possibly named after a Dropbox partner organization. The PDF file contained a suspicious link to a domain named ‘mmv-securitytop.’ Darktace’s email security tool detected and held the email, but a user received another email from a legitimate no-reply@dropboxcom on January 29, requesting to open the previously shared PDF file.
“Darktrace/Email moved the email to the user’s junk file and applied a lock link action to prevent the user from directly following a potentially malicious link,” but couldn’t prevent the damage because an employee clicked on the link.
Next, the user’s device got connected to a malicious endpoint, ‘mmv-securitytop’, leading to a fake Microsoft 365 login page. These credential harvesters, disguised as trusted organizations like Microsoft, increase the likelihood of stealing privileged SaaS account credentials.
The fake Microsoft login page – Screenshot credit: Darktrace
Since January 31, Darktrace observed suspicious SaaS activity, including logins from unusual locations and endpoints associated with ExpressVPN, suggesting threat actors are using a VPN to mask their true location.
An interesting finding was that threat actors bypassed a customer’s MFA policy using valid tokens and meeting authentication requirements. An additional login was observed from 87.117.225155, using the HideMyAss VPN service.
According to Darktrace’s blog post, the actor created a new email rule, ‘….’, to move emails to the ‘Conversation History’ mailbox folder, a tactic used by threat actors during phishing campaigns. This generic name helps maintain undetected activity on target networks.
Dropbox exploitation is gaining popularity among threat actors, as it is difficult to detect foul play because emails are sent from legitimate addresses. In September 2023, Hackread.com reported a BEC 3.0 attack campaign leveraging Dropbox to send emails redirecting users to credential-harvesting pages.
Clicking on malicious links in phishing emails can lead to malware infections, stealing of sensitive data, and compromising login credentials. In business settings, a single employee’s account can allow attackers to access the entire SaaS environment, thereby disrupting operations.
Protection Against Phishing Attacks
While relying on common sense is typically the best defence against such attacks, scammers’ increasing sophistication can sometimes override our natural caution. Therefore, it’s crucial to proactively protect yourself. Here are 5 key points to help you recognize and safeguard against email phishing:
Suspicious Sender Addresses and Email Content:
Check sender email addresses carefully for typos or misspellings of legitimate companies.
Be wary of generic greetings or an impersonal tone.
Look for grammatical errors or unusual phrasing in the email body.
Watch out for emails with a strong sense of urgency or pressure to act quickly.
Malicious Links and Attachments:
Never click on links or open attachments in emails from unknown senders.
Hover over a link to see the actual destination URL before clicking. It might not match the displayed text.
Don’t download attachments you weren’t expecting, even from seemingly familiar senders.
Phishing for Information:
Phishing emails often try to trick you into revealing personal information like passwords or credit card details.
Legitimate companies will never ask for such information via email.
Multi-Factor Authentication (MFA) and Strong Passwords:
Although, in this case, scammers bypass MFA, it is still the most preferred way to protect suspicious logins.
Enable MFA on all your online accounts whenever possible. This adds an extra layer of security beyond just your password.
Use strong, unique passwords for all your online accounts and avoid using the same password for multiple accounts.
Staying Informed and Reporting Phishing Attempts:
Keep yourself updated on the latest phishing tactics by reading security blogs or news articles.
Report suspicious emails to your email provider or the platform it impersonates. This helps them track and block future phishing attempts.
In recent months, the cybersecurity landscape has witnessed a significant evolution in ransomware attacks, with perpetrators deploying an increasingly diverse array of data-exfiltration tools.
Symantec’s latest findings reveal that attackers have utilized at least a dozen different tools for data exfiltration in the past three months alone.
This trend underscores a strategic shift towards leveraging malware and dual-use tools—legitimate software repurposed for malicious intent—to siphon data from victim organizations.
Malware analysis can be fast and simple. Just let us show you the way to:
Interact with malware safely
Set up virtual machine in Linux and all Windows OS versions
Work in a team
Get detailed reports with maximum data
If you want to test all these features now with completely free access to the sandbox:
Double Extortion: A Growing Threat
According to the Symantec report, Ransomware operators have adopted a more aggressive tactic known as double extortion. By stealing sensitive data before encrypting the victim’s files, attackers can exert additional pressure on organizations to pay the ransom.
This approach not only complicates recovery efforts for the affected entities but also increases the potential for reputational damage and regulatory scrutiny.
The Expanding Toolkit
Among the tools favored by ransomware actors, Rclone remains the most commonly used for data exfiltration.
most frequently used exfiltration tools
However, there is a noticeable rise in the use of remote administration and management tools like AnyDesk, ScreenConnect, and Atera.
Rclone: An open-source cloud management tool, sometimes exploited by ransomware actors for data theft.
AnyDesk: A remote desktop application that attackers use for unauthorized access, occasionally disguising it to avoid detection.
RDP (Remote Desktop Protocol): Developed by Microsoft, this protocol enables remote control of computers. Attackers often enable it through registry modifications and firewall rule adjustments to gain malicious access.
Cobalt Strike: A tool meant for penetration testing but commonly used by attackers for stealthy data exfiltration and establishing covert communications.
ScreenConnect: Remote desktop software by ConnectWise for computer access.
Atera: Remote monitoring software often utilized by attackers for network access.
WinRAR and similar utilities: Used by attackers for file archiving in preparation for data exfiltration.
Restic: An efficient and secure backup tool, exploited by ransomware groups like those using Noberus for data theft.
TightVNC: Open-source remote desktop software.
WinSCP: A legitimate FTP and SFTP client for Windows.
Pandora RC: Commercial remote access tool, sometimes used maliciously for information theft and deploying additional tools.
Chisel: An open-source proxy tool, abused in ransomware attacks for data tunneling to attacker-controlled sites.
PowerShell: A Microsoft scripting tool, exploited for various malicious activities including data exfiltration through commands like Compress-Archive.
These tools offer a blend of functionality that appeals to attackers, including the ability to act as a backdoor into compromised systems.
Case Study: Rclone in Action
A notable instance of Rclone’s misuse occurred during a RagnarLocker ransomware attack in July 2023. Attackers deployed Rclone to transfer data from network shares to external storage solutions, demonstrating the tool’s versatility in facilitating large-scale data exfiltration.
The initial sign of malicious behavior was the execution of PowerShell commands to deactivate Local Security Authority (LSA) protection.
Following this, the attackers utilized SoftPerfect Network Scanner (netscan.exe), a widely accessible tool, for identifying host names and network services.
On the subsequent day, their operations continued with the deployment of Mimikatz and LaZagne for credential theft.
They then employed several native tools to collect system data, backup registry hives, run commands remotely across the network, and activate Remote Desktop Protocol (RDP) to enable external access.
Protection and Mitigation Strategies
In response to these evolving threats, Symantec emphasizes the importance of robust cybersecurity measures. Organizations are advised to monitor outbound traffic for anomalies, restrict the use of dual-use tools, and implement strong identity and access management practices.
Additionally, maintaining up-to-date software and employing endpoint detection and response (EDR) tools can significantly enhance an organization’s resilience against ransomware attacks.
The diversification of data-exfiltration tools in ransomware campaigns highlights the need for continuous vigilance and adaptive security strategies.
As attackers refine their techniques, organizations must prioritize the detection and mitigation of these threats to safeguard their data and maintain operational integrity.
VMware’s ESXi, Workstation, and Fusion products could allow attackers to execute malicious code on affected systems.
Impacted VMware Products
These vulnerabilities impact the following VMware products:
VMware ESXi
VMware Workstation Pro / Player (Workstation)
VMware Fusion Pro / Fusion (Fusion)
VMware Cloud Foundation (Cloud Foundation)
VMware has acknowledged the presence of several vulnerabilities in its products after they were privately reported.
DocumentIntegrate ANY.RUN in your company for Effective Malware Analysis
Malware analysis can be fast and simple. Just let us show you the way to:
Interact with malware safely
Set up virtual machine in Linux and all Windows OS versions
Work in a team
Get detailed reports with maximum data
If you want to test all these features now with completely free access to the sandbox:
The company has released updates to address these issues in the affected software.
While each vulnerability is rated as ‘Important,’ their combined potential impact escalates to ‘Critical’ severity.
Shadowserver has tweeted a warning about vulnerabilities in VMware ESXi instances.
These vulnerabilities can enable a malicious actor with local admin privileges to bypass sandbox protections.
Shadowserver is conducting scans and sharing its findings to help mitigate the risks associated with these vulnerabilities.
We are scanning & sharing VMware ESXi instances which have vulnerabilities that could allow a malicious actor with local admin privileges to escape sandbox protections – https://t.co/RCSKJLXDHX
Tagged as “cve-2024-22252”. Based on version checks, we see ~16.5K vulnerable. pic.twitter.com/ACDw0F2ZeE
Use-After-Free Vulnerability in XHCI USB Controller (CVE-2024-22252)
A use-after-free vulnerability, CVE-2024-22252, has been found in the XHCI USB controller component of VMware ESXi, Workstation, and Fusion.
This flaw has been assigned a CVSSv3 base score of 9.3 for Workstation and Fusion and 8.4 for ESXi, indicating a critical threat level for the former and an important one for the latter.
Attackers with local administrative access to a virtual machine can exploit this vulnerability to run code as the VMX process on the host.
The attack is confined to the VMX sandbox for ESXi, but for Workstation and Fusion, it could lead to code execution on the host machine.
VMware advises users to apply the patches listed in the ‘Fixed Version’ column of their ‘Response Matrix.’
Workarounds are also provided for those who cannot immediately patch their systems.
Use-After-Free Vulnerability in UHCI USB Controller (CVE-2024-22253)
Another use-after-free vulnerability, CVE-2024-22253, affects the UHCI USB controller in the same VMware products.
It shares similar severity scores and attack vectors as CVE-2024-22252.
VMware ESXi is also susceptible to an out-of-bounds write vulnerability, tracked as CVE-2024-22254, with a CVSSv3 base score of 7.9, falling into the ‘Important’ severity category.
An attacker accessing the VMX process could exploit this vulnerability to break out of the sandbox, leading to further unauthorized actions on the host system.
VMware has released patches to address this vulnerability, but no workarounds are available.
Users are urged to apply the updates as soon as possible.
Information Disclosure Vulnerability in UHCI USB Controller (CVE-2024-22255)
An information disclosure vulnerability, CVE-2024-22255, also exists in the UHCI USB controller, with a CVSSv3 base score of 7.1.
This could allow a malicious actor with administrative access to a virtual machine to leak memory from the VMX process.
VMware extends its gratitude to the security researchers from Team Ant Lab and TianGong Team of Legends at Qi’anxin Group, as well as VictorV and Wei of Team CyberAgent for their responsible disclosure of these vulnerabilities through the 2023 Tianfu Cup Pwn Contest.
VMware product users are strongly encouraged to review the provided documentation and apply the necessary patches to ensure their systems are protected against these vulnerabilities.
You can block malware, including Trojans, ransomware, spyware, rootkits, worms, and zero-day exploits, with Perimeter81 malware protection. All are incredibly harmful, can wreak havoc, and damage your network.
Stay updated on Cybersecurity news, Whitepapers, and Infographics. Follow us on LinkedIn & Twitter.
Enterprises across the United States and Europe are on high alert as a new ransomware strain, dubbed “DoNex,” has been actively compromising companies and claiming victims.
This emergent threat has cybersecurity experts working overtime to understand the attack’s full scope and develop countermeasures.
The DoNex ransomware group has made its presence known by listing several companies as its victims on their dark web portal, accessible via the Onion network.
The group’s tactics are particularly insidious, employing a double-extortion method.
This not only involves the encryption of files, which are then appended with a unique.
VictimID extension, but also the exfiltration of sensitive data, holding it hostage to leverage additional pressure on the victims to pay the ransom.
Ransom Notes and Communication
Affected companies have discovered ransom notes named Readme.VictimID.txt on their systems, which instruct them to establish contact with the DoNex group through Tox messenger, a peer-to-peer instant messaging service known for its security and anonymity features.
DocumentIntegrate ANY.RUN in your company for Effective Malware Analysis
Malware analysis can be fast and simple. Just let us show you the way to:
Interact with malware safely
Set up virtual machine in Linux and all Windows OS versions
Work in a team
Get detailed reports with maximum data
If you want to test all these features now with completely free access to the sandbox:
The use of Tox indicates an attacker’s preference for secure communication channels, making it more challenging for law enforcement to track and intercept.
Broadcom recently spotted the emergence of a new ransomware actor, self-dubbed “DoNex,” which was detected in the wild during March.
Currently, the exact methods DoNex uses to infiltrate enterprise systems remain a mystery.
Cybersecurity teams diligently monitor the situation and conduct thorough investigations to uncover the group’s modus operandi.
Understanding the attack vectors is crucial for preventing further incidents and developing effective defense strategies.
A recent tweet by HackManac reported the emergence of a new ransomware group called Donex.
This group has already leaked data from 5 companies on their website.
New Ransomware Group Detected 🚨
A new criminal group enters the ransomware scene: Donex
So far, on their data leak site, 5 companies have found their data leaked:
Symantec, a leader in cybersecurity solutions, has identified protections against the DoNex ransomware through its products.
Symantec’s systems detect the threat in two ways:
File-based Detection: Known as Ransom. Darkrace, this signature-based detection is designed to catch known ransomware file indicators.
Machine Learning-based Detection: Labeled as Heur.AdvML.B!200, this advanced detection uses machine learning algorithms to identify and block ransomware behaviors that traditional signature-based methods may not catch.
The rise of the DoNex ransomware is a stark reminder of the evolving threat landscape.
Enterprises are advised to stay vigilant, ensure their security systems are up to date, and educate their employees on the risks of ransomware.
Regular backups and a robust incident response plan are also critical in mitigating the impact of such attacks.
As the situation develops, cybersecurity firms and law enforcement agencies are expected to issue further updates and advisories.
It is imperative for companies to monitor these communications and to collaborate with the cybersecurity community to defend against these and future ransomware threats.
With Perimeter81 malware protection, you can block malware, including Trojans, ransomware, spyware, rootkits, worms, and zero-day exploits. All are incredibly harmful and can wreak havoc on your network.
Stay updated on Cybersecurity news, Whitepapers, and Infographics. Follow us on LinkedIn & Twitter.
Last week, a bipartisan House bill was introduced that could mean the end of popular video app TikTok in the U.S. The proposed legislation would ban TikTok in the states if its parent company, ByteDance doesn’t sell its interest in the app. ByteDance is a Chinese company and U.S. lawmakers are concerned about TikTok’s connection with China and fear that the company collects personal data from TikTok subscribers.
The bill was introduced by introduced by Reps. Mike Gallagher (R-Wis.) and Raja Krishnamoorthi (D-Ill.); the pair are the top lawmakers on the House Select Committee on the Chinese Communist Party. If the bill becomes law, ByteDance would have more than five months to divest itself of TikTok. If ByteDance stands pat, TikTok would become illegal to distribute from a U.S. app storefront or a web housing platform.
But according to The Hill, there is a deep-pocketed investor out there who said on Friday that he would buy the platform if it is going to get banned. Shark Tank investor Kevin O’Leary, who sold The Learning Channel to Mattel for $3.2 billion in 1999, said on Fox News that he will buy TikTok if the platform is about to get banned. “Not going to get banned, ’cause I’m gonna buy it,” O’Leary said on Fox News’ show “The Story.” He continued by saying, “Somebody’s going to buy it, it won’t be Meta and it won’t be Google, ’cause…regulator [will] stop that.”
Kevin O’Leary says that he won’t let TikTok get banned in the U.S.
The investor known sarcastically as Mr. Wonderful on ABC’s long-running Shark Tank television show said about TikTok, “This is worth billions, it’s one of the most successful advertising platforms in social media today. All my companies use it, I’ll buy it.”
TikTok spokesperson Alex Haurek told The Hill, “This bill is an outright ban of TikTok, no matter how much the authors try to disguise it. This legislation will trample the First Amendment rights of 170 million Americans and deprive 5 million small businesses of a platform they rely on to grow and create jobs.” President Joe Biden already said on Friday that if the bill makes it out of Congress, he will sign it.
By monthly average users, TikTok is the fourth largest social media platform in the world. It currently has over 1 billion monthly average users. Since its launch in 2016, the app has been installed over 3 billion times.
