The victims of this “data leak” also include celebrities like Alicia Keys, Loren Gray, Kylie Jenner, Ariana Grande, and Kim Kardashian.
The cybersecurity team at Safety Detectives, led by Anurag Sen, discovered an unsecured ElasticSearch server belonging to IGBlade.com, a social media analytics site. The server stored scraped data of millions of social media users. The data was taken from TikTok and Instagram.
Reportedly, at least 2.6 million user profiles have been exposed, equivalent to over 3.6 GB of data. The researchers dubbed it a shocking discovery since data scraping is banned on most social media websites, although it isn’t illegal.
About IGBlade.com
It is a Romanian website that collects social media users’ data to offer its clients an in-depth understanding of an Instagram or TikTok account. The platform has gathered data from millions of social media accounts of more than 30 different data metrics.
It then consolidates this information into a “navigable social account search engine” that displays critical data such as followers rate, demographics stats, engagement rate, data visualizations, account history, etc. To obtain these social media insights, users are required to create an account on IGBlade.
What was Exposed?
Part of the exposed data were screenshots and links to profile pictures and other types of scraped personal data of social media users. It is worth noting that all data on the exposed database was publicly available.
However, the incident has yet again ignited the debate on the controversial use of data scraping. Researchers claim that the data was left exposed without any encryption or password protection in place. The exposed data included:
Full names
Usernames
location data
About details
Profile pictures
Phone numbers
Email addresses
Engagement rate metrics
Follower counts & following counts.
Some celebrities were also affected, including:
Alicia Keys
Loren Gray
Kylie Jenner
Ariana Grande
Kim Kardashian
Kim Kardashian’s data (Left) – Loren Gray’s data including her business phone number (Right)
“The scraped data of users on the server is the same data that features each user’s corresponding IGBlade.com page, and the database often provides links back to IGBlade. This is how we know the database belongs to IGBlade.com,” researchers noted.
The exposed data was available online for more than a month until Safety Detectives’ researchers discovered it on July 5 and notified IGBlade. The company secured it on the same day.
Did you enjoy reading this article? Like our page onFacebookand follow us on Twitter.
AllBlock was available on Google Chrome’s Web Store where it is marketed as a potent Ad Blocker focusing on Facebook and YouTube to prevent pop-ups.
Google has maintained that it takes the security of Chrome extensions very seriously and regularly vets them to prevent exploitation. However, the new report from Imperva reveals that maybe Google isn’t performing its job as sincerely as it claims to be.
Chrome’s Ad-Blocker Extension Displaying Ads on Google
Security vendor Imperva’s Sillam and Ron Masas reported that a Google Chrome extension called AllBlock designed to block ads is injecting ads into Chrome and Opera.
Although the extension blocks ads, it runs a script in the background that injects a piece of JavaScript code into every tab that the user opens. This code communicates to remote servers and download/installs a payload connected to an ad-injection scam’s operators.
“When the user clicks on any modified links on the webpage, he will be redirected to an affiliate link. Via this affiliate fraud, the attacker earns money when specific actions like registration or sale of the product take place,” Imperva researchers observed.
The payload then retrieves a series of unwanted ads, most of which are not from legitimate sources, and includes affiliate links. AllBlock was available on Google Chrome’s Web Store where it is marketed as a potent Ad Blocker focusing on Facebook and YouTube to prevent pop-ups. It has now been removed from Opera add-ons and Chrome Web Store.
What is Ad Injection?
Ad injection is a method of inserting ads or links into a web page that isn’t supposed to host them. Scammers can earn money from advertisements by injecting unrelated ads or redirect unsuspecting users to affiliate links to earn a commission.
Imperva researchers identified such a campaign in August 2021 where several previously unknown domains were found to be distributing an ad injection script that would send legit URLs to a remote server and, in response, obtained a list of redirection domains. Consequently, when a user clicked on an altered link, they were redirected to another page, usually an affiliate link.
Ad injection scripts may feature evasion techniques like excluding Russian search engines, active detection of Firebug variables, and clearing the debugging console after every 100ms. In AllBlock ad injection scam, Imperva researchers were able to find the script in bg.js that they had been looking for since August.
How is The Extension Marketed?
It is yet unclear how AllBlock is distributed or promoted. According to Imperva, scammers are probably using other extensions in this campaign. They couldn’t identify the origin of the attack because of the way the malicious script was injected.
“The script we first observed was injected via a script tag pointing to a remote server where the AllBlock extension injects the malicious code directly to the active tab,” Imperva’s report revealed.
This indicates a larger campaign at work using different delivery methods and extensions, which might be connected with the PBotcampaign.
Did you enjoy reading this article? Like our page onFacebookand follow us on Twitter.
Best Buy has a really incredible deal on the Xbox Series S right now. You can pick it up for $249.99, which is $50 off. But that’s not really the deal here though. This is the Gilded Hunter Bundle, which does have in-game consmetics and virtual currency for Fortnite, Rocket League and Fall Guys. All of which you can download onto the Xbox Series S with just the click of a button.
The Series S is the cheaper Xbox on this console run, which isn’t a bad thing actually. It’s an all-digital model, which means that you will need to download all of your games onto this console. So the 512GB of storage may not go as far as you initially thought. But Xbox does make it pretty easy to add some more storage to your console.
What’s great about the Xbox Series S is, that you can use Game Pass on here. That’s going to give you instant access to hundreds if not thousands of games, for a low monthly subscription. Giving you a whole library of games, without spending hundreds of dollars all at once.
Small size and affordable price. The Xbox Series S is the smallest and most affordable Xbox console ever made. It measures just 6.5 x 15.1 x 27.5 cm and weighs only 1.93 kg, making it easy to fit into even a small space. It is also the most affordable next-generation console, starting at $299.
Fast loading times. The Xbox Series S has a custom NVMe SSD that provides significantly faster loading times than previous Xbox consoles. This means you can get into the action faster and spend less time waiting for games to load.
Support for 120fps gameplay. The Xbox Series S supports 120fps gameplay with games that support it. This means you can experience smoother and more responsive gameplay, especially in fast-paced games.
Upscaling to 4K resolution. The Xbox Series S can upscale games that are not natively 4K to 4K resolution. This means you can still enjoy games in a high-definition image, even if you don’t have a 4K TV.
Support for Dolby Atmos and Dolby Vision. The Xbox Series S supports Dolby Atmos and Dolby Vision HDR, which provide immersive audio and visual experiences.
Backward compatibility. The Xbox Series S is backward compatible with all Xbox One games, so you can play your old games on your new console.
You can buy the Xbox Series S Gilded Hunter Bundle from Best Buy today at the link below.
In July 2021 the REvil ransomware group vanished due to mounting US pressure after the Kaseya attack. However, the group was back in September 2021 by carrying out extortion-based DDoS attacks on ITSPs in the UK and Canada/America.
The infamous REvil ransomware group has suddenly announced to end its activities. The group, which gained prominence over cyberspace with high-profile ransomware attacks against Kaseya, JBS, and Travelex this year, has reportedly decided to go underground after its Tor payment portal and data leak blog were hijacked.
The news of REvil’s shutdown was posted on a well-known criminal forum run by a threat actor “0_neday” suspected to be associated with the gang and was first reportedby Dmitry Smilyanets from Recorded Future.
It is worth noting that in July 2021, the REvil ransomware group vanished due to mounting US pressure after the Kaseya attack. However, the group was back in September 2021 by carrying out extortion-based DDoS attacks on ITSPs in the UK and Canada/America.
REvil Announces Shutdown
The post where the group announced the closure of its activities revealed that the REvil gang’s Tor services were allegedly hijacked and whoever hacked it replaced the services with a copy of the gang’s private keys, which they must have obtained from a previous backup. The server was claimed to be “compromised,” and the group stated in the post that “they were looking for me.”
“To be precise, they deleted the path to my hidden service in the torrc file [used for configuring the Tor service] and raised their own so that I would go there. I checked on others — this was not. Good luck everyone, I’m off,” REvil operator(s) noted in the post.
As shown in the screenshot below, the operator used the infamous Russian language hacker forum XSS.IS to publish their post:
Who Hijacked REvil’s Tor Sites?
At the moment, there’s no clarity regarding who could have hijacked REVil’s Tor sites. According to The Washington Post, the FBI had managed to access encryption keys used by the REvil gang for the Kaseya attack in July. But the agency couldn’t take down the gang.
There are rumors that the Tor sites have been taken over by a former member of the REvil group known as Unkn/Uknown, who has been a spokesperson for the gang but didn’t accompany them when the group resurfaced in September 2021.
A website called VX-Underground tweeted that just Uknown and the threat actor on whose forum REvil’s closure statement was posted had access to domain keys, and the ransomware gang’s domain was accessed recently with Unknown’s keys.
“Since there was no confirmation of the reason for his loss, we resumed work, thinking that he was dead. But since we have today at 17.10 from 12:00 Moscow time, someone brought up the hidden-services of a landing and a bog with the same key as ours, my fears were concerned,” the threat actor explained.
However, in a conversation with Hackread.com, Steve Moore, chief security strategist, Exabeam said that, “This latest disruption seems to be caused by insider fighting or possible offensive takedown – it’s the final blow to REvil. The operator only mentions a “third party” – no attempt is made to identify their identity.
“Keep in mind these are organizations like any other, but with fewer rules. Based on information shared, they lost control of their backups which contained keys to overtake their network. In the exciting twist, the adversary was seemingly taken down due to weak technology hygiene, a flaw generally exploited by them to extort money from their victims, ” Moore added.
Did you enjoy reading this article? Like our page onFacebookand follow us on Twitter.
The warning comes days after three rogue packages, okhsa, klow, and klown discovered by DevSecOps firm Sonatype, were removed from the NPM repository.
On Friday, the US Cybersecurity and Infrastructure Security Agency (CISA) released a warning to disclose an incident related to the GitHub Advisory Database. According to CISA, a crypto-mining malware was hidden in a popular JavaScript NPM library, UAParser.js.
The library rakes in more than six to eight million downloadsper week and is used in websites and applications to identify browsers and systems used. The NPM platform became a part of Microsoft-owned GitHub in 2020.
Three Rogue NPM Packages Discovered
The warning comes days after three rogue packages, okhsa, klow, and klown discovered by DevSecOps firm Sonatype, were removed from the NPM repository.
Reportedly, three versions of UYAParser.js, 0.7.29, 0.8.0, 1.0.0, were embedded with malicious code after the attacker successfully hijacked the NPM account of the maintainer.
It was identified that a device running any of these versions could allow attacked access to sensitive and confidential information and even let them take control of the computer.
It is suspected that the malicious code was injected to install a crypto miner on the targeted system. The issue is now patched in versions 0.7.30, 0.8.1, and 1.0.1.
Developer’s Response
It was developed and maintained by an Indonesian programmer Faisal Salman (who uses the alias faisalman to publish his software). The programmer posted on his Gitmemory profile that his developed software has been modified and embedded with malicious code.
“I believe someone was hijacking my NPM account and published some compromised packages (0.7.29, 0.8.0, 1.0.0) which will probably install malware,” Salman said.
GitHub Alert
In an independent alert, GitHub notified users that any computer running this package should be considered compromised, and therefore, sensitive data and keys stored on the device should be transferred to another device.
“The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it,” the notice read.
Did you enjoy reading this article? Like our page onFacebookand follow us on Twitter.
Squid Game and Joker malware turn out to be a “killer combination” after all.
Netflix’s biggest ever series Squid Game is a smash hit with over 142 million users watching it globally. This dystopian series from Korea has raked in approx. $900 million against a relatively underwhelming production cost of $21.4 million.
The craze surrounding Squid Game is surreal, and this is why cybercriminals are trying their level best to exploit its popularity. There are countless Squid Game merchandise, memes, and games available. However, at the same time, there are several unofficial apps uploaded on Google Play Store that are distributing malware.
About Squid Game Wallpaper
A Twitter user and security researcher (@ReBensk) discovered an Android app that was actually Joker malware disguised as a Squid Game wallpaper app.
One of the malicious Squid Game app on the Google Play Store.
It is worth noting that Joker malware isn’t new, as it has appeared on the Google Play Store plenty of times. Joker malware can secretly sign in unsuspecting users onto premium subscription services by displaying a fake sign-up process.
Joker can also steal SMS messages, device information, and contact lists. In the current incident, the Joker variant used in the wallpaper app targets victims of ad fraud. Moreover, it signs innocent users onto expensive SMS services discreetly.
The malicious Squid Game wallpaper app was later examined by ESET malware researcher Lukas Stefanko who discovered that the app exposed users to malicious ad fraud and SMS subscriptions.
Although Google removed this particular app from the Play Store, what’s concerning is the fact that more than 5,000 users had already downloaded it. Moreover, according to Stefanko, there are over 200 Squid Game-related apps available on Google Play Store.
Stefanko evaluated all the apps and concluded that none contained malware, but they all had several ads. And, another startling discovery he made was that there’s no official Squid Game app at all. Hence, fans need to be very careful when looking for show-related apps.
Seems like a great opportunity to make money on in-app ads from one of the most popular TV show without an official game. The most downloaded of them reached 1M installs in 10 days. Its game play is not that well handled, Stefanko tweeted.
If you are on Android there are certain precautions you need to take before downloading an app, for instance, usereliable anti-virus software, scan your device regularly and avoid downloading unnecessary apps from Play Store and third-party platforms.
Did you enjoy reading this article? Like our page onFacebookand follow us on Twitter.
If you have been wanting to learn a foreign language, there’s never been a better time to start. With smartphone apps, you can now learn any language from the comfort of your couch. Of course, mastering a language not native to you isn’t easy. It will require immense dedication and practice. But your Android smartphone can be of great help in this journey.
The Google Play Store has tons of apps that allow you to learn new languages at your own pace and schedule. These apps teach you everything from vocabulary and grammar to the right pronunciation and usage of words in sentences and much more. Whether your goal is to just have basic conversations in a foreign language or to master the language and leverage the skill professionally, as long as you have that burning desire inside you, it’s doable.
But before all of this, you must find the app that is best suited for your goal. To help you with your search, we have compiled a list of the best Android apps for learning new languages. While all apps offer the same core functionality, i.e. teach you new languages, their approach and teaching methods vary. Go through the article below for more information about each app. We have included a brief description, Google Play rating and size, cost of in-app purchases, and screenshots or promo videos, as well as a Google Play Store download link.
Best language learning Android apps 2023 downloads
Below is a little more information on each app, including a direct link for easy downloading.
All download links go to the app’s Google Play Store listing. Users are always recommended to download apps from Google Play or an authorized app store.
Duolingo
– Price: Free to download – In-app purchases: $0.99 – $149.99 – Size: Varies with device – Google Play rating: 4.7 out of 5 stars
With over 300 million users around the world, Duolingo is one of the most popular apps for learning new languages. The app offers courses in more than 40 languages and you can enroll in as many courses as you like at once. While it may not be the best idea to simultaneously pursue multiple courses, as it could all get mixed up and confusing, Duolingo’s game-like mini-lessons make things a lot simpler.
Whether you are a native English speaker or not, this app has language courses for everyone. Its expert-curated science-based lessons start with basic words, phrases, and sentences before gradually moving to the more complex side of languages. With regular practice, your grammar and vocabulary get strong, helping you improve your speaking, reading, and writing skills over time.
Duolingo also offers additional resources such as Stories and Events to make your learning process more fun and effective. Moreover, its playful rewards and achievements motivate you to make practicing a daily habit.
– Price: Free to download – In-app purchases: $12.95 – $399.99 – Size: Varies with device – Google Play rating: 4.6 out of 5 stars
Babbel is another popular name when it comes to Android apps for learning new languages. It offers more than 60,000 lessons in 14 different languages. You get thousands of hours of immersive and interactive language content crafted by dedicated professionals, with each lesson broken into small segments that only take 10-15 minutes of your time every day.
Language lessons in Babbel are tailored to real-life situations and customized according to the local culture. So instead of learning the same phrase and vocabulary in multiple languages, you’ll be learning native language skills. This practical approach helps you quickly develop natural speaking abilities in foreign languages. Of course, the app will also teach you formal words, phrases, grammar, pronunciation, and sentence formation.
– Price: Free to download – In-app purchases: $4.99 – $191.99 – Size: Varies with device – Google Play rating: 4.5 out of 5 stars
Mondly focuses on conversational skills more than developing vocabulary. You get lessons on specific real-life situations in 33 languages. So if you’re planning a trip abroad and need to learn some basics in the native language, this app has got you covered. It offers audio pronunciation from native speakers, so you can learn to pronounce words and phrases the way they speak.
Since mastering a language requires you to amass a sizable vocabulary, Mondly eventually comes to that. But conversational skills are its forte. It even boasts AI chatbots to help you practice speaking foreign languages. The app uses speech recognition technology to determine whether you are speaking correctly and provides feedback accordingly. Mondly keeps track of your progress and lets you compete with other users on the platform.
– Price: Free to download – In-app purchases: $0.99 – $299.99 – Size: Varies with device – Google Play rating: 4.7 out of 5 stars
Rosetta Stone has been around for decades, which is a testament to its effectiveness when it comes to teaching foreign languages. Now available as an app, it offers interactive and contextual lessons in over 20 languages. Its proprietary speech recognition technology helps you develop speaking abilities from the very beginning. The app asks you to repeat a said word and match spoken words and phrases with images on the screen.
All this while, Rosetta Stone will guide you to improve your vocabulary and grammar in foreign languages. You can tailor your lessons according to your goal. Simply specify why you want to learn a language and the app will give you curated lessons that gradually take you closer to that goal. It divides lessons into 10-minute segments and lets you download courses for offline access.
– Price: Free to download – In-app purchases: $0.99 – $199.99 – Size: Varies with device – Google Play rating: 4.6 out of 5 stars
Memrise uses video lessons to teach you foreign languages. The videos are supplied by native speakers, with the whole of its 65 million+ user community contributing. The app boasts more than 30,000 such videos, allowing you to learn the pronunciation, tone, and accent of the language as the locals speak it. When you are ready to begin conversations yourself, you have an AI chatbot for practicing.
This app offers lessons in more than 20 languages, with each course comprising of a rich variety of practice sets, quizzes, and games. These features make your journey more fun and engaging. Memrise also has language lessons curated to real-life situations, helping develop basic conversational skills.
– Price: Free to download – In-app purchases: $0.99 – $299.99 – Size: Varies with device – Google Play rating: 4.6 out of 5 stars
Lingualeo offers a wide range of resources to help you learn languages. It boasts vocabulary training courses, grammar exercises, thematic courses, and video lessons, as well as featured collections of language-themed articles, speeches, books, and more. All of this helps you develop your reading, speaking, and writing skills in foreign languages.
This app’s game-based approach allows you to compete with other users and earn rewards for achieving goals faster. With more than 23 million users around the world, it’s a pretty big community, so competition is high. You can use the same Lingualeo account on the app and website, allowing you to continue your lessons from the device of your choice.
– Price: Free to download – In-app purchases: $0.99 – $169.99 – Size: Varies with device – Google Play rating: 4.6 out of 5 stars
Busuu is another popular app among language learners, with more than 120 million people using it to learn new languages globally. It offers courses in 14 languages, with the option to select your current skill set. If you’re a complete newbie to a language, the app will start lessons from the lowest level. But if you do know some basics, it won’t waste your time teaching what you already know.
Regardless of your expertise in a language, Bussu allows you to create a study plan of your own. This ensures that you are learning at a pace best suitable to your schedule. If you need help, you can always turn to the 120 million-strong community where you will certainly find a few native speakers of the language you are learning. You can have conversations with them and get feedback to sharpen up your skills.
– Price: Free to download – In-app purchases: $0.99 – $194.99 – Size: Varies with device – Google Play rating: 4.5 out of 5 stars
Drops offers courses in more than 45 languages. It uses illustrations and fast-paced micro-games to teach you essential words, phrases, and conversational skills in a fun way. The app doesn’t give much importance to grammar in its lessons, ensuring that you don’t lose the fun element as you progress. The grammatical part of the language fills in automatically over time.
Language courses in Drops are broken into bite-size lessons that only take a few minutes to complete. So even if you have a busy schedule, you can squeeze in one lesson daily for regular practice. Each lesson feels like a new level in a game, so you enjoy more as you learn.
– Price: Free to download – In-app purchases: $1.99 – $54.99 – Size: Varies with device – Google Play rating: 4.2 out of 5 stars
Beelinguapp focuses on reading comprehension where you read stories in different languages side by side. You can also listen to the story in your target language. This allows you to translate words and phrases between your native language and target language in real-time and grasp their usage and pronunciation naturally.
This unique approach of Beelinguapp makes it a crown favorite. The app offers courses in around 20 languages. While the courses are curated for beginner, intermediate, and expert learners, it’s best suitable for people who already know the basics. You will develop reading and speaking skills faster with Beelinguapp if you know simple words and phrases.
– Price: Free to download – In-app purchases: $0.99 – $199.99 – Size: Varies with device – Google Play rating: 4.8 out of 5 stars
If you’re a native English speaker looking to learn a new language, you won’t find more options anywhere other than Mango Languages. This app boasts courses in over 70 languages for English speakers. You can even choose regional variants of some languages, such as Latin American and Castilian variants of Spanish. Mango Languages also offers English courses for 21 foreign languages, so its collection is huge.
Like most other apps on this list, Mango Languages teaches you real-life conversation skills from the get-go. It uses audio clips from native speakers to help you with the pronunciation of words and the accent. Lessons are downloadable for offline access. You also get interactive listening and reading exercises here.
On October 21, 2021, Facebook filed a lawsuit against a Ukrainian citizen for allegedly scraping information of 178 million users of the social network and selling the data on hacker forums.
Reportedly, the data scraping occurred between 2018 and 2019. Also called web scraping, data scraping refers to importing massive amounts of data from a website and storing it on a local device in a spreadsheet or document.
It is worth noting that in January 2021, Facebook also sued a Portuguese company for developing malicious Chrome extensions allowing data scraping.
Is data scraping illegal?
Depending on its use web data scraping is an illegal technique in which a computer program (bots) extracts data from a website.
Remember, third-party firms can use data scrapping, a fairly common practice to extract the personal information of users from websites like LinkedIn, Facebook, or Twitter.
This information can be accessed by cybercriminals in case proper security measures are not implemented. For instance, malicious elements can use ‘scraper bots’ to extract private information anonymously.
Who’s facing the lawsuit?
The lawsuit is filed against a freelance computer programmer Alexander Solonchenko from Kirovograd, Ukraine, who used the online handles of barak_obama and Solomame to carry out his objectives.
The activity of Barak_Obama on RaidForums (Image: Hackread.com)
Court documentsrevealed that the programmer could access and sell user IDs and contact numbers, which are publicly available but obtaining and selling the data is against Facebook’s terms of service.
What Happened?
According to reports, in 2018, Solonchenko scraped personal details of Facebook users exploiting the contact import feature of Facebook, which the company discontinued in Sep 2019.
Using this feature, he could sync users’ contact lists to identify which contacts had an account on Facebook to reach out to them on Messenger. The defendant then fed Facebook servers with millions of random phone numbers.
Facebook claims that he used an automated tool to mimic Android devices in this attack. Whenever the company returned the info to accounts associated with the phone numbers fed to its servers, he collected it.
The programmer allegedly tried to sell the stolen data on the clearnet cybercrime and hacker forum called RaidForums in October 2020. Facebook also stated that the defendant exploited the feature between Jan 2018 and September 2019, which means the data heist continued for more than 21 months.
About Contact Importer Feature
This feature allowed users to upload their contact list directly from their address books onto their mobile devices and provided them with a one-to-one list of users whose phone numbers matched the numbers uploaded from a device’s address book. This functionality was included to let users identify friends through their contact information.
How Facebook Tracked the programmer?
Facebook tracked down the programmer after he mistakenly used the same username and contact information on email and job portals. It turned out that the Ukrainian programmer had scraped and sold data from several other high-profile firms and organizations, including Ukraine’s largest private delivery service, largest commercial bank, and a France-based data analytics firm.
After tracking him down, Facebook quickly filed a lawsuit with the Federal District Court for the Northern District of California and requested the judge to ban Solonchenko from accessing its website and selling the scraped data apart from seeking undefined damages.
Did you enjoy reading this article? Like our page onFacebookand follow us on Twitter.
At the time of writing, the home page of 911 (911.re) Proxy Service was displaying a detailed message left by the website’s administrator revealing details of the security breach.
911 proxy service (911.re), regarded as one of the few original residential proxy networks, has announced shutting down its operations after suffering a data breach. The service that has sold access to countless Microsoft Windows computers since 2015 confirmed in a message on its home page that the cyberattack destroyed critical elements of its business operations.
Incident Details
Earlier in July 2022, Brian Krebs from KrebsOnSecurity had criticized the connections 911.re proxy service had with dubious pay-per-install affiliate programs, which bundled its software with pirated software and free utilities.
Krebs noted that 911.re operated multiple pay-per-install programs and paid affiliates to bundle its software with other programs to generate a steady stream of proxies.
oon after Krebs’ report, 911.re informed users about reviewing its network and implementing new security measures to “prevent misuse” of its services, along with closing new user registrations and proxy balance top-up.
“We are reviewing every existing user, to ensure their usage is legit and in compliance with our Terms of Service,” the notice read.
Many users complained that they could not use the service after the company’s public notice. On July 28th, the website announced a permanent shutdown of its services.
“We regret to inform you that we permanently shut down 911.re and all its services on July 28th.”
Was 911.re Hacked?
As shown in the screenshot above, 911.re claims that its service was hacked in July 2022 after someone manipulated the balances of many user accounts by abusing an API (application programming interface) that handled account top-ups.
The company investigated and discovered that the hacker “maliciously damaged” its server data. The hackers managed to overwrite its servers, data, and its backups. Since the company wasn’t sure how it compromised this system, it decided to shut down the recharge system and new user registration “urgently.”
How do Residential Proxy Services Work?
Users rent a residential IP address and use it as a relay for internet communications while securing their identity. But they are generally unaware that it would turn their device into a proxy that allows other users to use their internet address.
Such proxy services build their networks by offering free proxy or free VPN services powered by software that turns their computers into a traffic relay.
Google attributed the malware campaign to a group of attackers recruited via a Russian-language hacker forum.
Google has disclosed details of a new campaign involving phishing attacks launched against YouTube channel owners with the sole purpose of hijacking their channels. According to the report, threat actors are using cookie theft malware in the attacks to take control of the device/computer and hack YouTube accounts.
Researchers revealed that attackers behind this channel hijacking scheme are financially motivated as they auction off the stolen channels if they have a large number of followers or promote cryptocurrency scams by abusing these accounts.
About the Campaign
In their report, Google’s Threat Analysis Group’s (TAG) Ashley Sen attributed to a group of attackers recruited via a Russian-language forum through the following job description, offering two types of work:
The attacks have been going on since 2019, and attackers used to lure targets through fake collaboration schemes such as requests to purchase ads on the targeted user’s channel, photo editing, online games or music players, VPNs, and demo for anti-virus software, etc.
After gaining the channel owner’s trust, the scammers would send the victim a URL through email or a Google Drive PDF in which they would promise a legitimate software, but actually, it redirected them to a malware landing page.
When the malware was installed on the computer, it would steal cookies from the browser using a smash-and-grab technique, and the cookies were used to hijack the session and eventually hijack the channel. Scammers would then look to sell it to the highest bidder with an asking price of $3,000 to $4,000 or launch cryptocurrency scams using it.
It was observed that scammers sent phishing messages to email IDs made public by YouTube channel owners for business purposes.
The malware used in the scam includes Azorult (also used in recent COVID-19 related scams), Raccoon, Vidar, Grand Stealer, Kantal, Nexus stealer, Masad, The Thief, Predator, Vikro Stealer, and RedLine along with open-source tools like AdamantiumThief and Sorano.
How was The Campaign Busted?
Google’s TAG team collaborated with Gmail, YouTube, Trust&Safety, CyberCrime Investigation Group, and Safe Browsing teams to decrease the distribution rate of phishing emails on Gmail. Their collaboration decreased the volume of the phishing campaign by 99.6% since May 2021 and blocked 1.6 million messages to probable targets.
Furthermore, around 62k Safe Browsing phishing page warnings and 2.4k files were blocked, with nearly 4,000 accounts restored successfully. After attackers sensed increased detection efforts, they turned to other email providers such as Seznam.cz, email.cz, Aol.com, and post.cz.
It was also noted that the attackers had registered nearly 15,000 accounts and had domains associated with fake firms, while over 1,000 websites were used to distribute malware. For preventing further distribution of phishing emails, Google notified the FBI as well.
Did you enjoy reading this article? Like our page onFacebookand follow us on Twitter.
