Criminals continue their quest for acquiring cryptocurrencies without having to buy and manage their own mining equipment. They're resorting to attacks aimed at stealing the cryptocurrencies via hacking, phishing, fake advertising and web injection attacks via repurposed banking Trojans.
An analysis of a massive 8.8 GB trove of files containing usernames and plaintext passwords suggests hundreds of services may have experienced unreported or undiscovered data breaches. Data breach expert Troy Hunt says the trove of 80 million records appears to contain fresh data.
Arkansas developer Taylor Huddleston has been sentenced to serve more than two years in prison for developing, marketing and selling two tools designed to be used maliciously - the NanoCore remote access Trojan and Net Seal license software.
Certificate authorities continue to be tricked into issuing bogus TLS certificates. A study by Recorded Future found that at least three underground vendors can supply fraudulent TLS certificates, which pose serious risks to data security and privacy.
The U.S. Securities and Exchange Commission has released revised guidance "to assist public companies in preparing disclosures about cybersecurity risks and incidents." It includes new prohibitions on trading in corporate shares after a breach has been discovered but before investors have been notified.
Want to meddle with a democracy? Just use its social media outlets against it to amplify already existing social divisions. That's the quick take on the indictment recently unsealed by Special Counsel Robert Mueller that accuses Russians of running an "active measures" campaign against the United States.
After a U.S. indictment charged Russians with running a troll factory that interfered in U.S. elections, groups tracking online disinformation campaigns warn that Russian bots are now debating the school shooting in Parkland, Florida. The White House is facing questions over what it's doing to deter Moscow.
In the wake of Special Counsel Robert Mueller unsealing an indictment charging Russian individuals and organizations with running a troll factory that interfered in U.S. politics, secretaries of state from many states sought information warfare defenses to defend their electoral integrity.
Google has begun activating a new feature in Chrome that will block 12 types of intrusive advertisements. But some security experts say the online advertising industry needs to solve the malware and privacy problems that have caused users to turn to ad-blocking and anti-tracking tools.
Intel faces 32 lawsuits filed over the trio of flaws in its CPUs known as Meltdown and Spectre, seeking damages for the security vulnerabilities as well as alleged insider trading. The flaws have also been cited in lawsuits against chipmakers AMD and ARM, as well as against Apple.
Microsoft has been working to reduce the ability of attackers who use the PowerShell scripting language to "live off the land" in enterprise networks, in part via machine learning. But IT administrators should also have these three essential malicious PowerShell script defenses in place.
A U.S. grand jury has taken the extraordinary step of indicting 13 Russian nationals and three Russian companies for allegedly interfering with the U.S. political system, including the 2016 presidential election, in what the Justice Department portrays as "information warfare against the United States."
After a year of brainstorming on blockchain technology, Microsoft says it will add support in its Authenticator app for a decentralized identity system that's designed to put users in control of their personal information.
Criminals in Europe are annually laundering at least $4 billion - and growing - via cryptocurrencies, warns Europol. The agency is calling on regulators and legislators to regulate cryptocurrencies to help battle money laundering and protect consumers.
Attackers recently snuck cryptomining code onto thousands of websites by inserting it into a third-party accessibility plug-in called Browsealoud. Web specifications designed to guard against these types of rogue actions by third-party code libraries already exist. Why aren't more sites using them?