An enormous IT outage across the world today is not the result of a cyberattack, but rather a faulty update from CrowdStrike.

A faulty update from the cybersecurity vendor CrowdStrike crashed countless Windows computers and sent them into a “Blue Screen of Death” (BSOD), grinding to a halt the global operations of airlines, hospitals, news broadcasters, transportation agencies, and more.

The incident itself is not the result of a cyberattack. There is no evidence of a breach or of any cybercriminal involvement.

But, as Malwarebytes Labs has reported before, many major events can lead to follow-on threats of phishing and scams, and this global outage is no different. On July 19, the US Cybersecurity and Infrastructure Security Agency (CISA) issued an advisory on this same risk:

“CISA has observed threat actors taking advantage of this incident for phishing and other malicious activity. CISA urges organizations and individuals to remain vigilant and only follow instructions from legitimate sources. CISA recommends organizations to remind their employees to avoid clicking on phishing emails or suspicious links.”

As of reporting, CrowdStrike has already issued a fix.

****What happened****

On July 19, businesses in Australia began reporting that their Windows computers were restarting automatically into a BSOD, making them inaccessible to users. The reports were limited only to Windows machines and, as verified later by CrowdStrike, computers running Mac OS or Linux were not affected.

As IT admins in Australia scrambled to get their organizations back online, the same BSOD issue began greeting workers across Europe. The problem, it became clear, was becoming global, with reports of similar problems in Germany, Japan, India, and, eventually, the United States.

Hundreds of businesses were immediately impacted. Flights were grounded. Delays are being warned for package delivery provider UPS. Hospitals in the state of Maryland began cancelling procedures. And The Washington Post reported that, while many retailers were unscathed, coffee giant Starbucks was experiencing difficulties with its mobile ordering system.

What every affected business had in common was their use of Windows computers running CrowdStrike’s cybersecurity platform.

In the past 24 hours, CrowdStrike issued a faulty software update for Windows devices that included a problematic “channel file.” Windows devices that installed this update were then sent into a boot loop back into the “Blue Screen of Death” which kept users from accessing their own computers.

****The fix****

As of 05:27 AM UTC, CrowdStrike had identified the faulty channel file and issued a new, safe channel file for use. Deleting the channel file and installing the correct channel file, however, could require direct, physical access to a computer—a particularly time-intensive task as increasingly more businesses have adopted hybrid and Work From Home models.

CrowdStrike has a full statement on hox to fix Windows machines that are still stuck in the BSOD loop here.

Everyday users who are affected by this outage on their work machines or personal machines are not at heightened risk of a cybersecurity attack. Instead, people should simply remain vigilant about malicious emails and websites that promise fixes for the problem. For any and all maintenance, rely on CrowdStrike’s official statements and, if experiencing problems at work, rely on your IT admin.

**Summer mega sale**

Go into your vacation knowing you’re much more secure: This summer you can get a huge **50% off a Malwarebytes Standard subscription** or **Malwarebytes Identity bundle**. Run, don’t walk!

 CrowdStrike update at center of Windows &#8220;Blue Screen of Death&#8221; outage 

The Identity Theft Resource Center has published a report showing a 1,170% increase in compromised data victims compared to the same quarter last year.

Nope, that headline’s not a typo. Over one thousand percent.

The Identity Theft Resource Center (ITRC) tracked 1,041,312,601 data breach victims in Q2 2024, an increase of 1,170% over Q2 2023 (81,958,874 victims).

The ITRC is a national non-profit organization set up with the goal of minimizing the risk and mitigating the impact of identity compromise. Through public and private support, it provides no-cost victim assistance and consumer education.

The vast majority of that rise in numbers in due to a few very large compromises. The ITRC mentions Prudential (2.5 million people) and Infosys McCamish Systems (6 million people) as main contributors.

Because both of these breaches were announced/updated in the second quarter of 2024 they have a huge impact on the numbers. When we compare the number of data breach victims in the first half of 2024 (H1 2024) then we see an increase of 490 percent compared to the first half of 2023. Which is still significant and worrying.

The ITRC broke down some of the numbers to show them in an infographic.

Infographic by ITRC

Some notable statistics we can derive from the infographic:

*   Almost 90% of the compromises in H1 2024 are due to data breaches.
*   Financial services had the most breaches, followed by healthcare.
*   The largest data breaches in number of victims are Ticketmaster, Advance Auto Parts, and Dell.
*   80 supply chain attacks accounted for 446 affected entities and over 10 million victims.

Another trend the ITRC highlights is the increase in stolen driver’s license information. Mostly caused by a post pandemic trend to use driver’s license information for identity confirmation. This has increased both the chances of this information being included in a breach, and increased the value of that information to thieves.

The number of data breaches where driver’s license data was stolen totaled 198 instances in pre-pandemic, full-year 2019 compared to 636 in full-year 2023 and 308 through June 30, 2024.

Most of the data breaches are not the result of negligence but of targeted cyberattacks. This explains the rising demand for data deletion services. Not only does it play a significant role in safeguarding privacy rights on the business side, it also helps avoid or lessen the legal consequences of a breach.

ITRC president and CEO Eva Velasquez summarized the report like this:

> “The takeaway from this report is simple. Every person, business, institution and government agency must view data and identity protection with a greater sense of urgency.”

**Protecting yourself after a data breach**

There are some actions you can take if you are, or suspect you may have been, the victim of a data breach.

*   **Check the vendor’s advice.** Every breach is different, so check with the vendor to find out what’s happened and follow any specific advice they offer.
*   **Change your password.** You can make a stolen password useless to thieves by changing it. Choose a strong password that you don’t use for anything else. Better yet, let a password manager choose one for you.
*   **Enable two-factor authentication (2FA).** If you can, use a FIDO2-compliant hardware key, laptop or phone as your second factor. Some forms of two-factor authentication (2FA) can be phished just as easily as a password. 2FA that relies on a FIDO2 device can’t be phished.
*   **Watch out for fake vendors.** The thieves may contact you posing as the vendor. Check the vendor website to see if they are contacting victims and verify the identity of anyone who contacts you using a different communication channel.
*   **Take your time.** Phishing attacks often impersonate people or brands you know, and use themes that require urgent attention, such as missed deliveries, account suspensions, and security alerts.
*   **Consider not storing your card details**. It’s definitely more convenient to get sites to remember your card details for you, but we highly recommend not storing that information on websites.
*   **Set up identity monitoring.** Identity monitoring alerts you if your personal information is found being traded illegally online, and helps you recover after.

**Check your exposure**

Looking at the numbers in the ITRC report, it’s likely you’ve had other personal information exposed online in previous data breaches. You can check what personal information of yours has been exposed with our Digital Footprint portal. Just enter your email address (it’s best to submit the one you most frequently use) to our free Digital Footprint scan, and we’ll give you a report.

**We don’t just report on threats – we help safeguard your entire digital identit**y

Cybersecurity risks should never spread beyond a headline. Protect your—and your family’s—personal information by using identity protection.

**Summer mega sale**

Go into your vacation knowing you’re much more secure: This summer you can get a huge **50% off a Malwarebytes Standard subscription** or **Malwarebytes Identity bundle**. Run, don’t walk!

 Number of data breach victims goes up 1,000% 

Gen Z, who are most likely to engage in consensual tracking, are also the most likely to face non-consensual tracking after a breakup.

Breaking up is hard to do, but for younger Americans today, ending a romantic relationship requires more than a heart-to-heart conversation—it could also require protection against follow-on invasions of online privacy and security.

According to a new analysis of research released earlier this summer by Malwarebytes, 45% of Gen Z partners said that, following a breakup, their former partners abused personal login credentials for a variety of harmful activities, such as accessing emails, tracking locations, and even spying on someone through a shared smart device.

This type of credential abuse is an abuse of consent. When couples have agreed to let one another access personal apps, messaging platforms, devices, and locations, some exes maintain that access even after a breakup.

The problem is particularly pronounced amongst America’s youth, as, comparatively, just 23% of Gen Xers and 10% of Baby Boomers reported the same behavior from their own exes. Those lower rates are not the function of lower app usage or smartphone adoption by older populations, as Malwarebytes’ research was controlled across all generations for the sharing of online accounts, devices, and location information.

Instead, the disparate privacy invasions could be a consequence of disparate sharing. As Malwarebytes revealed last year, Gen Z were more likely to consensually and non-consensually monitor their partners than any other generation.

The findings emerge from a new analysis of research that Malwarebytes released earlier this year in the report, “What’s mine is yours: How couples share an all-access pass to their digital lives.”

Together, they data reveals that modern breakups—like modern romance—are intimately intertwined with online life.

**The kids aren’t alright**

The kids (who are hardly kids by now) are having problems of consent.

When asked about how their ex-partners behaved following a breakup, Gen Z respondents experienced higher rates of login abuse than any other generation for nearly every single type of harm described.

For example, 14% of Gen Z respondents said that an ex-partner of theirs had logged into their own social media accounts after a breakup, compared to 8% of Gen Xers and 3% of Baby Boomers who said the same. That higher rate matched the similar 13% of Gen Z respondents who said that an ex-partner had “used my accounts to impersonate me.” Such impersonation included when an ex wrongfully logged into a personal social media account to make fraudulent posts, or when an ex even sent emails on the person’s behalf.

In one slim disparity, 11% of Gen Z respondents said an ex-partner had “accessed my emails, texts, DMs, or other messages,” compared to 9% of Gen X respondents and 4% of Baby Boomers.  

But when Gen Z respondents did not report the highest rates of login abuse for one specific activity, it was common for their next-generation neighbors to take the title.

In fact, when comparing Gen Z respondents and Millennials together—as a combined group—against every generation older than them, the younger generations reported significantly higher rates of overall login abuse (43% of Gen Z and Millennials combined compared to 15% of all people older than Millennials), social media login abuse (13% compared to 4%), financial account login abuse (9% compared to 2%), and streaming service login abuse, such as when an ex continued to use a former partner’s Netflix or Spotify accounts after a breakup (14% compared to 1%).

While having an ex muddy your Hulu recommendations may seem like a minor inconvenience, America’s younger generations also faced higher rates of stalking, non-consensual location tracking, and outright digital spying.

****America’s youth and a potential stalking crisis****

Gen Z respondents and Millennials, combined, reported significantly higher rates of having an ex that “used my accounts to stalk me,” compared to the combined Gen X respondents and Baby Boomers who reported the same (13% compared to 5%).

Stalking itself is an umbrella term that includes unwanted, repeated attention from someone. That can include an abuser who physically follows their ex around town, or a spurned partner who sends incessant texts, phone calls, and emails. It can also include a divorced spouse who has moved out of a shared home but who, by maintaining access to a smart device, raises a thermostat to dangerous temperatures or who tracks a home’s visitors on a smart doorbell.

Worryingly, these types of activities—which can all fit into the broader term of “stalking”—were also individually reported more often by America’s younger generations.

For instance, significantly more Gen Z respondents and Millennials, combined, said an ex had “used my accounts to track my location or tracked via location sharing apps” than every generation older than them (12% compared to 3%). And 10% of this younger group of Americans also said that an ex had “logged into my smart devices to spy on me,” compared to 4% of Americans older than them.

Remember, also, that younger Americans reported higher rates of suffering from an ex who impersonated them (10% compared to 4% of Americans older than Millennials) and who also accessed their emails, texts, DMs, or other messages (10% compared to 6%).

All of these harms, depending on their regularity, can be described as stalking. With access to a former partner’s email and messaging platforms, an ex can send lewd messages to friends and family, destroy the former partner’s relationships at work, and sign the former partner up for annoying, endless spam mailers. This is targeted, unwanted harassment, which is exactly what stalking encompasses.

Though the reasons for the higher rates of stalking and stalking behavior faced by Gen Z and Millennials are unclear, it’s important to provide context from research that Malwarebytes released last year.

When asking 1,000 people in North America about the ways they monitored both their significant others and their children, Gen Z respondents were significantly more likely to track their romantic partners locations and digital activity—both with consent and without.

In fact, 29% of Gen Z respondents said that, with permission, they tracked a spouse or significant other’s location through an app or Bluetooth tracker (compared to 20% of non-Gen Z respondents), and 25% said they’d installed monitoring software on a spouse or significant other’s device (compared to 17% of non-Gen Z respondents).

It’s hard to ignore that the generation most likely to engage in consensual location tracking is also the generation most likely to report non-consensual location tracking after a breakup.

This doesn’t mean that location sharing is inherently dangerous, or that relationships amongst younger Americans are inherently more volatile.

Instead, this data merely points to a teaching moment. Romance is complex enough without the addition of location tracking, device sharing, password use, and joint account setups. But while Malwarebytes can’t help with any of the actual difficulties around dating, it can help with everything digital.

Visit Malwarebytes’ “Modern Love in the Digital Age” guidance hub today for advice on safely and securely sharing your digital life with the person you trust most.

**Summer mega sale**

Go into your vacation knowing you’re much more secure: This summer you can get a huge **50% off a Malwarebytes Standard subscription** or **Malwarebytes Identity bundle**. Run, don’t walk!

 Gen Z breakups tainted by login abuse for spying and stalking, research shows 

Rite Aid has started notifying 2.2 million people that were affected by data breach that was part of a June ransomware attack.

The US’ third-largest pharmacy chain Rite Aid has filed a data breach notification in which it reports that the data stolen during a June ransomware attack compromised the data of some 2.2 million people.

Ransomware group RansomHub claimed responsibility for the attack that took place on June 6, 2024. Ransomware groups are always looking for ways to increase their leverage over their victims, and threatening to leak stolen customer data is one of their most common methods.

The site where RansomHub’s leaks stolen data features a ransom demand next to a typical countdown timer, demanding payment before the timer expires on July 26, after which the group has threatened to release the stolen data.

Rite Aid listing on RansomHub leak site

After the discovery of the breach on June 20, Rite Aid started an investigation. The restoration of the compromised systems has now reached completion, according to Rite Aid.  

Reportedly, the stolen data appears to be limited to purchases made between June 6, 2017, and July 30, 2018. Rite Aid says names, addresses, dates of birth, and the numbers associated with driver’s licenses or other ID documents were stolen.

RansomHub claims that:

> ​”While having access to the Riteaid network we obtained over 10 GB of customer information equating to around 45 million lines of people’s personal information. This information includes name, address, dl\_id number, dob, riteaid rewards number.”

Rite Aid is offering affected customers a standard 12 months of credit monitoring from Kroll. Details on how to claim that offer can be found in the letter it’s sending customers.

**Protecting yourself after a data breach**

There are some actions you can take if you are, or suspect you may have been, the victim of a data breach.

*   **Check the vendor’s advice.** Every breach is different, so check with the vendor to find out what’s happened, and follow any specific advice they offer.
*   **Change your password.** You can make a stolen password useless to thieves by changing it. Choose a strong password that you don’t use for anything else. Better yet, let a password manager choose one for you.
*   **Enable two-factor authentication (2FA).** If you can, use a FIDO2-compliant hardware key, laptop or phone as your second factor. Some forms of two-factor authentication (2FA) can be phished just as easily as a password. 2FA that relies on a FIDO2 device can’t be phished.
*   **Watch out for fake vendors.** The thieves may contact you posing as the vendor. Check the vendor website to see if they are contacting victims, and verify the identity of anyone who contacts you using a different communication channel.
*   **Take your time.** Phishing attacks often impersonate people or brands you know, and use themes that require urgent attention, such as missed deliveries, account suspensions, and security alerts.
*   **Consider not storing your card details**. It’s definitely more convenient to get sites to remember your card details for you, but we highly recommend not storing that information on websites.
*   **Set up identity monitoring.** Identity monitoring alerts you if your personal information is found being traded illegally online, and helps you recover after.

Malwarebytes has a free tool for you to check how much of your personal data has been exposed online. Submit your email address (it’s best to give the one you most frequently use) to our free Digital Footprint scan and we’ll give you a report and recommendations.

**Summer mega sale**

Go into your vacation knowing you’re much more secure: This summer you can get a huge **50% off a Malwarebytes Standard subscription** or **Malwarebytes Identity bundle**. Run, don’t walk!

 Rite Aid says 2.2 million people affected in data breach 

Rabbit has introduced an option to erase all data from the r1 device before selling it on, but what if you lose it or it gets stolen?

Rabbit, the manufacturer of the Artificial Intelligence (AI) assistant r1 has issued a security advisory telling users it’s found a potential security risk. If a user loses or sells their device, a person in possession of the r1 could potentially jailbreak the device and gain access to files that contain logging information, chats, and photos.

To tackle the potential problem with sensitive data being left behind on the r1, Rabbit has taken the following measures:

*   A factory reset option is now available in the settings menu that lets you erase all data from the r1 prior to transferring ownership.
*   Pairing data is no longer logged to the device.
*   The amount of log data that gets stored on the device has been reduced.
*   Pairing data can no longer be used to read from the user’s Rabbithole journal section. It can only trigger actions.

Rabbit also says it is performing a full review of device logging practices to check whether additional technical controls are needed.

If you have an r1, you don’t need to do anything as the fix will be downloaded and installed automatically. While most updates to the r1 do not require any action of the user, updates that require you to accept them, including new features and more supported apps, will happen via over-the-air updates. For these, follow the prompt on your r1, make sure you’re connected to WiFi and a power source, and wait for it to update.

For those not familiar with the concept, the Rabbit r1 is an AI-powered gadget that can manage the use of your apps for you. It’s a standalone gadget with a 2.88-inch touchscreen, a rotating camera for taking photos and videos, and a scroll wheel/button designed to navigate the menu or allow you to talk to the built-in AI.

The Rabbithole mentioned earlier is an all-in-one web portal to manage the relationship with rabbit OS, and the device that you pair the r1 to. The Rabbit r1 uses a Large Action Model (LAM) to translate the user’s voice into actions on the device it’s paired with, whether that’s a handheld device, like a phone, or a desktop computer.

It’s still pretty much a project under development. Right now, the Rabbit r1 can answer questions, call an Uber, order DoorDash, play music on Spotify, translate speech, generate images on Midjourney, identify nearby objects with its camera and record voice memos. Nothing your phone can’t do, but Rabbit promises more options on the horizon and claims that all these actions are easier to accomplish when you’re using the r1.

The journal section of the Rabbithole web portal shows any visual searches you’ve conducted using the r1’s camera and voice memos you’ve recorded.

Rabbit says there’s no indication that pairing data has been abused to retrieve Rabbithole journal data belonging to a former device owner. Yet the possibility exists, and it’s good that users now have the ability to erase all data before selling the device. However, this doesn’t solve the issue if the r1 is stolen or lost.

**We don’t just report on threats – we help safeguard your entire digital identit**y

Cybersecurity risks should never spread beyond a headline. Protect your—and your family’s—personal information by using identity protection.

**Summer mega sale**

Go into your vacation knowing you’re much more secure: This summer you can get a huge **50% off a Malwarebytes Standard subscription** or **Malwarebytes Identity bundle**. Run, don’t walk!

 AI device Rabbit r1 logged user interactions without an option to erase them before selling 

This week on the Lock and Code podcast, we speak with Ali Diamond about what it felt like to find an AI image model of herself online.

_This week on the Lock and Code podcast…_

Full-time software engineer and part-time Twitch streamer Ali Diamond is used to seeing herself on screen, probably because she’s the one who turns the camera on.

But when Diamond received a Direct Message (DM) on Twitter earlier this year, she learned that her likeness had been recreated across a sample of AI-generated images, entirely without her consent.

On the AI art sharing platform Civitai, Diamond discovered that a stranger had created an “AI image model” that was fashioned after her. The model was available for download so that, conceivably, other members of the community could generate their own images of Diamond—or, at least, the AI version of her. To show just what the AI model was capable of, its creator shared a few examples of what he’d made: There was AI Diamond standing what looked at a music festival, AI Diamond with her head tilted up and smiling, and AI Diamond wearing, what the real Diamond would later describe, as an “ugly ass \*\*\*\*ing hat.”

AI image generation is seemingly lawless right now.

Popular AI image generators, like Stable Diffusion, Dall-E, and Midjourney, have faced valid criticisms from human artists that these generators are copying their labor to output derivative works, a sort of AI plagiarism. AI image moderation, on the other hand, has posed a problem not only for AI art communities, but for major social media networks, too, as anyone can seemingly create AI-generated images of someone else—without that person’s consent—and distribute those images online. It happened earlier this year when AI-generated, sexually explicit images of Taylor Swift were seen by millions of people on Twitter before the company took those images down.

In that instance, Swift had the support of countless fans who reported each post they found on Twitter that shared the images.

But what happens when someone has to defend themselves against an AI model made of their likeness, without their consent?

Today, on the Lock and Code podcast with host David Ruiz, we speak with Ali Diamond about finding an AI model of herself, what the creator had to say about making the model, and what the privacy and security implications are for everyday people whose likenesses have been stolen against their will.

For Diamond, the experience was unwelcome and new, as she’d never experimented using AI image generation on herself.

> “I’ve never put my face into any of those AI services. As someone who has a love of cybersecurity and an interest in it… you’re collecting faces to do what?”

Tune in today to listen to the full conversation.

_Show notes and credits:_

Intro Music: “Spellbound” by Kevin MacLeod (incompetech.com)  
Licensed under Creative Commons: By Attribution 4.0 License  
http://creativecommons.org/licenses/by/4.0/  
Outro Music: “Good God” by Wowa (unminus.com)

**Listen up—Malwarebytes doesn’t just talk cybersecurity, we provide it.**

Protect yourself from online attacks that threaten your identity, your files, your system, and your financial well-being with our exclusive offer for Malwarebytes Premium for Lock and Code listeners.

 How an AI “artist” stole a woman’s face, with Ali Diamond (Lock and Code S05E15) 

Hacktivists claim they have stolen 1.2 TB of data from Disney's developer Slack channels.

A group of cybercriminals going by the handle NullBulge claims to have downloaded the Slack channels used by Disney’s developers.

> “#DisneySlackLeak
> 
> #Disney has had their entire dev slack dumped. 1.1TiB of files and chat messages. Anything we could get our hands on, we downloaded and packaged up. Want to see what goes on behind the doors? go grab it.”

The group says it got a hold of a huge amount of data, including unreleased projects and login info:

> “1.2 TB of data, almost10,000 channels, every message and file possible, dumped. Unreleased projects, raw images and code, some logins, links to internal api/web pages, and more! Have fun sifting through it, there is a lot there. We tried to hold off until we got deeper in, but our inside man got cold feet and kicked us out! I thought we had something special {name}! Consider the dropping of literally every bit of personal info you have, from logins to credit cards to SSN, as a warning for people in the future.”

This seems to indicate that the group was helped by an insider, and that it might have obtained even more had that person not backed out of assisting. It’s unlikely that NullBulge had access to customer data through these Slack channels, but it does look as if the group accessed a lot of material that Disney was working on.

Calling itself a hacktivist group that aims for better compensation and protection of artists’ rights, the group then announced the breach on infamous data leak site BreachForums and provided screenshots of its findings.

Post by NullBulge on BreachForums

> “Hi there folks, it is us again.
> 
> Yesterday we leaked some small DB, now we leak the big guns.
> 
> 1.1TiB of data. almost 10,000 channels, every message and file possible, dumped. Unreleased projects, raw images and code, some logins, links to internal api/web pages, and more! Have fun sifting through it, there is a lot there.
> 
> Perfect for gathering intelligence and more.”

The earlier post NullBulge is referring to is a WordPress database dump of the howwelove\[.\]com domain. We have no idea what the group’s beef with this relationships-focused website is.

Disney is yet to make a comment. We’ll keep this post updated with the latest developments

**We don’t just report on threats – we help safeguard your entire digital identit**y

Cybersecurity risks should never spread beyond a headline. Protect your—and your family’s—personal information by using identity protection.

**Summer mega sale**

Go into your vacation knowing you’re much more secure: This summer you can get a huge **50% off a Malwarebytes Standard subscription** or **Malwarebytes Identity bundle**. Run, don’t walk!

 Disney &#8220;breached&#8221;, data dumped online 

A list of topics we covered in the week of July 8 to July 14 of 2024

July 12, 2024 - In a new malware campaign, threat actors are using Google ads to target Mac users looking to download Microsoft Teams.

July 12, 2024 - Customers of the stalkerware application mSpy had their customer support details exposed after a data breach

July 12, 2024 - AT&T has told customers about yet another data breach. This time call and text records of nearly all customers were stolen.

July 12, 2024 - Apple has sent a warning to people targeted by mercenary spyware in 98 countries.

July 8, 2024 - Shopify has denied it has suffered a breach, saying the stolen data comes from a third-party provider that will notify affected customers.

 A week in security (July 8 &#8211; July 14) 

In a new malware campaign, threat actors are using Google ads to target Mac users looking to download Microsoft Teams.

Competition between stealers for macOS is heating up, with a new malvertising campaign luring Mac users via a fraudulent advert for Microsoft Teams. This attack comes on the heels of the new Poseidon (OSX.RodStealer) project, another threat using a similar code base and delivery techniques.

Based on our tracking, Microsoft Teams is once again a popular keyword threat actors are bidding on, and it is the first time we have seen it used by Atomic Stealer. Communication tools like Zoom, Webex or Slack have been historically coveted by criminals who package them as fake installers laced with malware.

This latest malvertising campaign was running for at least a few days and used advanced filtering techniques that made it harder to detect. Once we were able to reproduce a full malware delivery chain, we immediately reported the ad to Google.

**Top search result for Microsoft Teams**

We were able to reliably search for and see the same malicious ad for Microsoft Teams which was likely paid for by a compromised Google ad account. For a couple of days, we could not see any malicious behavior as the ad redirected straight to Microsoft’s website. After numerous attempts and tweaks, we finally saw a full attack chain.

Despite showing the _microsoft.com_ URL in the ad’s display URL, it has nothing to do with Microsoft at all. The advertiser is located in Hong Kong and runs close to a thousand unrelated ads.

**Malicious redirect and payload**

We confirmed the ad was indeed malicious by recording a network capture (see below). Each click is first profiled (_smart\[.\]link_) to ensure only real people (not bots, VPNs) proceed, followed by a cloaking domain (_voipfaqs\[.\]com_) separating the initial redirect from the malicious landing (decoy) page (_teamsbusiness\[.\]org_).

Victims land on a decoy page showing a button to download Teams. A request is made to a different domain (locallyhyped\[.\]com) where a unique payload (file name and size) is generated for each visitor.

Once the downloaded file _MicrosoftTeams\_v.(xx).dmg_ is mounted, users are instructed to open it via a right click in order to bypass Apple’s built-in protection mechanism for unsigned installers.

In the video below, we show the steps required to install this malicious application, noting that you are instructed to enter your password and grant access to the file system. This may not come as unusual for someone wanting to install a new program, but it is exactly what Atomic Stealer needs to grab keychain passwords and important files.

Following the data theft is the data exfiltration step, only visible via a network packet collection tool. A single POST request is made to a remote web server (147.45.43\[.\]136) with the data being encoded.

**Mitigations**

As cyber criminals ramp up their distribution campaigns, it becomes more dangerous to download applications via search engines. Users have to navigate between malvertising (sponsored results) and SEO poisoning (compromised websites).

To mitigate such risks, we recommend using browser protection tools that can block ads and malicious websites. Often times, threat actors will rely on redirects from ads or compromised networks that can be stopped before even downloading a malicious installer.

Malwarebytes for Mac detects this threat as OSX.AtomStealer:

**Indicators of Compromise**

Cloaking domain

voipfaqs\[.\]com

Decoy site

teamsbusiness\[.\]org

Download URL

locallyhyped\[.\]com/kurkum/script\_66902619887998\[.\]92077775\[.\]php

Atomic Stealer payload

7120703c25575607c396391964814c0bd10811db47957750e11b97b9f3c36b5d

Atomic Stealer C2

147.45.43\[.\]136

 Fake Microsoft Teams for Mac delivers Atomic Stealer 

Customers of the stalkerware application mSpy had their customer support details exposed after a data breach

In a new episode of Spy vs Spy, the mobile monitoring app mSpy has suffered a data breach that exposed information about millions of its customers.

As Malwarebytes Labs has reported before, the types of companies that make mobile applications that enable users to non-consensually spy and monitor on other users are also—unsurprisingly—rather lax when it comes to their own security. This is the third known mSpy data breach since the company began in around 2010.

TechCrunch reports that in May 2024, unknown attackers stole millions of customer support tickets, including personal information, emails to support, and attachments, including personal documents.

The stolen support tickets date back to 2014, so that’s a decade’s worth of support tickets, reportedly millions of individual customer service tickets and their corresponding email addresses, as well as the contents of those emails.

Sold as a parental monitoring tool, mSpy touts itself as:

> “a hugely powerful phone monitoring app which can report on almost every area of your kid’s online activities (and one or two of the offline ones, too).”

Parental monitoring apps present their own complications—particularly when they’re used non-consensually against children—as they can give parents a near-omniscient, unfiltered view into their children’s lives, granting them access to text messages, shared photos, web browsing activity, locations visited, and call logs. Without getting consent from a child, these surveillance capabilities represent serious invasions of privacy.

The same is true when these types of apps are used against adults, and while mSpy may advertise itself now as a tool for parental safety, that wasn’t the case when it was founded.

In fact, in the early 2010s, mSpy promoted its monitoring capabilities against adults, including both in an office environment and in romantic relationships. Looking back at a 2014 archive of mSpy’s website, the company claims that, with mSpy, employers can “make sure your employees’ time is not wasted on writing personal emails.” In an earlier archived version of mSpy’s website from 2012, the company touts that its app can help you “discover if your partner is cheating on you.”

At Malwarebytes, we prefer to refer to these types of apps as “stalkerware” and as one of the founding members of the Coalition Against Stalkerware, we advise strongly against using these apps.

The Coalition Against Stalkerware defines stalkerware as tools—software programs, apps and devices—that enable someone to secretly spy on another person’s private life via their mobile device. The abuser can remotely monitor the whole device including web searches, geolocation, text messages, photos, voice calls and much more. Such programs are easy to buy and install. They run hidden in the background, without the affected person knowing or giving their consent. Regardless of stalkerware’s availability, the abuser is accountable for using it as a tool and hence for committing this crime.

TechCrunch analyzed where mSpy’s contacting customers were located by extracting all of the location coordinates from the dataset and plotting the data in an offline mapping tool. The results show that mSpy’s customers are located all over the world, with large clusters across Europe, India, Japan, South America, the United Kingdom, and the US.

If you fear your data may have been exposed in this or any other breaches, Malwarebytes has a free tool for you to check how much of your personal data has been exposed online. Submit your email address (it’s best to give the one you most frequently use) to our free Digital Footprint scan and we’ll give you a report and recommendations.

If you are looking for a way to remove stalkerware from your device, you have come to the right place. You can keep these and other threats off your mobile devices by downloading Malwarebytes for iOS, and Malwarebytes for Android today.

**Summer mega sale**

Go into your vacation knowing you’re much more secure: This summer you can get a huge **50% off a Malwarebytes Standard subscription** or **Malwarebytes Identity bundle**. Run, don’t walk!

Source

Malwarebytes