Google Warns of New Campaign Targeting BPOs to Steal Corporate Data

Tracked as UNC6783, the threat actor is likely linked to Mr. Raccoon, the hacker behind the alleged theft of Adobe data from a BPO.

The post Google Warns of New Campaign Targeting BPOs to Steal Corporate Data appeared first on SecurityWeek.

Hundreds of Salesforce Customers Allegedly Targeted in New Data Theft Campaign

Salesforce has confirmed that customers are being targeted via poorly secured instances.

The post Hundreds of Salesforce Customers Allegedly Targeted in New Data Theft Campaign appeared first on SecurityWeek.

Over 300 Malicious Chrome Extensions Caught Leaking or Stealing User Data

With more than 37 million combined downloads, the extensions expose users to tracking and personal information theft.

The post Over 300 Malicious Chrome Extensions Caught Leaking or Stealing User Data appeared first on SecurityWeek.

Chrome Extensions With 900,000 Downloads Caught Stealing AI Chats

Impersonating a legitimate extension from AITOPIA, the two malicious extensions were also exfiltrating users’ browser activity.

The post Chrome Extensions With 900,000 Downloads Caught Stealing AI Chats appeared first on SecurityWeek.

Arizona Attorney General Sues Chinese Online Retailer Temu Over Data Theft Claims

Arizona is the latest state to sue Temu and its parent company PDD Holdings over allegations that the Chinese online retailer is stealing customers’ data.

The post Arizona Attorney General Sues Chinese Online Retailer Temu Over Data Theft Claims appeared first on SecurityWeek.

Claude AI APIs Can Be Abused for Data Exfiltration

An attacker can inject indirect prompts to trick the model into harvesting user data and sending it to the attacker’s account.

The post Claude AI APIs Can Be Abused for Data Exfiltration appeared first on SecurityWeek.

F5 Says Nation-State Hackers Stole Source Code and Vulnerability Data

F5 shared few details on the threat actor, but the attack profile seems to point to China.

The post F5 Says Nation-State Hackers Stole Source Code and Vulnerability Data appeared first on SecurityWeek.

Salesforce AI Hack Enabled CRM Data Theft

Prompt injection has been leveraged alongside an expired domain to steal Salesforce data in an attack named ForcedLeak.

The post Salesforce AI Hack Enabled CRM Data Theft appeared first on SecurityWeek.

ChatGPT Targeted in Server-Side Data Theft Attack

OpenAI has fixed this zero-click attack method called ShadowLeak by researchers.

The post ChatGPT Targeted in Server-Side Data Theft Attack appeared first on SecurityWeek.

Ransomware Gang Collects Data from Blood Testing Lab

Apex Laboratory patient data was lifted and posted on a leak site.

Hey Alexa, Who Am I Messaging?

Research shows that microphones on digital assistants are sensitive enough to record what someone is typing on a smartphone to steal PINs and other sensitive info.

Insider Report: Healthcare Security Woes Balloon in COVID-Era

As hackers put a bullseye on healthcare, Threatpost spotlights how hospitals, researchers and patients have been affected and how the sector is bolstering their cyber defenses.

RansomExx Ransomware Gang Dumps Stolen Embraer Data: Report

The group published files stolen from the Brazilian aircraft manufacturer in a ransomware attack last month.

Clop Gang Gallops Off with 2M Credit Cards from E-Land

The ransomware group pilfered payment-card data and credentials for over a year, before ending with an attack last month that shut down many of the South Korean retailer’s stores.

Electronic Medical Records Cracked Open by OpenClinic Bugs

Four security vulnerabilities in an open-source medical records management platform allow remote code execution, patient data theft and more.

Code42 Incydr Series: Why Most Companies Can’t Stop Departing Employee Data Theft

According to Code42’s Data Exposure Report, 63% of employees say they brought data with them from their previous employer to their current employer.

Fitbit Spyware Steals Personal Data via Watch Face

Immersive Labs Researcher takes advantage of lax Fitbit privacy controls to build a malicious spyware watch face.

TikTok Fixes Flaws That Opened Android App to Compromise

The flaws are disclosed as Oracle reportedly partners with TikTok as concerns in the U.S. over spying continue.

Transparent Tribe Mounts Ongoing Spy Campaign on Military, Government

The group has added a management console and a USB worming function to its main malware, Crimson RAT.

Google Chrome Browser Bug Exposes Billions of Users to Data Theft

The vulnerability allows attackers to bypass Content Security Policy (CSP) protections and steal data from website visitors.