All news in category “Incidents and Data Breaches”

🔓 PayPal is notifying customers that a software error in its PayPal Working Capital loan application exposed sensitive personal information, including Social Security numbers, for nearly six months. The company says the issue, present from July 1 to December 13, 2025, was caused by a code change that was rolled back after discovery on December 12. PayPal has reset passwords for affected accounts, refunded unauthorized transactions for some users, and is offering two years of Equifax credit monitoring.

🔒 Elastic Security Labs disclosed a ClickFix campaign that leverages compromised legitimate websites to deliver a new remote access trojan named MIMICRAT. Attackers inject JavaScript to load an externally hosted PHP lure that shows a fake Cloudflare verification page and tricks victims into running a PowerShell command. A multi-stage PowerShell chain performs ETW and AMSI bypasses, then drops a Lua-based in-memory loader which decrypts shellcode to install the RAT. MIMICRAT communicates over HTTPS on port 443 using profiles that mimic web analytics and supports localized lures in 17 languages to widen impact.

🔒 The University of Mississippi Medical Center (UMMC) closed all clinic locations statewide after a ransomware attack disrupted multiple IT systems and blocked access to the Epic electronic medical record. Outpatient and ambulatory surgeries, procedures, and imaging appointments were canceled while inpatient and emergency care continue using established downtime procedures. UMMC said it has taken network systems offline, is working with the FBI and CISA, and that attackers have communicated and may be negotiating an extortion demand.

🔔 The FBI says Americans lost more than $20 million last year amid a sharp increase in ATM 'jackpotting' attacks that use malware to force cash machines to dispense money. These attacks—often leveraging Ploutus—target the ATM's software layer (the XFS interface) to bypass bank authorization and trigger withdrawals without cards. The agency urged institutions to audit ATMs for unauthorized removable storage and validate system images to detect physical intrusion and malware staging.

🛡️ A 29-year-old Ukrainian national was sentenced to five years in U.S. prison after pleading guilty to charges tied to a scheme that sold stolen U.S. identities to overseas IT workers, enabling them to secure jobs at roughly 40 American companies and funnel wages back to North Korea. Prosecutors say he operated Upworksell.com, managed hundreds of proxy identities and U.S.-based laptop farms, and was ordered to pay $46,547.28, serve 12 months of supervised release, and forfeit more than $1.4 million.

⚖️ Oleksandr Didenko, a 39-year-old Ukrainian, was sentenced to 60 months in prison and 12 months of supervised release after pleading guilty to aggravated identity theft and wire fraud conspiracy for selling stolen U.S. identities to foreign IT workers. Using the seized platform UpWorkSell, he provided at least 871 proxy identities and accounts that helped applicants secure positions with roughly 40 U.S. companies and supported multiple "laptop farms" that masked device locations. Authorities also seized more than $1.4 million in cash and cryptocurrency tied to the scheme.

🔒 Saxony's State Criminal Police Office (LKA) has created a special commission to investigate a cyberattack on the Staatliche Kunstsammlungen Dresden. The incident, reported on January 21, disrupted significant parts of the institution's digital infrastructure, including its online shop and visitor services, while the physical security systems were reportedly not affected. The Dresden Public Prosecutor General's Office is directing the investigation but has provided no further details. The SKD says it is working closely with a security firm to ensure the safety of collections and visitors.

💰 The FBI warned that 1,900 ATM jackpotting incidents have been reported since 2020, with 700 occurring in 2025 and losses exceeding $20 million last year. Threat actors deploy specialized malware such as Ploutus, often gaining physical access using generic keys to open ATM faces and then replacing or modifying hard drives to install code. The malware exploits the Windows OS and the ATM's XFS layer to issue dispenser commands directly, bypassing bank authorization and enabling rapid cash-outs across multiple ATM models. The FBI advised operators to strengthen physical protections, change default credentials, enforce device allowlisting, maintain logs, and configure automatic shutdowns when compromise indicators are detected.

🔒 Three former Google engineers and one spouse were indicted in U.S. federal court for allegedly stealing trade secrets and transferring sensitive files, including materials related to Google's Tensor processor, to unauthorized locations reportedly including Iran. The defendants — Samaneh Ghandali, Mohammadjavad Khosravi and Soroor Ghandali — are accused of exfiltrating documents to third‑party channels, copying files to personal and employer devices, and concealing their actions. They were arrested in San Jose after Google detected suspicious activity and notified law enforcement; the indictment carries multiple counts with significant prison and fine exposures.

🔐 Researchers at KnowBe4 discovered a campaign aimed at North American businesses that tricks employees into entering a “Secure Authorization” code on a legitimate Microsoft 365 login page. Unknown to victims, the code actually authorizes an attacker-controlled device through the OAuth 2.0 Device Authorization Grant, issuing access and refresh tokens that grant persistent access to Outlook, Teams, OneDrive and other services. Recommended mitigations include allowlisting OAuth apps, disabling device-code flow in Entra conditional access where feasible, auditing integrations, and ongoing employee awareness training.

🛡️ Operation Red Card 2.0, led by INTERPOL and law enforcement from 16 African nations between December 8, 2025 and January 30, 2026, targeted infrastructure and actors behind high-yield investment scams, mobile money fraud, and fraudulent loan apps. Authorities arrested 651 suspects, recovered over $4.3 million, confiscated 2,341 devices and disrupted 1,442 malicious IPs, domains and servers. The operation linked scams to more than $45 million in losses and identified 1,247 victims, underscoring the value of multinational cooperation against transnational cybercrime.

🔍 Group-IB uncovered a sophisticated campaign that impersonated Indonesia’s official Coretax service to distribute malicious Android APKs, causing an estimated $1.5m–$2m in losses nationwide. Attackers combined phishing sites, WhatsApp impersonation and vishing to coerce victims into installing RATs such as Gigabud.RAT and MMRat, enabling remote access and unauthorized banking transfers. The operation produced 996 phishing URLs, 228 new malware samples and used infrastructure that impersonated over 16 trusted brands, suggesting a scalable MaaS model.

🚨 Operation Red Card 2.0 demonstrates how synchronized public‑ and private‑sector action can disrupt transnational fraud. Between December 2025 and January 2026, authorities across 16 African countries used shared intelligence and operational coordination to identify victims, arrest operators, seize devices, and dismantle malicious infrastructure. Fortinet supported the effort through data contributions and the Cybercrime Atlas, helping turn intelligence into enforcement outcomes.

🔒 A Nigerian national, Matthew Abiodun Akande, was sentenced to eight years in prison after hacking multiple Massachusetts tax preparation firms and filing over 1,000 fraudulent tax returns seeking more than $8.1 million in refunds. Authorities say he stole clients' Social Security numbers and prior-year tax data by deploying the Warzone RAT masked with a crypter, and used convincing CEO-impersonation phishing messages with a Dropbox link to silently install malware. Akande was arrested in October 2024 at London’s Heathrow Airport, extradited to the U.S. in March 2025, and ordered to pay nearly $1.4 million in restitution plus three years of supervised release.

📞 Threat actors are combining device-code phishing and voice-based social engineering to abuse the OAuth 2.0 Device Authorization flow and compromise Microsoft Entra accounts. Instead of malicious apps, attackers leverage legitimate Microsoft OAuth client IDs and the standard device login workflow so victims unknowingly produce valid tokens and complete MFA. Security researchers suspect the ShinyHunters extortion group is involved; administrators should audit and revoke suspicious consents, disable the device code flow when not needed, and enforce conditional access policies.

🔍 A coordinated operation led by INTERPOL and the African Joint Operation against Cybercrime (AFJOC) arrested 651 suspects across 16 countries between December 8 and January 30. Authorities recovered over $4.3 million and identified 1,247 victims linked to schemes responsible for more than $45 million in losses. Investigators seized 2,341 devices, dismantled networks of fraudulent accounts and took down 1,442 malicious websites, domains, and servers.

🛡️ ThreatFabric has disclosed Massiv, a new Android trojan that impersonates IPTV apps to deliver device takeover (DTO) attacks aimed at financial theft. Distributed via SMS phishing droppers, Massiv abuses Android accessibility and MediaProjection APIs to stream screens, capture keystrokes and SMS, and deploy fake overlays that harvest banking credentials and KYC data. Operators have used stolen information to open accounts, launder money and remotely control infected devices while concealing malicious activity behind black-screen overlays.

🔒 A new Android banking trojan called Massiv is being distributed as a fake IPTV application to harvest credentials, perform keylogging, and seize remote control of infected devices. Researchers at ThreatFabric observed campaigns that targeted a Portuguese government app integrated with Chave Móvel Digital, enabling fraudsters to bypass KYC checks and open accounts in victims' names. Massiv supports live screen streaming via Android's MediaProjection API and a UI-tree mode using the Accessibility Service to extract interface elements, click controls, and bypass screen-capture protections.

🛡️ Acronis Threat Research Unit disclosed CRESCENTHARVEST, a campaign observed after January 9 that targets Farsi-speaking supporters of Iran's protests with a remote access trojan and information stealer. Attackers lure victims with protest-themed archives and double-extension .LNK shortcuts that run PowerShell to fetch a secondary ZIP while opening benign media. The payload sideloads DLLs via a Google-signed software_reporter_tool.exe, extracts Chrome app-bound keys, harvests browser and Telegram data, logs keystrokes, and communicates with a WinHTTP C2 at servicelog-information[.]com.

🔐 The author of Notepad++ says the recently released updates have hardened a previously compromised update mechanism so it is now effectively unexploitable. Releases from 8.8.9 through 8.9.2 add layered checks: the updater now verifies both the signed installer and the signed XML manifest with independent cryptographic signatures and aborts on any anomaly. The auto-updater was reinforced, though users can still opt out during installation. The developer warns no system is absolutely unbreakable, but the changes substantially raise attacker cost.