Email security

Hardware cryptocurrency wallet Trezor had its automated support system exploited to facilitate cryptocurrency theft as part of a new phishing campaign, according to BleepingComputer.

BleepingComputer reports that all users of the German free privacy-focused email hosting server Cock.li since 2016 amounting to more than 1 million individuals were confirmed to have had their information compromised following a breach stemming from the exploitation of vulnerabilities impacting its deprecated Roundcube webmail platform.

CNN reports that the Washington Post had some of its journalists' email accounts subjected to a possible targeted cyberattack on Thursday.

Attackers exploiting a critical Roundcube webmail software vulnerability concealed for a decade could achieve vulnerable system takeovers and arbitrary code execution, according to The Hacker News.

More than 90% of the top 1.8 million email domains worldwide could be compromised in spoofing attacks, as only 7.7% of the said domains have adopted the most extensive Domain-based Message Authentication, Reporting, and Conformance policy dubbed 'p=reject', reports Infosecurity Magazine.

Intrusions with spear-phishing emails and geofenced payloads have been deployed by suspected Indian state-sponsored advanced persistent threat operation Sidewinder to compromise various government entities in Bangladesh, Pakistan, and Sri Lanka with the StealerBot malware, reports The Hacker News.

While most of the victims are based overseas, security pros say it’s plausible the group will also target North America.