Phishing

ISIS, Enron, Tor, Scams, Wintermute, Zabbix, Josh Marpet and more on the Security Weekly News.

Threat actors commenced attacks by distributing phishing emails with a malicious Microsoft Excel file, which leverages the CVE-2017-0199 and CVE-2017-11882 vulnerabilities to deliver the Ande Loader, according to an analysis from Fortinet FortiGuard Labs.

The corrupted files evade security systems but are easily recovered to deliver phishing links.

Threat actor uses leveraging the Rockstar 2FA phishing-as-a-service and bypasses MFA.

Such an operation has prompted increased awareness of the growing prevalence of stablecoin theft, noted Interpol, which has committed to continuing the South Korea-backed cybercrime crackdown operation.

Security pros warn retailers to monitor APIs for irregularities to guard against sudden price fluctuations or inventory control issues.

Between August and October, the detection of fraudulent e-commerce sites rose by 110%, with tens of thousands of these hosted on SHOPYY, a Chinese e-commerce platform exploited by cybercriminals.

Phishing attacks continue to dominate the security landscape, though other avenues for cybercrime are seeing growth in popularity.