Weekly Email Security News Recap #3 [July 2022]
Cybersecurity issues make the news every single day with new and evolving threats a great concern to government authorities, big businesses, and individuals.
Email phishing alone remains a top concern for IT specialists. The only way to stay ahead of cybersecurity threats is to keep up to date with the latest headlines and ensure ample security measures are in place.
Read on for the week’s top cybersecurity news and email security news.
70,000 Email Addresses of Mental Health App Users Exposed
Popular mental health app Feelyou announced a platform vulnerability that exposed the email addresses of its 78,000 users in 177 countries.
Maia Arson Crimew, a security researcher, discovered the issue while reverse engineering several mental health trackers and similar apps.
After finding the vulnerability on the Feelyou platform, Maia contacted The Daily Dot (a digital media company), which announced it.
The journaling and mood tracking app is owned by Japan-based company Bajji.
Until last week, anyone could acquire users’ email addresses and link them to anonymous posts by simply accessing the app’s GraphQL application programming interface without any authentication.
Bajji founder Noritaka Kobayashi commented on the issue, saying the security issue existed since January 25th. He claimed that no proof about the attack had been found.
Kobayashi stressed that the app did not collect personal data of its users, such as:
- Names
- Genders
- Phone numbers
- Country, addresses
- Birth dates
- Credit card info
In a blog post in its app, Feelyou informed its users that the vulnerability is now patched.
Sophisticated PayPal Phishing Scam Leads to Complete Identity Theft
American content delivery network, cybersecurity, and cloud service company Akamai Technologies broke news this week about an elaborate PayPal phishing scam.
They detailed information on the sophisticated scam, where threat actors exploit vulnerable WordPress sites to commit extensive identity theft. Using brute force, the attackers breach such sites and inject the malicious phishing kit via a file management plugin.
The cybercriminals then use a fake PayPal login page, deceptively similar to the real one, to trick targets into providing sensitive data.
But the attackers aren’t only interested in victims’ login credentials; they also mimic legitimate security measures to trick victims into freely handing over confidential data like:
- Passports
- Social security numbers
- Credit card information
- Driver’s licenses
- Selfies
Akamai security researchers said they first detected the phishing kit after it occurred on one of their WordPress honeypots. Interestingly, they also found the threat actors using advanced measures to evade cybersecurity firms and avoid exposure. The phishing kit cross references known IP addresses and the cybercriminals also rewrite URLs that contain “.php” at the end to appear more legitimate to victims.
Google LLC Fined Over $358 Million for Failing to Remove Banned Data
According to a report by Roskomnadzor, Russia’s internet watchdog, Google and YouTube have failed to remove or restrict access to ‘prohibited materials’ in the country.
The Russian IT controller requested the removal numerous times.
After this, a court in Moscow charged a fine of $358 million on Google LLC for failing to restrict access to the following:
- Content about extremism and terrorism
- Information on “Special military operations” in Ukraine
- Content about harmful acts on the life and health of children
- Content promoting participation in unauthorized mass actions
Russia’s telecommunications watchdog Roskomnadzor fined Google LLC $1.2 million last month for not removing the restricted data violating numerous parts of Russia’s Code of Administrative Offenses
The Russian court-ordered fine would be revenue-based for violating the same legal requirement, reaching 10% of the firm’s annual turnover in the country.
Roskomnadzor explains that the $358 million fine was calculated based on the company’s annual trade turnover in Russia.
Russian users of Google Search, YouTube, and even Twitch will now see a warning about the platforms violating the law. The users won’t have permission to place advertisements, either.
Final Thoughts
Statistics show that up to 81% of companies worldwide have experienced a growth in email phishing attacks since March 2020.
Data breaches increase daily because of a lack of cybersecurity awareness; this is why we deliver weekly news reports and in-depth blogs on various cybersecurity topics, keeping you updated, aware, and knowledgeable.
Secure your domain and stay protected from cyberattacks!
The post Weekly Email Security News Recap #3 [July 2022] appeared first on EasyDMARC.
*** This is a Security Bloggers Network syndicated blog from EasyDMARC authored by Knarik Petrosyan. Read the original post at: https://easydmarc.com/blog/weekly-email-security-news-recap-3-july-2022/
