Kimsuky Stealing Emails, NPM Cards Discord, IP Camera Hack, and more.

Infosec Overnights - Daily Security News

A daily look at the relevant information security news from overnight - 29 July, 2022
Episode 276 - 29 July 2022
Kimsuky Stealing Emails- https://www.bleepingcomputer.com/news/security/cyberspies-use-google-chrome-extension-to-steal-emails-undetected/
NPM Cards Discord -
https://www.infosecurity-magazine.com/news/malicious-npm-packages-steal/
Trojan Play Store Apps -
https://thehackernews.com/2022/07/over-dozen-android-apps-on-google-play.html
Phishing Countdown- https://www.zdnet.com/article/this-phishing-attack-uses-a-countdown-clock-to-panic-you-into-handing-over-passwords/
IP Camera Hack -
https://thehackernews.com/2022/07/dahua-ip-camera-vulnerability-could-let.html
Hi, I’m Paul Torgersen. It’s Friday July 29th, 2022 and this is a look at the information security news from overnight.
From BleepingComputer.com:
A North Korean-backed threat group tracked as Kimsuky is using a malicious browser extension to steal emails from Google Chrome or Microsoft Edge users reading their webmail. The malware, called SHARPEXT supports Chrome, Edge and Whale browsers and can steal mail from Gmail and AOL accounts. Details in the article.
From InfoSecurity-Magazine.com:
Researchers have discovered a supply chain attack using malicious npm packages, this time targeting Discord users. The purpose of the campaign, named LofyLife, appears to be to steal Discord tokens and users’ credit card data. Kaspersky said it identified four suspicious packages which feature obfuscated Python and JavaScript code. Details and a link to the write up inside.
From TheHackerNews.com:
Another 17 so-called productivity apps have been uncovered and removed from the Google Play store. The apps did perform some basic tasks they advertise, but they were also dropping in malicious apps like Octo, Hydra, Ermac, and TeaBot. See the full list of affected apps in the article and make sure you delete those puppies.
From ZDNet.com:
A new phishing attack has taken a page out of the ransomware playbook by using a countdown clock to pressure victims into entering their username and password. At the end of the countdown they would be permanently locked out of whatever account is being targeted. Obviously nothing actually changes when the countdown reaches zero, but for some less sophisticated users, this could be very compelling.
And last, from TheHackerNews.com:
A security vulnerability in Dahua's Open Network Video Interface Forum standard implementation (ONVIF), can lead to a threat actor seizing control of IP cameras. ONVIF governs an open standard for how IP-based physical security products communicate with one another in a vendor-agnostic manner. I’m sure you can understand how some nation-state bad guys would be very interested in tapping into live video feeds. Get your patch on kids.
That’s all for me. Have a great weekend. If you like this podcast, please spread the word, and until next time, be safe out there.