2-Spyware
What are you dealing with?
Pop-ups & adwareunwanted ads, push notificationsBrowser hijackerschanged homepage, redirectsRansomwarelocked or encrypted filesTrojans & backdoorshidden remote accessSpyware & keyloggersstolen passwords and dataScam emailsfake invoices, extortion, phishingFake alerts"your PC is infected" pagesRogue anti-spywarefake security tools that pretend to be realSuspicious filesis this .exe or process safe?Unsafe websitescheck a link before you open it
Community
Data breachesThe Record reports that medical device maker iRhythm said data on at least 360,000 people was breached in a June cyberattack. The stolen information includes names, addresses, phone numbers, patient account numbers, device serial numbers, insurance numbers, dates of service and dates of birth. iRhythm says the attack did not affect its devices or operations, but affected people should watch their accounts and be alert for misuse of their personal information.
Malware newsSecurityWeek reports that Bitdefender found Midnight Mimosa, a campaign that ships malware preinstalled in the firmware of low-cost Android devices built on MediaTek platforms. The malware can silently install and remove apps, grant permissions, and load code remotely, and some related apps were also found on Google Play. Windows users should be cautious with cheap devices and avoid installing apps from untrusted sources.
Scam alertsThe CyberScoop reports that authorities have indicted MonsterCloud owner Zohar Pinhasi, accusing him of charging ransomware victims inflated fees while claiming to use proprietary recovery tools that did not exist. Prosecutors say he paid cybercriminals to recover data without telling clients, and that the company drew in hundreds of clients with false promises. Windows users and small offices hit by ransomware should be careful about who they trust for recovery and verify any claims before paying.
Exploited flawsSecurityWeek reports that Citrix is urging immediate patching of a critical NetScaler vulnerability that could lead to remote code execution or denial of service. The flaw affects NetScaler ADC and NetScaler Gateway appliances in specific SAML configurations, as well as Secure Private Access Hybrid deployments. Citrix says it is not aware of unmitigated exploits, but users should update to the fixed versions as soon as possible.
Daniel ReevesOne Windows setting worth checking after a scare: Windows Security > Virus & threat protection > Protection history. If something was blocked or removed, it often tells you whether the problem was a real threat or just a noisy browser tantrum. Saves a lot of guesswork, which is nice for a change.Malware newsMalwarebytes Labs reports that attackers compromised infrastructure behind the .gh, .sl, and .as country-code domain namespaces and used it to obtain unauthorized HTTPS certificates for Google domains and other organizations. Google blocked the certificates in Chrome and worked with certificate authorities to revoke them. Windows users should keep their browser and operating system updated and never bypass certificate warnings.
Ray DunbarGot a weird e-mail on my Windows 10 PC this morning. Said my Microsoft account was locked and I had 24 hours to verify or lose access. The sender looks off, and the link smells bad. I didn’t click it. Is this a common scam, or should I check anything in Windows or my account?
Browser securityChrome OS has received a Long Term Support Channel update to version 150.0.7871.256. Google says it includes selected security fixes, including issues in Browser, Omnibox, Extensions, WebRTC, GPU, PDF, and other components. Devices in the LTC channel will be updated to this version, so users should install it when it arrives.
Exploited flawsSecurityWeek reports that TP-Link has disclosed five vulnerabilities in its Aginet line of ISP-managed mesh systems, routers and modems. The bugs can let an attacker on the same network take over an affected device, create a super-administrator account, enable SSH access, or recover passwords and Wi-Fi credentials from configuration files. TP-Link says firmware updates are distributed by ISPs, so users should check the device management interface or app for updates and contact their ISP if none are available.
Scam alertsGraham Cluley reports that UK losses from hacked email and social media accounts have risen by 417%, with scammers posing as your friends to sell tickets to gigs that do not exist. The post says this is part of a big rise in cyber scams stealing social media accounts. Home users should be careful with messages from friends that ask for money or tickets, and check requests through another channel before paying.
Ethan ColeThat’s a worrying result, because a safety feature should not make harmful prompts easier to follow. It really shows why watermarking and prompt-safety need careful testing together before people rely on them.Data breachesSecurityWeek reports that Oracle Health says personal and medical information from its legacy Cerner systems was compromised in a cyberattack. The data may have included names, Social Security numbers, and medical record details such as diagnoses, medicines, test results, images, and care information. People affected should watch for suspicious account activity and follow any notice from Oracle Health or their healthcare provider.
Hannah PriceThat is worrying, especially if they’re using browser cache pre-fetching to make the first signs less obvious. I’d be checking Windows updates, keeping an eye on anything odd in the browser, and being extra careful with unexpected prompts before clicking anything. https://www.2-spyware.com/clickfix-attacks-evolve-to-better-hide-malicious-payloads.html
Jessica LaneJust got a weird “account security alert” email on my Windows 11 laptop saying a login had been blocked and I needed to verify my details right away. The sender looked close enough to the real company name, but the message felt rushed and the link preview was off. Has anyone else seen these lately, and what do you check first?