{"id":74270,"date":"2023-12-31T12:00:00","date_gmt":"2023-12-31T20:00:00","guid":{"rendered":"https:\/\/cyberguy.com\/?p=74270&preview=true&preview_id=74270"},"modified":"2023-12-31T13:23:04","modified_gmt":"2023-12-31T21:23:04","slug":"worst-malware-security-privacy-breaches-2023","status":"publish","type":"post","link":"https:\/\/cyberguy.com\/security\/worst-malware-security-privacy-breaches-2023\/","title":{"rendered":"The worst malware, security, and privacy breaches of 2023"},"content":{"rendered":"
\n
\n

2023 was quite a rollercoaster ride when it came to cybersecurity. Cybercriminals continue on a rampage, taking advantage of weaknesses in all sorts of devices, platforms, and networks. From sneaky phishing tricks to dreaded malware infections and data breaches, it felt like we were under constant siege. It’s safe to say that the security and privacy of millions of people were compromised. Here are some of the worst malware, security, and privacy breaches of this past year.<\/span><\/p>\n<\/div>\n<\/div>\n

\n
\n

 <\/p>\n<\/div>\n<\/div>\n

1) Russian cyber group Star Blizzard unleashes a global spear-phishing attack<\/a>\"\"<\/h2>\n

A Russian hacking group tied to the Kremlin unleashed a global attack. They use what appear to be links to innocent websites to steal information. These hackers from Star Blizzard, which formerly operated as SEABORGIUM, are also known as Callisto Group\/TA446\/COLDRIVER\/TAG-53\/BlueCharlie. <\/span><\/p>\n

The dangerous group targets anyone who might have information they can use. They even went after the U.S. government. For the most part, <\/span>Star Blizzard has attacked people tied to academics, defense, government organizations, and more in the U.S. and the U.K. According to the U.S. Cybersecurity and Infrastructure Security Agency, the group is also targeting NATO members and countries near China.<\/p>\n

Read more\u00a0<\/a><\/p>\n

 <\/p>\n

2) Guard your passwords: CherryBlos & FakeTrade malware threaten Androids<\/a><\/h2>\n
\"fake

Credit: Trend Micro<\/p><\/div>\n

Two related malware campaigns target Android users interested in cryptocurrencies or online income opportunities. The first campaign uses phishing websites to trick users into downloading apps that contain the CherryBlos malware. This malware can steal your cryptocurrency wallet credentials and replace your withdrawal address with the attacker\u2019s.<\/p>\n

The second campaign uses fake money-earning apps that contain the FakeTrade malware. These apps promise you increased income, but they will not let you withdraw your funds. Both campaigns use fake posts on popular platforms like TikTok, Twitter, and Telegram to lure you into their traps.<\/p>\n

Read more\u00a0<\/a><\/p>\n

 <\/p>\n

3) Massive cyberattack strikes millions of Americans: Are you at risk?<\/a><\/h2>\n

\"\"<\/p>\n

Millions of Americans faced a significant threat to their personal data as a result of a massive cyberattack targeting the widely used file-transfer program known as MOVEit. The impact was vast, even compromising residents of Louisiana and Oregon who possessed driver’s licenses or state identification cards, and there were concerns among officials that the number of affected individuals could increase sizably. Moreover, this breach had far-reaching consequences, impacting numerous firms and organizations, including multinational corporations, federal and state agencies, and universities.<\/p>\n

Read more\u00a0<\/a><\/p>\n

 <\/p>\n

MORE: TOP IDENTITY THEFT SCAMS TO AVOID\\<\/strong><\/a><\/p>\n

 <\/p>\n

4) Facebook accounts hit with malicious ad attack with dangerous malware<\/a><\/h2>\n
\"\"

Credit: Bitdefender Labs<\/p><\/div>\n

In an alarming revelation, Bitdefender Labs had uncovered a sinister turn in cybercrime tactics on Facebook. Hackers used a virus called NodeStealer to steal cookies and passwords<\/a>. It\u2019s a sneaky piece of code that runs on JavaScript and Node.js, and it can grab your web browser data and use it to hack into your Facebook account.<\/p>\n

How do they do it? Well, they use cunning malvertising campaigns<\/a>, which are\u00a0fake ads that look like they\u2019re from Meta, the company that owns Facebook. When you click on these ads, you\u2019re actually downloading the NodeStealer virus, which then starts to spy on your online activity.<\/p>\n

Read more\u00a0<\/a><\/p>\n

 <\/p>\n

MORE: DON’T FALL FOR THAT “LOOK WHO DIED” FACEBOOK MESSAGE TRAP\u00a0<\/a><\/strong><\/p>\n

 <\/p>\n

5) Beware of this new Mac malware targeting your data and devices<\/a><\/h2>\n

\"person<\/p>\n

In the grand scheme of cyber threats, a new villain emerged from the shadows, targeting none other than our beloved Mac users. With a penchant for pilfering passwords, greed for grabbing crypto, and a propensity for pocketing personal data, this digital bandit goes by the name “Realst.” Masked behind the guise of counterfeit blockchain games, it poses an ominous threat to your virtual safety.<\/p>\n

“Realst” isn’t just your run-of-the-mill malware – oh no – it’s a crafty chameleon in the world of cybercrime, vetting its victims through seemingly innocent game access codes shared over social media or direct messages. “Realst” doesn’t just have one form but 16 distinct variants that it uses to carry out its malicious activities.<\/p>\n

Read more\u00a0<\/a><\/p>\n

 <\/p>\n

6) The new iPhone security threat that allows hackers to spy on your phone<\/a><\/h2>\n
\"A

Credit: Apple<\/p><\/div>\n

A troubling new vulnerability in iOS now allows hackers to spy on you through your keyboard. Certo Software<\/a> released a report revealing how cybercriminals are avoiding Apple’s stringent security measures to steal your information.<\/p>\n

Essentially, what hackers are doing is installing a third-party keyboard that features a keylogger into your iPhone. They’ll disguise that keylogger in a small app and use Apple’s TestFlight tool for app developers to bypass Apple’s security checks. Hackers are hoping you download those apps and turn over your own information.<\/p>\n

Read more\u00a0<\/a><\/p>\n

 <\/p>\n

7) Mac users beware of new malware targeting your confidential information<\/a><\/h2>\n

\"person<\/p>\n

If you thought your Mac was invincible, it’s time to reconsider. A sneaky malware is on the prowl, ready to snatch your personal information and dash away with your credit card details. The malware goes by the name of ShadowVault, and it isn’t just your garden-variety cyber-thief. It insidiously goes about its business on compromised Mac devices, siphoning off valuable info such as usernames and passwords, stored credit card info, data from crypto wallets, and more. The worst part? Criminals can subscribe for 500 dollars a month to access and use this malware. Cyber security firm Guardz discovered the ShadowVault malware through the XSS forum on the dark web, where it was being offered to anyone who was willing to pay the $500 bucks per month to rent the malware.<\/p>\n

Read more\u00a0<\/a><\/p>\n

 <\/p>\n

8) Massive free VPN data breach exposes 360M records<\/a><\/h2>\n
\"1-SUPERVPN\"

Credit: Apple App Store (Qingdao Leyou Hudong Network Technology Co)<\/p><\/div>\n

Cybersecurity researcher Jeremiah Fowler discovered and reported that over 360 million user data records have been leaked in a breach with the free VPN service SuperVPN. These records contained tons of personal information, including email addresses, original IP addresses, geolocation records, unique user identifiers, references to visited websites, and more.<\/p>\n

Fowler did an enormous amount of research<\/a> and found one key detail that was quite concerning. He noticed that the smartphone app for SuperVPN was listed under different developers depending on the App Store it was downloaded from.<\/p>\n

The Google Play Store version was credited to SuperSoft Tech, while the Apple App Store version was credited to Qingdao Leyou Hudong Network Technology Co. Both companies seem to have connections to China as the notes for each are written in Mandarin, which serves as the official language of the country. Fowler then discovered a publicly exposed database linked with the SuperVPN app containing 133 GB of data.<\/p>\n

Read more\u00a0<\/a><\/p>\n

 <\/p>\n

9) Beware of fake browser updates on your Mac<\/a><\/h2>\n
\"\"

Credit: Malwarebytes<\/p><\/div>\n

If you use a Mac, you may have seen pop-ups or notifications urging you to update your web browser. But before you click on them, you should know that they could be part of a malicious malware campaign called ClearFake, which is designed to steal your personal data.<\/p>\n

ClearFake is the name given to a malware campaign that uses fake browser updates to infect your Mac with a credential stealer called Atomic Stealer.<\/strong> This campaign was first discovered by security company Malwarebytes in their threat research report. According to Malwarebytes, ClearFake is one of the first social engineering campaigns that targets both Windows and Mac users with fake browser updates.<\/p>\n

Read more\u00a0<\/a><\/p>\n

<\/h2>\n

10) Despite an FBI takedown, the infamous Raccoon Stealer malware returns<\/a><\/h2>\n

\"person<\/p>\n

In the world of digital wrongdoing, it seems some cyber pests never really go extinct. Remember Raccoon Stealer<\/a>? If you don’t, it is a malware strain, and you might want to brace yourself. It’s back, it’s bolder, and it’s up to no good\u2014again.<\/span><\/p>\n

Picture this: A malware so astute it pilfers data from 60 applications. We’re talking login details, credit card numbers, those treasured browser histories you thought were safe, and even the ever-popular cryptocurrency accounts. <\/span><\/p>\n

Now, what if I told you that this notorious service was available to any aspiring hacker for a mere $200 subscription a month? It’s the Netflix of cybercrime, except you get stolen credentials instead of shows.\u00a0<\/span><\/p>\n

Read more<\/a><\/p>\n

 <\/p>\n

So, how do you g<\/span>uard your digital domain?<\/h2>\n

Have strong passwords: <\/strong>Using the same password across multiple platforms will always make you more vulnerable because if one account gets hacked, they all get hacked. \u00a0Use a password manager<\/a> to keep track of all your passwords. Instead of relying on a single password, which, if stolen, can expose you.\u00a0<\/span><\/p>\n

Use 2-factor authentication:<\/strong> -Implementing 2-factor authentication<\/a> is just an extra shield that will prevent a hacker from getting into your accounts.<\/p>\n

Have good antivirus software on all your devices: <\/strong>The best way to protect yourself from malware like this is to install antivirus protection on all your devices. Having antivirus software on your devices will make sure you are stopped from clicking on any potential malicious links that may install malware on your devices, allowing hackers to gain access to your personal information.<\/p>\n

Special Back to School offer for CyberGuy Readers:\u00a0\u00a0<\/b>My #1 pick is\u00a0TotalAV<\/a>, and you can get a limited-time deal for CyberGuy readers: $19 your first year (80% off) for the TotalAV Antivirus Pro package.<\/span><\/a><\/p>\n

Find my review of Best Antivirus Protection here<\/a><\/p>\n

Best Antivirus Protection 2023<\/a><\/p><\/blockquote>\n