Each week, the PhishLabs team posts The Week in Cybercrime (TWIC) to recap noteworthy cybercrime articles and reports (open source).
One-man operation leverages phishing and browser alerts to distribute new variant of Zeus banking Trojan (PhishLabs)
The PhishLabs’ R.A.I.D. has discovered a new variant of Zeus deployed through fake browser alerts. Victims are initially targeted through phishing scams purporting to deliver a file through Google Documents.
‘Poodle’ Bug Returns, Bites Big Bank Sites (KrebsOnSecurity)
Many of the nation’s top banks, investment firms and credit providers are vulnerable to a newly-discovered twist on a known security flaw that exposes Web site traffic to eavesdropping.
Payment gateway provider breached (HelpNetSecurity)
New Jersey-based Charge Anywhere, whose electronic payment gateway solutions route payment transactions from merchants’ Point-of-Sale (PoS) systems to their payment processors, has announced that they have suffered a breach that may have affected payment card data from as far back as late 2009.
Chase Breach: Fear of Phishing (BankInfoSecurity)
Account data and payment card information wasn't compromised as part of the massive breach that struck banking giant JPMorgan Chase. As part of the attack, hackers accessed personally identifiable information stored by Chase about some 76 million households and 8 million businesses.
Alibaba Marketplace Vulnerability Puts Millions Of Shoppers at Risk (TheHackerNews)
Alibaba Group has patched a major security vulnerability in one of its e-commerce portals that exposed account details of tens of millions of Merchants and shoppers to cyber criminals.
Microsoft pulls a patch and offers PHANTOM FIX for the mess (TheRegister)
Another Patch Tuesday, another mess for Microsoft, which has pulled update 3004394, aka “December 2014 update for Windows Root Certificate Program in Windows”. Redmond says the patch “is causing additional problem on computers that are running Windows 7 Service Pack 1 (SP1) and Windows Server 2008 R2 SP1. This includes the inability to install future updates.
iCloud attack is blunt and obvious (ZDNet)
A man-in-the-middle (MITM) attack in China against logins to Apple's iCloud is easily-detected by web browsers, but appears sophisticated in other ways.