Hacking News

T-Mobile disclosed that hackers stole addresses, phone numbers, and birthdates from 37 million customers, PayPal notified ~35,000 users that a credential stuffing attack exposed Social Security numbers and tax IDs, and a new Android banking malware called Hook emerged with full device takeover capability — allowing attackers to see your screen, control your device, steal crypto wallet seed phrases, and read your WhatsApp messages in real time.

Stories Covered

PayPal Credential Stuffing Attack Exposes SSNs and Tax IDs for 35,000 Users

PayPal distributed data breach notifications disclosing a credential stuffing attack that occurred December 6–8, 2022. Approximately 35,000 accounts were compromised. A credential stuffing attack does not exploit any vulnerability in PayPal’s systems: attackers take username and password combinations from previous data breaches elsewhere on the internet, automate login attempts against PayPal, and succeed wherever a victim reused the same password across multiple sites. PayPal confirmed it found no evidence of a flaw or misconfiguration on its own platform — the attack succeeded entirely because victims used the same credentials on PayPal that had already been exposed in other breaches. For affected accounts, attackers had access to names, dates of birth, Social Security numbers, addresses, and individual tax identification numbers — the categories of data useful for identity theft rather than just financial fraud. PayPal responded by resetting affected passwords, requiring a password change on next login, and offering affected users two years of Equifax identity monitoring. The defense is the same as it has always been: unique passwords for every account, managed via a password manager so the uniqueness is practical rather than theoretical. A credential stuffing attack cannot work against an account whose password is not reused anywhere else.

T-Mobile’s Latest Breach: 37 Million Customers, a Years-Long Pattern of Incidents

T-Mobile filed a report with the Securities and Exchange Commission disclosing a security breach affecting approximately 37 million customers. The stolen data included addresses, phone numbers, and dates of birth; T-Mobile stated that passwords, PINs, credit card numbers, Social Security numbers, and bank account information were not accessed. The breach occurred in late November 2022. This disclosure is notably the sixth T-Mobile security incident in roughly four years. In August 2018, a vulnerable API exposed data on 2 million customers. In November 2019, roughly 1 million prepaid customers had account information stolen. In March 2020, hackers breached an employee email account to access customer data. In January 2021, an incident exposed SIM swap-adjacent account data. In August 2021, the worst incident to date exposed names, driver’s license numbers, Social Security numbers, birthdates, prepaid PINs, addresses, and phone numbers for millions of customers — discovered only after a hacker posted the dataset for sale on an underground forum. The current incident adds addresses, phone numbers, and birthdates to what attackers already hold from prior incidents. Even absent financial data, the combination of name, address, phone number, and birthdate is sufficient to enable targeted phishing, SIM swapping, and identity theft operations against affected customers. A carrier that has experienced six security incidents in four years represents a systemic risk for its customers regardless of what specific data categories any single incident exposed.

Hook: New Android Banking Malware With Device Takeover, Crypto Wallet Theft, and WhatsApp Access

ThreatFabric researchers analyzed Hook, a new Android banking malware advertised by its creator, Duke Eugene — the same actor behind ERMAC. Hook was marketed as written from scratch and representing a new generation of capability, though ThreatFabric found the code shares substantial architecture with ERMAC. What is genuinely new in Hook is the combination of capabilities that places it at the same threat tier as Hydra and Octo, the two most dangerous Android banking malware families in terms of device control. Hook adds Virtual Network Computing support, allowing operators to see the victim’s screen in real time, and abuses Android Accessibility Services to interact with UI elements — clicking buttons, filling in text fields, navigating applications. The combination of screen viewing and UI control constitutes a full device takeover: anything a person with physical access to the device could do, Hook can do remotely. Communication with the command-and-control server uses WebSockets rather than the polling method used by older malware families, enabling real-time bidirectional communication that allows operators to issue commands and receive responses without waiting for the next polling interval. Beyond standard device takeover capabilities, Hook can extract seed phrases from cryptocurrency wallets — the recovery phrase that allows anyone who has it to recreate the wallet and drain its contents — and can read and send messages from WhatsApp. Hook is being rented by Duke Eugene as malware-as-a-service. For Android users: avoid sideloading applications outside the Google Play Store, keep Android security updates current, and review which apps have been granted Accessibility Service permissions — legitimate apps rarely need this and malware consistently abuses it.

Listen to the Episode

Security researchers gained admin access to Reviver’s backend and could track the GPS location of every digital license plate in California, Canada’s regulators reclassified stablecoins as securities forcing Tether off Crypto.com, a critical RCE vulnerability in the JsonWebToken library threatens over 22,000 projects, and a SugarCRM zero-day allowed attackers to take full server control — already hitting 12% of exposed instances before a patch was available.

Stories Covered

California Digital License Plates Had an Admin Backdoor That Let Anyone Track Every Car

Security researchers discovered that Reviver — the company behind digital license plates approved for use in California — had a backend administrative account type that, once accessed, allowed a researcher to do significantly more than just view plates. With admin access, the researcher could track the GPS location of any plate in real time, modify the personalized message displayed on the bottom of any plate, and update or delete any plate in the system. California has permitted digital license plates for some time; Reviver markets them as the modern successor to traditional stamped metal plates, with features including GPS tracking for vehicle recovery and customizable display text. The same features that make the plates useful to vehicle owners — remote tracking, remote update capability — become attack surface when the administrative controls behind them are accessible. The researchers reported the vulnerability responsibly to Reviver, which patched the issue promptly. The existence of a privileged account type with this level of access across the entire fleet is consistent with what developers and testers implement for backend system maintenance, but any such account represents a high-value target: gaining it would have given an attacker persistent visibility into the physical location of every Reviver-equipped vehicle in California without the individual vehicle owners knowing.

Canada Reclassifies Stablecoins as Securities, Tether Delisted From Crypto.com Canada

The Canadian Securities Administrators (CSA) published its position that stablecoins — cryptocurrencies pegged to external assets like the US dollar — should be treated as securities or derivatives rather than currency. The Ontario Securities Commission enforcing this position meant that Tether (USDT), the largest stablecoin by market capitalization and the third-largest digital asset overall, could no longer be offered on regulated Canadian exchanges without complying with securities regulations it had not previously been subject to. Crypto.com announced it would delist Tether in Canada by January 31st, converting any remaining user balances to USD Coin (USDC), a stablecoin issued by Circle, a registered US money service business already operating under regulated frameworks. The distinction matters: USDT and USDC both claim a 1:1 peg to the US dollar, but Tether has faced prior legal scrutiny over whether its reserves actually back its outstanding supply at the stated 1:1 ratio. USDC, by contrast, operates under regulatory visibility that gives it a cleaner compliance profile. The Canadian move is part of a broader global pattern of regulators attempting to assert jurisdiction over crypto assets that exist outside traditional securities definitions — with stablecoins being particularly targeted because their dollar-pegged nature makes them functional substitutes for fiat currency in ways pure cryptocurrencies are not.

JsonWebToken CVE-2022-23529: RCE in a Library With 10 Million Weekly Downloads

A high-severity remote code execution vulnerability was disclosed in the JsonWebToken (JWT) library, tracked as CVE-2022-23529 and patched in version 9.0.0. The JWT library is developed and maintained by Auth0 (owned by Okta) and is one of the most widely deployed authentication libraries in the Node.js ecosystem — it has over 10 million weekly downloads on NPM and is used by more than 22,000 projects. Any application running JWT version 8.5.1 or below is potentially vulnerable to remote code execution, meaning an attacker could run arbitrary code on the server hosting the application without requiring valid credentials or prior access. The disclosure underscores the supply chain risk pattern: rather than attacking a single application, finding a critical vulnerability in a widely-used library creates simultaneous exposure across thousands of codebases. Developers running any version of jsonwebtoken below 9.0.0 should update immediately. This is not a vulnerability that benefits from a wait-and-see approach — the library is so widely distributed that exploitation attempts against unpatched instances were essentially certain to follow the public disclosure.

SugarCRM Zero-Day: Authentication Bypass and Full Server Takeover, 12% of Servers Hit

A zero-day vulnerability in SugarCRM — a customer relationship management platform used by businesses — was publicly disclosed in late December 2022 and exploited in the wild before a patch was available. The vulnerability is an authentication bypass flaw: attackers could send commands to the server without needing to log in. Once bypassing authentication, the attack chain involved manipulating a server-side file to obtain a session cookie, then using that cookie to upload a malicious image file containing embedded code. The code in the image established a remote session on the server, giving the attacker full control. From that position, attackers can install persistent backdoors, launch further attacks using the compromised server’s resources, and access or exfiltrate any data the SugarCRM instance holds about customers and business operations. The original disclosure included Google Dorks — specialized search queries that identify publicly exposed SugarCRM instances — which gave attackers a ready-made targeting list. By the time reporting was published, approximately 354 of the roughly 3,000 SugarCRM servers exposed to the internet had already been compromised, representing about 12% of the total exposed population. SugarCRM released a hotfix in early January 2023 and applied it directly to cloud-hosted instances; administrators running on-premises deployments needed to apply the patch manually. If you run SugarCRM on your own infrastructure and have not applied the hotfix, treat the server as potentially compromised and investigate before patching.

Listen to the Episode

Twitch was breached and a 125 GB torrent posted to 4chan exposed the platform’s entire source code, creator payouts going back to 2019, internal red team tools, and source code for an unreleased Amazon Steam competitor called Vapor — while the Freakout botnet was hijacking surveillance DVRs for Monero mining and the MyKings botnet had quietly accumulated $24.7 million in crypto since its first appearance five years earlier.

Stories Covered

Freakout Botnet Hijacks Surveillance DVRs for Monero Mining Using a Polymorphic Python Bot

Juniper Threat Labs researchers documented a new campaign by the Freakout botnet — active since at least January 2021 — targeting Visual Tools DVR VX16 devices used in surveillance systems. The malware component is NecroPython, a Python IRC bot that exploits multiple CVEs across different platforms including CVE-2021-29000 (Genexis), CVE-2020-15568 (TerraMaster TOS before 4.1.29), CVE-2020-25494 (Xen OS), CVE-2020-28188 (TerraMaster TOS up to 4.2.0), and CVE-2019-12725 (Zeroshell 3.9.0). Surveillance DVRs make attractive mining targets because they run continuously, are rarely monitored for performance anomalies, and are often left unpatched. Once compromised, the bot deploys XMRig, a Monero miner configured to send earnings to an attacker-controlled wallet. Monero is specifically preferred by criminal crypto mining operations because its privacy features make transaction tracing significantly harder than Bitcoin. NecroPython includes a polymorphic engine that mutates the malware’s code signature on each execution, complicating signature-based antivirus detection. For persistence across network changes, it uses a domain generation algorithm — attempting to contact a rotating set of programmatically derived domains until it finds its command-and-control server. Detection at the network level is possible by monitoring for machines generating abnormally high volumes of DNS requests in short windows — an indicator consistent with DGA behavior that does not match any normal user activity pattern.

Call of Duty’s Ricochet Anti-Cheat Kernel Driver: Security Concerns at Scale

Activision announced Ricochet, a kernel-level anti-cheat driver for Call of Duty: Warzone and Vanguard. The security concern with kernel-level drivers is not specific to Ricochet — it applies to any software operating at kernel privilege. Kernel drivers have deeply integrated access to the operating system, and any vulnerability in the driver represents an attack surface that operates at the highest privilege level on the machine. Call of Duty has approximately 100 million players; even if only a quarter play on PC, that represents roughly 25 million machines with this driver installed. A critical vulnerability in Ricochet would create a fleet of 25 million potentially exploitable systems attributable to a single driver from a single company. Activision stated the driver is not always-on and only inspects software interacting with Call of Duty, though those constraints are policy rather than architectural guarantees. The second concern is false positives: Ricochet reportedly intends to use machine learning to identify cheat patterns in server data. Machine learning classifiers are not perfectly accurate, and at the scale of tens of millions of players, even a half-percent false positive rate produces hundreds of thousands of incorrectly flagged accounts. Without a transparent appeal process and human review, automated enforcement at that scale creates accountability problems that the gaming community is right to scrutinize before accepting a kernel-level agent on their machines.

MyKings Botnet: $24.7 Million in Crypto, Clipboard Hijacking, and Steam Trade URL Manipulation

Avast Threat Labs documented the MyKings botnet, which has been active for roughly five years and remains operational. The Avast analysis found wallets linked to MyKings operations holding approximately $24.7 million in accumulated cryptocurrency — a figure reflecting the sustained revenue from a long-running operation rather than a single campaign. MyKings is notable for the breadth of its toolkit: it deploys bootkits (which install in the boot sector, making them extremely difficult to remove without a full system wipe), cryptocurrency miners, droppers for additional payload delivery, and clipboard stealers. The clipboard stealer is particularly effective against cryptocurrency users: it monitors the clipboard for wallet addresses and substitutes the attacker’s wallet when a user copies and pastes an address for a transaction, diverting funds without the victim noticing until they check their transaction history. The latest version extended this clipboard manipulation to Steam item trade URLs, hijacking trade offers so that the attacker receives the items instead of the intended recipient. A separate module uses Yandex Disk cloud storage as a delivery mechanism: compressed archives hosted there are made to appear as photo files and spread through social engineering, with victims unzipping what they believe is a legitimate file and executing the embedded malware instead.

Twitch Hack: 125 GB Leak Exposes Source Code, Creator Payouts, Red Team Tools, and Amazon’s Steam Competitor

An anonymous actor posted a 125 GB torrent to 4chan in October 2021 containing data described as the entirety of Twitch’s internal infrastructure. The leaked dataset included the complete Twitch source code with commit history going back to the platform’s early days, creator payout data from 2019 onward, mobile, desktop, and console clients, proprietary SDKs, internal AWS service configurations, IGDB and CurseForge properties, and — notably — source code for an unreleased Amazon Game Studios project codenamed Vapor described as a Steam competitor. The leak also included Twitch’s internal red team penetration testing tools, meaning the same attacker toolkit Twitch uses internally for its own security assessments was now in public circulation. Multiple sources confirmed the data was authentic. The hacker stated their motivation as disrupting the platform over what they described as a toxic community culture rather than financial gain, which makes this breach unusual: the attacker had access to data valuable enough to sell but chose to dump it publicly instead. For Twitch users: change your password if you have not done so since October 2021. The exposed data enables attackers with knowledge of creator identities and payout figures to craft targeted social engineering attacks against high-earning streamers.

Listen to the Episode

Cognizant, one of the world’s largest IT services companies, was hit by Maze ransomware — a variant that steals files before encrypting to maximize ransom pressure; COVID-19 scams generated $17.5 million in fraud losses in just four months; Pulse Secure VPN had a CVSS 10/10 remote code execution flaw with 14,500 vulnerable servers still exposed months later; and researchers found over 760 malicious RubyGems packages using typosquatting to steal Bitcoin from developers’ clipboards.

Stories Covered

Cognizant Hit by Maze Ransomware: Exfiltration Before Encryption, File-Stealing Pressure Tactic

Cognizant — a multinational IT services corporation — disclosed it was hit by Maze ransomware. What distinguishes Maze from other ransomware families is its pre-encryption exfiltration step: Maze operators steal victim data before encrypting it, then threaten to publish the stolen files publicly if the ransom is not paid. This creates a second layer of leverage beyond the encryption itself — a victim with offline backups who could otherwise recover without paying still faces the exposure threat on stolen data. Bleeping Computer published indicators of compromise associated with the attack including IP addresses and file hashes for keepstl32.dll, meme.tmp, and maze.dll. An InfoSec researcher released a YARA rule to identify the malware: YARA is a classification tool that lets security researchers define patterns to detect and categorize malware families. The Maze double-extortion model — encrypt and threaten to leak — has since become the standard ransomware operating model across most major ransomware groups. Defenses specific to ransomware: maintain offline backups that are not connected to the main network so an infection cannot reach and encrypt them, patch aggressively to reduce initial access vectors, lock down Remote Desktop Protocol access and require VPN with MFA for any remote administrative access.

COVID-19 Scams: $17.5 Million in Fraud Losses, Fake Government Sites, and Malicious Word Documents

The FTC received 22,853 COVID-19-related fraud complaints between January and April 2020, with total reported losses of $17.53 million and a median loss of $533 per victim. The scam landscape during this period included multiple distinct attack vectors. Researchers at Inky found phishing emails leading to a pixel-perfect fake clone of the White House’s official COVID-19 information website, where a download button prompted victims to download a malicious Microsoft Word document that, when opened with macros enabled, downloaded and executed malware. A separate Bitdefender-identified campaign sent emails with attachments disguised as image files that were actually malicious executables mounting as a DVD drive. A Facebook-distributed scam impersonating a fictional “U.S. Emergency Grants Foundation” targeted older users, directing them to a fake government grants website that harvested Social Security numbers and personal information for identity fraud. Fake flight cancellation refund emails collected phone numbers, email addresses, and payment card information from frequent travelers. A malvertising campaign registered covid19onlineinfo.com and multiple similar domains to host an exploit kit targeting older Internet Explorer versions, attempting to install Kpot v2, a credential stealer targeting passwords and personal information. The unifying pattern across all of these is the exploitation of fear and urgency during a period when normal verification instincts were overridden by the anxiety of the pandemic.

Pulse Secure VPN: CVSS 10 RCE Flaw, 14,500 Exposed Servers, and Credentials That Outlast Patches

In 2019, ten major vulnerabilities were disclosed in Pulse Secure VPN, including one rated CVSS 10.0 — the maximum severity score — for a remote unauthenticated code execution flaw. The NSA identified approximately 14,500 servers still vulnerable to these flaws as of August 2019 and issued alerts. By January 2020, attackers were still actively exploiting the vulnerabilities to distribute ransomware. CISA issued a warning that patching the vulnerability alone was not sufficient for organizations that had been compromised: attackers who obtained valid credentials during the exploitation window were using those credentials to maintain persistent access even after the underlying software flaw was patched. Attackers routed their connections through Tor and virtual private servers to obscure origin, and maintained footholds through scheduled tasks, remote access trojans, and legitimate remote management tools like TeamViewer. CISA released a tool to help administrators detect whether their systems had been compromised before being patched. The core lesson: when a critical authentication-adjacent vulnerability is patched, the remediation must include credential rotation across all accounts that could have been exposed — patching the code path does not invalidate attacker credentials that were already harvested.

760 Malicious RubyGems: Typosquatting and Bitcoin Clipboard Theft Across Package Ecosystems

ReversingLabs researchers identified close to 760 malicious libraries in the RubyGems package registry, all using typosquatting — registering package names that closely resemble legitimate library names, with minor variations like replacing the letter “i” with the number “1” — to trick developers into installing them instead of the intended dependency. The malicious packages targeted cryptocurrency: once installed on a developer’s machine, a malicious executable extracted a VBScript that created an autorun registry key for persistence and monitored the Windows clipboard for cryptocurrency wallet addresses, replacing any detected address with the attacker’s wallet. Any cryptocurrency transaction initiated by a victim who had unknowingly installed one of these packages would have its destination wallet silently swapped, sending funds to the attacker. Researchers noted consistent signatures across the malicious libraries suggesting a single threat actor or coordinated group behind the campaign. Similar malicious packages using the same techniques had previously been identified in the NPM and PyPI ecosystems. The attack surface is structural: every package registry that allows any user to publish packages without review has this exposure. For developers: audit your dependency list, verify package names match exactly against the intended library, check publish dates and download counts against expected values, and prefer packages where you can inspect source code or that have established maintenance history.

Listen to the Episode

Kaspersky blocked 356,000 malware attacks disguised as student textbooks and essays, the Magecart “Inter” toolkit made credit card skimming accessible as a $1,000 commercial service with 24/7 support, Marriott disclosed a second major breach affecting 5.2 million loyalty app guests, and the IRS warned of a wave of COVID-19 stimulus payment scams targeting Americans during the pandemic.

Stories Covered

Malware Disguised as Textbooks: 356,000 Attacks on Students via Fake Educational Downloads

Kaspersky published research documenting malware campaigns targeting students through fake educational content. The data — representing only users running Kaspersky antivirus, so likely a fraction of total exposure — showed 356,000 attacks, 74,000 unique users who attempted to download malware disguised as essays across 233,000 attempts, and 30,000 users who attempted to download malware disguised as textbooks across approximately 122,000 attempts. English textbooks were the most common lure at roughly 2,000 attack attempts, followed by mathematics at 1,200 and literature at 870. The delivery mechanism exploits a fundamental Windows behavior: by default, Windows hides known file extensions. A file named textbook.pdf.exe appears to the user as textbook.pdf — they see what looks like a PDF but double-clicking executes the .exe. Kaspersky identified three primary malware families in this campaign. The most prevalent was StockWorm (worm.win32.stock.a), a worm that spreads itself through email contacts found on the victim machine. The second was win32.agent.ifdx, a downloader trojan that masquerades as a PDF or Word document before pulling down additional payloads like cryptominers. Third was WinLNK.agent.gen, which hides in compressed archives and uses a shortcut file (.lnk) disguised as a document or image to display a decoy file while executing the malicious payload. The lesson is consistent across all three: files downloaded from unofficial sources — piracy sites, random search results for textbooks — carry no verification that the content matches what is advertised.

Magecart “Inter” Toolkit: Credit Card Skimming as a $1,000 Commercial Service With 24/7 Support

PerimeterX researchers published an analysis of the Inter toolkit, a Magecart-family credit card skimmer that has been sold commercially since 2018 and was originally marketed at $1,300 (later approximately $1,000). The toolkit functions as malware-as-a-service for non-technical attackers who have already compromised an e-commerce checkout page — it provides a full control panel, a command-and-control drop zone for collecting stolen card data, geolocation enrichment of victim IP addresses, filtering and export tools for the harvested data, and a code generator for creating loader and skimmer scripts without any programming knowledge. The included obfuscation tooling prevents the skimmer from loading if a browser debugger is detected — meaning security researchers and developers testing with browser developer tools open will not see the skimmer execute, complicating detection. The Caesar obfuscator bundled with the toolkit carries an independent market value of around $100. The developers offered clients a 30/70 revenue split as an alternative to the upfront purchase price, plus 24/7 support. PerimeterX was able to locate a publicly exposed developer staging server with its directory tree visible rather than the application interface, which let them examine the source file structure directly. The researchers also located debugging artifacts left by the developers and made contact with them. The commercialization of attack toolkits like Inter is a significant factor in the expansion of e-commerce credit card skimming — it removes the technical barrier entirely, allowing anyone with access to a compromised checkout to start collecting payment data.

COVID-19 IRS Stimulus Scams: Red Flags and How to Report

As the U.S. government prepared to distribute $1,200 economic impact payments to most American adults under the CARES Act, the IRS issued warnings about a wave of scams exploiting the distribution. The IRS identified several specific red flags: anyone using the term “stimulus check” or “stimulus payment” rather than the official term “economic impact payment,” anyone claiming they can accelerate your payment in exchange for personal information, any request for banking or personally identifiable information to process or expedite a payment, any check arriving with an unusual amount accompanied by instructions to call a number to verify information, or any request to sign over your economic payment to a third party. The IRS does not call, email, or proactively contact taxpayers to collect information needed to process payments. Anyone with direct deposit on file from their 2018 or 2019 tax returns receives payment automatically; all others receive paper checks by mail. Retirees and Social Security recipients receive automatic payments without any required action. Suspected phishing attempts using the IRS name or EFTPS branding should be forwarded to [email protected]. As with all pandemic-era scams, the most effective protection is sharing specific red flag information with older or less technically-oriented family members and friends who are most likely to be targeted.

Marriott’s Second Breach: 5.2 Million Loyalty App Guests Hit After Starwood’s 383 Million-Record Exposure

Marriott disclosed a second major data breach in under two years, this time affecting 5.2 million hotel guests who used the company’s loyalty application. The breach was discovered in late February 2020 and is believed to have begun from mid-January. The attack vector was compromised login credentials belonging to two employees at a franchise property who had backend access to the loyalty app. Data believed to have been accessed includes contact information (names, mailing addresses, email addresses, phone numbers), loyalty account numbers and point balances, personal details (company affiliation, gender, birth month and year), linked airline loyalty program account numbers, and guest preferences such as language and room type. Marriott stated that passwords, PINs, payment card data, passport numbers, national ID numbers, and driver’s license information were not believed to have been taken. The breach follows a significantly larger incident disclosed in November 2018, when Marriott’s acquisition of Starwood Hotels revealed that the Starwood guest reservation system had been compromised for approximately four years, exposing approximately 383 million guest records. Having 5.2 million loyalty program records exposed after a breach of that scale represents a continued security posture failure rather than an isolated incident. Loyalty program credentials are a consistent target because the accounts often contain usable points balances and are linked to other travel accounts and payment methods.

Listen to the Episode