Lifeboat Foundation

The North Korean-backed BlueNorOff threat group targets Apple customers with new macOS malware tracked as ObjCShellz that can open remote shells on compromised devices.

BlueNorOff is a financially motivated hacking group known for attacking cryptocurrency exchanges and financial organizations such as venture capital firms and banks worldwide.

The malicious payload observed by Jamf malware analysts (labeled ProcessRequest) communicates with the swissborg[.]blog, an attacker-controlled domain registered on May 31 and hosted at 104.168.214[.]151 (an IP address part of BlueNorOff infrastructure).

OpenAI has confirmed that a distributed denial-of-service (DDoS) attack is behind “periodic outages” affecting ChatGPT and its developer tools.

ChatGPT, OpenAI’s AI-powered chatbot, has been experiencing sporadic outages for the past 24 hours. Users who attempted to access the service have been greeted with a message stating that “ChatGPT is at capacity right now,” and others, including TechCrunch, have been unable to log into the service.

OpenAI CEO Sam Altman initially blamed the issue on interest in the platform’s new features, unveiled at the company’s first developer conference on Monday, “far outpacing our expectations.” OpenAI said the issue was fixed at approximately 1 p.m. PST on November 8.

The development arrives days after Elastic Security Labs disclosed the Lazarus Group’s use of a new macOS malware called KANDYKORN to target blockchain engineers.

Also linked to the threat actor is a macOS malware referred to as RustBucket, an AppleScript-based backdoor that’s designed to retrieve a second-stage payload from an attacker-controlled server.

In these attacks, prospective targets are lured under the pretext of offering them investment advice or a job, only to kick-start the infection chain by means of a decoy document.

Another good use for AI. Fighting disinformation.

About 60% of adults in the US who get their news through social media have, largely unknowingly, shared false information, according to a poll by the Pew Research Center. The ease at which disinformation is spread and the severity of consequences it brings — from election hacking to character assassination — make it an issue of grave concern for us all.

Continue reading “Fake everything: how machine learning is being used to fight back against disinformation campaigns” »

‘Prompt injection’ attacks haven’t caused giant problems yet. But it’s a matter of time, researchers say.

Imagine a chatbot is applying for a job as your personal assistant. The pros: This chatbot is powered by a cutting-edge large language model. It can write your emails, search your files, summarize websites and converse with you.

The con: It will take orders from absolutely anyone.

Continue reading “Chatbots are so gullible, they’ll take directions from hackers” »

Hackers are using WormGPT, a rogue AI tool, to write phishing emails and malware.

Cybersecurity experts have warned that a new generative AI tool called WormGPT, which is being sold on the dark web, poses a serious threat to businesses and individuals.

IStock/BrianAJackson.

Continue reading “WormGPT: Dark web’s new AI weapon for cyberattacks” »

StripedFly, a stealthy malware posing as a crypto miner, has infected over a million devices worldwide and has flown under the radar for 5 years.

Up until that moment, Tokelau, formally a territory of New Zealand, didn’t even know it had been assigned a ccTLD. “We discovered the.tk,” remembered Aukusitino Vitale, who at the time was general manager of Teletok, Tokelau’s sole telecom operator.

Zuurbier said “that he would pay Tokelau a certain amount of money and that Tokelau would allow the domain for his use,” remembers Vitale. It was all a bit of a surprise—but striking a deal with Zuurbier felt like a win-win for Tokelau, which lacked the resources to run its own domain. In the model pioneered by Zuurbier and his company, now named Freenom, users could register a free domain name for a year, in exchange for having advertisements hosted on their websites. If they wanted to get rid of ads, or to keep their website active in the long term, they could pay a fee.

In the succeeding years, tiny Tokelau became an unlikely internet giant—but not in the way it may have hoped. Until recently, its.tk domain had more users than any other country’s: a staggering 25 million. But there has been and still is only one website actually from Tokelau that is registered with the domain: the page for Teletok. Nearly all the others that have used.tk have been spammers, phishers, and cybercriminals.

Imagine this scenario: It’s early Saturday morning, you just woke up, and are trying to check the news on your phone while enjoying a cup of coffee. You notice your phone isn’t connected to the internet for some reason. You check the Starlink app for a system status, and it’s offline. Attempts to create a support ticket are unsuccessful, your Starlink account credentials aren’t being accepted. The bank calls a few moments later. They’ve frozen your credit card due to fraud. You listen, stunned, as they explain that someone has ordered over $6,000 worth of Starlink equipment in the last 24 hours.

No internet service, thousands of dollars stolen, and no help from Starlink. This is an increasingly common situation faced by Starlink customers. Hackers are gaining access to unsuspecting Starlink accounts, and using the payment information on file to order thousands in equipment. Later, they will resell the equipment on 3rd party marketplaces like Amazon, eBay, and Facebook Marketplace. In this article, I’ll explain what’s going on, how to protect yourself, and what Starlink needs to do to prevent more accounts from being hacked.

Table of Contents.