{"id":29223,"date":"2019-09-27T06:00:13","date_gmt":"2019-09-27T12:00:13","guid":{"rendered":"https://www.webroot.com/blog/?p=29223"},"modified":"2019-09-27T10:23:30","modified_gmt":"2019-09-27T16:23:30","slug":"cyber-news-rundown-instagram-phishing-campaign","status":"publish","type":"post","link":"https://www.webroot.com/blog/2019\/09\/27\/cyber-news-rundown-instagram-phishing-campaign\/","title":{"rendered":"Cyber News Rundown: Instagram Phishing Campaign"},"content":{"rendered":"\n<h2>Copyright Phishing Campaign Hits Instagram<\/h2>\n\n\n\n<p>Many <a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/instagram-phishing-attack-baits-with-copyright-infringement-note\/\">Instagram accounts<\/a> were recently compromised after receiving a notice that their accounts would be suspended for copyright infringement if they didn\u2019t complete an objection form within 24 hours. By setting a timeframe, the attackers are hoping that flustered victims would quickly begin entering account credentials into a phony landing page before being redirected to the authentic Instagram login page to appear legitimate. <\/p>\n\n\n\n<h2>WordPress Plugin Exploited<\/h2>\n\n\n\n<p><a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/hackers-exploit-unpatched-bug-in-rich-reviews-wordpress-plugin\/\">Rich Reviews<\/a>, a vulnerable WordPress plugin that was removed from the main WordPress repository more than six months ago, has been found still active on thousands of websites. This vulnerability allows attackers to download malicious payloads, then redirect victims to phony websites that could further infect their systems. Fortunately, several security companies are working with the plugin\u2019s creators to fix the current vulnerabilities, though these updates won\u2019t reach users until it\u2019s put back on the repository. <\/p>\n\n\n\n<h2>Banking Malware Campaign<\/h2>\n\n\n\n<p>Hundreds of <a href=\"https:\/\/www.infosecurity-magazine.com\/news\/north-korean-malware-attacks-atms\/\">malware\nsamples<\/a> have been discovered that target ATMs and can be deployed to obtain\nsensitive banking information from infected systems. Dtrack, the name of the\nmalware tools, can also be used to steal local machine information, such as\nkeystrokes and browser history, by using known vulnerabilities in network\nsecurity. This type of attack comes from the Lazarus Group, who have been known\nto target nations and major financial institutions around the world.<\/p>\n\n\n\n<h2>Click2Gov Site Hacked<\/h2>\n\n\n\n<p>An online bill paying site used in dozens of cities across\nthe U.S. was recently hacked in at least eight cities, already compromising more\nthan 20,000 individuals from all 50 states. This will be the third breach affecting\n<a href=\"https:\/\/arstechnica.com\/information-technology\/2019\/09\/payment-card-thieves-hack-click2gov-bill-paying-portals-in-8-cities\/\">Click2Gov<\/a>,\nall of which used an exploit allowing attackers to gain both remote access to\nthe system and upload any files they choose. Many of the cities that were\ntargeted recently were part of the prior attacks on the Click2Gov portal. <\/p>\n\n\n\n<h2>Wyoming Healthcare Hit with Ransomware<\/h2>\n\n\n\n<p><a href=\"https:\/\/www.infosecurity-magazine.com\/news\/ransomware-attack-wyoming-health\/\">Campbell\nCounty Health<\/a>\u2019s computer systems were brought to a halt after suffering a ransomware\nattack this week. Nearly 1,500 computers were affected and all currently\nscheduled surgeries and other medical care must be delayed or diverted to\nanother facility. Fortunately, CCH is working quickly to restore all of their\nsystems to normal and determine the exact infection point for the attack.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Copyright Phishing Campaign Hits Instagram Many Instagram accounts were recently compromised after receiving a notice that their accounts would be suspended for copyright infringement if they didn\u2019t complete an objection form within 24 hours. By setting a timeframe, the attackers are hoping that flustered victims would quickly begin entering account credentials into a phony landing [&hellip;]<\/p>\n","protected":false},"author":47,"featured_media":29229,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[3005],"tags":[],"yst_prominent_words":[4953,3563,6425,3881,19377,25037,25039,19583,21589,3477,3919,25041,4281,4649,4075,5003,3989,4155,17061,25035],"acf":[],"_links":{"self":[{"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/posts\/29223"}],"collection":[{"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/users\/47"}],"replies":[{"embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/comments?post=29223"}],"version-history":[{"count":1,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/posts\/29223\/revisions"}],"predecessor-version":[{"id":29227,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/posts\/29223\/revisions\/29227"}],"wp:featuredmedia":[{"embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/media\/29229"}],"wp:attachment":[{"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/media?parent=29223"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/categories?post=29223"},{"taxonomy":"post_tag","embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/tags?post=29223"},{"taxonomy":"yst_prominent_words","embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/yst_prominent_words?post=29223"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}