Considered to be social media for professionals, LinkedIn is an invaluable tool for millions of people all over the world and a great way to make a wide range of professional connections.

Unfortunately, hackers and scammers are aware of this fact and tend to gravitate to it as well. They are hoping to take advantage of the unsuspecting. Recent research from the cybersecurity company Check Point reveals that LinkedIn has become the most spoofed brand in phishing attacks. These attacks account for a staggering 52 percent of such incidents globally.

This figure would be surprising all by itself but what makes it almost shocking is the fact that in the 4th quarter of 2021, LinkedIn was only the 5th most spoofed brand. They were just 8 percent of phishing attacks seeking to impersonate the brand.

Clearly, between late last year and right now something changed, and the social media property suddenly became a hot commodity on the Dark Web. In fact, as of now nothing else even comes close. Shipping giant DHL is the second most impersonated brand, accounting for 14 percent of all spoofing incidents globally. So it lags far behind LinkedIn in that regard.

After DHL the number of spoofing incidents fall off markedly, with Google accounting for just 7 percent, Microsoft and FedEx tied at 6 percent, WhatsApp at 4 percent, and Amazon at just 2 percent.

Beyond that, Maersk clocks in at 1 percent and Ali Express and Apple each account for 0.8 percent which is barely enough to register on the radar.

No one can say with certainty why it’s happening. The current theory is that given LinkedIn’s nature as a hub for professionals, the platform is a natural target and is especially attractive to spear phishers who specifically target well-connected professionals to gain access.

Whatever the explanation, if you rely on LinkedIn, be aware that not all communications you receive may be what they seem. So proceed with caution.

Millions of people around the world have leveraged the awesome power of WordPress to build their sites. Whether for personal or business use, WordPress has the flexibility and functionality to create just about any type of site you can dream of.

A large part of this flexibility comes from the power of plugins, but that’s the problem. With thousands of plugins available, there are lots of opportunities for hackers.

Recently, the authors of the Elementor WordPress plugin released an update (version 3.6.3) which addresses a critical security flaw that allowed unauthorized users to execute code remotely. The issue put nearly half a million websites at risk, so the company moved quickly to address it.

Elementor’s user base has been quick to embrace the security patch with about a million of the plugin’s users having already updated. Unfortunately, that still leaves about five hundred thousand users who are vulnerable.

If you have incorporated Elementor into your website’s design and functionality, check to see what version you’re running. If you’re running anything before 3.6.3 then your site is at risk, and you should update as soon as possible.

WordPress manages their sprawling global empire with surprising efficiency, and carefully tracks security threats introduced by plugin security flaws. Kudos to both WordPress and the development team at Elementor for finding and acknowledging the issue, then moving quickly to make sure it was resolved.

In our view this is model behavior that companies in any industry can learn from. There was a lot of transparency here right from the start. Everyone involved with and responsible for the software was responsive and took fast action, making the fix available quickly.

Kudos all around. This is how it should be done!

The owners of the Qbot botnet are changing things up. The botnet’s normal Modus Operandi for distributing their signature Qbot malware has been to push their malicious code via phishing emails which contain Microsoft Office documents laden with poisoned macros. More recently though, the group behind the botnet has switched to phishing emails carrying password-protected ZIP files which contain malicious MSI Windows Installer packages.

It’s the first time we’ve seen this tactic from Qbot and no one is sure what drove the change. The best theory put forward so far is that the tactical shift is a response to a recent announcement by Microsoft to disable Excel 4.0 macros by default. This was done in a bid to shut down macros as a possible delivery system. If so, it demonstrates the incredible nimbleness and responsiveness of the hacking world.

Microsoft began rolling out a new VBA autoblock feature for Microsoft Office in April 2022.

Microsoft had this to say about the matter:

“Despite the varying email methods attackers are using to deliver Qakbot, these campaigns have in common their use of malicious macros in Office documents, specifically Excel 4.0 macros.

It should be noted that while threats use Excel 4.0 macros as an attempt to evade detection, this feature is now disabled by default and thus requires users to enable it manually for such threats to execute properly.”

Qbot can best be described as a modular Windows banking trojan that spreads like a worm. It has been active for more than a decade and the people who control the malicious code have targeted several high-profile corporate entities, seeking the biggest bang for their buck.

Over the years, several large and well-organized gangs of hackers, including MegaCortex, PwndLocker, and REvil have leveraged Qbot to breach corporate networks. Although Microsoft’s recent moves have made it harder for the botnet to operate, it’s clear that they are adapting.

There’s a new strain of malware that specifically targets Android users that you should be aware of. Dubbed simply “Fakecalls,” it is a banking trojan that boasts a powerful new ability we haven’t seen before in the malware world. It can fake a call from your bank.

On its face, it looks like most of the other mobile banking apps that Android users install. The graphics are well-done and it’s a convincing copy of the banking software that it seeks to emulate. It displays a very accurate corporate logo and also includes a customer support number for the bank.

Here’s where it gets interesting. The number shown is the actual customer support number of the bank, but when the user attempts to call that number, the malware will break the connection and display a dummy call screen which is virtually identical to the real one.

The victim still sees the bank’s genuine customer support number on the screen. So, by all outward appearances, nothing has changed. However, the connection that ultimately gets made isn’t to a bank employee but one of the hackers controlling the malicious code.

Naturally the representative will be asking for several sensitive pieces of information to “verify the identity” of the victim who’s calling in. Then, every bit of the information gathered will be used against the victim later.

If there’s a silver lining to be found here it lies in the fact that so far, this app is only offered in Korean. Outside of South Korea you don’t see it very often. If you do business in that part of the world, you may have some exposure to it.

According to Kaspersky Lab, the malware can only be found on third party sites so it hasn’t penetrated the Google Play Store. If you steer clear of those third-party sites for downloading apps even if you do business in South Korea your exposure should be quite limited.

If you have any tools in your garage, odds are good that at least a few of them are Snap-on tools. The brand is ubiquitous in the United States and the company is one of the leading manufacturers globally. They sell under a variety of different brand names and some of them you may not have heard of. Their brands include including Norbar, Blue-Point, Blackhawk Mitchell1, and Williams.

Recently, the Snap-on corporation disclosed that the company had been the victim of a successful data breach, making them the latest in an unending succession of large companies to feel the sting of hackers.

For their part, a representative from Snap-on had this to say about the incident:

“In early March, Snap-on detected unusual activity in some areas of its information technology environment. We quickly took down our network connections as part of our defense protocols, particularly appropriate given heightened warnings from various agencies.

We launched a comprehensive analysis assisted by a leading external forensics firm, identified the event as a security incident, and notified law enforcement of the incursion.

We believe the incident involved associate and franchisee data including information such as: names, Social Security Numbers, dates of birth, and employee identification numbers.”

The company is in the process of reaching out to their impacted customers. If you do business with Snap-on and don’t want to wait, contact them right away to find out if you’re one of the people whose data was compromised by the incident.

If you were impacted, know that the company is offering a one-year free subscription to the IDX identity theft protection service. That is small consolation, but still something.

Unfortunately, Snap-on’s initial response to the breach was a bit disorganized with tweets going out from associated brands before there was formal communication from Snap-on itself. This led to a bit of backlash from their users which is entirely understandable.

Any time a crisis like this occurs a cool head and seamless, well-orchestrated communications are essential. Snap-on fell down a bit in that regard. They can do better, and their customers deserve better.

If you rely on Microsoft’s Edge browser to surf the web, you’re in luck. The Redmond Giant has recently made some modifications to the browser’s “sleeping tabs” feature, which improves its overall performance and responsiveness.

The Sleeping Tabs feature began rolling out for edge users running Beta 88 back in December of 2020.

It had the impact of dramatically reducing CPU and memory usage. This latest change rolling out in Edge 100 will enable pages that are sharing a browsing instance with another page to go to sleep.

It may not sound like it should be very significant. However, the company’s own tests indicate that roughly 8 percent more tabs will be able to put to sleep in this manner which will save you more resources with each additional sleeping tab.

How much more? Well, that’s an excellent question. Based on Microsoft’s extensive research into the matter, a sleeping tab saves an average of 85 percent of its normal memory usage and 95 percent of its normal CPU usage. So by idling/putting to sleep as may tabs as possible, the Edge browser winds up saving you incredible amounts of processing power you can use for other things.

If you want to see just how much you’re saving by using the feature, you can simply click “Performance” under the top right menu or enable the “Performance” button to the Microsoft Edge Toolbar. That would give you a quick read out on your savings quickly.

By default, Edge “puts a tab to sleep” after two hours of inactivity but if you like you can change that default time under the browser’s settings

This is a small but significant change. Speed is life in business and where tech is concerned, speed comes down to making the most efficient use you can of your PC’s resources. The latest changes to Edge have a role to play in that. Kudos to Microsoft for a very interesting and very good change indeed.

Are you one of the legions of users who rely on the Teradici PCoIP client? If so, be aware that whether you’re running Windows, Linux, or macOS, there’s a raft of new critical security vulnerabilities you need to be aware of.

These are security issues that could potentially impact some fifteen million endpoints.

The essence of the problem is that there’s a flaw that causes an infinite denial of service loop. That leads to a critical integer overflow that causes the software to hang, which would mean that remote users would no longer be able to access their devices.

In other words, an attack leveraging this flaw could be incredibly disruptive. HP warns of a total of eight critical security vulnerabilities that have been recently identified.

These vulnerabilities are tracked as:

CVE-2022-22822
CVE-2022-22823
CVE-2022-22824
CVE-2021-45960
CVE-2022-22825
CVE-2022-22826
CVE-2022-22827
CVE-2021-46143
If there is a silver lining to be found here, it lies in the fact that HP has taken fast action and already has a fix in place that addresses all flaws listed above. Simply check the version of the software you’re running and if you’re not running version 22.01.3 or later, you are at risk and should update right away.

These latest versions of the software all use OpenSSL 1.1 and libexpat 2.4.7 which is key.

This isn’t the first time in recent history where problems with OpenSSL gave the whole world a scare, Make no mistake, this is a serious issue. Don’t take any chances here. If you’re vulnerable, patch your way to safety as soon as you’re able.

Kudos to the fine folks at HP for moving quickly to address all of the above. Although this certainly will not be the last scare we see in 2022, if the future issues are handled this deftly, then we can all breathe a sigh of relief.

If you’re a member of the Windows Insiders group, you may already be aware of this. If you missed the company’s announcement be on the lookout for some new security improvements in upcoming releases.

Microsoft has been playing an increasingly active role in countering a wide range of cybersecurity threats and their upcoming security enhancements for Windows 11 are a part of that broader story.

One of the first changes you’ll see is enhanced phishing protection, which will help guard against phishing attacks. That will work in tandem with Microsoft Defender SmartScreen which is a cloud-based anti-phishing and anti-malware service offered by the company.

With SmartScreen integrated into the new OS, Windows 11 users will be warned when entering their login credentials into websites that appear to be hacked or are in any way suspect.

SmartScreen is very good at what it does. Last year according to Microsoft statistics the service blocked more than 25 billion Azure Active Directory brute force attacks and intercepted more than 35 billion phishing emails. So this is exceptional protection indeed.

In addition to that, a new Personal Data Encryption is planned for Windows 11 which will protect users’ files and data when they’re not signed into the device. It does this by blocking access until they authenticate via Windows Hello. It’s a small change, but a vitally important one.

Finally, the company is also introducing a raft of new Enterprise Level security improvements that will include Smart App Control, which checks apps against a core features profile and model and only allows them to run if they are deemed safe.

Also on the Enterprise front, Microsoft’s engineers have been busy improving the security of user accounts, devices, and apps, including a new feature called Config Lock. It locks security settings and will auto-revert to their default level if end-users or attackers attempt to modify them.

These are excellent changes all and Windows 11 is really beginning to take shape now. We love it and we’re pretty sure you will too!

If you own an Android device, odds are excellent that your go-to source for apps of any kind is the Google Play Store. That includes antivirus apps to help keep your device safe.

Unfortunately, the hackers of the world are aware of that fact and are always on the lookout for ways to capitalize on that.

Recently, researchers at Check Point have made a disturbing discovery. Six different apps on the Play Store were recently found to be poisoned variants containing the Sharkbot malware. Sharkbot is designed to steal usernames and passwords by displaying cleverly disguised overlay windows that appear over the login window you expect to see when you visit a given website.

Instead of entering your login credentials on the site you thought you were visiting, you instead inadvertently feed the credentials to the bot. The bot dutifully exfiltrates them to a command-and-control server so the hackers controlling the malicious code can abuse them at their leisure.

To add insult to injury, all six of the poisoned apps appeared to be perfectly legitimate antivirus apps. Even worse is those apps were downloaded by unsuspecting users more than fifteen thousand times before Google caught the issue and removed them from the Play store.

Alexander Chailytlko is the cyber security researcher who led the team that made the discovery. They have an intriguing theory about how the hackers were able to get their poisoned code past Google’s robust series of checks against exactly such things.

Per Chailytko, “We think that they were able to do it because all malicious actions were triggered from the C&C server, so the app could stay in the “OFF”-state during a test period in Google Play and turn “ON” when they get to the users’ devices.”

If that theory proves correct and there’s little reason to doubt it Google is going to have a tough time keeping that sort of thing from happening in the future. That means the Play Store may not be quite the safe place most people expect. That’s troubling indeed.