CloudSEK Updates

Phishing campaigns and "pig butchering" scams have increasingly exploited Zendesk's SaaS infrastructure, leveraging its free trial subdomains to mimic legitimate brands and deceive unsuspecting users. By registering subdomains with brand-like names, attackers create authentic-looking interfaces to facilitate phishing, data theft, and financial fraud. This misuse is compounded by B2B marketing tools that assist in gathering employee emails, and by Zendesk's lack of email verification for ticket assignments, which allows phishing emails to bypass spam filters. To mitigate these risks, organizations must implement proactive measures such as blacklisting unknown Zendesk instances, utilizing detection tools like XVigil, and educating employees about phishing tactics.

Discover how the Belsen Group exploited a zero-day vulnerability in 2022 to leak over 15,000 Fortigate firewall configurations, exposing sensitive credentials, firewall rules, and management certificates. This high-impact cyber incident, detailed in our analysis, highlights the risks of authentication bypass vulnerabilities and offers crucial mitigation strategies, including credential updates, firewall audits, and certificate rotation. Stay informed and secure your network against evolving threats with actionable insights from this comprehensive report.

CloudSEK’s XVigil is a powerful digital risk protection platform that equips organizations to tackle ever-evolving cybersecurity threats with real-time monitoring of the surface, deep, and dark web. Trusted by Reddoorz’s CISO, Anurag, for over five years, XVigil provides actionable insights into compromised data, detects threats like leaked documents, and delivers robust solutions through features like dark web monitoring, social media oversight, and rapid incident takedowns. With AI-driven intelligence and proactive security measures, XVigil stands out as a critical tool for safeguarding sensitive data and strengthening organizational cybersecurity strategies.

Post-holiday sales come with heightened risks of online shopping scams and phishing attacks as cybercriminals exploit consumer enthusiasm with fake websites, phishing emails, and fraudulent deals. Common schemes include CEO fraud, fake domains imitating major brands like Amazon and eBay, and malicious advertising. Scammers also target payment portals, leveraging fake credit card gateways, and deploy malware through seemingly legitimate e-cards. To stay safe, shoppers should verify website authenticity, avoid clicking on unsolicited links, and use trusted payment methods. Remaining vigilant and informed about these threats can help mitigate financial losses and maintain trust in e-commerce platforms.

Sensitive data leaks in Postman workspaces pose significant risks, exposing API keys, credentials, and tokens that can lead to unauthorized access, data breaches, and reputational harm. A year-long investigation revealed over 30,000 publicly accessible workspaces leaking sensitive information, including business data and customer PII. Improper access controls, accidental sharing, and storing data in plaintext were major contributors to these vulnerabilities. Adopting best practices like using environment variables, limiting permissions, and implementing external secrets management is critical to mitigate these risks and secure collaborative development environments.

Cybercriminals are increasingly targeting YouTube creators by exploiting fake brand collaboration offers to distribute malware. These sophisticated phishing campaigns involve carefully crafted emails that impersonate trusted brands, presenting enticing partnership deals. The malware, disguised as legitimate documents like contracts or promotional materials, is often delivered through password-protected files hosted on platforms such as OneDrive to evade detection. Once downloaded, the malware can steal sensitive information, including login credentials and financial data, while also granting attackers remote access to the victim’s systems. With content creators and marketers as primary targets, this global campaign underscores the importance of verifying collaboration requests and adopting robust cybersecurity measures to protect against such threats.

The blog explores the growing threat landscape of Cyber Monday scams, detailing the diverse tactics cybercriminals use to exploit the online shopping surge. Key threats include phishing attacks, fake online marketplaces, social media scams, fraudulent gift card generators, and advanced tools like Malware-as-a-Service (MaaS). Psychological manipulation tactics—such as urgency, authority, and social proof—amplify the success of these schemes.

The Androxgh0st botnet, an emerging cyber threat since January 2024, has resurfaced with advanced capabilities and integration of IoT-focused Mozi payloads. Exploiting over 20 vulnerabilities in technologies like Cisco ASA, Atlassian JIRA, PHP frameworks, and IoT devices, Androxgh0st enables unauthorized access and remote code execution. Its growing sophistication includes shared infrastructure and malware persistence tactics, posing risks to global web servers and IoT networks. CloudSEK’s research highlights the botnet's operational overlap with Mozi, emphasizing the need for immediate patching and vigilant monitoring to mitigate exploitation risks​.

As Halloween approaches, online scams targeting eager celebrants are on the rise. Scammers exploit increased spending on costumes, decorations, and events using fake websites, phishing schemes, and counterfeit products. Tactics include fraudulent costume shops, fake charity events, and phishing links that mimic reputable brands. Protect yourself by verifying websites, sticking to trusted retailers, avoiding unsolicited messages, and reporting scams. Stay vigilant to enjoy a safe and scam-free Halloween season.