Malwarebytes – Network Securitas

March 26, 2018

Who and What Is Coinhive?

This post was originally published on this siteMultiple security firms recently identified cryptocurrency mining service Coinhive as the top malicious threat to Web users, thanks to the tendency for Coinhive’s computer code to be used on hacked Web sites to steal the processing power of its visitors’ devices. This post looks at how Coinhive vaulted to the top of the threat list less than a year after its debut, and explores clues about the possible identities of the individuals behind the service. Coinhive is a cryptocurrency mining service that relies on a small chunk of computer code designed to be […]

March 11, 2020

Crafty Web Skimming Domain Spoofs “https”

This post was originally published on this siteEarlier today, KrebsOnSecurity alerted the 10th largest food distributor in the United States that one of its Web sites had been hacked and retrofitted with code that steals credit card and login data. While such Web site card skimming attacks are not new, this intrusion leveraged a sneaky new domain that hides quite easily in a hacked site’s source code: “http[.]ps” (the actual malicious domain does not include the brackets, which are there to keep readers from being able to click on it). This crafty domain was hidden inside the checkout and login […]

November 17, 2020

Be Very Sparing in Allowing Site Notifications

This post was originally published on this siteAn increasing number of websites are asking visitors to approve “notifications,” browser modifications that periodically display messages on the user’s mobile or desktop device. In many cases these notifications are benign, but several dodgy firms are paying site owners to install their notification scripts and then selling that communications pathway to scammers and online hucksters. Notification prompts in Firefox (left) and Google Chrome. When a website you visit asks permission to send notifications and you approve the request, the resulting messages that pop up appear outside of the browser. For example, on Microsoft […]

September 27, 2023

‘Snatch’ Ransom Group Exposes Visitor IP Addresses

This post was originally published on this siteThe victim shaming site operated by the Snatch ransomware group is leaking data about its true online location and internal operations, as well as the Internet addresses of its visitors, KrebsOnSecurity has found. The leaked data suggest that Snatch is one of several ransomware groups using paid ads on Google.com to trick people into installing malware disguised as popular free software, such as Microsoft Teams, Adobe Reader, Mozilla Thunderbird, and Discord. First spotted in 2018, the Snatch ransomware group has published data stolen from hundreds of organizations that refused to pay a ransom […]