Cybersecurity experts have sounded the alarm after uncovering what they’re calling the ‘mother of all breaches’ – a staggering leak of more than 16 billion records from some of the world’s biggest platforms.

The massive data dump includes passwords and sensitive info linked to government accounts, as well as major tech giants like Apple, Google, Facebook, and Telegram.

Some files were vaguely labelled things like “logins” or “credentials,” making it difficult for researchers to pin down exactly what’s been exposed. Still, the scale of the breach has sent shockwaves through the cybersecurity world.

Talk’s Ian Collins: “Researchers believe most of it was stolen using malware!”

Why This Matters:

• This breach isn’t from one single event — it’s a mega compilation of data from various past hacks.

• Sensitive information, including passwords and personal credentials, are part of the leak.

• Experts warn of the increased risk of phishing, identity theft, and account takeovers.

What You Should Do Immediately:

• Change your passwords, especially on major platforms like Google, Facebook, and Apple.

• Use unique passwords for every account.

• Turn on two-factor authentication (2FA) wherever possible.

• Be cautious of suspicious emails, texts, or login requests.

Stay alert — this breach is a major wake-up call for individuals and businesses alike. If you’ve reused passwords or haven’t updated them recently, now is the time.

Watch on YouTube:

The post The Mother Of All Breaches!” | 16 Billion Facebook, Apple And Google Passwords Exposed appeared first on Resultworx.

According to thousands of reports from affected customers logged by DownDetector, these ongoing issues block login attempts and impact Microsoft 365 suite websites and Outlook services.

“Further information can be found at https://status.cloud.microsoft, or under MO991872 if the admin center is accessible to you,” the company said.

“We’re investigating reports of an issue where some users and admins may be unable to access Microsoft 365 services or the Microsoft 365 admin center,” explains the Microsoft 365 Admin Center message.

According to Microsoft, the list of likely affected services includes:

• SharePoint Online search and site or file access
• Exchange Online mailbox search or access
• Microsoft 365 Admin Center access

While the company has yet to provide more information on the number of users affected by this outage and its extent, these problems are tagged as an “incident” described by Microsoft as “critical service issues, typically involving noticeable user impact.”

In December, a Microsoft 365 outage shut down the Office web apps and the admin center, and earlier this month, a Multi-Factor Authentication (MFA) outage prevented customers from accessing Microsoft 365 Office apps.

In November, another Microsoft 365 outage affected multiple services and features worldwide, including Microsoft Teams, Exchange Online, SharePoint Online, OneDrive, Purview, Copilot, and Outlook Web and Desktop.

Update January 29, 13:44 EST: Microsoft says it received reports that these ongoing issues have been resolved for some users.

“We’re analyzing available service telemetry to identify why the issue initially occurred and we’re also working to identify whether additional actions are required to resolve the impact for all users.”

Update January 29, 14:44 EST: Microsoft updated the M365 Admin Center to say the incident has been mitigated.

“After further investigation, we confirmed that impact was limited to admins attempting to access the Microsoft 365 admin center, and we’ve updated the Title, User impact, and Scope of impact sections of this communication accordingly,” it stated.

“We’ve identified a recent configuration change that contained an error, which prevented access requests from completing as expected. We reverted this change and after a period of extended monitoring, we’ve confirmed that the issue is resolved for all users.”

Original Post: Microsoft investigates Microsoft 365 outage affecting users, admins

The post Microsoft investigates Microsoft 365 outage affecting users, admins appeared first on Resultworx.

This recurring issue only impacts Windows apps that are using the CopyFile API and are also large address aware, according to Redmond.

Microsoft says Windows devices are at a higher risk of being affected by this particular issue when using specific commercial or enterprise security software that utilizes extended file attributes.

No instances have been reported regarding file copying functionality impact within File Explorer; however, specific applications utilizing the CopyFile API may encounter issues.

Users of Microsoft Office applications such as Word and Excel may also experience copying and saving problems, but only when utilizing 32-bit versions. In such cases, impacted users will see “Document not saved” error messages.

It’s also important to note that those using Windows devices in personal or non-managed commercial environments are unlikely to encounter this known issue.

Microsoft has addressed this issue with the KB5027231 Windows 11 cumulative update released today as part of this month’s Patch Tuesday.

“This update addresses a known issue that affects 32-bit apps that are large address aware and use the CopyFile API. You might have issues when you save, copy, or attach files,” Microsoft said today.

“If you use some commercial or enterprise security software that uses extended file attributes, this issue will likely affect you.”

Already fixed on Windows 10 and Windows 11 21H2

The company fixed the issue on Windows 10 and Windows 11 21H2 three weeks ago via Known Issue Rollback (KIR), a Windows capability that reverts buggy non-security fixes pushed through Windows Update.

Windows admins must install and configure a KIR Group Policy to resolve the file transfer and saving problems on affected enterprise-managed devices.

You can download the Group Policies from the links below:

• ​KB5023773 Known Issue Rollback — Windows 10 21H2/22H2
• KB5023774 Known Issue Rollback — Windows 11, version 21H2

After installing, you can find the Group Policy under Computer Configuration -> Administrative Templates.

To deploy the Known Issue Rollback, you have to go to the Local Computer Policy or the Domain policy on your domain controller using the Group Policy Editor to select the Windows version you want to target.

More information on deploying and configuring KIR Group Policies is available on Microsoft’s support website.

Original Posts: Microsoft fixes Windows 11 issue causing copying, saving failures

The post Microsoft fixes Windows 11 issue causing copying, saving failures appeared first on Resultworx.

Credential stuffing are attacks where hackers attempt to access an account by trying out username and password pairs sourced from data leaks on various websites.

Credential stuffing targets users that employ the same password for multiple online accounts, which is known as “password recycling.”

Close to 35,000 users impacted

PayPal explains that the credential stuffing attack occurred between December 6 and December 8, 2022. The company detected and mitigated it at the time but also started an internal investigation to find out how the hackers obtained access to the accounts.

By December 20, 2022, PayPal concluded its investigation, confirming that unauthorized third parties logged into the accounts with valid credentials.

The electronic payments platform claims that this was not due to a breach on its systems and has no evidence that the user credentials were obtained directly from them.

According to the data breach reporting from PayPal, 34,942 of its users have been impacted by the incident. During the two days, hackers had access to account holders’ full names, dates of birth, postal addresses, social security numbers, and individual tax identification numbers.

Transaction histories, connected credit or debit card details, and PayPal invoicing data are also accessible on PayPal accounts.

PayPal says it took timely action to limit the intruders’ access to the platform and reset the passwords of accounts confirmed to have been breached.

Also, the notification claims that the attackers have not attempted or did not manage to perform any transactions from the breached PayPal accounts.

“We have no information suggesting that any of your personal information was misused as a result of this incident, or that there are any unauthorized transactions on your account,” reads PayPal’s notification to impacted users.

Impacted users will receive a free-of-charge two-year identity monitoring service from Equifax.

The company strongly recommends that recipients of the notices change the passwords for other online accounts using a unique and long string. Typically, a good password is at least 12-characters long and includes alphanumeric characters and symbols.

Moreover, PayPal advises users to activate two-factor authentication (2FA) protection from the ‘Account Settings’ menu, which can prevent an unauthorized party from accessing an account, even if they have a valid username and password.

Original Posts: PayPal accounts breached in large-scale credential stuffing attack

The post PayPal accounts breached in large-scale credential stuffing attack appeared first on Resultworx.

The apps were found by security researchers at Bitdefender, who employed a real-time behavior-based analysis method to discover the potentially malicious applications.

Following standard tactics, the apps lure users into installing them by pretending to offer some specialized functionality but change their name and icon immediately after installation, making them difficult to find and uninstall.

From then on, the malicious apps begin to serve intrusive advertisements to the users by abusing WebView, generating fraudulent impressions and ad revenue for their operators.

Additionally, because these apps use their own framework to load the ads, it would likely be possible to drop additional payloads on a compromised device.

Hiding methods

As Bitdefender explains in the report, the adware apps implement multiple methods to hide on Android and even receive later updates to make it easier to hide on devices.

After installation, the apps typically assume a cog icon and rename themselves as ‘Settings,’ to evade detection and deletion.

If the user clicks on the icon, the app launches the malware app with a 0 size to hide from view. The malware then launches the legitimate Settings menu to trick users into thinking they launched the correct app.

In some cases, the apps assume the appearance of Motorola, Oppo, or Samsung system apps.

The malicious apps also feature heavy code obfuscation and encryption to thwart reverse engineering efforts, hiding the main Java payload inside two encrypted DEX files.

Another method for the apps to hide from the user is to exclude themselves from the ‘Recent apps’ list, so even if they run in the background, exposing active processes won’t reveal them.

Popular apps serving ads

The 35 malicious Android applications have download counts ranging from 10,000 to 100,000, totaling over two million downloads.

The most popular of these, having 100k downloads each, are the following:

• Walls light – Wallpapers Pack (gb.packlivewalls.fournatewren)
• Big Emoji – Keyboard 5.0 (gb.blindthirty.funkeyfour)
• Grand Wallpapers – 3D Backdrops 2.0 (gb.convenientsoftfiftyreal.threeborder)
• Engine Wallpapers (gb.helectronsoftforty.comlivefour)
• Stock Wallpapers (gb.fiftysubstantiated.wallsfour)
• EffectMania – Photo Editor 2.0 (gb.actualfifty.sevenelegantvideo)
• Art Filter – Deep Photoeffect 2.0 (gb.crediblefifty.editconvincingeight)
• Fast Emoji Keyboard APK (de.eightylamocenko.editioneights)
• Create Sticker for Whatsapp 2.0 (gb.convincingmomentumeightyverified.realgamequicksix)
• Math Solver – Camera Helper 2.0 (gb.labcamerathirty.mathcamera)
• Photopix Effects – Art Filter 2.0 (gb.mega.sixtyeffectcameravideo)
• Led Theme – Colorful Keyboard 2.0 (gb.theme.twentythreetheme)
• Animated Sticker Master 1.0 (am.asm.master)
• Sleep Sounds 1.0 (com.voice.sleep.sounds)
• Personality Charging Show 1.0 (com.charging.show)
• Image Warp Camera
• GPS Location Finder (smart.ggps.lockakt)

Of the above, ‘Walls light – Wallpapers Pack’, ‘Animated Sticker Master’, and ‘GPS Location Finder’ are still available on the Play Store when writing this article.

The rest of the listed apps are available on multiple third-party app stores like APKSOS, APKAIO, APKCombo, APKPure, and APKsfull, but the presented download counts are from their time on the Play Store.

That said, if you have installed any of these apps in the past, you should locate and remove them from your device immediately.

Because the apps masquerade themselves as Settings, running a mobile AV tool to locate and remove them might be helpful in this case.

Original Posts: Android malware apps with 2 million installs found on Google Play

The post Android malware apps with 2 million installs found on Google Play appeared first on Resultworx.

Quick Assist allows Windows 10 and Windows 11 users to receive or give assistance to other Windows users by taking control of their computer remotely.

The app makes it much easier to assist friends, family, and co-workers fix their computer problems without having to go to their location or install a third-party application.

“The end of service is planned for 5/16, after which point the existing inbox app will no longer work,” the official Twitter account for the Office Insider Program explained.

“Users will see a prompt whenever that app is opened advising that an update is required, along with a button to download the Store app.”

As many of them pointed out, the new version requires local admin privileges to be installed (something regular users don’t have on enterprise endpoints), removes support for the keyboard shortcut, and it installs next to the old, native version

“Best thing about the existing Quick Assist is that it’s guaranteed to be on every Windows 10 computer, which means we don’t have to walk someone through an installation over the phone, which always carries the risk that they will install an impostor (malicious) app,”

Microsoft’s reply

While Microsoft has not published any updates and the end of service date of May 16 (this Monday) still stands, some Redmond employees have replied to Windows admins’ complaints and suggestions.

For instance, Microsoft employee Nathan Pfeifer said the new Quick Assist also comes in offline versions that can be downloaded via the Microsoft Store for Business (which will also be retired in the first quarter of 2023).

Kapil Tundwal, a Principal Software Engineering Manager at Microsoft, added that the Quick Assist store app requires admin rights when installing to allow remote helpers to take full control of the other user’s device.

He also said that Microsoft is working to address the older app not being removed when installing the new version in a Microsoft Store update that will also fix the no longer working keyboard shortcuts.

The company also published a new support document on Friday sharing info on how to install and open the Microsoft Store Quick Assist app.

Microsoft suggests pinning Quick Assist to the taskbar to avoid opening the old app and “refrain” from using the shortcut as it will launch the native app instead.

Original Posts: Windows admins frustrated by Quick Assist moving to Microsoft Store

The post Windows admins frustrated by Quick Assist moving to Microsoft Store appeared first on Resultworx.

This malware is linked to a cluster of malicious activity dubbed Raspberry Robin and was first observed in September 2021.

Red Canary’s Detection Engineering team detected the worm in multiple customers’ networks, some in the technology and manufacturing sectors.

Raspberry Robin spreads to new Windows systems when an infected USB drive containing a malicious .LNK file is connected.

Once attached, the worm spawns a new process using cmd.exe to launch a malicious file stored on the infected drive.

Windows legitimate tools abused to install malware

It uses Microsoft Standard Installer (msiexec.exe) to reach out to its command-and-control (C2) servers, likely hosted on compromised QNAP devices and using TOR exit nodes as additional C2 infrastructure.

“While msiexec.exe downloads and executes legitimate installer packages, adversaries also leverage it to deliver malware,” the researchers said.

“Raspberry Robin uses msiexec.exe to attempt external network communication to a malicious domain for C2 purposes.”

While they haven’t yet found if it establishes persistence and through which methods, they suspect that the malware installs a malicious DLL file on compromised machines to resist removal between restarts.

Raspberry Robin launches this DLL with the help of two other legitimate Windows utilities: fodhelper (a trusted binary for managing features in Windows settings) and odbcconf (a tool for configuring ODBC drivers).

The first allows it to bypass User Account Control (UAC), while the second will help execute and configure the DLL.

How and why?

While the Red Canary analysts have been able to closely inspect what the newly discovered does on infected systems, there are still several questions that need to be answered.

“First and foremost, we don’t know how or where Raspberry Robin infects external drives to perpetuate its activity, though it’s likely this occurs offline or otherwise outside of our visibility. We also don’t know why Raspberry Robin installs a malicious DLL,” the researchers said.

“One hypothesis is that it may be an attempt to establish persistence on an infected system, though additional information is required to build confidence in that hypothesis.”

Since there is no info on this malware’s end-stage malicious tasks, another question that needs an answer is what is the Raspberry Robin operators’ goal.

Further technical information on the Raspberry Robin worm, including indicators of compromise (IOCs) and an ATT&CK of this malware, can be found in Red Canary’s report.

The post New Raspberry Robin worm uses Windows Installer to drop malware appeared first on Resultworx.

Known as Microsoft Defender for Business, this product is designed for SMBs with up to 300 employees who need protection against malware, phishing, and ransomware attacks on Windows, macOS, iOS, and Android devices.

“Microsoft believes in security for all. We are proud to further deliver on that vision today,” said Vasu Jakkal, CVP, security, compliance and identity at Microsoft.

“With the GA of Defender for Business, SMBs will get greater protection with simplified security to help them better protect, detect and respond to threats.”

Microsoft Defender for Business has started rolling out to Microsoft 365 Business Premium customers worldwide beginning March 1st.

Now customers can also get Defender for Business as a standalone license straight from Microsoft and Microsoft Partner Cloud Solution Provider (CSP) channels

Defender for Business features a wizard-driven setup that makes it easier to configure clients. It will also enable all recommended security policies for organizations without a dedicated security team.

Key features bundled with this SMB-focused endpoint security suite include:

• Simplified deployment and management for IT administrators who may not have the expertise to address today’s evolving threat landscape.
• Next-generation antivirus protection and endpoint detection and response to detect and respond to sophisticated attacks with behavioral monitoring.
• Automated investigation and remediation to help customers react quickly to threats.
• Threat and vulnerability management proactively alerts users to weaknesses and misconfigurations in software.
• Microsoft 365 Lighthouse integration with Microsoft Defender for Business for IT service providers to view security events across customers, with additional capabilities coming.

Microsoft said that it’s also planning to add support for servers later this year with the help of an add-on solution.

In November, Microsoft announced this new security solution at Microsoft Ignite 2021 after a 300% increase in ransomware attacks during 2020.

Original Posts: Microsoft Defender for Business stand-alone now generally available

The post Microsoft Defender for Business stand-alone now generally available appeared first on Resultworx.

While Google states that this Chrome update will roll out in the next few weeks, users can receive it immediately by going into the Chrome menu > Help > About Google Chrome.

The browser will also automatically check for new updates and install them the next time you close and relaunch Google Chrome.

As this bug is actively exploited in attacks, it is strongly advised that you perform a manual check for new updates and relaunch the browser to apply them.

Few details disclosed

The zero-day bug fixed today is tracked as CVE-2022-1364 and is a high severity type confusion weakness in the Chrome V8 JavaScript engine.

While type confusion flaws generally lead to browser crashes following successful exploitation by reading or writing memory out of buffer bounds, attackers can also exploit them to execute arbitrary code.

This vulnerability was discovered by Clément Lecigne from Google’s Threat Analysis Group who reported it to the Google Chrome team yesterday.

While Google said they have detected attacks exploiting this zero-day, it did not provide further details regarding how these attacks are conducted.

“Access to bug details and links may be kept restricted until a majority of users are updated with a fix,” Google added.

This is the only vulnerability disclosed in this update, indicating that Chrome 100.0.4896.127 was pushed out as an emergency update to resolve this issue.

Third Chrome zero-day fixed this year

With this update, Google has addressed the third Chrome zero-day since the start of 2022.

As this zero-day is known to be used in attacks, it is strongly advised to update Google Chrome as soon as possible

Original Post: https://www.bleepingcomputer.com/news/security/google-chrome-emergency-update-fixes-zero-day-used-in-attacks/

The post Google Chrome emergency update fixes zero-day used in attacks appeared first on Resultworx.