IT NEWS

Feedback from real users placed Malwarebytes EDR as the most user-friendly EDR solution available in the Mid-market Usability Index, with a Usability Score that surpasses the average across all vendors by almost 10 percent. 

“If you are purchasing Malwarebytes, then you have made the correct choice. You will quickly see how easy it is to implement, and how great their support is.”

Mauro B. 

“Very easy to install and deploy, setup, and configure – for instance – a 5 machine setup would take roughly ~10 mins from start to finish.”

Verified User 

Malwarebytes EDR and MDR are recognized as leaders in endpoint security by real, reputable customers. Want to learn more about how we can help protect your business? Get a free trial below.

TRY NOW

Last week on Malwarebytes Labs:

• Europol lifts the lid on cybercrime tactics
• Malwarebytes wins every Q2 MRG Effitas award & scores 100% on new phishing test
• Watch out, this LastPass email with “Important information about your account” is a phish
• iPhone 15 launch: Wonderlust scammers rear their heads
• Upgrading your iPhone? Read this first
• 3 reasons why your endpoint security is not enough
• Patch now! September Microsoft Patch Tuesday includes two actively exploited zero-days
• PSA: Ongoing Webex malvertising campaign drops BatLoader
• Ransomware review: September 2023
• Update Chrome now! Google patches critical vulnerability being exploited in the wild
• Microsoft Teams used to deliver DarkGate Loader malware
• Two Apple issues added by CISA to its catalog of known exploited vulnerabilities
• Major cyberattack leaves MGM Resorts reeling
• Re-air: What teenagers face growing up online: Lock and Code S04E19
• Wyze home cameras temporarily show other people’s security feeds
• The main causes of ransomware reinfection

Stay safe!

Malwarebytes EDR and MDR removes all remnants of ransomware and prevents you from getting reinfected. Want to learn more about how we can help protect your business? Get a free trial below.

TRY NOW

The European Union Agency for Law Enforcement Cooperation (Europol), has published a report that examines developments in cyberattacks, discussing new methodologies and threats observed by Europol’s operational analysts. The report also discusses the criminal organizations behind cyberattacks and the influence of geopolitical events.

The report follows the Internet Organized Crime Assessment (IOCTA), Europol’s assessment of the cybercrime landscape and how it has changed over the last 24 months.

When it comes to the most deployed tactics, the report holds no big surprises.

“Phishing emails containing malware, Remote Desktop Protocol (RDP) brute forcing and Virtual Private Network (VPN) vulnerability exploitation are the most common intrusion tactics used by cybercriminals. Legitimate software and tools built into operating systems are then misused to establish persistence and traverse their victims’ networks.”

Cybercriminals usually gain initial access through compromised user credentials or by exploiting vulnerabilities in the targeted infrastructure.

Ransomware is named as the most prominent threat with a broad reach and a significant financial impact on industry. This in contrast to an FBI report that stated more money is lost to investment fraud than ransomware and business email compromise (BEC) combined. But if we look at news coverage then ransomware is certainly the most prominent one. And we have seen that the number of ransomware attacks and the height of the ransomware demands have gone up.

Affiliate programs remain the most observed form of organization for ransomware groups. The most common service providers for ransomware groups include initial access brokers (IABs), crypter developers, droppers-as-a-service, money laundering, and bullet-proof hosting services.

These groups work closely with other malware-as-a-service groups to compromise high-revenue targets and post huge ransom demands, running into millions of Euros. IAB’s will typically sell the access they have gained to other criminals, who could be inside or outside of the same criminal organization. Compromised organizations can be exposed to several simultaneous or consecutive cyber-attacks because the IABs usually do not offer exclusivity of their assets to the buyers.

Another trend flagged in the Europol report is that most ransomware groups are still using the multi-layered extortion method, with indications that the theft of sensitive information might become the core threat. The information theft is also seen to be feeding an ecosystem of criminals dealing in and making use of personal and financial information.

The Russian conflict with Ukraine led to a significant boost in Distributed Denial of Service (DDoS) attacks against EU targets. The most noticeable DDoS attacks were politically motivated and coordinated by pro-Russian hacker groups. Together with Russia’s internal politics it has uprooted cybercriminals pushing them to move to other jurisdictions.

Confirming several observations made by researchers, Europol points out that criminals have shifted their preference of using malicious macros in favor of container files after Microsoft blocked macros delivered over the Internet in its applications. Criminals are using SEO techniques and search-engine advertising tools to lure potential victims to web pages masquerading as download sites for popular software programs, which actually deliver malware to the victim’s system.

Other notable facts:

• Mobile malware campaigns are less prolific after the takedown of Flubot.
• Cyberattacks are becoming more targeted and continue causing disruptions in all sectors.
• Crypters have become a key component in malware development operations.
• Microsoft Exchange Server vulnerabilities are another common intrusion tactic.
• Ransomware groups sometimes rent separate servers for victim data exfiltration, but are increasingly moving toward using legitimate cloud storage providers.

How to avoid ransomware

• Block common forms of entry. Create a plan for patching vulnerabilities in internet-facing systems quickly; and disable or harden remote access like RDP and VPNs.
• Prevent intrusions. Stop threats early before they can even infiltrate or infect your endpoints. Use endpoint security software that can prevent exploits and malware used to deliver ransomware.
• Detect intrusions. Make it harder for intruders to operate inside your organization by segmenting networks and assigning access rights prudently. Use EDR or MDR to detect unusual activity before an attack occurs.
• Stop malicious encryption. Deploy Endpoint Detection and Response software like Malwarebytes EDR that uses multiple different detection techniques to identify ransomware, and ransomware rollback to restore damaged system files.
• Create offsite, offline backups. Keep backups offsite and offline, beyond the reach of attackers. Test them regularly to make sure you can restore essential business functions swiftly.
• Don’t get attacked twice. Once you’ve isolated the outbreak and stopped the first attack, you must remove every trace of the attackers, their malware, their tools, and their methods of entry, to avoid being attacked again.

Malwarebytes EDR and MDR removes all remnants of ransomware and prevents you from getting reinfected. Want to learn more about how we can help protect your business? Get a free trial below.

TRY NOW

The consequences of last year’s LastPass breach continue to be felt, with the latest insult to users coming in the form of a highly convincing phishing email.

Although the “unauthorized party” that compromised LastPass users’ data was able to steal password vaults, it’s likely that they are having a hard time cracking them open. LastPass’s own assessment was that “it would be extremely difficult to attempt to brute force guess master passwords for those customers who follow our password best practices.”

Brute force guessing techniques may be successful for some weak passwords, but it’s an approach that quickly runs out of steam. The frequency with which passwords are uncovered diminishes exponentially, and the cost per password increases in the same way. So while some passwords will be so strong they are effectively uncrackable, many weaker ones are likely to be safe simply because they’re too costly to uncover.

However, there is another, far easier way for criminals to get at LastPass users’ passwords, without cracking them: They can simply ask.

They can do this becasue alongside the password vaults that were stolen, criminals also made off with customers’ email addresses, as well as “basic customer account information”, company names, end-user names, billing addresses, telephone numbers, and IP addresses.

Armed with this data, attackers can send targeted phishing emails that attempt to steal the passwords needed to unlock the stolen password vaults.

The LastPass phishing email we received was convincing, familiar, and executed with high production values. However, as convincing as it was, the email could not avoid the two red flags that allow anyone to spot almost any scam: A demand for personal information and an attempt to hurry the victim.

The email lure tells users to verify their personal data or face losing deactivation of “certain features” on 26 September.

The full email reads:

Verification of your personal data

Warning: Some of your contact information is out of date, it must be verified in order to maintain full access to your LastPass account.

LastPass is based on two fundamentaI principIes: the security and confidentiaIity of your personaI data. For us, data security is paramount. LastPass takes payment security and the trust our customers pIace in us very seriousIy. When you use LastPass , we make every effort to protect your personaI information and that reIated to your payments.

To avoid the deactivation of certain features of your LastPass account, log in before September 26, 2023 to confirm your account information.

Although we spotted quickly that the “From” address of the email was registered in Thailand and didn’t appear to be related to LastPass, we suspect many won’t. Unfortunately, the old advice to watch out for strange addresses, complicated URLs, and to not click on links is being undermined by a vast army of legitimate companies using mailing systems that do all three.

The email’s ‘Confirm my information’ link uses a complicated URL format that likely contains a unique ID, which redirects to the phishing site itself. Like the email, the site is an almost pixel-perfect copy of the real thing. (The only giveaways in the design were ‘Create an account’ and ‘Forgot password’ buttons that don’t do anything.)

Again, while some users might be put off by the Slovakian domain name, it looks neat enough and somewhat official.

Filling in the username and password causes the page to reload, this time with a request for a two-factor authentication (2FA) code—allowing us to remind you once again that while code-based 2FA is a solid defence against all kinds of password attacks, it is no defence against phishing. (For that you need 2FA based on FIDO2, such as hardware keys.)

Having fed the criminals some useless information, we checked the site’s Slovakian domain name and discovered that it had been created just a few days before on September 2, 2023, via the Russian registrar webnames.ru—a veritable bunting of fluttering red flags.

Thankfully, while this phish was convincing and difficult to spot, our standard phishing advice still applies, and would have kept you safe:

• Block known bad websites. Malwarebytes DNS filtering blocks malicious websites used for phishing attacks, as well as websites used to spread or control malware.
• Don’t take things at face value. Phishing attacks often seem to come from people or brands you know, and use themes that require urgent attention, such as missed deliveries, account suspensions, and security alerts.
• Take action. If you receive a phishing attempt at work, report it to your IT or security team. If you fall for a phish, make your data useless: If you entered a password, change it, if you entered credit card details, cancel the card.
• Use a password manager. Password managers can create, remember, and fill in passwords for you. They protect you against phishing because they won’t enter your credentials into a fake site.
• Use a FIDO2 2FA device. Some forms of 2FA can be phished just as easily as a password. 2FA that relies on a FIDO2 device can’t be phished.

We don’t just report on threats—we remove them

Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.

Yesterday, Apple launched its latest iPhone and Watch models at its massive Wonderlust event. As with many high profile launches like this, it attracted not just a mountain of press, but a whole load of scammers too.

One site uses the Apple brand to host a cryptocurrency scam. The hook is a supposed giveaway of “50,000 ETH and 5,000 BTC”, which is $79,885,500 and $130,325,000 respectively. Sadly the site, registered just yesterday, is not giving away this kind of digital cash.

The front page claims:

We believe that Blockchain and BTC coin will make the world more fair. To speed up the process of cryptocurrency mass adoption, we decided to run a 5,000 BTC giveaway.

As to how the scammers claw their ill-gotten gains from the victims, it’s a case of double your money. To get your foot on the ladder, all participants are required to chip in a little cryptocurrency of their own so there’s a large pool of funds for the lucky winner.

The site continues:

To participate you just need to send from 0.1 BTC to 50 BTC to the contribution address and we will immediately send you back 0.2 BTC to 100 BTC (x2) to the address you sent it from.

To give you an idea of the supposed investment in the prize fund, 0.1 BTC is $2,606. 50 BTC is an eye watering $1,305,600. Meanwhile over in ETH land, a donation of 1 ETH would set you back $1,599. The maximum donation amount of 500 ETH is worth $79,9975.

This is an incredibly fast path to losing all of your money. An ETH and BTC address are provided for both fake donation options, and anyone sending funds to these addresses will likely not be seeing their money again.

Scrolling down the page shows a very long list of supposed transactions, as a way of encouraging people to hop on the bandwagon. However, sites which track address transactions and other activity display zero funds going in or out of those addresses.

With the event now over, the chances of this particular site hitting a payday will become increasingly remote. The people behind these kinds of sites are hoping that visitors won’t look too closely lest they spot the scam coming apart at the seams.

Even so, this is a common tactic and a popular way for scammers to encourage panic sending with the promise of huge payouts just out of reach. If any site asks you to “donate” cryptocurrency funds claiming you’ll double your money, you can safely ignore and move on.

This fake donation technique was doing the rounds last year, typically bolted on to Elon Musk scams. Here’s one from last April which used a “guess the planet” competition as bait. That same month, another scam made use of fake Medium blogs to achieve the same end result.

The value of your digital currency may rise or fall, but none of it matters if you’ve handed the lot to a scammer. If ever something had “If it’s too good to be true…” attached, this is most definitely somewhere up at the top.

We don’t just report on threats—we remove them

Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.

Google has released an update for Chrome Desktop which includes one critical security fix. There is an active exploit for the patched vulnerability, according to Google, which means cybercriminals are aware of the vulnerability and are using it.

If you’re a Chrome user on Windows, Mac, or Linux, you should update as soon as possible.

The easiest way to update Chrome is to allow it to update automatically, which basically uses the same method as outlined below but does not require your attention. But you can end up lagging behind if you never close the browser or if something goes wrong—such as an extension stopping you from updating the browser.

So, it doesn’t hurt to check now and then. And now would be a good time, given the severity of the vulnerabilities in this batch. My preferred method is to have Chrome open the page chrome://settings/help which you can also find by clicking Settings > About Chrome.

If there is an update available, Chrome will notify you and start downloading it. Then all you have to do is relaunch the browser in order for the update to complete.

After the update, the version should be 116.0.5845.187 for Mac and Linux, and 116.0.5845.187/.188 for Windows, or later.

The vulnerability

Google never gives out a lot of information about vulnerabilities, for obvious reasons. Access to bug details and links may be kept restricted until a majority of users are updated with a fix. However, from the update page we can learn a few things.

The Common Vulnerabilities and Exposures (CVE) database lists publicly disclosed computer security flaws. The zero-day patched in this update is listed as:

CVE-2023-4863: a heap buffer overflow in WebP, also described as a vulnerability that resides in the WebP image format which could lead to arbitrary code execution or a crash.

A buffer overflow is a type of software vulnerability that exists when an area of memory within a software application reaches its address boundary and writes into an adjacent memory region. In software exploit code, two common areas that are targeted for overflows are the stack and the heap.

The heap is an area of memory made available use by the program. The program can request blocks of memory for its use within the heap. In order to allocate a block of some size, the program makes an explicit request by calling the heap allocation operation.

Credit for reporting the vulnerability was given to Apple Security Engineering and Architecture (SEAR) and The Citizen Lab at The University of Torontoʼs Munk School on 2023-09-06. The fact that this happens to coincide with a report by CitizenLab about two Apple vulnerabilities that used by the NSO group to drop the Pegasus spyware, seems too much to be a coincidence.

Add the fact that both Apple CVE-2023-41064 and  Chrome CVE-2023-4863 are based on image processing and we feel comfortable saying that these two vulnerabilities are very, very likely to be related.

We don’t just report on threats—we remove them

Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.

This article is based on research by Marcelo Rivero, Malwarebytes’ ransomware specialist, who monitors information published by ransomware gangs on their Dark Web sites. In this report, “known attacks” are those where the victim did not pay a ransom. This provides the best overall picture of ransomware activity, but the true number of attacks is far higher.

Ransomware news in August was highlighted by the sudden fall of CL0P from the list of the most active gangs in any given month, while Lockbit returned to the number one spot after a steady four-month decline in activity.

CL0P published the data of just four victims on their leak site last month, down from 91known victims in June and 170 known victims in July. In June, CL0p shot to the top of the charts due to their use of a zero-day exploit in MOVEit Transfer, with victims of those attacks continuing to be posted into July.

This dramatic decrease isn’t too surprising given that CL0P’s vulnerability-focused approach to attacking has diminishing returns. As more organizations became aware of and patched the zero-day that CL0P discovered, CL0P’s zero-day campaign saw less and less momentum, with fewer at-risk targets. We witnessed a similar trend earlier this year when, after targeting 104 victims using a GoAnywhere MFT zero-day, CL0P’s presence almost vanished in April and May, as organizations presumably caught on and patched the vulnerability.

Lockbit, on the other hand, posted a total of a 124 victims on its leak site last month to reclaim its usual number one spot on the monthly charts. Before this sudden increase in attacks, we had been observing an average decrease of 20 attacks a month from the group since April 2023.

We speculated on reasons for the downward trend in last month’s review, such as it being possibly related to a recent affiliate arrest, but interesting research published last month may also hold the clue to other answers.

In the third installation of his “Ransomware Diaries” series, researcher Jon DiMaggio reveals the extent of Lockbit’s alleged internal instability, including how its apparent storage limitations and slow response times have led to affiliates leaving it for competitors. If more frustrated clientelle are leaving Lockbit than before, then it could be a novel, possible explanation to any monthly dips in activity.

To get a better idea of the true strength of Lockbit’s current operations, however, we can compare any period of decline to their typical number of monthly attacks. Data stretching back to March 2022, for example, places their median number of attacks at around 67 a month. From April 2023 to July 2023, their median number of attacks was actually slightly higher than this at 69 attacks a month, making the decline seem less substantial. In other words, while Lockbit might be plagued by internal instability at the moment, the effect of this on their monthly numbers seems insignificant in the long-run.

Contrasting with LockBit’s storage server challenges, the recent move by CL0P last month to use torrents underscores the evolving tactics ransomware gangs employ to circumvent storage limitations.

As ransomware gangs steal data from major companies, the scale of the information requires immense storage capacities. Traditional cloud services like AWS and Azure not only come with high costs but also demand personal identifiable information (PII) and credit card details upon registration—information that can easily be subpoenaed by law enforcement. A torrenting service, on the other hand, optimizes downloads by sourcing data from multiple proximate locations, rather than a lone server.

Since torrenting necessitates the data be scattered across all participating nodes in the peer-to-peer network, ransomware gangs can bypass the challenges of storage and bandwidth while also better evading law enforcement. Additionally, if more top ransomware gangs can follow CL0p’s footsteps and start to rely more on torrents to distribute stolen data, victims may feel increased pressure to pay ransoms as their data becomes more widely available. 

Newcomers

CloAk

CloAk is a relatively new ransomware group that emerged between late 2022 and the beginning of 2023. In August 2023 the group published the data of 25 victims, mostly from Europe and with a special focus on Germany.

The CloAk leak site

Metaencryptor

Metaencryptor is a new ransomware gang that published the data of 12 victims in August 2023.

The Metaencryptor leak site

RansomedVC

RansomedVC is a new group that published the data of nine victims on its leak site last month. The group has adopted a favorite ideology of other ransomware actors—that they are serving as nothing more than “pen-testers”—and added a twist, alleging that any vulnerabilities they have found in victims’ networks must also be reported under compliance to Europe’s General Data Protection Regulation (GDPR). RansomedVC has advertised themselves as a “digital tax for peace” service and threatened victims with data breach fines if the ransom isn’t paid.

The RansomedVC leak site

INC Ransom 

INC Ransom is a newcomer to the ransomware scene last month that published three victims to its leak site in August.

The INC Ransomware leak site

How to avoid ransomware

• Block common forms of entry. Create a plan for patching vulnerabilities in internet-facing systems quickly; disable or harden remote access like RDP and VPNs; use endpoint security software that can detect exploits and malware used to deliver ransomware.
• Detect intrusions. Make it harder for intruders to operate inside your organization by segmenting networks and assigning access rights prudently. Use EDR or MDR to detect unusual activity before an attack occurs.
• Stop malicious encryption. Deploy Endpoint Detection and Response software like Malwarebytes EDR that uses multiple different detection techniques to identify ransomware, and ransomware rollback to restore damaged system files.
• Create offsite, offline backups. Keep backups offsite and offline, beyond the reach of attackers. Test them regularly to make sure you can restore essential business functions swiftly.
• Don’t get attacked twice. Once you’ve isolated the outbreak and stopped the first attack, you must remove every trace of the attackers, their malware, their tools, and their methods of entry, to avoid being attacked again.

Malwarebytes EDR and MDR removes all remnants of ransomware and prevents you from getting reinfected. Want to learn more about how we can help protect your business? Get a free trial below.

TRY NOW

A major incident impacting MGM Resorts has caused computer shutdowns all over the US. The systems most impacted are tied to casinos and hotel computer systems. According to the AP, locations caught by this shutdown range from New York and Ohio to Michigan and Mississippi.

At this point I’d link to the post on the company website explaining what’s occurred but at time of writing, the site tends to not load properly which is probably due to heavy traffic. When it does, it simply says that the MGM Resorts website is currently unavailable and gives visitors a list of contact numbers. AP also mentions that other MGM websites have been replaced with “back soon” style pages while the clean up from the attack is no doubt still ongoing.

At present, what’s available is a selection of posts made to X (formerly Twitter) giving brief details of the incident.

This is what MGM Resorts has to say on the matter:

MGM Resorts recently identified a cybersecurity issue affecting some of the company’s systems. Promptly after detecting the issue, we quickly began an investigation with assistance from leading external cybersecurity experts.  We also notified law enforcement and took prompt action to protect our systems and data, including shutting down certain systems. Our investigation is ongoing, and we are working diligently to determine the nature and scope of the matter.

pic.twitter.com/nxIweGInsB

— MGM Resorts (@MGMResortsIntl) September 11, 2023

MGM goes on to say that “resorts are fully operational”. Meanwhile, BBC reporter Joe Tidy reports that slot machines and casino floors were left empty, and that physical room keys had to be distributed. An additional admin error caused a guest to walk in on someone else. Clearly things are not going swimmingly for MGM Resorts.

Scene in MGM Grand according to a TikTok user who said slots machines down and casino floor empty after cyber attack. She also says staff had to make and distribute physical room keys and an admin error caused her to walk in on another guest. Source: https://t.co/etNWW0S49y pic.twitter.com/ZgYkv1fD58

— Joe Tidy (@joetidy) September 12, 2023

Some systems are slowly coming back to life, but there’s no estimate for when full functionality will be restored. The initial fallout of the attack seems to have been the worst of it, with reports of “thousands” of guests locked out of their rooms.

In terms of what the attack could mean for guests, it’s too early to say. MGM has not touched on whether or not customer data has been breached or exfiltrated, and if the culprit is ransomware this could rumble on for days or weeks. Nobody wants to think about their personal data being wrapped up and dropped onto a data dump website, but as with all these incidents it is a distinct possibility. Unverified sources are claiming this to be the case, but we would suggest sticking to official sources only.

If you’re a guest at an MGM resort, don’t panic. Keep note of the contact numbers, and ask staff what the process is for keeping you informed of any breaking developments. An abundance of caution would suggest monitoring credit and debit card payments for a little while, along with watching out for any MGM themed emails. If you do receive the latter, go back to an official point of contact and verify its authenticity. Sometimes organisations send out emails which are genuine, but look suspicious. It’s always better to check.

If this attack does prove to be ransomware, the next development we hear about could be the attackers announcing a data dump or additional demands. For the time being, don’t panic and try to enjoy your resort time as best as you can given the unusual circumstances.

We don’t just report on threats—we remove them

Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.

The Cybersecurity & Infrastructure Security Agency (CISA) has added two new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. This means that Federal Civilian Executive Branch (FCEB) agencies need to remediate this vulnerability by October 2, 2023 in order to protect their devices against active threats. We urge everyone else to take these seriously too.

Apple released security updates for several products to address these vulnerabilities on September 7, 2023.

An overview of the updates that are available at the time of writing:

The updates may already have reached you in your regular update routines, but it doesn’t hurt to check if your device is at the latest update level. If a Safari update is available for your device, you can get it by updating or upgrading macOS, iOS, or iPadOS.

How to update your iPhone or iPad.

How to update macOS on Mac.

The Common Vulnerabilities and Exposures (CVE) database lists publicly disclosed computer security flaws. The CVEs added to the Catalog of Known Exploited Vulnerabilities are:

CVE-2023-41064: A buffer overflow issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.6.9, macOS Big Sur 11.7.10, macOS Ventura 13.5.2, iOS 16.6.1 and iPadOS 16.6.1, iOS 15.7.9 and iPadOS 15.7.9. Processing a maliciously crafted image may lead to arbitrary code execution.

A buffer overflow is a type of software vulnerability that exists when an area of memory within a software application reaches its address boundary and writes into an adjacent memory region. In software exploit code, two common areas that are targeted for overflows are the stack and the heap.

The heap is an area of memory made available use by the program. The program can request blocks of memory for its use within the heap. In order to allocate a block of some size, the program makes an explicit request by calling the heap allocation operation.

CVE-2023-41061: A validation issue was addressed with improved logic. This issue is fixed in watchOS 9.6.2, iOS 16.6.1 and iPadOS 16.6.1. A maliciously crafted attachment may result in arbitrary code execution.

At the time of the patches being released, Apple said it was aware of a report that these issues may have been actively exploited.

The vulnerabilities were discovered as zero-days by CitizenLab, while checking the device of an individual employed by a Washington DC-based civil society organization with international offices. Together, these two vulnerabilities were found to be used in an attack chain dubbed BLASTPASS. The exploit chain was capable of compromising iPhones running the latest version of iOS (16.6) without any interaction from the victim and was reportedly used by the NSO Group to deliver the Pegasus spyware.

We don’t just report on threats—we remove them

Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.