COMPANY BLOGPOSTED Jun 23, 2023

Threat Intelligence Report - June 23, 2023.

The NetFire Threat Intelligence Report contains a weekly collection of key developments to be aware of along with action tips from NetFire.

NetFire Threat Intelligence Team

Hackers Leak Over 100,000 ChatGPT Credentials on Dark Web

Over 100,000 login credentials for OpenAI's ChatGPT AI chatbot were leaked on the dark web, with the theft being carried out using the Raccoon Infostealer malware through phishing emails. The stolen credentials, which peaked at 26,802 logins in May 2023, included personal data, login information, and potentially crypto wallet details, posing a significant cybersecurity risk.

Millions of GitHub Repos Likely Vulnerable to RepoJacking

Millions of GitHub repositories are at risk of a supply chain attack called "RepoJacking". Researchers found that approximately 2.95% of 1.25 million analyzed repositories were vulnerable, suggesting that around 9 million projects on GitHub could be impacted, allowing attackers to deploy malware through dependencies and code from hijacked repositories, potentially affecting a large number of users.

Ongoing Microsoft 365 Issues Affect Apps Including Outlook and Teams

Microsoft 365 users have been reporting issues with Microsoft Outlook and other apps, including freezing, slow performance, and errors related to licensing. Admins have tried various workarounds, but the problem has not been resolved for everyone, leading some to switch affected users to Outlook on the Web (OWA) temporarily. The cause of the issue remains unclear, and Microsoft has not yet provided an official response or solution.

iOttie MageCart Attack Causes Data Breach Through WordPress Plugins

Car mount and mobile accessory maker iOttie experienced a data breach that lasted for nearly two months, during which malicious scripts were injected into its online store to steal credit card and personal information of online shoppers. The attack, known as MageCart, involved hackers exploiting vulnerabilities in WordPress plugins to inject malicious JavaScript into checkout pages, enabling them to collect sensitive data and potentially conduct financial fraud and identity theft. iOttie customers who made purchases between April 12th and June 2nd are advised to monitor their financial accounts for fraudulent activity.

First Zero-Trust Application Performed in Space

Cybersecurity company SpiderOak has successfully tested its OrbitSecure software in space, marking the first zero-trust application performed in orbit. The software offers data-level security by encrypting each record and storing it in a digital ledger, with immediate detection and reissuing of encryption keys in case of a breach, demonstrating its potential for enhancing data security and resilience in the space environment.

Follow NetFire and stay tuned for more insights.