You don’t have to make life easy for cybercriminals – and you don’t have to be tech savvy to adopt the behaviors that make their jobs tough. They log off empty-handed, and you can enjoy the internet and all the scrolling, shopping, and clicking you can handle!
We present to you a few real scammers. While some of them have been arrested, more are following in their footsteps, and we want you to make their lives difficult.
Here are the punks who are hoping you’ll take shortcuts.
Dpxaker: Weak Password Seller
Cozy Bear: Cybercriminal Organization backed by Russia
Zestix: Ready to use your lack of MFA against you
Giant Company: Phishing company operating scams by impersonating people you know and trust
Make life hard for them
You don’t need to know how all the scams work. You don’t need expensive tools. You don’t need to be an expert. Here’s what you should do to Stay Safe Online:
Every password should be 16 characters long, unique to the account, and a random mix of letters, numbers, and symbols
Use a password manager to create and store your passwords
Enable multifactor authentication for every account
Keep your software updated
Scrutinize every unexpected inbound message, especially if it seems urgent or requests payment
For more free, fun cybersecurity tips and tricks, check out our Cybersecurity Awareness Month campaign and sign up for our free email newsletter.
Cyber-criminality has evolved from isolated incidents into an industrialized, borderless ecosystem.
Artificial intelligence is enabling 55 per cent of reported cybercrimes across Africa making attacks faster, more scalable, and increasingly difficult for victims and platforms to detect, according to INTERPOL’s African Cyberthreat Assessment Report 2026.
With more than 1.1 billion mobile subscribers recorded in 2025, Africa’s digital transformation is expanding rapidly.
However, cybercrime legislation is fragmented and AI readiness in law enforcement agencies remains alarmingly low.
The 40-page report draws on survey data from 36 African member countries and highlights a defining shift: cyber-criminality has evolved from isolated incidents into an industrialized, borderless ecosystem.
The Cyberthreat Landscape
East Africa emerged as a hub of mobile money fraud and infrastructure-targeted ransomware.
Business email compromise and romance scams targeting both corporate and individual victims were prolific in Central and West Africa.
Southern Africa’s ultra-high connectivity makes it a magnet for global threat actors seeking maximum disruption.
The financial toll of cybercrime in Africa is significant.
Since 2024, cybercrime-related losses have more than doubled, from USD 192 million to USD 484 million, driven primarily by AI-facilitated scams, credential harvesting, and automated social engineering campaigns.
According to the report, in 2025, online scams continued to be the most reported type of cybercrime, with attackers leveraging mobile money platforms, social media and AI to reach their targets.
Notably, 72 per cent of surveyed countries reported the presence of scam centres, with the highest concentration in Southern and West Africa.
AI-enabled cyberthreats
Digital sextortion and online harassment, often facilitated by AI-generated deepfakes and synthetic media, remained pervasive, with some 600,000 sextortion detections recorded by TrendAI, one of several partners working with INTERPOL.
Similarly, the sophistication of Business E-Mail Compromise (BEC) schemes increased dramatically, with AI used to generate highly convincing e-mail correspondence, with Africa-based threat actors targeting victims in Europe and North America using infrastructure located across multiple jurisdictions.
The report reveals that the absence of real-time, inter-agency data sharing between banks, telecoms and law enforcement creates a dangerous blind spot in efforts to combat financial fraud.
This vulnerability is being exploited by criminals who have moved beyond simply stealing existing credentials to creating entirely synthetic identities.
Combining real personal data with fabricated elements, these AI-generated digital personas can bypass even advanced biometric verification systems and have been used to open bank accounts, secure mobile loans and register SIM cards under false names.
Neal Jetton, Director of INTERPOL’s Cybercrime unit said:
“Cybercrime has emerged as one of the most significant criminal threats to the region. AI is automating every stage of a cyberattack from reconnaissance and phishing to extortion and evasion.
“However, we see that when countries work together, cybercriminal infrastructure can be identified, disrupted and dismantled.”
Meaningful transnational progress is visible. In 2025, 17 countries enacted or amended cybercrime legislation, including the launch of an online reporting platform in Senegal aimed at enhancing the response to online violations affecting children.
At the same time, regionally coordinated capacity building initiatives continue to strengthen long-term cyber resilience.
Operational cooperation is also delivering noteworthy results.
Four high impact cybercrime operations coordinated by INTERPOL including Operation Serengeti 2.0, Operation Contender 3.0, Operation Sentinel and Operation Red Card 2.0 collectively led to more than 1,500 arrests, the seizure of hundreds of devices and the recovery of over USD 100 million.
In its recommendations, the report calls for standardized digital forensic capabilities, enhanced cross-border cooperation, investment in AI literacy among law enforcement officers and formal-public private partnership to support effective prevention, detection and response.
INTERPOL’s Africa Cyberthreat Assessment is part of the Organization’s African Joint Operation against Cybercrime initiative funded by the United Kingdom’s Foreign, Commonwealth and Development Office.
The assessment benefited from data contributed by partners Fortinet, Mastercard, the Shadowserver Foundation, S2W and TrendAI.
The first computer worm to spread extensively across the internet was the Morris Worm, released on November 2, 1988.
This computer worm was created by Robert Tappan Morris, a graduate student at Cornell University, it was originally designed as an experiment to gauge the size of the early internet. However, a design flaw caused it to replicate much faster than intended, leading to the first major cyberattack in history.
Within 24 hours, it infected approximately 6,000 computers, which was about 10% of the internet at the time. It exploited vulnerabilities in the Unix operating system, specifically in programs like sendmail and the finger service. The worm didn’t delete data, but it reinfected machines multiple times, consuming so much processing power that it caused systems to crash or become unusable.
SO WHAT IS A COMPUTER WORM?
A computer worm or digital worm is a standalone malware computer program designed to replicate itself and spread across networks without requiring human interaction.
However, unlike computer viruses, these digital worms don’t require a host file or program to latch onto. Instead, they exist as self-contained files or scripts.
While both are types of malicious software (malware) that replicate themselves and damage computer systems, the main difference is how they spread. Computer viruses require a “host” and human interaction to spread, whereas computer worms are standalone programs that spread by themselves across networks.
WHAT ARE THE MAIN DIFFERENCES BETWEEN A COMPUTER VIRUS AND A COMPUTER WORM?
Computer Virus A computer virus attaches itself to a clean computer program or file (host) and hides there. It stays completely still until a user accidentally opens the infected file or runs the program. Once activated, the virus infects other files and spreads when the user shares those files with others. Computer virus takes time to spread because it relies on human movement.
Computer Worms A computer worm is a standalone, independent program. It does not need a host file to exist, nor does it need you to click anything. Once a computer worm gets onto your device (often through a network connection or software loophole), it replicates itself and spread automatically. Computer worms spread rapidly through network connections such as the internet and Local Area Network.
Computer Worms can spread across the Internet and Local Area Network.
Both computer worm and computer virus can harm your device, delete files, or steal personal information. To keep your devices and data safe while browsing, you don’t need to be a tech expert—you just need to stay alert. Here are the most effective habits to adopt:
1. Check for the “Padlock” Always look at the address bar for HTTPS (and the padlock icon) before entering any passwords or credit card info. This means your connection is encrypted, making it much harder for hackers to “listen in” on your data.
2. Be Skeptical of Links and Pop-ups Think before you click: Hover your mouse over a link to see the actual URL destination in the bottom corner of your browser. If it looks gibberish or slightly misspelled (like g00gle.com instead of google.com), stay away.
Avoid “Free” Traps: Sites offering free movie streams or cracked software are prime breeding grounds for the worms and viruses we discussed.
3. Use a Password Manager Reusing the same password is a huge risk. Use a password manager (like Bitwarden, Google Password Manager or 1Password) to create and store unique, complex passwords for every site. This way, if one site gets hacked, your other accounts stay safe.
4. Enable Two-Factor Authentication (2FA) Even if a hacker gets your password, 2FA acts as a second lock. Always choose an authenticator app or a security key over SMS (text) codes when possible, as they are more secure.
5. Keep Your Browser Updated Those “Update Available” pop-ups are actually critical. They often contain security patches for newly discovered vulnerabilities that hackers are already trying to exploit.
6. Use an Ad Blocker Many malicious scripts (malvertising) are delivered through shady ads. Using an extension like uBlock Origin can stop these scripts from even loading on your page.
Experts are warning about computer “worms” created with AI that can infect devices and harm users without restraint. University of Toronto professor Nicolas Papernot joins with more. Credits: CBS NEWS
TYPES OF COMPUTER WORMS
1) Email Worms Also called mass-mailer worms, they propagate by sending copies of themselves (whether as email attachments or malicious links). Upon opening the file or clicking on the link, a worm will activate, and it will have access to contacts of the recipient to continue spreading.
2) File-sharing Worms Since file-sharing worms allow infected users to hide behind the guise of real media files, they are shared in filesharing aids. Once the file is downloaded by a user, the worm turns the device into an evil server that may accumulate personal data or credentials to be used or sold.
3) Crypto Worms Crypto worms are like ransomware. They spread through systems, encrypt files of users, and then request that decryption key be returned by payment, typically in cryptocurrency. These worms can lock down entire networks if not contained.
4) Internet Worms This category of Computer Worms has the specific purpose of targeting widely used websites with weak Cyber Security measures. The goal of these worms is to infiltrate the website’s system, which then allows them to spread to any computer that has accessed the site and infect them as well.
5) Instant Messaging Worms The worms sent by Instant Messaging Worms exploit an instant messaging program and social media by spitting off impersonation links or files sent by a trusted source. They are usually filled with clickbait, making a user unintentionally infect himself or herself and share it with others.
6) IRC Worms Internet Relay Chat (IRC) Worms spread into chat rooms or forums through the vulnerability of IRC clients. They transmit virulent links or move orders to the people and propagate at high-speed using real-time chats.
7) P2P Worms P2P Worms take advantage of peer-to-peer file-sharing programs by assuming the form of desirable downloadable content. After being downloaded, they multiply through shared folders and also linked users, so infection becomes widespread even without the knowledge of the user.
Computer Worm Examples
1) Morris (1988) Created by Robert Morris, this worm unintentionally overloaded 6,000 UNIX Operating Systems leading to crashes and damages up to £8 million.
2) Mydoom (2004) Targeting Windows systems, Mydoom became one of the fastest-spreading worms, causing an estimated £30 billion in damages. It persists, accounting for a significant portion of malicious emails.
3) Storm Worm (2007) Storm Worm was carried by emails with eye catching headlines like 230 killed as storm swept Europe which even fooled the user into clicking. After activation, it infected systems, making them a botnet to send spam and attack computers with millions of computers.
4) ILOVEYOU (2020) ILOVEYOU was a love letter worm which made itself known as a love letter, also called the Love Bug. It hit more than 50 million devices within two weeks of its outbreak and resulted in clean-up and recovery costs which amount to about 12 billion pounds.
5) Conficker Also referred to as Downup or Kido, Conficker exploited vulnerabilities in Microsoft Windows to spread rapidly. It infected millions of computers across more than 100 countries. It disrupted networks worldwide and demonstrated how unpatched systems can be compromised at a massive scale.
6) Code Red Code Red was a widespread Computer Worm that emerged in 2001, infecting more than 300,000 systems. It targeted Microsoft IIS web servers and generated massive traffic from compromised machines, even overwhelming high-profile websites such as that of the White House.
How do I know if I have a computer worm?
Computer worms are a type of self-replicating malware. Because they consume resources and spread without your knowledge, they typically leave behind specific red flags.
Signs of a Computer Worm Infection
Sudden Performance Drops: Unusually high CPU usage, frequent freezing, or a sluggish system.
Rapidly Disappearing Hard Drive Space: Because worms replicate repeatedly, they can eat up large chunks of your storage.
Network Activity Outburst: Your internet becomes incredibly slow, or you notice unusually high network traffic even when you aren’t browsing.
Unfamiliar Emails: People in your contact list receive strange or spam emails that you never sent.
Missing or Strange Files: System files go missing, or you notice unknown programs/folders suddenly appearing on your hard drive.
Programs Running Automatically: Web browsers or programs launching on their own without you clicking them.
How to Confirm and Remove the Worm
Disconnect the Network: Unplug your Ethernet cable or turn off Wi-Fi. This isolates the computer worm so it cannot infect other devices.
Run an Offline Antivirus Scan:
Windows: Open the Windows Security app, go to Virus & threat protection > Scan options, and select Microsoft Defender Antivirus offline scan. The PC will restart and perform a deep, 15-minute scan while the malware is inactive.
2. Check Task Manager:
Press Ctrl + Shift + Esc to open Task Manager.
Look for any unusual processes taking up massive amounts of memory or using unfamiliar names.
If you spot a suspicious process, right-click and open its file location to delete it.
3. Use an On-Demand Scanner:
Once you have completed the built-in scan, download a reliable on-demand tool like Malwarebytes.
Free Scan to catch anything the primary antivirus might have missed.
You can protect your online accounts with more than just a password.
Multifactor authentication (MFA) adds another layer of protection—think of it like securing your front door with both a deadbolt and a keypad lock. MFA is a simple, effective way to keep hackers out, even if they manage to get your password.
What is multi-factor authentication?
Multifactor authentication, often called MFA, is a security feature that requires you to verify your identity in multiple ways before accessing an account. You might also hear it called two-factor authentication (2FA) or two-step verification.
Here’s how it works: when logging in, you provide your username and password as usual, but then you add another step to prove it’s really you. This second step could be a fingerprint, a code sent to your phone, or even a notification from an app.
Why bother? Because passwords alone can be stolen or guessed, especially if they are short, use common words, and are reused. As a reminder: each password should be unique, at least 16 characters long, and a random string of characters. MFA makes it exponentially harder for cybercriminals to break into your accounts. Even if they know your password, they’ll hit a wall.
MFA increases the security of an account by 99%
According to guidance by the Cybersecurity and Infrastructure Agency (CISA) and backed up by research from Microsoft, enabling MFA can prevent 99% of automated hacking attacks.
The math makes sense. If you require both a password and another factor like FaceID to increase your protection, the account’s security basically doubles!
It’s important to remember that these statistics refer to automated attacks. You still need to be on the lookout for social engineering hacks, like phishing, where cybercriminals try to trick you into giving them your password or MFA code.
How does MFA work?
Enabling MFA means tweaking your login process just a bit:
Enter your username and password.
If correct, you verify your identity in a second way.
Depending on the account or service, this second step might involve:
A text or email with a one-time code.
A prompt in an authentication app like Google Authenticator.
A biometric scan (e.g., fingerprint or facial recognition).
A physical security key.
Most MFA systems are quick and seamless, adding between five and 30 seconds to your login time while almost doubling your security.
Types of multifactor authentication
MFA usually requires two factors, which is why it is sometimes called two-factor authentication. One factor is your password. The other factor can include:
One-time passwords (OTP): Codes sent via text or email expire quickly.
Authenticator apps: Apps like Duo or Microsoft Authenticator generate time-sensitive codes or send push notifications to approve logins.
Biometrics: Scans of your fingerprint, face, or voice.
Hardware tokens: Physical devices, such as USB keys, that connect to your computer to verify your identity.
Security questions: Answers to personal questions, like your first pet’s name or high school.
PINs: A secondary password unique to the service.
MFA fans will say these factors break down into three categories:
Something you have: text message codes, authenticator apps, and hardware keys.
Something you know: passwords, security questions, and PINs.
Something you are: biometrics.
While any form of MFA is better than no MFA, we recommend using authenticator apps, biometrics, or hardware devices as second factors. Text message codes and security questions are more vulnerable but are still better than only a password.
Where should you enable MFA?
MFA is common nowadays, and many services allow you to enable it. Start by checking the accounts you use daily. Some familiar platforms that typically allow for MFA include:
Banking: Secure your financial data with MFA for online banking and payment apps.
Email: Protect your inbox, which often holds sensitive information and links to your other accounts.
Social media: Keep your accounts safe from unauthorized posts or takeovers.
Online shopping: Add an extra layer of security to your stored payment details.
While MFA is highly effective, it’s not invincible. Some cybercriminals use social engineering to trick users into granting access. For example, they might flood you with MFA requests, hoping you’ll approve one out of frustration or confusion.
If you receive an MFA request and you aren’t logging in, don’t approve it. Instead:
Contact the account’s platform immediately.
Change your password for the account.
Update any other accounts that use the same password – this is why every password should be unique to the account.
Despite rare instances of bypasses, MFA remains one of the strongest defenses against unauthorized access.
Is a passkey the same as MFA?
Passkeys are a newer login technology that we’re very excited about. In a sense, they are a form of MFA, but neither factor required is a password. In this way, they pave the way forward for a passwordless future. Instead of a password, generally, the factors involved are the possession of a device and biometrics, like a facial scan. If you’re prompted to set up a passkey, try it out! They are simple to set up and are incredibly secure.
Why MFA is a must
Your data is valuable and MFA takes your protection to a new level. This simple tool adds a robust layer of security that can stop hackers in their tracks.
Don’t wait for a hack to teach you the hard way—take action today. Enable MFA on all accounts that offer it and enjoy the peace of mind that comes with knowing your digital life is well-protected.
Check Point Software Technologies released its Global Threat Index for December 2024, emphasising the growing sophistication of cybercriminals. For Africa, December was hardly a season to be jolly with eight of the continent’s countries listed among the top 20 most attacked.
Ethiopia retained its top spot as the most attacked country with a 98.2% Normalised Risk Index out of the 106 countries featured in the Index.
Other African countries featured in the top 20 are:
Uganda at 8th place with a Normalised Risk Index of 68,2. Angola at 9th place with a Normalised Risk Index of 66,2. Ghana at 11th position with a Normalised Risk Index of 62,7. Nigeria at 13th position with a Normalised Risk Index of 62,3, not too far from Ghana. Kenya’s Normalised Risk Index has increased since last month, moving from position 20 to 17 with a Normalised Risk Index of 57,6. Mozambique comes in at position 18 with a Normalised Risk Index of 56,9. In 20th position with a higher Normalised Risk Index than last month is Cote d’Ivoire with 55,6. In December, the malware focus was on the rise due to FunkSec, an emerging ransomware-as-a-service, RaaS operator leveraging Artificial Intelligence, alongside persistent threats from malware families like FakeUpdates and AgentTesla. Data from ransomware shame sites reveals FunkSec as the most active group in December, responsible for 14% of all published attacks.
Linked to Algeria, FunkSec appears driven by financial gain and hacktivist ideologies, with its AI-assisted tactics pointing to the increasing use of advanced technologies in cybercrime.
FunkSec’s operations have thrust it to the forefront of double-extortion ransomware groups. Publishing over 85 victims in December 2024 alone, FunkSec has surpassed its competitors in volume. However, Check Point Research has flagged many of these claims as recycled or unverified, raising doubts about the group’s credibility
Among the most prevalent malware threats, FakeUpdates reclaimed the top spot globally, affecting 5% of organisations worldwide, followed closely by AgentTesla, 3% and Androxgh0st, 3%. FakeUpdates, also known as SocGholish, remains a versatile downloader that introduces additional malicious payloads, while AgentTesla continues to target sensitive credentials.
Maya Horowitz, VP of Research at Check Point Software, commented on the findings. “The latest trends in cybercrime underscore the importance of vigilance and innovation in cybersecurity. Organisations must leverage advanced threat prevention measures to protect themselves against the evolving landscape of sophisticated attacks.”
Cybersecurity researchers have discovered an improved version of an Apple iOS spyware called LightSpy that not only expands on its functionality, but also incorporates destructive capabilities to prevent the compromised device from booting up.
“While the iOS implant delivery method closely mirrors that of the macOS version, the post-exploitation and privilege escalation stages differ significantly due to platform differences,” ThreatFabric said in an analysis published this week.
LightSpy, first documented in 2020 as targeting users in Hong Kong, is a modular implant that employs a plugin-based architecture to augment its capabilities and allow it to capture a wide range of sensitive information from an infected device.
Attack chains distributing the malware leverage known security flaws in Apple iOS and macOS to trigger a WebKit exploit that drops a file with the extension “.PNG,” but is actually a Mach-O binary responsible for retrieving next-stage payloads from a remote server by abusing a memory corruption flaw tracked as CVE-2020-3837.
This includes a component dubbed FrameworkLoader that, in turn, downloads LightSpy’s Core module and its assorted plugins, which have gone up significantly from 12 to 28 in the latest version (7.9.0).
“After the Core starts up, it will perform an Internet connectivity check using Baidu.com domain, and then it will check the arguments that were passed from FrameworkLoader as the [command-and-control] data and working directory,” the Dutch security company said.
“Using the working directory path /var/containers/Bundle/AppleAppLit/, the Core will create subfolders for logs, database, and exfiltrated data.”
The plugins can capture a wide range of data, including Wi-Fi network information, screenshots, location, iCloud Keychain, sound recordings, photos, browser history, contacts, call history, and SMS messages, as well as gather information from apps like Files, LINE, Mail Master, Telegram, Tencent QQ, WeChat, and WhatsApp.
Some of the newly added plugins also boast destructive features that can delete media files, SMS messages, Wi-Fi network configuration profiles, contacts, and browser history, and even freeze the device and prevent it from starting again. Furthermore, LightSpy plugins can generate fake push notifications containing a specific URL.
The exact distribution vehicle for the spyware is unclear, although it’s believed to be orchestrated via watering hole attacks. The campaigns have not been attributed to a known threat actor or group to date.
Some of the newly added plugins also boast destructive features that can delete media files, SMS messages, Wi-Fi network configuration profiles, contacts, and browser history, and even freeze the device and prevent it from starting again. Furthermore, LightSpy plugins can generate fake push notifications containing a specific URL.
The exact distribution vehicle for the spyware is unclear, although it’s believed to be orchestrated via watering hole attacks. The campaigns have not been attributed to a known threat actor or group to date.
Microsoft has disclosed details about a now-patched security flaw in Apple’s Transparency, Consent, and Control (TCC) framework in macOS that has likely come under exploitation to get around a user’s privacy preferences and access data.
The shortcoming, codenamed HM Surf by the tech giant, is tracked as CVE-2024-44133 (CVSS score: 5.5). It was addressed by Apple as part of macOS Sequoia 15 by removing the vulnerable code.
HM Surf “involves removing the TCC protection for the Safari browser directory and modifying a configuration file in the said directory to gain access to the user’s data, including browsed pages, the device’s camera, microphone, and location, without the user’s consent,” Jonathan Bar Or of the Microsoft Threat Intelligence team said.
Microsoft said the new protections are limited to Apple’s Safari browser, and that it’s working with other major browser vendors to further explore the benefits of hardening local configuration files.
HM Surf follows Microsoft’s discovery of Apple macOS flaws like Shrootless, powerdir, Achilles, and Migraine that could enable malicious actors to sidestep security enforcements.
While TCC is a security framework that prevents apps from accessing users’ personal information without their consent, the newly discovered bug could enable attackers to bypass this requirement and gain access to location services, address book, camera, microphone, downloads directory, and others in an unauthorized manner.
The access is governed by a set of entitlements, with Apple’s own apps like Safari having the ability to completely sidestep TCC using the “com.apple.private.tcc.allow” entitlement.
While this allows Safari to freely access sensitive permissions, it also incorporates a new security mechanism called Hardened Runtime that makes it challenging to execute arbitrary code in the context of the web browser.
That said, when users visit a website that requests location or camera access for the first time, Safari prompts for access via a TCC-like popup. These entitlements are stored on a per-website basis within various files located in the “~/Library/Safari” directory.
The HM Surf exploit devised by Microsoft hinges on performing the following steps –
Changing the home directory of the current user with the dscl utility, a step that does not require TCC access in macOS Sonoma
Modifying the sensitive files (e.g., PerSitePreferences.db) within “~/Library/Safari” under the user’s real home directory
Changing the home directory back to the original directory causing Safari to use the modified files
Launching Safari to open a web page that takes a snapshot via the device’s camera and grab the location
The attack could be extended further to save an entire camera stream or stealthily capture audio through the Mac’s microphone, Microsoft said. Third-party web browsers don’t suffer from this problem as they do not have the same private entitlements as Apple applications.
Microsoft noted it observed suspicious activity associated with a known macOS adware threat named AdLoad likely exploiting the vulnerability, making it imperative that users take steps to apply the latest updates.
“Since we weren’t able to observe the steps taken leading to the activity, we can’t fully determine if the AdLoad campaign is exploiting the HM surf vulnerability itself,” Bar Or said. “Attackers using a similar method to deploy a prevalent threat raises the importance of having protection against attacks using this technique.”
INTERPOL has announced the arrest of eight individuals in Côte d’Ivoire and Nigeria as part of a crackdown on phishing scams and romance cyber fraud.
Dubbed Operation Contender 2.0, the initiative is designed to tackle cyber-enabled crimes in West Africa, the agency said.
One such threat involved a large-scale phishing scam targeting Swiss citizens that resulted in financial losses to the tune of more than $1.4 million.
The cybercriminals posed as buyers on small advertising websites and used QR codes to direct victims to fraudulent websites that mimicked a legitimate payment platform.
This allowed victims to inadvertently enter personal information such as their credentials or card numbers. The perpetrators also impersonated the unnamed platform’s customer service agents over the phone to further deceive them.
As many as 260 scam reports are said to have been received by Swiss authorities between August 2023 and April 2024, prompting a collaborative investigation that traced the roots of the campaign to Côte d’Ivoire.
The main suspect behind the attacks confessed to the scheme and making illicit financial gains of over $1.9 million. Five other individuals conducting cybercriminal activities at the same location have also been arrested.
In a separate case, authorities said they apprehended a suspect and their accomplice in Nigeria on April 27, 2024, in connection with a romance scam after Finnish authorities alerted the Nigerian Police Force via INTERPOL that a victim was scammed out of a “substantial amount of money.”
Such financial grooming crimes entail scammers creating fake online identities on dating apps and social media platforms to develop romantic or close relationships with prospective victims, only to steal money from them.
“Leveraging the increased reliance on technology in every aspect of our daily lives, cybercriminals are employing a range of techniques to steal data and execute fraudulent activities,” Neal Jetton, Director of the Cybercrime Directorate, said.
“These recent successful collaborations, under the umbrella of Operation Contender 2.0, demonstrate the importance of continued international cooperation in combating cybercrime and bringing perpetrators to justice.”
The development comes as the U.S. Department of Justice (DoJ) said a 45-year-old dual citizen of Nigeria and the United Kingdom, Oludayo Kolawole John Adeagbo, has been sentenced to seven years in prison for his role in a multimillion-dollar business email compromise (BEC) scheme.
Adeagbo “conspired with others to participate in multiple cyber-enabled BEC schemes that defrauded a North Carolina university of more than $1.9 million, and attempted to steal more than $3 million from victim entities in Texas, including local government entities, construction companies, and a Houston-area college,” the DoJ said.
It also follows an announcement from Meta that it’s teaming up with U.K. banks to combat scams on its platforms as part of an information-sharing partnership program dubbed Fraud Intelligence Reciprocal Exchange (FIRE).
Ticketmaster, a subsidiary of Live Nation, suffered a data breach, which may impact millions of customers.
Live Nation confirmed in a regulatory filing with the U.S. Securities and Exchange Commission (SEC) on Friday that its subsidiary Ticketmaster has suffered a data breach.
The filing stated that on May 20, the company noticed “unauthorized activity” within a database that contained “Company data” and subsequently “launched an investigation with industry-leading forensic investigators to understand what happened.” The filing went on to describe that on May 27, a “criminal threat actor” offered to sell, what it alleged to be, Ticketmaster data on “the dark web.”
What do we know about the Ticketmaster data breach and the force behind it?
Hackread reported on May 28 that the hacking group named ShinyHunters had claimed responsibility for the cyber-attack on the online forum BreachForums, a hacking website used to facilitate data breaches and the sharing of said data. In the post, the hacking group reportedly states it is seeking $500,000 for the 1.3TB database of compromised customer data, which it claims includes names, addresses, phone numbers, and credit card details of 560 million users.
Live Nation’s regulatory filing does not state how many of its Ticketmaster users’ data has been compromised by the hack, nor does it confirm if ShinyHunters is the culprit.
TIME has reached out to Live Nation and Ticketmaster for comment and further information.
In the filing, Live Nation stated it was “working to mitigate risk to [their] users” and was cooperating with law enforcement officials. They went on to say that in their investigation, the breach was unlikely to make “a material impact on our overall business operations or on our financial condition or results of operations.”
What can Ticketmaster customers do to protect themselves?
In the aftermath of this breach, Ticketmaster users can protect themselves by staying vigilant against phishing attempts, monitor accounts and credit cards, and change passwords, using strong and unique alternatives.
Live Nation and Ticketmaster have yet to release a public statement addressing the breach, but on Ticketmaster’s website blog in April, ahead of the data hack, they provided general advice on how to protect information and tickets. They advised users to make sure to get contact information only from Ticketmaster’s official website and to be aware of fake customer service phone numbers that could appear in search engines.
Ticketmaster’s data breach comes at a trying time
Ticketmaster specifically dominates the market for live events in the United States—so much so that on May 23, the U.S. Department of Justice (DOJ) sued Live Nation and Ticketmaster, accusing them of running an “illegal monopoly” over live events in America—destroying competition and driving up prices for fans.
Per the complaint, in 2022 “Ticketmaster accounted for at least 70% of the total face value associated with all tickets sold at large arenas and amphitheaters.” In stark contrast, “no other rival ticketed more than 14%.”
In the DOJ lawsuit, Live Nation is accused of multiple tactics, including using long-term contracts to keep venues from choosing rival ticketers, blocking venues from using multiple ticket sellers, and threatening venues that they could lose money and fans if they didn’t choose Ticketmaster.
What do we know about ShinyHunters?
The hacking group claiming responsibility, ShinyHunters, is well known for its data hacking of multiple companies in 2020 and 2021, including the Indonesian e-commerce site Tokopedia, the Indian education platform Unacademy, Wattpad, AT&T Wireless, and Microsoft. In January, one member of the ShinyHunters hacking group—a French citizen named Sebastien Raoult—was arrested and sentenced in U.S. District Court in Seattle to three years in prison.
In a statement following the arrest, the Justice Department said that between April 2020 and July 2021, ShinyHunters posted sales of hacked data from more than 60 companies, and that they stole hundreds of millions of customer records and caused loss to victim companies that is estimated to exceed $6 million.
Have I Been Pwned has added the information for 26,818,266 people whose data was leaked in a recent hack of The Post Millennial conservative news website.
The Post Millennial is a conservative Canadian online news magazine belonging to the Human Events Media Group, which also operates the American ‘Human Events’ news platform.
Earlier this month, both news platforms were hacked, with their sites’ front pages defaced with fake messages claiming to be written by The Post Millennial’s editor, Andy Ngo.
As part of the attacks, the threat actors claim to have stolen the company’s mailing lists, subscriber database, and details of the company’s writers and editors, sharing links to the stolen data shared on the defaced pages.
The data quickly spread online, being shared in torrents and hacking forums, allowing threat actors and others to download the data easily.
The exposed data during the Post Millennial hack includes the following types of information:
Full Names
Email addresses
Usernames
Account Passwords
IP addresses
Phone numbers
Physical addresses
Genders
This data allegedly belongs to writers, editors, and subscribers to the sites, which could create significant privacy and security risks to the exposed individuals.
Yesterday, Troy Hunt added the data to the Have I Been Pwned data breach notification service, noting that the data has not been confirmed to have been stolen directly from Human Events or The Post Millennial.
As the leaked data is for a considerable number of users, Hunt decided to add it to HIBP to alert those potentially exposed.
“The breach resulted in the defacement of the website and links posted to 3 different corpuses of data including hundreds of writers and editors (IP, physical address, and email exposed), tens of thousands of subscribers to the site (name, email, username, phone and plain text password exposed), and tens of millions of email addresses from several thousand mailing lists alleged to have been used by The Post Millennial (this has not been independently verified),” reads HIBP’s post.
“The mailing lists appear to be sourced from various campaigns not necessarily run by The Post Millennial and contain a variety of different personal attributes including name, phone and physical address (depending on the campaign).”
As tweeted by Troy Hunt, while the data was leaked as part of The Post Millennial defacement, it is unclear where it originated from.
By the time of writing this, The Post Millennial has not issued a public statement regarding the site’s defacement or to warn its subscribers that data may have been exposed.
BleepingComputer has contacted both The Post Millennial and Human Events for a comment but has not received a reply.
In the meantime, reset your passwords and monitor account activity closely if you are a subscriber to the mentioned news outlets. Also, treat all communications (email, call, SMS) with vigilance.
