Top 10 Stories

Cybersecurity firm Palo Alto Networks has identified new malware, which it calls YiSpecter, that infects iOS devices by abusing private APIs. Most affected users live in China and Taiwan. Once it infects a phone, YiSpecter can install unwanted apps; replacing legitimate apps with ones it has downloaded; force apps to display full-screen advertisements; change bookmarks and default search engines in Safari; and send user information back to its server. It also automatically reappears even after users...

More than 1 Billion Android devices are vulnerable to hackers once again – Thanks to newly disclosed two new Android Stagefright vulnerabilities. Yes, Android Stagefright bug is Back… …and this time, the flaw allows an attacker to hack Android smartphones just by tricking users into visiting a website that contains a malicious multimedia file, either MP3 or MP4. View full story

The MS Society has written to approximately 25,000 of its website users to warn them that their personal information might have been compromised by a cyber attack. The charity said it had discovered malicious software on its website systems that could mean it had been subject to a hacking attempt. People who might have been affected include those who are registered with the charity’s online forum, who have contacted it through the “contact us” form on its...

Up-market retailer David Jones says its website has been hacked and private customer data stolen, a day after a similar attack on Kmart’s wesbite. David Jones said today that it recently learned that a third party exploited a vulnerability in its website to extract limited information about some of our customers. The information obtained includes names, email address, order details and mailing addresses. No credit card, financial or password information was hacked. View full story

Nearly two-thirds of IT security professionals believe that potentially life-threatening vulnerabilities should be made public if disclosure to the manufacturer hasn’t worked, according to a new study. Unified security management vendor AlienVault polled over 650 security professionals at Black Hat 2015 to gauge their views on what should be done if a serious flaw is found on a critical internet-connected device. Although the majority agreed that the information should be made public if the manufacturer...

Global information services group Experian announced Thursday that one of its business units had been hacked. The breach occurred on a server that contained data on behalf of one of its clients, T-Mobile. The data includes personal information for a combination of about 15 million customers and credit applicants in the U.S. The company said that the incident did not impact its own consumer credit database. The data also included applicants requiring a credit check...

It’s notable whenever cybercime spills over into real-world, physical attacks. This is the story of a Russian security firm whose operations were pelted with Molotov cocktail attacks after exposing an organized crime gang that developed and sold malicious software to steal cash from ATMs. The threats began not long after December 18, 2013, when Russian antivirus firm Dr.Web posted a writeup about a new Trojan horse program designed to steal card data from infected ATMs. Dr.Web received email warning the company to...

There is a new spam campaign targeting Scandinavians that’s spreading nasty ransomware—with a 0% detection rate. Heimdal Security has identified the campaign as the fourth major ransomware campaign in the wild since the beginning of September, including one that compromised 142 million legitimate websites for its cause. This one starts by sending email  with an attached Word document to arbitrary recipients. That document contains macros, which, when activated, will download and run the malicious ransomware, encrypting...

The evolution of malware is garnering attention from security researchers and law enforcement, as the off-the-shelf banking Trojans known as Dyre and Dridex have now been linked to the theft of massive amounts of corporate and personal data. Eward Driehuis, a director at cybersecurity and threat-intelligence firm Fox-IT who was a featured presenter at Information Security Media Group's Fraud Summit Toronto this week, says cybercriminals are now using Dyre and Dridex to gather data that can help track patterns of human...

Several Thai government websites have been hit by a suspected distributed-denial-of-service (DDoS) attack, making them impossible to access. The sites went offline at 22:00 local time (15:00 GMT) on Wednesday. Access was restored by Thursday morning. It appeared to be a protest against the government's plan to limit access to sites deemed inappropriate. Tens of thousands of people have signed a petition against the proposal they call the "Great Firewall of Thailand". The name is...