Dark Reading Daily -- March 13, 2023

ChatGPT Browser Extension Hijacks Facebook Business Accounts

Between March 3 and March 9, at least 2,000 people a day downloaded the malicious "Quick access to ChatGPT" Chrome extension from the Google Play app store.

BlackLotus Secure Boot Bypass Malware Set to Ramp Up

BlackLotus is the first in-the-wild malware to exploit a vulnerability in the Secure Boot process on Windows, and experts expect copycats and imminent increased activity.

Legal Industry Faces Double Jeopardy as a Favorite Cybercrime Target

Hackers are increasingly tantalized by the troves of sensitive data held by lightly protected law firms and legal services organizations.

Unpatched Zero-Day Bugs in Smart Intercom Allow Remote Eavesdropping

A video-enabled smart intercom made by Chinese company Akuvox has major security vulnerabilities that allow audio and video spying, and the company has so far been unresponsive to the discoveries.

Pig Butchering & Investment Scams: The $3B Cybercrime Threat Overtaking BEC

A novel take on investment scams mixes romance and the lure of crypto riches to con targets out of "the whole hog" of their assets.

Make Sure Your Cybersecurity Budget Stays Flexible

CISOs' ability to pivot tight budgets is key to defense plans that can stand up to attackers.

And the Cyberattack Goes to ... Fans of Oscar-Nominated Films

With the rise of cybercriminals targeting online piracy, this year's Oscar-nom fans need to be especially careful not to download malicious files while attempting to watch popular films for free.

Inside Threat: Developers Leaked 10M Credentials, Passwords in 2022

More than five out of every 1,000 commits to GitHub included a software secret, half again the rate in 2021, putting applications and businesses at risk.

How to Jump-Start Your Cybersecurity Career

With more than 700,000 cybersecurity jobs available, now is a good time to consider a career change.

5 Critical Components of Effective ICS/OT Security

These agile controls and processes can help critical infrastructure organizations build an ICS security program tailored to their own risk profile.

US Lawmakers Face Cyberattacks, Potential Physical Harm After DC Health Link Breach

The threat actor who posted the data for sale has claimed credit for multiple other breaches, including one at grocery platform Weee! that exposed data on more than 1.1 million customers.

LATEST FROM THE EDGE

Proposed FCC Rule Redefines Data Breaches for Communications Carriers

If the proposed rule is approved, organizations would need to disclose all data breaches, even ones that don't cause any harm, to affected customers.

LATEST FROM DR TECHNOLOGY

3 Ways Security Teams Can Use IP Data Context

Innocently or not, residential proxy networks can obscure the actual geolocation of an access point. Here's why that's not great and what you can do about it.

The Promise and Reality of Cloud Security