Dark Reading Weekly -- May 25, 2023

Google's .zip, .mov Domains Give Social Engineers a Shiny New Tool

Security professionals warn that Google's new top-level domains, .zip and .mov, pose social engineering risks while providing little reason for their existence.

OAuth Flaw in Expo Platform Affects Hundreds of Third-Party Sites, Apps

A cybersecurity vulnerability found in an implementation of the social login functionality opens the door to account takeovers and more.

'Volt Typhoon' China-Backed APT Infiltrates US Critical Infrastructure Orgs

According to Microsoft and researchers, the state-sponsored threat actor could very well be setting up a contingency plan for disruptive attacks on the US in the wake of an armed conflict in the South China Sea.

Microsoft: BEC Attackers Evade 'Impossible Travel' Flags With Residential IP Addresses

Threat actors are circumventing geo-location-based security detections, using a combination of cybercrime-as-a-service platforms and the purchasing of local IP addresses.

Bridgestone CISO: Lessons From Ransomware Attack Include Acting, Not Thinking

A February 2022 attack knocked the giant tire maker's North American operations offline for several days.

PyPI Shuts Down Over the Weekend, Says Incident Was Overblown

The climate of concern around open source security and supply chain attacks may have caused a small story to become a big one.

3 Common Initial Attack Vectors Account for Most Ransomware Campaigns

The data shows how most cyberattacks start, so basic steps can help organizations avoid becoming the latest statistic.

Apple Patches 3 Zero-Days Possibly Already Exploited

In an advisory released by the company, Apple revealed patches for three previously unknown bugs it says may already have been used by attackers.

Meta Hit With $1.3B Record-Breaking Fine for GDPR Violations

The technology conglomerate has until later this year to end its transfer of European user's data across the Atlantic.

3 Ways Hackers Use ChatGPT to Cause Security Headaches

As ChatGPT adoption grows, the industry needs to proceed with caution. Here's why.

Cyber Warfare Lessons From the Russia-Ukraine Conflict

Techniques used in cyber warfare can be sold to anyone — irrespective of borders, authorities, or affiliations. We need to develop strategies to respond at scale.

Keep Your Friends Close and Your Identity Closer

As we share an increasing amount of personal information online, we create more opportunities for threat actors to steal our identities.

How Enterprises Are Managing Application Security Risks in a Heightened Threat Environment