Cybercriminals pose as LastPass staff to hack password vaults

If you are not Off Last Pass Yet get off it..you should be Try Bitwarden
By Bill Toulas April 18, 2024 10:56 AM

LastPass is warning of a malicious campaign targeting its users with the CryptoChameleon phishing kit that is associated with cryptocurrency theft.

CryptoChameleon is an advanced phishing kit that was spotted earlier this year, targeting Federal Communications Commission (FCC) employees using custom-crafted Okta single sign-on (SSO) pages.

According to researchers at mobile security company Lookout, campaigns using this phishing kit also targeted cryptocurrency platforms Binance, Coinbase, Kraken, and Gemini, using pages that impersonated Okta, Gmail, iCloud, Outlook, Twitter, Yahoo, and AOL.

During its investigations, LastPass discovered that its service was recently added to the CryptoChameleon kit, and a phishing site was hosted at at the “help-lastpass[.]com” domain.

The attacker combines multiple social engineering techniques that involve contacting the potential victim (voice phishing) and pretending to be a LastPass employee trying to help with securing the account following unauthorized access.

Below are the tactics LastPass observed in this campaign:

Victims receive a call from an 888 number claiming unauthorized access to their LastPass account and are prompted to allow or block the access by pressing “1” or “2”.

If they choose to block the access, they’re told they will get a follow-up call to resolve the issue.

A second call comes from a spoofed number, where the caller, posing as a LastPass employee, sends a phishing email from “support@lastpass” with a link to the fake LastPass site.

Entering the master password on this site allows the attacker to change account settings and lock out the legitimate user.

The malicious website is now offline but it is very likely that other campaigns will follow and threat actors will rely on new domains.

Users of the popular password management service are recommended to beware of suspicious phone calls, messages, or emails claiming to come from LastPass and urging immediate action.

Some indicators of suspicious communication from this campaign include emails with the subject “We’re here for you” and the use of a shortened URL service for links in the message. Users should report these attempts to LastPass at abuse@lastpass.com.

Regardless of the sevice, the master password should not be shared with anyone since it is the key to all your sensitive information.

Article (https://www.bleepingcomputer.com/news/security/cybercriminals-pose-as-lastpass-staff-to-hack-password-vaults/)

Roy Miehe | MspPortal Partners Inc. | Ceo/President
Security Software Distributor: Bitdefender , Barracuda, Phishing Simulation & Cyber Security Training
“Where Service and Technical Skills Count”

Plus Bonus Article must read today

By Bill Toulas April 15, 2024 10:52 AM

Cisco Duo’s security team warns that hackers stole some customers’ VoIP and SMS logs for multi-factor authentication (MFA) messages in a cyberattack on their telephony provider.

Cisco Duo is a multi-factor authentication and Single Sign-On service used by corporations to provide secure access to internal networks and corporate applications.

Duo’s homepage reports that it serves 100,000 customers and handles over a billion authentications monthly, with over 10,000,000 downloads on Google Play.

In emails sent to customers, Cisco Duo says an unnamed provider who handles the company’s SMS and VOIP multi-factor authentication (MFA) messages was compromised on April 1, 2024.

The notice explains that a threat actor obtained employee credentials through a phishing attack and then used those credentials to gain access to the telephony provider’s systems.

The intruder then downloaded SMS and VoIP MFA message logs associated with specific Duo accounts between March 1, 2024, and March 31, 2024.

“We are writing to inform you of an incident involving one of our Duo telephony suppliers (the “Provider”) that Duo uses to send multifactor authentication (MFA) messages via SMS and VOIP to its customers,” reads the notice sent to impacted customers.

“Cisco is actively working with the Provider to investigate and address the incident. While the investigation is ongoing, the following is a summary of the incident based on what we have learned to date.”

The provider confirmed that the threat actor did not access any contents of the messages or use their access to send messages to customers.

However, the stolen message logs do contain data that could be used in targeted phishing attacks to gain access to sensitive information, such as corporate credentials.

The data contained in these logs includes an employee’s:

Phone number
Carrier
Location data
Date
Time
Message type

When the impacted supplier discovered the breach, they invalidated the compromised credentials, analyzed activity logs, and notified Cisco accordingly. Additional security measures were also implemented to prevent similar incidents in the future.

The vendor provided Cisco Duo with all of the exposed message logs, which can be requested by emailing msp@duo.com to help better understand the scope of the breach, its impact, and the appropriate defense

strategy to take.

Cisco also warns customers impacted by this breach to be vigilant against potential SMS phishing or social engineering attacks using the stolen information.

“Because the threat actor obtained access to the message logs through a successful social engineering attack on the Provider, please contact your customers with affected users whose phone numbers were contained in the message logs to notify them, without undue delay, of this event and to advise them to be vigilant and report any suspected social engineering attacks to the relevant incident response team or other designated point of contact for such matters,” concludes the notification from Cisco’s Data Privacy and Incident Response Team.

“Please also consider educating your users on the risks posed by social engineering attacks and investigating any suspicious activity.”

The FBI warned last year that threat actors were increasingly using SMS phishing and voice calls in social engineering attacks to breach corporate networks.

In 2022, Uber was breached after a threat actor performed an MFA fatigue attack on an employee and then contacted them on WhatsApp via their phone numbers, pretending to be IT help desk personnel. This eventually led to the target allowing the hackers to log into the account and gain access to Uber’s systems.

Cisco has not disclosed the supplier’s name and the number of customers impacted by this incident. BleepingComputer contacted Cisco with further questions but a reply was not immediately available.
Related Articles:

Article (https://www.bleepingcomputer.com/news/security/cisco-duo-warns-third-party-data-breach-exposed-sms-mfa-logs/)

Article a Must Read ( https://www.bleepingcomputer.com/news/security/cisco-warns-of-large-scale-brute-force-attacks-against-vpn-services/) Cisco warns of large-scale brute-force attacks against Most VPN services

Roy Miehe | MspPortal Partners Inc. | Ceo/PresidentSecurity

Software Distributor: Bitdefender , Barracuda, Phishing Simulation & Cyber Security Training

“Where Service and Technical Skills Count