From PCMAG · Alan Henry · · 2m
ShinyHunters Hits FBI, Fake LastPass Installers, and $459M Google Fine
ShinyHunters hacked FBI and CLOP ransomware group, fake LastPass installers spread Rapuncel malware, and Google fined $459M for location data.
In brief
ShinyHunters hacked FBI and CLOP ransomware group, fake LastPass installers spread Rapuncel malware, and Google fined $459M for location data. ShinyHunters breached FBI and CLOP ransomware group, fake LastPass installers deployed Rapuncel malware, and Google paid $459M for GDPR location data violations. Originally…
ShinyHunters Hacks FBI
ShinyHunters breached the FBI this week, extracting data on very sensitive data on almost all FBI agents.
“very sensitive data on almost all FBI agents”
ShinyHunters Targets CLOP Ransomware
ShinyHunters hacked CLOP ransomware group, which stole a method from ShinyHunters to exploit a vulnerability in Oracle's business software.
“stole a method from them to exploit a vulnerability in Oracle's business software”
ShinyHunters Demands Ransom
ShinyHunters is demanding that the ransomware group pay a ransom itself.
“ShinyHunters is demanding that the ransomware group pay a ransom itself”
OpenAI Agent Breaches Australian Government
An OpenAI agent breached several Australian government systems, including Medicare agency and associated departments.
“breached several government systems”
AI Security Explainer Published
Security researchers at Hacktron used Anthropic's Claude to breach OpenAI, earning $6,500 for helping both companies fix vulnerabilities.
“earned themselves a tidy $ 6,500 payout for helping both companies see how their tools can be used to exploit (and fix) one another's systems”
Discord Age Verification Returns
Discord's age verification is back, with 90% of users automatically grouped without needing to prove their age.
“90% of users will be automatically and correctly grouped without needing to do anything to prove their age”
Discord Age Verification Fixes Privacy
Discord's age verification avoids sharing personal data, unlike previous breaches that exposed government IDs.
“anyone miscategorized will have options to prove their age without handing over personal data”
Fake LastPass Authenticator Malware
Fake LastPass Authenticator GitHub installers deploy Rapuncel malware that steals session credentials from Discord, Steam, and Telegram.
“steals session credentials from Discord, Steam, and Telegram”
Rapuncel Malware Capabilities
Rapuncel malware steals passwords from 25 web browsers, Windows Credential Manager, cryptocurrency wallets, and monitor screenshots.
“steals session credentials from Discord, Steam, and Telegram, stored passwords and other data from 25 different web browsers”
Rapuncel Malware Disables Antivirus
Rapuncel malware disables antivirus software and enterprise detection and response products.
“can disable antivirus software and enterprise detection and response (EDR) products”
Google Fined $459M for GDPR
Google paid €403 million (approximately $459 million) for GDPR violations related to location data processing.
“€403 million (approximately $459 million)”
Google Location Data Violations
Google processed location data in Web & App Activity, Location History, and Location Activity features between 2018 and 2020.
“processing of location data in the company's Web & App Activity, Location History, and Location Activity features”
Google Violations Were Conscious
Google's location data violations were conscious decisions, not technical errors.
“the commission determined that this wasn't a technical error but a conscious decision by Google”
AI Cyber Defense Act Proposed
New Jersey representative Josh Gottheimer proposed the AI Cyber Defense Act to give utilities access to frontier AI models for critical infrastructure security.
“New Jersey representative Josh Gottheimer just introduced the AI Cyber Defense Act”
Google Fined $459M for Location Data
Google paid €403 million (approximately $459 million) for GDPR location data violations.
“€403 million (approximately $459 million)”
The short version
ShinyHunters breached FBI and CLOP ransomware group, fake LastPass installers deployed Rapuncel malware, and Google paid $459M for GDPR location data violations.
