nsayoutube.blogg.se

Meow hackers also recently targeted a Mailfire server that was misconfigured and left open.

The attack leaves the word “meow” as its only calling card, according to researcher Bob Diachenko. A Meow attack refers to ongoing attacks that started earlier in July and left 1,000 unsecured databases permanently deleted. The day after they discovered the database, researchers believe it was attacked by the ongoing widespread Meow cyberattack, which completely wiped all its data.

Researchers said that in order to confirm that the database was live and real, they entered fake login credentials on one of the scam web pages and verified they had been recorded. The data in the exposed database included credentials and IP addresses text outlines for comments the fraudsters would make on Facebook pages (via a hacked account) that directed people to suspicious and fraudulent websites and personally identifiable information (PII) data such as emails, names and phone numbers of the Bitcoin scam victims. It was open between June and September of this year it was discovered on Sept. The unsecured Elasticsearch database was 5.5 gigabytes and contained 13,521,774 records of at least 100,000 Facebook users.

Threatpost has reached out to Facebook for further comment. Researchers said they have no evidence about whether the data was accessed or leaked by any other malicious parties. “These websites all eventually led to a fake Bitcoin trading platform used to scam people out of ‘deposits’ of at least €250. The fraudsters then “used the stolen login credentials to share spam comments on Facebook posts via the victims’ hacked account, directing people to their network of scam websites,” according to researchers with vpnMentor on Friday. Researchers said that the cybercriminals behind the scam were tricking Facebook victims into providing their account login credentials by using a tool that pretended to reveal who was visiting their profiles.

Researchers have uncovered a wide-ranging global scam targeting Facebook users, after finding an unsecured database used by fraudsters to store the usernames and passwords of at least 100,000 victims.