Tea

A first-of-its-kind policy allows Chinese firms to treat data as an asset, but compliance hurdles are keeping many companies on the sidelines.

• The government has allowed all Chinese companies to register data as assets on their balance sheets.
• Adoption of the policy has been slow, with only a small percentage of companies logging data as assets.
• Compliance hurdles are high, but China’s experiment could potentially shape global accounting norms.

Malware targeting macOS systems is increasingly pervasive in our current threat landscape. Most of the associated threats are cybercrime-related, ranging from information stealers to cryptocurrency mining. Over the past year, we have witnessed an increase in cybercrime activity linked to North Korean nation-state APT groups.

In line with the public service announcement issued by the FBI regarding North Korean social engineering attacks, we have also witnessed several such social engineering attempts, targeting job-seeking software developers in the cryptocurrency sector.

In this campaign, we discovered a Rust-based macOS malware nicknamed RustDoor masquerading as a legitimate software update, as well as a previously undocumented macOS variant of a malware family known as Koi Stealer. During our investigation, we observed rare evasion techniques, namely, manipulating components of macOS to remain under the radar.

The characteristics of these attackers are similar to various reports during the past year of North Korean threat actors targeting other job seekers. We assess with a moderate level of confidence that this attack was carried out on behalf of the North Korean regime.

This article details the activity of attackers within compromised environments. It also provides a technical analysis of the newly discovered Koi Stealer macOS variant and depicts the different stages of the attack through the lens of Cortex XDR.

Inocencia en Juego: An Investigation into Groups Targeting Children on Facebook

I am a professor of Latin American history and Director of the Civic Resilience Initiative of the Institute for Cyber Law, Policy, and Security at the University of Pittsburgh. I am also a mother of four: my older children were born and raised in Costa Rica, where we lived for nearly a decade and I taught at the main public university. In my research, I study various phenomena related to social media. In 2022, I published an account of my failed efforts to get Facebook to remove public Spanish-language groups in which children were being openly targeted for online sexual exploitation in Wired.

Eventually, in the months after publication, those specific groups disappeared. However, in 2023, I stumbled into a new set of public groups permeated by the same type of content. These were framed as fan groups for the Mexico kid hip-hop trio Los Picus. I wrote an initial report on the phenomenon in Tech Policy Press last January.

In this update and extension of that work, I report that the scope of the problem is far greater than I had initially found, encompassing multiple different fandoms and many dozens of public Facebook groups with over two and a half million members. Groups that center around popular celebrities, such as YouTube stars Mau McMahon and Karla Bustillos and the child members of their household; Phoenix, Arizona-born teen entertainer Xavi; and K-Pop stars, become host to what appears to be child predation.

The groups I have identified likely represent just a fraction of the problem. In addition to my own research, over the past few months, five journalists in Spanish-language news organizations in Latin America, coordinated by the investigative journalism consortium El CLIP, looked into these phenomena. Today, they published their reports in El CLIP, Chequeado, Crónica Uno, El Espectador, and Factchequeado. Their reporting indicates that this problem extends to even further Facebook groups—many not associated with any fandom, but rather branded as places to discuss teen issues— that the legislation in the countries investigated is often insufficient to deal with this sort of digital grooming, and that Meta collaborates too little with local authorities to try to curb this behavior.

In this report, I use the fact that posters in these Facebook groups sometimes ask participants to post their age and country of origin to provide rough quantitative data on the regional spread of stated ages and national origin. Numerous accounts in these groups identify themselves as children from Mexico, Venezuela, Colombia, Peru, and Ecuador, with others from across the hemisphere. Accounts identifying as children as young as 7 and 8 are present, and 10, 11, and 12-year-olds are common.

Towards the end of this report, I look in detail at some of the interactions in comments within these—again, fully public—groups to describe some forms of emotional luring and manipulation that very young Spanish-speaking Facebook users are apparently subject to.

We presented a range of questions to Meta about these phenomena. A Meta spokesperson responded with a statement and provided a link to Meta’s proactive steps to address these and similar phenomena:

Child exploitation is a horrific crime. We work aggressively to fight it on and off our platforms and to support law enforcement in its efforts to arrest and prosecute the criminals behind it. Our policies prohibit child exploitation, inappropriate interactions with children, and the sexualization of minors; these rules apply globally, in different languages, including English and Spanish, and across each of our platforms. While predators constantly change their tactics to evade detection, our global teams and tools work to identify and quickly remove violating content.

Please note that the report below contains disturbing descriptions and screenshots of posts and interactions involving accounts identifying as children. These images have been edited to remove any information that could be used to identify a particular account or user identity.

About a third of workers say AI use will lead to fewer job opportunities for them in the long run; chatbots seen as more helpful for speeding up work than improving its quality

Between early November and December 2024, Palo Alto Networks researchers discovered new Linux malware called Auto-color. We chose this name based on the file name the initial payload renames itself after installation.

The malware employs several methods to avoid detection, such as:

• Using benign-looking file names for operating
• Hiding remote command and control (C2) connections using an advanced technique similar to the one used by the Symbiote malware family
• Deploying proprietary encryption algorithms to hide communication and configuration information

Once installed, Auto-color allows threat actors full remote access to compromised machines, making it very difficult to remove without specialized software.

This article will cover aspects of this new Linux malware, including installation, obfuscation and evasion features. We will also discuss its capabilities and indicators of compromise (IoCs), to help others identify this threat on their systems too.

• There are many risks associated with selling items on online marketplaces that individuals and organizations should be aware of when conducting business on these platforms.
• Many of the general recommendations related to the use of these platforms are tailored towards purchasing items; however, there are several threats to those selling items as well.
• Recent phishing campaigns targeting sellers on these marketplaces have leveraged the platforms’ direct messaging feature(s) to attempt to steal credit card details for sellers’ payout accounts.
• Shipment detail changes, pressure to conduct off-platform transactions, and attempted use of “friends and family” payment options are commonly encountered scam techniques, all of which seek to remove the seller protections usually afforded by these platforms.
• There are several steps that sellers can take to help protect themselves and their data from these threats. Being mindful of the common scams and threats targeting sellers can help sellers identify when they may be being targeted by malicious buyers while it is occurring so that they can take defensive actions to protect themselves.

This is pretty interesting:

The results highlight significant differences in browser security: while Google Chrome and Samsung Internet exhibited lower threat indices, Mozilla Firefox demonstrated consistently higher scores, indicating greater exposure to risks. These observations a slightly contradict widespread opinion.

18 year old, publicly traded education technology company, Chegg, has sued Google over its AI Overviews and how it has hurt their traffic and revenue. Chegg has "filed a complaint against Google, which has unjustly retained traffic that has historically come to Chegg, impacting our acquisitions, revenue and employees," said Nathan Schultz, CEO of Chegg.