In a seizure warrant application, the U.S. Secret Service sheds light on how threat actors stole $34,000 using fake antivirus renewal subscription emails.The now-executed seizure warrant was submitted by Special Agent Jollif of the United States Secret Service (USSS) to recover funds stolen in a fake Norton subscription renewal email that led to the threat actor gaining access to a victim’s PC and bank account.

According to the court document submitted by a Special Agent of the United States Secret Service, the stolen money is stored in a Chase bank account belonging to someone named “Bingsong Zhou,” associated with phishing scams impersonating Norton Antivirus renewal subscriptions.

These phishing emails claim that the recipient is about to be charged for renewing an antivirus subscription license and to call the enclosed number to cancel it.

The victim calls the phone number listed on the email, and from there, the scammers direct them to perform various actions such as installing remote access software on their computers, infecting themselves with malware, and entering their account credentials on a phishing page.

This type of scam has been ongoing for many years, but Jollif stated that the activity has recently risen to higher volumes.

Illusionary deposit – One case highlighted in the court document mentions a victim who received a phishing email on November 28, 2023, alleging that he would be charged $349.95 for a Norton antivirus subscription unless he canceled the charge.
…

Tagged:

By now most internet users know their online activity is constantly tracked. No one should be shocked to see ads for items they previously searched for, or to be asked if their data can be shared with an unknown number of “partners.”But what is the scale of this surveillance? Judging from data collected by Facebook and newly described in a unique study by non-profit consumer watchdog Consumer Reports, it’s massive, and examining the data may leave you with more questions than answers.

Using a panel of 709 volunteers who shared archives of their Facebook data, Consumer Reports found that a total of 186,892 companies sent data about them to the social network. On average, each participant in the study had their data sent to Facebook by 2,230 companies. That number varied significantly, with some panelists’ data listing over 7,000 companies providing their data.

The Markup helped Consumer Reports recruit participants for the study. Participants downloaded an archive of the last three years of their data from their Facebook settings, then provided it to Consumer Reports.

By collecting data this way, the study was able to examine a form of tracking that is normally hidden: so-called “server-to-server” tracking, in which personal data goes from a company’s servers to Meta’s servers. Another form of tracking, in which Meta tracking pixels are placed on company websites, is visible to users’ browsers.

Because the data came from a self-selected group of users, and because the results were not demographically adjusted, the study does not “make any claims about how representative this sample is of the U.S. population as a whole,” Consumer Reports noted. Participants were also likely more privacy conscious and technically inclined than typical users and more likely to be members of Consumers Reports.

Despite its limitations, the study offers a rare look, using data directly from Meta, on how personal information is collected and aggregated online.

…

How Can I See My Data? Facebook users can browse through the list of companies that have sent their data to Facebook by going to: https://accountscenter.facebook.com/info_and_permissions

…

To see detailed information about these interactions, request a copy of your data.

…

Filed: https://themarkup.org/series/privacy

Site RSS: https://themarkup.org/feeds/rss.xml

Scammers are buying up cheap domain names to host sites that sell dodgy health products using fake articles, according to cybercrime disruption outfit Netcraft.The firm on Tuesday noted that purveyors of legal-but-dubious health products often run fake news campaigns to promote their offerings, often with layouts that mimic prominent news outlets. Some of the stories suggest that judges on entrepreneurial reality shows Shark Tank and Dragons’ Den have backed the products.

The fakery is sprayed across the internet, often to social media. Netcraft suggests it’s hosted on freshly-registered domain names from among the constellation of new global top-level domain names (gTLDs).

Such domains have proliferated in recent years after ICANN decided to allow new gTLDs in 2011.

…

“The cheap domain pricing on these TLDs allows criminals to cost-effectively spread their campaigns over a large number of domains,” Netcraft’s analysts wrote. “This makes it harder to perform countermeasures against cyber-attacks, as the campaign can be spread across more infrastructure.”

…

Scammers have duped consumers out of more than $1 billion by exploiting Walmart’s lax security. The company has resisted taking responsibility while breaking promises to regulators and skimping on training.

America’s largest retailer has long been a facilitator of fraud on a mass scale, a ProPublica investigation has found. For roughly a decade, Walmart has resisted tougher enforcement while breaking promises to regulators and skimping on employee training, according to more than 50 interviews, internal documents supplied by former industry executives, court filings and other public records.

Walmart has a financial incentive to avoid cracking down. It makes money each time a Walmart gift card is used and earns a fee when another brand of card is bought. And it receives one commission when a person sends a money transfer and a second when the recipient picks it up. The company’s financial services business generates hundreds of millions in annual profits. (Its filings do not provide specific figures for gift cards and money transfers.)

Just over a decade ago, Bitcoin appeared to many of its adherents to be the crypto-anarchist holy grail: truly private digital cash for the internet.Satoshi Nakamoto, the cryptocurrency’s mysterious and unidentifiable inventor, had stated in an email introducing Bitcoin that “participants can be anonymous.” And the Silk Road dark-web drug market seemed like living proof of that potential, enabling the sale of hundreds of millions of dollars in illegal drugs and other contraband for bitcoin while flaunting its impunity from law enforcement.

This is the story of the revelation in late 2013 that Bitcoin was, in fact, the opposite of untraceable—that its blockchain would actually allow researchers, tech companies, and law enforcement to trace and identify users with even more transparency than the existing financial system. That discovery would upend the world of cybercrime. Bitcoin tracing would, over the next few years, solve the mystery of the theft of a half-billion dollar stash of bitcoins from the world’s first crypto exchange, help enable the biggest dark-web drug market takedown in history, lead to the arrest of hundreds of pedophiles around the world in the bust of the dark web’s largest child sexual abuse video site, and result in the first-, second-, and third-biggest law enforcement monetary seizures in the history of the US Justice Department.

That 180-degree flip in the world’s understanding of cryptocurrency’s privacy properties, and the epic game of cat-and-mouse that followed, is the larger saga that unfolds in the book Tracers in the Dark: The Global Hunt for the Crime Lords of Cryptocurrency, out this week in paperback.

All of it began with the work of a young, puzzle-loving mathematician named Sarah Meiklejohn, the first researcher to pull out traceable patterns in the apparent noise of Bitcoin’s blockchain. This excerpt from Tracers in the Dark reveals how Meiklejohn came to the discoveries that would launch that new era of crypto criminal justice.

…

And critics worry it will tie the hands of U.S. intelligence agencies with an unusual power: It can make binding decisions on surveillance practices with federal agencies, which won’t be able to challenge those decisions.

…

The global trade in personal data is a large and growing business, up to $7.1 trillion between the U.S. and the EU alone, but governed by legal regimes that differ sharply across borders.

…

The court never officially opened for business, at least not publicly. The closest thing to an announcement was Merrick Garland’s press conference last November, naming the eight judges who would hear cases.

…

Filed under:

• Google,
• Microsoft,
• Amazon,
• Data,
• Joe Biden,
• Joe Biden 2024,
• Eric Holder,
• Online Privacy,
• European Union,
• TikTok,
• Meta