Monthly threat updates fromF-SecureFebruary 2024

Discover the latest
threat updates. Packedwith insights from theexperts at F-Secure.
Delivered every month.
Learn how sellers can outsmart scammers. Find out
the hidden threat behind OpenAI’s next leap. Know
which social networks protect the privacy of yourdirect messages. And discover how criminals have
expanded their pursuit of Google accounts. All thisand much more in this month’s F-Alert threat report.

Monthly threat report from F-Secure | February 20242Sellers get scammed, too
Laura KankaalaThreat Intelligence
LeadBuyers aren't the only ones who need to beware online – sellers also face
online shopping fraud.

Helsinki, Finland

expert tip
Never accept overpayment. And never shareyour private information, such as a Google Voiceverification code, with any potential buyer. Both ofthese are common parts of advanced seller scams.

“It's entirely possible
to be scammed as aseller.”

Ecommerce doesn’t just offer thechance to buy almost anythingfrom anywhere. Individuals can also
quickly set up shop to sell their wares
in minutes, often through some of thelargest shopping platforms on earth.
And scammers have noticed.

Abusing the system“It's entirely possible to be scammed
as a seller,” said
Laura Kankaala,
F-Secure ThreatIntelligence Lead.
“Buyers can, for instance,
abuse the system byclaiming that the item you
sent is poor quality or isn’t theright size. They can even fake aproblem with the product’sdelivery.”

The goal of the scam is often to retain
the product while avoiding payment.

victim of fraud should do more thanvent," Laura explained.

“In worst-case scenarios, thescammed items are then resold by
the scammers themselves,” she said.
“Scammed sellers often feel they
have few options because
online retail platforms are likely
to side with the customers,
who the company has spentmoney and time to acquire.”

Reporting shady buyers"Somewronged
sellers
from platforms
such as Ebay
and Vinted
have shared
their horror stories
online. But any“It's imperative to always report
shady buyers to the online shopping
platforms, no matter how small theloss,” she said. “It’s likely this scammer
is not only scamming you but others
as well.”Take screenshots of all contact withthe potential scammer and any othertype of evidence you can gather.
Some platforms may require to youreport a fraud in a specific amount oftime for the complaint to proceed.
“Finally, consider also filing a police
report,” she concluded.

OpenAI deals with growing pains
New GPT Store and phishing attacks reveal the promise and peril of custom
AI bots.
OpenAI has seen astonishing successin just a little over a year since it
launched ChatGPT, offering the world
a masterclass in the opportunities andchallenges that come with being theleader in the hottest industry on earth.
With the launch of the delayed GPTStore, the security world is closely
watching how OpenAI will handle bothmoderation and threats like phishing.

Like any digital marketplace
The GPT Store allows users to createand sell custom versions of ChatGPT,
called GPTs, that offer useful services
from finding hiking trails to creatingwebsites.
“But, just like any digital marketplace,such as Google Play, the GPT Store is
not immune to the lurking shadows ofsecurity threats and malicious actors,”

explained Khalid Alnajjar, a Senior
Threat Data Researcher at F-Secure.
Just days after the launch of the store,
several GPTs seemed to be offering “AIgirlfriends,” which are in direct violationof OpenAI’s policies.
But GPT fans have more to worry
about than just amorous robots.

A hidden threat“Beneath the wavesof OpenAI's
bustling GPTStore lies a hidden
threat,” Khalid said.
He noted thatphishing attacks
cleverly disguised
to extract user
credentials canKhalid Alnajjar
Senior Threat DataResearcherHelsinki, Finland

target ChatGPT users. And theresearchers who discovered thissecurity weakness noted that attacks
can work from the GPT Store.
“The prompt injection attack works bymaking the ChatGPT interface renderan external image,” he said. “While thisuse case is a legitimate one, attackers
can abuse the feature by loading
an invisible tiny pixel or passing
sensitive user information as
URL parameters.”
He added that ChatGPT’s
conversation sharing feature
also presents numerous
security risks – fromspreading phishingattacks to directly
spreading malware
through malicious
links or downloads.

expert tipBe mindful of the information you share with any AI
interface. Before you hit enter, pause, and think: “Do I
really need to share this? Is this safe?”“Beneath the wavesof OpenAI's bustling
GPT Store lies ahidden threat.”TrendingScm

Breach thatmatters

Adding insult to romance scams

Naz.api dump of credentials fromYahoo, eBay, Facebook and moreWHAT:

WHY IT MATTERS:Romance scams are literally a billion-dollar business, but the criminals

Since October of last year, we have been alerting our customers who werebehind them still want more. A Massachusetts woman, who lost overaffected by this massive data leak that has only recently made the headlines. The$150,000 to a romance scammer, was also harassed by scammers

leak, known as the Naz.api dataset, consists of hundreds of millions of records

pretending to be law enforcement agencies handling her case.

from various online platforms, such as Roblox, Coinbase, and Yammer. Among

HOW:
An email with the subject “THE CIA IN COLLABORATION WITH THEFBI” threatened the woman. The message warned that if she spoke tolaw enforcement or her lawyer about a months-long scam with a manthese records are 71 million unique credentials, of which 25 million are not foundanywhere else online. The source of the leak is likely an infostealer malware, as all
the passwords are in plaintext. No major site stores passwords without some formof encryption.

alleging to be a pipeline worker needing emergency funds, she would

BREACHED DATA:

never get her money back. Even worse, she could face criminal charges.

The data includes usernames, passwords, email addresses and a variety of other

PREPARE:

personally identifiable information for hundreds of millions of internet users.

If you’re reading this, you probably know to be suspicious of any plea for

WHAT SHOULD YOU DO:

money from a stranger. You also know that you should reach out to a

A leak this large could impact nearly any average internet user or one of their loved

trusted friend or relative the moment you feel you may be scammed. Be

ones. If you haven’t done a check on whether your data has been leaked online

sure to share these precautionswith any of your loved ones who might bebefore, now is the perfect time. Also be sure that all your accounts have an extra

looking for love online.

layer of security: activate two-factor authentication or passkeys wherever they areavailable.

Monthly threat report from F-Secure | February 2024

Has your data been exposed as part of Naz.api? Check with our F-Secure Identity Theft Checker!

5Are your DMs really private?
Joel Latto

Meta has finally rolled out end-to-end encryption for Instagram andMessenger. How do other social networks compare?

Threat Advisor
Helsinki, Finland

After seven years, Meta has finally

But the issue is pretty simple for“Just because a service calls them

fulfilled CEO Mark Zuckerberg’s

consumers.

‘private messages’ is no guarantee thatpromise to fully encrypt all direct
messages on Instagram and Facebook.

expert tip
No matter how well encrypted your messages
are, they’re only as secure as your account. This is
another reason to use strong, unique passwords andtwo-factor authentication, whenever possible, toprevent account takeovers.

“End-to-endencryption turns a
direct message into a
private message.”

Encrypted messages offer theconfidence that the contents of yourthe content is encrypted,” explained
Joel Latto, Threat Advisor at F-Secure.
“End-to-end encryption is what turns a

End-to-end encryption often puts

communications are only accessible

tech companies in conflict withto you and the receiver. No one else—governments and law enforcement

not the platform, telecommunication

You need to know if you canagencies that want access to any

providers, or anyone trying to snoop—

expect privacy from the direct

information deemed necessary for theirshould be able to see them.

communications on your favorite socialaims.

direct message into a private message.”

media platform. That’s why we’ve
prepared this chart.

Message encryption by social network
Platform

Encryption

Direct or private

Meta (Facebook, Instagram, Messenger, WhatsApp)

End-to-end encryption by default

PrivateTikTok“End-to-end encryption is not currently available.”

DirectLinkedIn“We encrypt data in transit. Certain sensitive data is also encrypted at rest,
including credit card information and passwords.”

Unclear, but assume
direct.

X

Encrypted Direct Messages are available for verified users and verified
organizations’ affiliated users.

Can be private but
not by default.

MastodonPosts on Mastodon are not end-to-end encrypted.

DirectYoutube, Threads, Bluesky

No messaging availablen/aMalware targets Google accounts
Criminals take advantage of newer methods to access everything from
Gmail accounts to YouTube channels.
You may have never considered theexploit that uses a specific Google API

value of your Google account, but youto ‘revive’ stolen session cookies andcan be sure attackers have.

gain unauthorized access to Google

The massive growth of infostealers has

accounts” said Ash Shatrieh, Threat

been fueled by the constant innovations

Intelligence Researcher at F-Secure.

used to manipulate potential victims.

Almost 2 billion people use Gmail,which is used by countless people as askeleton key for access to all their key
accounts as a backup email. Of the 2.5
billion active YouTube users, 114 million
run their own channels.
The tech giant has made impressive
progress in improving account security
lately by joining the FIDO alliance to rollout passkeys, and introducing a new wayfor account verification. But criminals
seem to be adjusting with malware
specifically designed to take over a“What’s new here is criminals canretain access even if the password ischanged. The API allows cookies to beregenerated once more even after apassword reset.”

security.
“Lumma infostealer quickly began to

Google services linked to that account,take advantage of the security hole,including Calendar, Photos, and Meet.

which Google has said that it doesn’t“Information stealing malware has
been able to take advantage of a known

is that users often don’t think twice
when ignoring their security software’s
warnings about installing theAdvisor at F-Secure.

generally offers excellent accountplan to fix,” Ash added. “Very quickly,
several other infostealers also added
the same exploit.”

Helsinki, Finland

expert tip

malware through cracked software

explained how Google Authentication

Google account and gain access to all thePasswordless hack“One of the advantages of spreading

downloads,” explained Joel Latto, Threat

two-factor authentication, which

Threat Intelligence
ResearcherTricks upon tricks

A post on Telegram in October of 2023
cookies could be used to bypass

Ash Shatrieh

The Lumma stealer uses a variation on

If you think you’ve been infected by an infostealer, youneed to do more than just scan your computer thistime. You need to log out of all Google sessions, change
your Google password, and log in again to regeneratecookies. Reviewing and revoking any odd connections
is also a good idea.

another common trick to spread evenfurther.
“Using compromised YouTube
accounts, the criminals post videos
for cracked software to seed infected
files, much in the same way cracked
software is often advertised in DiscordForums,” he concluded.

“Very quickly, several
other infostealers
also added the sameexploit.”About F-Secure
F-Secure makes every digital moment more secure, for everyone.
We deliver brilliantly simple, frictionless security experiences thatmake life easier for the tens of millions of people we protect andour 200 partners.
For more than 30 years, we’ve led the cyber security industry,
inspired by a pioneering spirit born out of a shared commitment to
do better by working together.
For more information visit f-secure.com today!