Monthly threat updates fromF-SecureJanuary 2023

Discover the latest
threat updates. Packed
with insights from theexperts at F-Secure.
Delivered every month.
Find out how you might be affected by the recent
massive Twitter data leak. See how scammers
exploit Instagram’s mysterious account recovery
system. Find out how criminals have hijacked
Google’s search results. And learn how the month's
biggest leaks might affect you and your data.

Monthly threat report from F-Secure | January 2023

2Majority of Twitter users exposed
Joel Latto
Threat Advisor

A leak of 200 million email addresses puts some users’ privacy
at risk and could lead to targeted attacks.

Helsinki, FinlandMore than 200 million Twitter users
appear to have had their personal
data posted on a hacker forum,
where it is being sold for just $2.

expert tip
To hide your identity, Twitter recommends not adding
a publicly known phone number or email. But go
three steps further. Don’t add your phone number atall. Instead, use an authenticator app or hardware
key for two-factor authentication. And uncheck both
“Discoverability” boxes in Twitter’s settings.

A pretty worthless dataset“The low price makes sense because
it’s a pretty worth less as a dataset,”said Joel Latto, F-Secure Threat
Advisor. “However, that doesn’tmean there aren’t any worries for theaffected users.”
Reports suggest that a now-patchedvulnerability in Twitter’s API“This leak is good reminder to always
use two-factor authentication
whenever it’s available.”(application programming interface)during 2021 made it possible to collectemail addresses, phone numbers,
and usernames from just over halfof the site’s users (around 400m).
However, Twitter has denied that thisvulnerability was exploited.

(although there was a bug thatleft 330 million users’ passwords
potentially exposed in 2018, but
without any evidence of misuse).
And with just a username and email
address, threat actors could try totake over an account by attempting toreset the password.

The biggest risk

“Unfortunately, almost every service
or site gets breached eventually,”
Latto said. “While the information
exposed here is minimal for mostusers, the need to be careful about
securing your key accounts andmonitoring your information justkeeps growing. This leak is goodreminder to always use two-factor
authentication whenever it’savailable.”“The biggest risk here is for‘pseudonymous’ users or who hide
their identity,” Latto explained. By
connecting these accounts to publicly
known emails, the identities of thesecloaked accounts could be exposedwith severe implications for activists
and other previously anonymoususers.
This breach ranks among the largestof all-time, and appears to be thebiggest leak in Twitter’s history

3Instagram influencers exploitedSome Instagram users locked out of their accounts have been forced toturn to the black market for help, but new tools may provide some support.
When an Instagram accounts has
been hacked, or shut down by Meta
(Instagram’s parent company) it canbe an uphill struggle for the legitimate
owner to reclaim their account, andthis has led some influencers into
compromising situations.

It can be overwhelming“Users who have been locked out of
their accounts often spend months
trying to get help from the site,” said
Laura Kankaala, F-Secure’s ThreatIntelligence Lead.
Users report issues with buggy userinterfaces, along with dead-end
conversations with Meta.
“The account recovery processincludes submitting pictures orvideos of yourself – which creates
opportunities for people looking to
exploit the recovery mechanism

by using photoshopped, or evendeepfaked content, to take overothers’ accounts,” Kankaala said.

The odd thing
Unfortunately, the difficulty ofrecovering accounts has created a
black market.
“Shady characters offer help for
substantial payments, and there havebeen reports of desperate influencers
taking desperate measures. The odd
thing is these efforts occasionallyseem to work,” Kankaala explained.
Kankaala believes these successes
come from tricks learned via trial
and error, whilst helping multiple
people who have lost their accounts
with their recovery process. She
notes some claim to use hacking
techniques, but there's no evidence
that this is true.

“If you come across someone
claiming to have hacked Instagram,
most likely they are bamboozling
victims into paying for nothing,”
Kankaala said.

Finally, some help
However, at the end of 2022,Instagram finally took significant
steps to address the issue.
“The mystery of the process has beena godsend for scammers,” Kankaalasaid. “Hopefully, this is the beginningof the end of this weird little economy.”

Laura Kankaala
Threat Intelligence
LeadHelsinki, Finland

expert tip
Secure your account. It's not only about strong
passwords. It’s also about enabling two-factor
authentication, activating login requests so you know
when a new device tries to access your account, andbeing mindful which 3rd-party applications, such asTinder, have access to your Instagram.

“It can be overwhelming forsomeone looking to restore theiraccount and their livelihood.”

Breach reports
A selection of the month’s biggest breaches, where confidential or protected information have been exposed.
DeezerGemini

Empowrd Apps

Andersen Corporation

Discovered: 6/1/2023

Discovered: 22/12/2022

Discovered: 12/1/2023

Discovered: 10/1/2023

Affected people:
Almost 335 million

Affected people:
More than 5 million

Affected people:
Almost 165,000

Affected people:
Over 1.2 million

Breach severity:

Breach severity:

Breach severity:

Breach severity:

Data from the online music streaming
service Deezer from 2019 was leaked tohacking forum in early 2023. This breachcontaining names, email addresses, IPs,
and usernames offers a reminder thatmonitoring your identity and applying
strong account security are necessary
even if you do not believe your data hasever been exposed. Victims of this breachshould expect targeted phishing attacks
and refrain from clicking on links or
attachments in emails.

Email addresses of users of Gemini, a
cryptocurrency exchange, were leakedon a hacking forum in late 2022. While
this leak only involves emails, users
should take the steps anyone should takewhenever data from a financial institution
they use has been compromised. File afraud alert with either Equifax, Experian,or Trans Union. Then check your credit tomake sure your personal information has
not been used to open any card you did
not apply for yourself.

Names, email addresses, usernames,
passwords, and phone numbers of thecivic engagement tool EmpowrdApps
have been leaked and are being privately
shared on the internet. The primary
worry for victims of this leak is password
security. Consider the password you used
for this app is compromised as it’s being
shared across the dark web. Change it
and any variations of this password thatyou’ve ever used and never use themagain.

Names, addresses, email addresses,
phone numbers and additional personal
information were leaked on a hacking
forum in January 2023. This dataset belongs
to the U.S.-based home improvementcompany Andersen Corporation. This kind of
combination information could be used forvery convincing phishing campaigns, by both
email and traditional mail.

Want to know if you were affected by a breach? Check out our F-Secure Identity Theft Checker!
Monthly threat report from F-Secure | January 2023

5

Google Ads hijacked
Yik HanResearcherPuchong, Malaysia

Criminals are abusing Google’s targeted ad platform to pump outmalware.
Users searching for software
packages on Google have been
served ads that lead to a “malware
cocktail.”expert tip
When it comes to using search engines, threats will
strike where least expect them, so we need to becareful whenever we click on a link, and always checkthe URL of the site we've been sent to. Additionally, useinternet security, like F-Secure TOTAL, that not only
secures your computer, but also protects your online
activity by blocking malicious websites.

Weaponizing ads“Google has generally eliminatedsearch engine poisoning, wherecriminals abused the site’s algorithm
to push malicious sites to the topof search results,” said Yik Han, aresearcher at F-Secure. “However,cyber criminals always adapt.”“It’s quite new, but detections arerising steadily.”A new threat combines
search engine poisoning withtyposquatting—a trick that uses
misspellings of popular sites to steal
web traffic—to exploit Google’s adplatform.
“Threats actors have found a way
to weaponize Google’s results bycreating malicious ads that redirect
users to fake websites that mimictrusted brands that deliver malware
straight to your computer,” Yik Han
explained.
Hundreds of companies that offer
software downloads have been
impersonated, including TikTok,
SnapChat, and MetaMask.
“For example, when you search for
Brave Browser Download, the realsearch result should redirect you tobrave.com, but a malicious ad willbring you to bravesoftware[.]com, afake website that hosts malware,”Said Yik Han.

Making users lesssuspicious
Yik Han noted that these malicious
sites serve up “malware cocktails,”
often an information stealer bundledwith a software installer, so the victim
won’t know stealer is running in thebackground. “Another technique usedby these threats to prevent detectionis ‘pumping,’” he said. “This is done byinserting junk data into the malware
until it reaches a large file size, in
hopes of making antivirus engines
stop scanning the file.”
F-Secure created the detection“Trojan: W32/GenInflated.B” for thesepumped up infostealers.
“It’s quite new, but detections arerising steadily,” Yik Han concluded.

6

Leaked code spikes infections
Several variants of Spynote have spread widely after the authorof the threat leaked the source code for this Android malware.

Amit Tambe
Researcher
Helsinki, Finland

Since the code behind SpyNote
was released in October of 2022,
the spyware has infected more
devices and evolved to threaten bankaccounts.

Doom for its victims“Apparently, the author of SpyNote
became frustrated by scammers
impersonating him in hacker forums
and published the code on GitHub,”
Amit Tambe, a researcher atF-Secure said. “Leaking source codeof malware always spells doom forits victims, invariably leading to an
infection surge.”
Bad actors continue to add more
malicious features and tactics to theoriginal app, which was designed
to secretly monitor and manage
devices.

“Attackers have impersonatedapps—such as Google, Alipay, andeven erotic video apps—and spreadthem through third-party Android app
sites, tricking users into downloading
and installing those apps,” Tambeexplained.

More countries, moreinfections
The latest variant targets banking
apps, aiming to loot users’ accounts.
“The apps use a variety of techniques
to gain free rein on the victim’s
device,” Tambe said. “Once access tothe device is obtained, the spyware
then does its job of exfiltrating
sensitive information such as audio
or video call data and accountcredentials.”
Infections have spread acrossmultiple borders since the sourcecode leak. And based on the numberof infections, the countries mostimpacted by the leak were Germanyand Poland, followed by othercountries such as Iran, the UK, andIndia.
“At F-Secure, we observed that theattacks which were initially present
in nine countries in the third quarterof 2022. That has now grown to 13
countries,” Tambe explained. “We also
saw a rise in the number of infections
by about 28.5% from the beginning ofthe last quarter of 2022.”

expert tip
Downloading of apps from outside of official sources
should be avoided. Care must be taken to find out
the names of real apps—especially for banks or
credit card companies—before downloading similarsounding alternatives.

“The apps use a variety oftechniques to gain free rein on thevictim’s device.”About F-Secure
F-Secure makes every digital moment more secure, for everyone.
We deliver brilliantly simple, frictionless security experiences thatmake life easier for the tens of millions of people we protect andour 170 partners.
For more than 30 years, we’ve led the cyber security industry,
inspired by a pioneering spirit born out of a shared commitment to
do better by working together.
For more information visit F-Secure today!