Cybercriminals are targeting hotels' backend Booking.com logins in order to take over the accounts and eventually harvest data on the hotels' customers. According to Perception Point's analysis of the campaign, threat actors are changing their tactics by focusing on specific industry practices and relationships to conduct targeted and convincing phishing attacks. Many of the phishing messages are addressed to hotel managers, claiming that former guests are leaving harsh reviews of the property online. The emails encourage hotels to sign in and respond to the complaints.

Exploring Artificial Intelligence (AI) is critical for remaining competitive, so CISOs must understand and address emerging AI threats. Large Language Model (LLM) vulnerabilities pose a significant threat to enterprise operations. It is essential for cyber teams to understand these vulnerabilities and how to mitigate them so enterprises can continue to innovate with LLMs without putting themselves at risk. This article continues to discuss the top LLM vulnerabilities and suggestions for mitigating them.

Healthcare services provider HMG Healthcare has recently disclosed a data breach impacting the personal health information of employees and residents at 40 affiliated nursing facilities.  The incident was identified in November 2023, but an investigation determined that the data breach occurred in August 2023.  The company noted that the incident involved hackers gaining access to their server and stealing unencrypted files.  Files on the server likely contained medical records and personal information.

China's Beijing Wangshendongjian Judicial Appraisal Institute claims to have discovered how to decrypt device logs for Apple's AirDrop feature. This operation would allow the government to identify the phone numbers or email addresses of those who have shared content. In order to avoid censorship in the country, people turned to Apple's AirDrop feature. The feature does not require cellular service, sending images between devices via Bluetooth and a private Wi-Fi network. This article continues to discuss the AirDrop cracking claimed by the Chinese state-backed research institute.

Since early 2023, threat actors have been using a new Mirai-based botnet called NoaBot as part of a cryptocurrency mining campaign. According to Akamai security researcher Stiv Kupchik, the new botnet's capabilities include a wormable self-spreader and an SSH key backdoor to download and execute additional binaries or spread to new victims. Mirai source code was leaked in 2016, which has given rise to several botnets.

Security researchers at Patchstack discovered a critical vulnerability in the AI Engine plugin for WordPress, specifically affecting its free version with over 50,000 active installations.  The plugin is widely recognized for its diverse AI-related functionalities, allowing users to create chatbots, manage content, and utilize various AI tools such as translation, SEO, and more.  The researchers noted that the security flaw is an unauthenticated arbitrary file upload vulnerability in the plugin’s rest_upload function within the files.php module.

According to security researchers at Arctic Wolf, under 4% of US states are fully prepared to detect and recover from election-targeted cybersecurity incidents.  The researchers surveyed state and local government leaders across the US and found that 14.3% of states were "not at all prepared" to deal with such incidents, with 42.9% only "somewhat prepared" ahead of the 2024 US election cycle, which includes presidential and other state and local elections.

Google recently released patches for 58 vulnerabilities in the Android platform and fixes for three security bugs in Pixel devices.  The first part of Android’s January 2024 update, which arrives on devices as the 2024-01-01 security patch level, addresses ten security holes in the Framework and System components, all rated high severity.  Google noted that the most severe of these issues is a security vulnerability in the Framework component that could lead to local escalation of privilege with no additional execution privileges needed.

According to Rob Joyce, the Director of Cybersecurity at the National Security Agency (NSA), hackers and propagandists are using generative Artificial Intelligence (AI) chatbots such as ChatGPT to make their operations appear more legitimate to native English speakers. Cybercriminals and hackers working for foreign intelligence agencies have been observed using chatbots to appear as native English speakers. Generative AI chatbots have become skilled at mimicking believable and grammatically correct writing.

Threat actors had public access to the private data of hundreds of millions of Brazilians, putting individuals at risk of identity theft, fraud, and targeted cybercrimes. According to Cybernews, a publicly accessible Elasticsearch instance contained a massive amount of private data belonging to Brazilian citizens. Elasticsearch is a popular tool for searching, analyzing, and visualizing large amounts of data. Since the leaked data was not linked to a specific organization, Cybernews was unable to determine the source of the leak.