Galaxy S22 hacked in seconds, U.S. COVID funds stolen and the Zombinder Android campaign

December 12, 2022 by Dan Virgillito

Researchers exploit Samsung Galaxy S22 in 55 seconds, Chinese hackers steal millions worth of U.S. COVID relief money, and the Android Zombinder threat. Catch all this and more in this week’s edition of Cybersecurity Weekly.

1. Samsung Galaxy S22 hacked in 55 seconds on the third day of Pwn2Own 

On day 3 of the Pwn2Own hacking contest, researchers from Pentest Limited managed to hack the Samsung Galaxy S22 in just 55 seconds. They did this after successfully demoing a zero-day bug as part of an Improper Input Validation attack against the device. This is the fourth time Samsung’s flagship device was hacked during the Toronto-based contest. In all four cases, it was running the latest version of Android OS with all the latest updates installed.

Read more »

Hacked for the Holidays Toolkit

man on chair

Kick off your organization’s holiday celebrations with our free Hacked for the Holidays security awareness toolkit. The resources in this toolkit cover topics like gift cards and charity scams to help keep employees cyber-safe this season.

2. Chinese hackers stole millions worth of COVID-19 relief funds: Secret Service

The Secret Service recently stated that Chinese hackers had stolen tens of millions of dollars worth of U.S. Covid relief funds since 2020. According to them, the Chinese cybercriminal group APT41 is responsible for the theft. It’s said to be the first instance of a pandemic fraud tied to state-sponsored threat factors that the U.S. government has acknowledged publicly. The Secret Service also said it considers the group to be highly adept at conducting financial crimes and espionage missions for personal benefit.

Read more »

3. Zombinder darknet service binds Android malware with legitimate apps

Cybersecurity firm ThreatFabric has discovered a new darknet platform that enables cybercriminals to bind malware to legitimate Android apps. Dubbed Zombinder, the campaign infects victims’ devices while maintaining the original functionality of the apps to escape detection. Basically, Zombinder appends an obfuscated loader to the app’s code, which displays a prompt to install a plugin when a user launches the app. If accepted, the campaign drops a malicious payload capable of keylogging, intercepting 2FA codes, and stealing emails from Gmail.

Read more »

4. Rackspace confirms ransomware attack after multiple customers report outages

Cloud company Rackspace confirmed a ransomware attack affected its exchange server. A security researcher believes the attackers exploited the ProxyNotShell vulnerabilities in Microsoft Exchange. While the company has since restored services for thousands of customers by migrating them to Microsoft 365, many took to social media to express dissatisfaction over the incident.

Read more »

5. North Korean threat actors used Seoul Halloween tragedy to distribute malware

Google’s threat analysis group found that North Korean hackers used the Seoul Halloween stampede as a reference to distribute malware in South Korea. The adversaries embedded the malware in Microsoft Office documents, which purported to be a report from the government. Google also said it hasn’t learned what the objective of the malware was, except that it exploited a vulnerability in Microsoft’s Internet Explorer.

Read more »

Posted: December 12, 2022
Dan Virgillito
View Profile

Dan Virgillito is a blogger and content strategist with experience in cyber security, social media and tech news. Visit his website or say hi on Twitter.