---

GitHub warns Java developers of new malware poisoning NetBeans projects

The malware's end goal was to install a remote access trojan and grant hackers access to highly sensitive workstations were sensitive projects were being developed.

---

A Rogues' Gallery of MacOS Malware

MacOS isn't immune from malware. Being prepared means understanding the nature of the worst threats a security team is likely to see attacking Macs in the enterprise.

---

GitHub Supply Chain Attack Uses Octopus Scanner Malware

Octopus Scanner is a new malware used to compromise 26 open source projects in a massive GitHub supply chain attack.

---

Inside the Hoaxcalls Botnet: Both Success and Failure

The DDoS group sets itself apart by using exploits -- but it doesn't always pan out.

---

Researchers ID Hacktivist Who Defaced Nearly 5,000 Websites

Opsec mistakes lead a Check Point researcher to an individual in Brazil who was behind a longtime hacking campaign.

---

Google to enable the Chrome anti-notification spam system in July 2020

Chrome will block sites from showing notification spam by default. Has been an opt-in feature since February.

---

Hackers Compromise Cisco Servers Via SaltStack Flaws

Attackers compromised six Cisco VIRL-PE servers that are affected by critical SaltStack vulnerabilities.

---

Valak Malware Retasked to Steal Data from US, German Firms

Once considered a loader for other malware, Valak regularly conducts reconnaissance and steals information and credentials, new analysis shows.

---

Fortune 500 company NTT discloses security breach

Japanese telecommunications giant NTT says hackers breached its internal network and stole data on 621 customers.

---

NSA Warns Russia's 'Sandworm' Group Is Targeting Email Servers

The Russian military group has been exploiting a flaw in the Exim mail transfer agent since last August, the NSA reports.

---

Cisco discloses security breach that impacted VIRL-PE infrastructure

Hackers used vulnerabilities in the SaltStack data center software to breach six Cisco servers.

---

3 SMB Cybersecurity Myths Debunked

Small and midsize businesses are better at cyber resilience than you might think.

---

Vulnerability Disclosures Drop in Q1 for First Time in a Decade

Even with more security issues published on Patch Tuesdays, the total number of software flaws dropped for the first three months of 2020, according to one tally.

---

UK Ad Campaign Seeks to Deter Cybercrime

The United Kingdom's anti-cybercrime agency is running online ads aimed at young people who search the Web for services that enable computer crimes, specifically trojan horse programs and DDoS-for-hire services. The ad campaign follows a similar initiative launched in late 2017 that academics say measurably dampened demand for such services by explaining that their use to harm others is illegal and can land potential customers in jail.

---

Google Location Tracking Lambasted in Arizona Lawsuit

The lawsuit, filed against Google by Arizona's Attorney General, alleges that the tech giant uses “deceptive and unfair conduct” to obtain users’ location data.

---

Google, Microsoft Brands Impersonated the Most in Form-Based Attacks

Attackers are preying on users' inclination to click on familiar-looking websites, but instead trick them into sharing usernames and passwords.

---

PonyFinal Ransomware Targets Enterprise Servers Then Bides Its Time

Microsoft has warned on a new breed of patient ransomware attacks that lurk in networks for weeks before striking.

---

NSA warns of new Sandworm attacks on email servers

NSA says Russia's military hackers have been attacking Exim email servers to plant backdoors since August 2019.

---

Data Loss Spikes Under COVID-19 Lockdowns

Two new reports suggest a massive gap between how organizations have prepared their cybersecurity defenses and the reality of their efficacy.

---

People know reusing passwords is risky – then do it anyway

And most people don’t change their password even after hearing about a breach, a survey finds

The post People know reusing passwords is risky – then do it anyway appeared first on WeLiveSecurity