Employee advocacy has existed as a concept for over a decade. But what began as a well-intentioned way to enhance corporate profile, thought leadership, and marketing also has some unintended consequences. When professionals post about their work, their company, and their role, they expect to reach like-minded professionals, as well as potential clients, allies, and partners. ESET, a leading company in proactive threat detection, warns that malicious actors are also paying attention and that the more information there is, the more opportunities there are to carry out malicious activities that could seriously affect an organization. Once that information is publicly available, it is often used to help create convincing spearphishing or business email compromise (BEC) attacks.

“The first stage of a typical social engineering attack is information gathering. The next is to weaponize that information in a spearphishing attack designed to trick the recipient into unknowingly installing malware on their device. Or, potentially, into sharing their corporate credentials to gain initial access. This could be achieved through an email, a text message, or even a phone call. Alternatively, they could use the information to impersonate a high-level executive or supplier in an email, phone call, or video call requesting an urgent bank transfer,” reveals Martina Lopez, Cybersecurity Researcher at ESET Latin America.

“The first stage of a typical social engineering attack is information gathering.” The main platforms for sharing this type of information are the usual ones. LinkedIn is perhaps the most widely used. It could be described as the world’s largest open database of corporate information: a veritable treasure trove of job titles, roles, responsibilities, and internal relationships. It’s also where recruiters post job openings, which can reveal too many technical details that can then be exploited in spearphishing attacks.

GitHub is perhaps best known in the cybersecurity context as a place where careless developers post hardcoded secrets, IP addresses, and customer data. But they can also share more innocuous information about project names, CI/CD pipeline names, and details about the technology stacks and open-source libraries they use. They can also share corporate email addresses in Git commit configurations.

Then there are the classic end-user-oriented social platforms, such as Instagram and X. This is where employees often share details about their travel plans to conferences and other events, which could be used against them and their organization. Even information on your company’s website could be useful to a potential scammer or hacker. Think about details on technical platforms, suppliers and partners, or important corporate announcements, such as mergers and acquisitions. All of this could serve as a pretext for sophisticated phishing.

The attacks mentioned above typically require a combination of impersonation, urgency, and relevance. Here are some hypothetical examples:

• An attacker finds information on LinkedIn about a new employee in the IT department of Company A, including their main duties and responsibilities. They impersonate a key technology vendor and claim an urgent security update is needed, referencing the target’s name, contact information, and job title. The update link is malicious.
• A malicious actor finds information about two colleagues on GitHub, including the project they are working on. They impersonate one of them in an email asking the other to review an attached document, which contains malware.
• A scammer finds a video of an executive on LinkedIn or a company website. They see on the person’s Instagram feed that they are giving a presentation and will be out of the office. Knowing that the executive may be difficult to contact, they launch a BEC deepfake attack using video or audio to trick a member of the finance team into transferring urgent funds to a new vendor.

ESET describes real-world examples of malicious actors using open-source intelligence (OSINT) techniques in the early stages of attacks. These include:

• A business email (BEC) attack that cost Children’s Healthcare of Atlanta (CHOA) $3.6 million: Malicious actors likely reviewed press releases about a newly announced campus to gather details, including the hospital’s construction partner. They then used LinkedIn and/or the company’s website to identify key executives and finance team members at the construction firm involved (JE Dunn). Finally, they impersonated the chief financial officer in an email to CHOA’s finance team requesting that they update their payment information for JE Dunn.
• The Russia-based SEABORGIUM and Iranian-aligned TA453 groups use OSINT for reconnaissance before launching spearphishing attacks against pre-selected targets. According to the UK’s NCSC, cybercriminals use social media and professional networking platforms to “research the interests [of their targets] and identify their real-world social or professional contacts.” Once they have established trust and a relationship via email, they send a link to collect the victims’ credentials.

Education: the most powerful preventive weapon

“While the risks of oversharing are real, the solutions are simple. The most powerful weapon is education. Updating security awareness programs is crucial to ensuring that everyone in a company understands the importance of not oversharing on social media. Ask staff to avoid sharing information through unsolicited direct messages, even if they recognize the sender (as their account could have been spoofed), and ensure they are able to detect phishing, BEC, and deepfake attempts,” advises Lopez from ESET Latin America.

” Furthermore, among ESET Latin America’s security recommendations is the need to support this with a strict social media policy, defining clear limits on what can and cannot be shared, and establishing clear boundaries between personal and professional/official accounts. It may also be necessary to review and update corporate websites and accounts to remove any information that could be used as a weapon.

Checking multifactor authentication (MFA) and strong passwords (stored in a password manager) should also be standard practice for all social media accounts, in case professional accounts are compromised to attack colleagues.

Finally, monitor publicly accessible accounts whenever possible to detect any information that could be used for spearphishing and business email marketing (BEC), and conduct red team exercises with employees to test their awareness.

“AI is making it faster and easier than ever for malicious actors to profile their targets, gather OSINT, and then draft convincing emails/messages in perfect natural language. AI-powered deepfakes further increase their options. The takeaway should be that if something is in the public domain, you can expect a cybercriminal to know it too and soon come knocking,” concludes Martina Lopez of ESET.

ESET invites you to learn more about cybersecurity by visiting: https://www.welivesecurity.com/es/.

For other useful preventative information, also available in Venezuela:  https://www.eset.com/ve/, and on their social media channels @eset_ve. Also on Instagram (@esetla) and Facebook (ESET).

With information and reference image provided by ESET and Comstat Rowland

Follow our news on Google! For current, interesting, and accurate information, click here to see all the content on Bitfinance.news. You can also find us on X/Twitter and Instagram

La entrada Oversharing and Cybersecurity: Dangers when employees share too much online apareció primero en Bitfinance.

Faced with financial doubts and concerns, it’s no surprise that people are looking for alternatives to make their money go further. This leads users with little investment experience to become interested and take their first steps. ESET, a leading company in proactive threat detection, warns that scammers are taking advantage of this curiosity or need with increasingly sophisticated scams on social media. It also warns that AI-powered scams produce fake ads, deepfakes, and promises of profits that seek to deceive even the most cautious users.

“Could you distinguish between a real investment ad and a fake one? It’s becoming increasingly difficult to do so. Threat actors today have various tactics to make their scams more credible, including deepfake videos generated with artificial intelligence. While there are many tactics, techniques, and procedures (TTPs) associated with this type of fraud, most begin with malicious or deceptive ads circulating on social media. They are often used as a lure to trick the victim, either into providing personal information or directly directing them to an investment scam,” says Camilo Gutiérrez Amaya, Head of the ESET Latin America Research Lab.

According to the FBI, investment scams have been the main source of income for cybercriminals for several years. At last count, they earned nearly $6.6 billion, and that’s just from crimes reported to the federal government. This figure dwarfs the $2.8 billion earned by the second-largest scam, business email compromise (BEC).

An example of this type of campaign was identified in June 2025, when Instagram ads impersonated legitimate banks. Some used tempting offers, such as high-interest accounts, in an attempt to persuade the victim to click and enter their banking information. In other cases, they used deepfake Instagram stories featuring banking investment strategists to collect personal information and/or lure them into WhatsApp groups about investment scams. A 2024 campaign spread a fake video of Lionel Messi to promote supposed investments through an app that promised high returns.

Also in 2024, ESET observed the Nomani Trojan campaign. The ad content and the phishing websites they linked to were designed to impersonate local news outlets and other organizations. Or, it could be a generic financial-themed visual with frequently changing names like “Quantum Bumex, Immediate Mator, or Bitcoin Trader.” Some of the characteristics of the Nomani campaign (and other similar campaigns) include:

• Highly localized content to attract specific regional victims.
• Distribution via fake ads on Facebook, Instagram, X, YouTube, as well as Messenger and Threads.
• Deepfake video testimonials potentially using celebrities, often displayed in low-quality videos and with unnatural keyword repetition.
• Use of fake and hacked accounts to run the ads (including, in one case, an actor with 300,000 followers).
• Shared templates and callbacks pointing to the same hosting infrastructure.

In this campaign, according to ESET, the intended objective is to persuade the victim to provide their personal information, which the scammers use to contact them directly. They use this method to trick them into signing up for an investment scam, taking out a loan, or even installing remote access software on their device. ESET observed a 335% increase in Nomani threats between H1 and H2 2024, and blocked more than 8,500 related domains.

While these techniques seem like clear indicators of fraud, they can be much more difficult to detect, especially if you are looking for opportunities to alleviate financial pressures. ESET states that the continued effectiveness of these types of scams, such as fraudulent financial ads, is due to the following:

• Times are tough, and the prospect of quick and easy financial gain is attractive.
• Attention spans are decreasing, especially on mobile devices, so warning signs may not be detected in time.
• Many people are unfamiliar with the latest threat TTPs, such as the use of deepfake videos, which makes them more vulnerable.
• Many of these threats are localized, use legitimate (hijacked) accounts, and can appear at the top of search results.
• Banks’ traditional anti-fraud mechanisms often don’t work if the manipulation is also carried out socially via telephone to invest in a fraudulent scheme.

Investment scams are very common, and ESET points out that it’s necessary to pay attention to these warning signs

• Flashy ads (which may leverage legitimate brands) offering returns that are too good to be true or unusually high interest rates.
• Celebrity endorsements are often the hook to give the product a certain legitimacy. Always check if the endorsement is legitimate.
• Videos that don’t look entirely right, for example, with visual glitches, poor audio and video synchronization, low resolution, or robotic or overly polished voices.
• Pressure to act quickly and secure the investment.
• Guaranteed return on investment.

They also advise staying alert to warning signs, resisting the temptation to click on ads about finance or investments, even if they appear to be promoted by legitimate brands and individuals, searching online for reviews of a specific investment plan or group to verify their authenticity, not investing in financial products without having thoroughly researched them and understanding how they work, ignoring any unsolicited third-party offers, never sharing personal and/or financial information after clicking on an online ad, and always checking the information circulated with the supposedly issuing entity through official channels. Finally, use security software on all your devices from a trusted provider like ESET, which will help block scams.

“In times of economic uncertainty, it’s understandable that we look for alternatives to improve our financial situation. But scammers are exploiting this very need with increasingly sophisticated tactics. Therefore, being wary of what’s easy, recognizing the warning signs, and protecting your personal data is essential to avoid falling for this type of scam,” concludes the ESET researcher. ESET invites you to learn more about cybersecurity by visiting:  https://www.welivesecurity.com/es/.

For other useful preventive information, it is also available in Venezuela:  https://www.eset.com/ve/, and on its social media channels @eset_ve. Also, available on Instagram (@esetla) and Facebook (ESET).

Bitfinance.News

With information and reference image provided by ESET and Comstat Rowland

Visit our news channel on Google News and follow us to get accurate, interesting information and stay up to date with everything. You can also see our daily content on X/Twitter and Instagram

La entrada Investor scams on social media are on the rise with the help of artificial intelligence apareció primero en Bitfinance.

Credential stuffing is a type of cyberattack in which malicious actors use leaked usernames and passwords to log in to accounts and services other than the one that was leaked. The success of these attacks relies on the habit of reusing the same password for different accounts or services. Therefore, if a password is leaked, attackers only need to try it on other sites where the user already has an account, since if there is a match, they gain access without needing to breach the system. ESET, a leading company in proactive threat detection, analyzes what a credential stuffing attack looks like, why they’re so effective, what their consequences can be, and how to avoid them.

“Repeating passwords is like using the same key to open your house, car, office, and safe. Paying attention and managing passwords properly is as important as locking your front door. Simple habits can make a difference: avoiding password reuse, enabling two-factor authentication, and using a secure password manager are practices we need to incorporate to stay protected against this type of threat and many others,” says Camilo Gutiérrez Amaya, Head of the ESET Latin America Research Lab.

The start of a credential stuffing attack is when a cybercriminal obtains leaked credentials. These are triggered by data breaches from important and well-known companies and organizations, and involve the exposure of millions of data points.

With this sensitive information available, and using bots or automated scripts, these passwords are tested on various sites, accounts, or services (such as Netflix, Gmail, banks, social networks, among others). Thousands of logins are tested per minute.

If a match is found, the accounts are logged in. This login would be identical to that of the legitimate user, making it difficult to detect, as there is no suspicious activity, such as repeated failed attempts.

To better understand the impact of these attacks, ESET reviews two specific cases that show how credential stuffing can compromise thousands of accounts

• PayPal case: Between December 6 and 8, 2022, PayPal suffered a credential stuffing attack that compromised nearly 35,000 accounts, exposing sensitive information such as names, addresses, dates of birth, and tax identification numbers.
• Snowflake: More than 165 organizations were affected when attackers accessed Snowflake utilizando credenciales robadas mediante malware tipo infostealer. Although Snowflake’s infrastructure was not directly compromised, attackers took advantage of the lack of multi-factor authentication and the use of old passwords.

“Large data breaches are the primary way cybercriminals obtain these credentials, and they are occurring more frequently than expected,” adds the ESET specialist.

In June 2025, another example was a series of databases totaling 16 billion records that were hosted in misconfigured repositories that were left exposed and public. Although the exposure was temporary, it was enough for researchers, or anyone else, to access the data, which included username and password combinations for online services such as Google, Facebook, Meta, Apple, and other accounts.

But it wasn’t the only one of the year: in May, security researcher Jeremiah Fowler revealed the public exposure of 184 million login credentials for users’ accounts around the world. This included information from various email server providers, Apple products, Google, Facebook, Instagram, Snapchat, and Roblox, to name just the most well-known. Not only that: the records included credentials from banks and other financial institutions, healthcare platforms, and government portals from several countries.

To avoid a credential stuffing attack, ESET recommends several actions

1. Essential: Do not reuse the same password across different accounts, platforms, and services.
2. Have strong, secure, and unique passwords for each account. For this purpose, a password manager is very useful. This tool is designed to store login credentials and protect them through encryption, and also includes a dedicated feature for generating complex and strong passwords.
3. Enable doble factor de autenticación on as many accounts and services as possible. This second factor is key if a password falls into the wrong hands, as a cyberattacker won’t be able to access the accounts without it.
4. Check if passwords or login credentials have already been leaked in a data breach, and change them immediately. For example, visit the website haveibeenpwned.com.

ESET invites you to learn more about computer security by visiting: https://www.welivesecurity.com/es/.

For other useful preventive information, it is also available in Venezuela: https://www.eset.com/ve/, and its social media channels @eset_ve. Also available on Instagram (@esetla) and Facebook (ESET).

With information and main image provided by ESET and Comstat Rowland

Visit our news channel on Google News and follow us to get accurate, interesting information and stay up to date with everything. You can also see our daily content on X/Twitter and Instagram

La entrada Credential stuffing: the risk of repeating passwords and how to protect yourself apareció primero en Bitfinance.

California Attorney General Rob Bonta has introduced a bill to require social media to post warning labels about health problems for minors resulting from prolonged browsing.

According to U.S. health authorities, “users who browse social media for more than three hours a day “are exposed to a double risk of experiencing mental health problems.”

Attorney General Bonta’s bill, known as AB 56, is supported by Assemblywoman Rebecca Bauer-Kahan. Both have referred that “subscribers, especially children and adolescents, should have access to clear information about the harmful effects that can be caused by the use of social media services. They suggest that companies such as Meta, Snap, ByteDance or X should show notices to users of all ages when they log in for the first time.”

Then, the sending of these notifications should be weekly, remain on screen for at least 90 seconds and cannot be skipped.

The legal tool is based on the provisions provided for in the laws of Protection against Cyberbullying and Prevention of Online Violence, which are in force in the state of California.

Among the provisions is the obligation for social networks to “inform about their protocols to avoid, detect and contain cyberbullying and the dissemination of violent materials.”

The bill addresses the problem of addiction to social networks among minors in particular. In this regard, it is appropriate to remember that in the United States the minimum age to use these digital communication spaces is 13 years old. Despite this, nearly 40% of children between 8 and 12 years old are members of one of these platforms.

“Vivek Murthy, the director general of public health in the United States, said at the beginning of the year that big tech should adopt a labeling system to warn about its possible negative effects on psychological well-being. The proposal was presented to Congress and supported by 42 attorneys general, including Bonta.”

M.Pino

Source: wired

(Reference image source: Panos Sakalakis for Unsplash)

Visit our news channel on Google News and follow us to get accurate, interesting information and stay up to date with everything. You can also see our daily content on X/Twitter and Instagram

La entrada California could require social media to post mental health warning labels apareció primero en Bitfinance.

ESET, a leading company in proactive threat detection, identified a phishing campaign aimed at mobile users that targeted bank customers. This novel criminal technique installs a phishing application from a third-party website without the user having to allow the installation of applications, it affects both iOS and Android users. Most of the cases known at the moment have occurred in the Czech Republic, and applications were directed to the Hungarian bank OTP Bank and the Georgian bank TBC Bank.

The ESET research team identified a series of phishing campaigns targeting mobile users that used three different URL delivery mechanisms: automated voice calls, SMS messages, and social media malvertising.

Voice call delivery was done via an automated call that warned the user about an outdated banking application and asked them to select an option on the keypad. After pressing the correct button, a phishing URL was sent via SMS.

The initial approach by SMS was carried out by indiscriminately sending messages to Czech telephone numbers. The message sent included a phishing link and a text for victims to perform social engineering and visit the link.

The spread through malicious ads was done by registering ads on Meta platforms such as Instagram and Facebook. These ads included a call to action, such as a limited offer for users to “download an update below.” This technique allowed threat actors to specify the target audience by age, gender, etc. The ads then appeared on the victims’ social networks.

After opening the URL delivered in the first stage, Android victims were faced with a high-quality phishing page that imitated the official Google Play Store page for the targeted banking app, or an imitation website of the app.

From there, victims are asked to install a “new version” of the banking app. Depending on the campaign, clicking the install/update button initiates the installation of a malicious application from the website, directly on the victim’s phone, either in the form of a WebAPK (Android users only), or as a Progressive Web App (PWA) for iOS and Android users. The highlight of this instance is that it bypasses traditional browser warnings to “install unknown apps”: this is the default behavior of Chrome’s WebAPK technology, which is abused by attackers.

The process is a little different for iOS users, as an animated pop-up tells victims how to add the phishing PWA to their home screen. The popup copies the look of native iOS messages. In the end, iOS users are not warned about adding a potentially harmful app to their phone.

Upon installation, victims are asked to enter their internet banking credentials to access their account through the new mobile banking application. All information provided is sent to the attackers’ C&C servers.

The malicious ads included a mashup of the bank’s official mascot (blue chameleon), as well as bank logos and text promising a financial reward for installing the app or warning users that a critical update had been released.

All stolen login information was recorded through a backend server, which then sent the banking login details entered by the user to a Telegram group chat. HTTP calls to send messages to the threat actor’s group chat were made through the official Telegram API. As mentioned by ESET: this technique is not new and is used in several phishing kits.

Warning

“Because two drastically different C&C infrastructures were used, we have determined that two different groups are responsible for the spread of phishing applications. More imitation apps will surely be created, since after installation it is difficult to separate legitimate apps from phishing ones. All sensitive information found during our investigation was quickly sent to the affected banks for processing. We also coordinate the dismantling of multiple phishing domains and C&C servers,” says Camilo Gutiérrez Amaya, Head of the ESET Latin America Research Laboratory.

Contact coordinates with ESET in Venezuela: https://www.eset.com/ve/. Also, their social networks: Instagram @esetla) and Facebook: (ESET).

With information and reference image provided by ESET and Comstat Rowland

Visit our news channel on Google News and follow us to get accurate, interesting information and stay up to date with everything. You can also see our daily content on Twitter and Instagram

La entrada Malicious banking applications: New phishing against Android and iOS users apareció primero en Bitfinance.

In the world of online investing, the promise of high returns with minimal risk is a seductive lure that has ensnared countless people around the world. ETC CLOUD LTD emerged as a ray of hope for many, offering a staggering 2.7% daily compound interest on investments made in USDT. This scheme, which is promoted as a partner of the renowned cryptocurrency exchange Binance and is run by a London-based director supposedly based in the Philippines named Ryan Collado Cruz, who painted a picture of legitimacy and prosperity.

https://www.northdata.com/Cruz,+Ryan+Collado,+London/vy3

Source: Mr Ryan Collado Cruz (Etc Cloud Computing Management Co., Ltd) – Director Profile – Endole

Company with address 10 Hammersmith Grove, London W6 7AP, United Kingdom, has the website https://etccloudltd.com/ designed to be used from mobile devices with react and vue.js technology where people could register and then recharge money under the promise of earning profits in USDT through compound interest. It turns out that this is a Ponzi scheme, meticulously designed to take many people’s money.

Source: https://suite.endole.co.uk/insight/company/14849301-etc-cloud-computing-management-co-ltd

They used the email etc66666@gmail.com to commit scams and the Instagram account https://www.instagram.com/etc_cloud.

Source: https://www.instagram.com/etc_cloud

ETC CLOUD LTD’s sophisticated presentation and strategic use of social media platforms, beneath the veneer of technological advancement and financial acumen lurks a classic Ponzi scheme structure, preying on the hopes and savings of unsuspecting victims, with a significant number reported in Venezuela.

Telegram groups used to scam and manipulate:

https://t.me/+FuEJGGoBvMRhNGFl

https://t.me/Etccloudltd_TissTeam

https://t.me/JulesTeam

ETC CLOUD COMPUTING MANAGEMENT CO., LTD. – LONDON (checkcompany.co.uk)

With a team of scammers and manipulators who, through false withdrawals and displays of a successful career at ETC Cloud LTD, stimulated the greed and trust of the victims so that they would deposit money into the platform. Among the members of that team is Rosalinda with the phone. from Spain +34 675 617 077, Louis and Matt.

Scammer Rosalinda: phone from Spain +34 675 617 077

Louis, scammer from ETC Cloud LTD

Several people have made videos on YouTube Channels warning other users about the scam so that they do not deposit more money in the ECT Cloud LTD accounts because they are going to lose money, since these are users of the platform who have been scammed and their only resource has been to spread information about this great scam internationally.

Here are several of the videos:

https://youtu.be/dB9jxqJHr4o

https://youtu.be/dB9jxqJHr4o?si=0pic8QzTWK_j9JJc

https://youtu.be/H_apSq02LBc?si=hBjFrN1pCQuSXZmx

https://youtu.be/fzJ5_LCuSbQ?si=Za2BAc5eVrVF1GJk

https://youtu.be/Ftsb9ec7lgo?si=8VadtsdcY28V2QUv

Here are some social media accounts used to scam and manipulate:

https://www.instagram.com/etc_cloud_/

https://www.instagram.com/etccloudltd/

People who have been involved with ETC Cloud LTD who were able to help in the big scam:

Kevin Aguilar https://www.instagram.com/kevinaguilar.trader/

The alleged ETC offer:

ETC is the world’s leading blockchain ecosystem and has launched a series of products, including the largest cryptocurrency transaction management platform. Our mission is to become a global cryptocurrency infrastructure provider in the future. ETC serves as a global energy cloud computing management platform and builds an intelligent cloud computing management platform. At present, ETC and Bi’an have reached a common framework agreement, and Bi’an has launched TRX pledge conversion. As the world’s first energy conversion platform for managing Bi’an, ETC gathers global energy users on the ETC cloud computing management platform and achieves a win-win cloud computing management platform for all three parties. The ETC platform was established in 2021. After a long period of market research and development, Ryan Corrado Cruz and his core team members officially launched the ETC app cloud computing management platform in 2023. ETC app license: www.etccloudltd.com.

Message from administrators on Telegram:

Possible collaborator:

Taken and with information from criptomonedaetc.blogspot.com/

Visit our news channel on Google News and follow us to get accurate, interesting information and stay up to date with everything. You can also see our daily content on Twitter and Instagram

La entrada The person behind the big Etc Cloud LTD scam: Who is Ryan Collado Cruz? apareció primero en Bitfinance.

A Russian-made malware, called Infamous Chisel, is out to steal funds from crypto wallets, the FBI reported on Friday.

The virus, which was originally used to steal Ukrainian military data, is now being used by hackers to grab cryptocurrency.

According to the US Federal Bureau of Investigation (FBI) alert, “Infamous Chisel is a collection of components that allow persistent access to an infected Android device through the Tor network and periodically collects and filters information of the victims of the compromised devices.”

They have also warned that the malware has the ability to “recover, copy, and transfer data sets connected to directories of specific applications on an infected device.”

This means that cybercriminals gain access to social networks, messaging applications and crypto wallets, particularly from Trust and Coinbase. The consequences are the theft of user data, access to email and, finally, to their accounts in digital currencies.

Among the capabilities of Infamous Chisel, very difficult to detect on Android devices due to the lack of tracking systems, there is also monitoring of “network behavior and collecting information about information traffic, as well as scanning and transferring SCP files, in addition to access Secure Shell”.

M.Pino

Source: diariobitcoin

(Reference image source: Growtika, Unsplash)

Visit our news channel on Google News and follow us to get accurate, interesting information and stay up to date with everything. You can also see our daily content on Twitter and Instagram

La entrada FBI alerts about new malware to steal cryptocurrencies apareció primero en Bitfinance.

Thailand has decided to require an injunction to shut down Facebook if it fails to effectively address misleading investment ads and cryptocurrency scams on its platform.

On Aug. 21, the Ministry of Digital Economy and Society (MDES) reported that more than 200,000 people were notably misled by Facebook ads promoting cryptocurrency scams, investments in fictitious companies, and fake government entities, such as the Stock Exchange Commission and Values.

Among the most common schemes used by scammers were cryptocurrency investment and business fraud, according to MDES. Some ads apparently used images of famous personalities and well-known financial figures, offering promises of up to 30 % daily profit, with the purpose of luring people into scams.

Chaiwut Thanakamanusorn, the MDES minister, said that the ministry had held talks with the Meta platform and had sent a letter to it in this regard, however, he stated that it does not exercise control over advertisers.

The Ministry is amassing evidence of the fraudulent advertisements, which, according to his statement, number a considerable 5,300. Later this month, he is set to formally petition the court to shut down Facebook within seven days.

The Ministry alerted about the modus operandi of these scams, emphasizing that consumers must be careful when faced with promises of high and guaranteed returns, as well as with advertisements that use images of famous people.

K. Tovar

Source: Cointelegraph

(Reference image source: Timothy Hales Bennett, Unsplash)

Visit our news channel on Google News and follow us to get accurate, interesting information and stay up to date with everything. You can also see our daily content on Twitter and Instagram

La entrada Thailand threatens to shut down Facebook over massive crypto scams apareció primero en Bitfinance.

Through various publications on social networks, it has been possible to appreciate the capture of a WhatsApp text message or direct message in which a username and password of a supposed Exchange site (cryptocurrency exchange page) where it says there is a large sum of USDT or Tether, which is known as a stablecoin and whose value is equal to the US dollar in a 1:1 ratio.

MásQueSeguridad (MQS) warns through a statement that, in the message, a text is observed where the user is asked not to “share with anyone” said information. Thus, trying to get the person to enter the website, with the data provided. By doing so, the victim arrives at a false page in which there is a balance with a high sum of USDT. This is a well-known method of social engineering that seeks to gain the attention and enthusiasm of the victim.

Now, if the victims want to transfer said fake balance to their cryptocurrency wallet, the website created by the cybercriminals will request their access credentials, taking control of their account and allowing the attackers to keep their funds.

This deception was observed circulating with different domain names, but g structurally it is the same. Among the domains detected by the MásQueSeguridad team, usdtbonim.com, usdtcoindc.com, usdtethon.com, usdtlonim.com are mentioned, which have a creation date between April 20 and 24, 2022, which is an indication alert.

Similarly, the messages are sent from numbers of national operators in countries such as Colombia and Venezuela, which have already been duly reported as spam on various verification platforms, adds MQD in its preventive document.

That is why MáQueSeguridad recommends verifying through search engines, such as Google or databases like es.trustpilot.com, the reliability of any website that could be doubtful. In the same way, to check unknown telephone numbers on sites such as www.truecaller.com, www.listaspam.com, www.spamcalls.net, among others. Additionally, sharing this information on social networks, with friends and family, for preventive purposes, to limit the efficiency of such attacks.

With information from MásQueSeguridad

La entrada MQS: New scam to steal crypto wallet credentials is circulating on Internet apareció primero en Bitfinance.

The Internet giant will apply, starting in September, a new pilot program that will aim to contain violations of its advertising policies, particularly for recidivist advertisers. Its new system will consist of sending warnings to advertisers who violate its regulations. After three strikes, the company could completely remove the ads.

According to the statement, Google “will issue a first warning and after that up to three strikes for each violation of our policies on dishonest behavior, unapproved substances and dangerous products or services, this policy includes advertisements that promote misleading behavior or products, such as the creation of false documents, piracy services and even spyware, as well as those that are directed to products such as tobacco, drugs or weapons, among other types of content”.

For some years these prohibitions have been active in Google Adsense, but with this new program the system will sanction, in a more decisive way, those who violate them.

One, two, three… out!

The Google Adsense penalty system will first send a warning without penalties to the advertiser and remove the ad that violates the rules.

If the advertiser repeats the breach of the policies, in a period of 90 days, Google Adsense will send the first strike, which contains the temporary suspension of the account for 3 days, during which the ads will not be eligible to be published.

The second strike will be applied to those who repeat a violation of the same policy for which they received the first warning within 90 days. The account will be suspended for 7 days and your ads will not be published.

And the third strike will be granted to those who violate the same policy for which they received the second warning within 90 days after the previous strike. Thus, the account will be definitively suspended.

The company will be very clear with its warnings and each time a strike is issued, the advertiser will receive an email informing them of the violation. Additionally, Google affirms that its advertisers will have the right to appeal any decision regarding non-compliance with its policies.

M. Rodríguez

Source: marketing4ecommerce

La entrada Google will apply new measures to advertisers who violate its policies apareció primero en Bitfinance.