The email didn ’ t just seem innocent , it also seemed familiar to the accounts payable employee at MacEwan University in Edmonton . It was from one of the local construction firms the public institution deals with , logo and all . There was new bank account information —could accounts payable please change it ? The staff and this supposed vendor communicated back and forth , from late June until a few weeks ago , in early August . One university employee was involved in this correspondence at first ; two more were added . Then vendor payments went through , as scheduled : $ 1.9 million from MacEwan accounts on August 10 . Another $ 22,000 were transferred seven days later . Finally , $ 9.9 million went to this new bank account on August 19 , a Saturday . Wednesday morning , for the first time in this episode , came a phone call . The Edmonton-area vendor wanted to know why it never got its payments . The massive fraud had already been perpetrated , $ 11.8 million winding its way into a TD bank account in Montreal and much of it then wired overseas , a university spokesman says . Investigators have traced $ 11.4 million of the money and frozen the suspect accounts in Quebec and Hong Kong . The school is pursuing civil legal action to recover the money . “ The status of the balance of the funds is unknown at the time , ” a MacEwan statement said about the other $ 400,000 . There ’ s likely not a person reading this online who hasn ’ t received a phishing attack Attack.Phishing , in which someone pretending to be Attack.Phishing a bank sends Attack.Phishing an email or text message , hoping to trick Attack.Phishing you into enter or re-enter account information or a credit card number . What hit MacEwan was a spear phishing attack Attack.Phishing , in which scammers impersonate Attack.Phishing a client or associate of the individual . In this case , the fraudster had cut-and-pasted the actual vendor ’ s logo , MacEwan spokesman David Beharry said . A phishing attacker will often cast several lures Attack.Phishing ; in this case , investigators said 14 different Edmonton-area construction sites or firms were impersonated Attack.Phishing as part of this attempt . The successful trick Attack.Phishing led to financial transfers equivalent to more than five per cent of the publicly funded school ’ s 2016 operating budget , according to records . This inflicted vastly more damage than the last well-documented online scam to successfully target an Alberta post-secondary school : last year , University of Calgary paid Attack.Ransom $ 20,000 in what ’ s known as a ransomware attack Attack.Ransom , in which cyberattackers manage to lock or encrypt network data until the victim pays up Attack.Ransom . While MacEwan is confident it can recoup the amounts already frozen , it will also incur legal fees on three continents as it tries to do so , Beharry says . Edmonton ’ s second-largest university knew enough about this problem to launch its own phishing awareness campaign last school year for staff and students , posters and all . Now , the school itself will become a cautionary tale about the perils and pratfalls of spear phishing cyberattacks Attack.Phishing . With this ugly incident , MacEwan University becomes a cautionary tale of another sort : financial controls . These were not high-level employees ensnared by this phishing attack Attack.Phishing , the school spokesman says , though he did not identify them or clarify how the three employees were involved . From now on , one fraud and $ 11.8 million later , such vendor banking information changes will need to go through a second and third level of approval at MacEwan before the final clicks or keystrokes occur .

Phishing Attack.Phishing takes place when a fraudster tricks Attack.Phishing an individual into sharing sensitive information ( account numbers , Social Security numbers , login credentials , etc . ) by way of fraudulent emails , texts , or counterfeit websites . Phishing Attack.Phishing can also enable a scammer to gain access to a computer or network so that they can install malware , such as ransomware , on a victim 's computer . Phishers are able to achieve this by spoofing Attack.Phishing the familiar , trusted logos of established , legitimate companies . Or , they may pose as Attack.Phishing a friend or family member and are often successful in completely deluding Attack.Phishing their targets . In carrying out attacks , Dark Caracal uses trojanized WhatsApp and Facebook apps to try to lure Attack.Phishing users into clicking malicious links and downloading Android malware , called Pallas , which can collect vast amounts of data . Dark Caracal targets include governments , military organizations , utilities , financial institutions , manufacturing companies and defense contractors . Stealth Mango ( Android ) and Tangelo ( iOS ) , discovered by Lookout Security Intelligence , are surveillanceware tools that target government officials , diplomats , activists and military personnel , specifically in Pakistan , Afghanistan , Iraq , India and the UAE . According to Lookout Security , “ data from U.S. , Australian , and German officials and military have been swept up in the campaign we believe is being run by members in the Pakistani military. ” Fake eFax email deceives Attack.Phishing email recipients by telling them they have received ‘ a new eFax ’ and that they need to click on a link button in the email to retrieve the document . The link goes to a phishing page . This is not a new attack , but has recently been spotted in emails again . Email filtering company , Mailguard , has picked up Attack.Phishing a fake E-Toll notification containing an infected .doc file . According to Mailguard , the file contains a malicious macro that will download malware to the victim ’ s computer . The notification also includes the logos of Microsoft Office and Mailguard in order to appear Attack.Phishing authentic . It even goes as far as to claim that , “ this document is protected by MailGuard '' . DHL branding was mimicked Attack.Phishing and fake shipping notifications were sent out Attack.Phishing , asking recipients to download an attached file that contained highly destructive trojan malware . “ MEWKit Attack.Phishing ” is a phishing attack Attack.Phishing that directly steals Ethereum from users of MyEtherWallet . Using MyEtherWallet as bait Attack.Phishing , it attempts to trick Attack.Phishing Ethereum investors into logging in to the bogus , cloned version of the website in order to steal their credentials . Gmail ’ s new Confidential Mode may invite link-baiting phishing attacks Attack.Phishing . According to analysis by ComputerWorld , “ Confidential Mode works by storing your email in a secure space on Google servers in the cloud . When both sender and recipient use Gmail , the email appears normal . But recipients who do not use Gmail get a link for viewing the email in a browser . The messages you send or receive via Confidential Mode are not actually email . The link is an email , but the message is an email-looking page on the internet that ’ s password-protected . Emails containing the link can , in fact , be forwarded , but only the intended recipient can successfully open the link . When someone gets one of these forwarded mails , they ’ re prompted for their Google login username and password to determine whether or not they ’ re the intended recipient . This is problematic , because it invites link-baiting phishing attacks Attack.Phishing , which could con people into revealing their login information . ” A phishing campaign Attack.Phishing targeting Apple users seeks to dupe Attack.Phishing victims into updating their profiles in preparation for the EU ’ s General Data Protection Regulation ( GDPR ) policies , which go into effect on May 25 . This is just one of many scams exploiting the coming implementation of GDPR policies .

Around 50 % of the impacted accounts never posted on the forum which leads to the conclusion that they weren ’ t real users but bots . The stolen data contains email addresses , hashed passwords , and salts but none of the usernames were taken Attack.Databreach . However , good news is that all passwords have been reset . Therefore it ’ s too early to assume what happened or how attackers were able to access Attack.Databreach the database . Nevertheless , the administrators believe that it could be because of a phishing attack Attack.Phishing . It must be noted that one of the forum ’ s staff members was also impacted Attack.Databreach by the breach Attack.Databreach which is not surprising since hackers are successfully cracking passwords from previous data breaches Attack.Databreach and using them for further attacks . More : 21 Million Decrypted Gmail , 5 Million Yahoo Accounts Being Sold on Dark Web The forum is implementing new security measures including site-wide HTTPS support , 2-step authentication requirement for their staff and passwords randomizing of inactive accounts . This is not the first time when Android Forums was security issues . In 2012 , the forum suffered a massive data breach Attack.Databreach in which user credentials of 1 million users were stolen Attack.Databreach . At the time of publishing Attack.Phishing this article , the Android Forums was down for scheduled maintenance but you can still go through the security notice through Google Cache

Called Chrysaor , the Android variant can steal Attack.Databreach data from messaging apps , snoop over Attack.Databreach a phone ’ s camera or microphone , and even erase itself . On Monday , Google and security firm Lookout disclosed the Android spyware , which they suspect comes from NSO Group , an Israeli security firm known to develop smartphone surveillance products . Fortunately , the spyware never hit the mainstream . It was installed less than three dozen times on victim devices , most of which were located in Israel , according to Google . Other victim devices resided in Georgia , Mexico and Turkey , among other countries . Users were probably tricked Attack.Phishing into downloading the malicious coding , perhaps though a phishing attack Attack.Phishing . Once it installs , the spyware can act as keylogger , and steal Attack.Databreach data from popular apps such as WhatsApp , Facebook and Gmail . In addition , it possesses a suicide function that ’ ll activate if it doesn ’ t detect a mobile country code on the phone -- a sign that the Android OS is running on an emulator . The surveillance features are similar to those found in Pegasus , which has also been linked with NSO Group . At the time , Lookout called the spyware the most sophisticated attack it ’ s ever seen on a device . The iOS variant exploited three previously unknown vulnerabilities to take over a phone and surveil the user . The spyware was uncovered when a human rights activist in the United Arab Emirates was found infected by it . His phone had received Attack.Phishing an SMS text message , which contained a malicious link to the spyware . But Lookout had also been investigating into whether NSO Group developed an Android version . To find out , the security firm compared how the iOS version compromises an iPhone and matched those signatures with suspicious behavior from a select group of Android apps . Those findings were then shared with Google , which managed to identify who was affected . However , unlike the iOS version , the Android variant doesn ’ t actually exploit any unknown vulnerabilities . Instead , it taps known flaws in older Android versions . Chrysaor was never available on Google Play , and the small number of infected devices found suggests that most users will never encounter it , the search giant said

Google has stopped Wednesday ’ s clever email phishing scheme Attack.Phishing , but the attack may very well make a comeback . One security researcher has already managed to replicate it , even as Google is trying to protect users from such attacks . “ It looks exactly like Attack.Phishing the original spoof Attack.Phishing , ” said Matt Austin , director of security research at Contrast Security . The phishing scheme Attack.Phishing -- which may have circulated Attack.Phishing to 1 million Gmail users -- is particularly effective because it fooled Attack.Phishing users with a dummy app that looked like Attack.Phishing Google Docs . Recipients who received Attack.Phishing the email were invited to click a blue box that said “ Open in Docs. ” Those who did were brought to an actual Google account page that asks them to handover Gmail access to the dummy app . While fooling Attack.Phishing users with spoofed emails is nothing new , Wednesday ’ s attack involved an actual third-party app made with real Google processes . The company ’ s developer platform can enable anyone to create web-based apps . In this case , the culprit chose to name the app “ Google Docs ” in an effort to trick Attack.Phishing users . The search company has shut down the attack by removing the app . It ’ s also barred other developers from using “ Google ” in naming their third-party apps . More traditional phishing email schemes Attack.Phishing can strike by tricking Attack.Phishing users into giving up their login credentials . However , Wednesday ’ s attack takes a different approach and abuses what ’ s known as the OAuth protocol , a convenient way for internet accounts to link with third-party applications . Through OAuth , users don ’ t have to hand over any password information . They instead grant permission so that one third-party app can connect to their internet account , at say , Google , Facebook or Twitter . But like any technology , OAuth can be exploited . Back in 2011 , one developer even warned that the protocol could be used in a phishing attack Attack.Phishing with apps that impersonate Attack.Phishing Google services . Nevertheless , OAuth has become a popular standard used across IT . CloudLock has found that over 276,000 apps use the protocol through services like Google , Facebook and Microsoft Office 365 . For instance , the dummy Google Docs app was registered to a developer at eugene.pupov @ gmail.com -- a red flag that the product wasn ’ t real . However , the dummy app still managed to fool Attack.Phishing users because Google ’ s own account permission page never plainly listed the developer ’ s information , unless the user clicks the page to find out , Parecki said . “ I was surprised Google didn ’ t show much identifying information with these apps , ” he said . “ It ’ s a great example of what can go wrong. ” Rather than hide those details , all of it should be shown to users , Parecki said . Austin agreed , and said apps that ask for permission to Gmail should include a more blatant warning over what the user is handing over . “ I ’ m not on the OAuth hate bandwagon yet . I do see it as valuable , ” Austin said . “ But there are some risks with it. ” Fortunately , Google was able to quickly foil Wednesday ’ s attack , and is introducing “ anti-abuse systems ” to prevent it from happening again . Users who might have been affected can do a Google security checkup to review what apps are connected to their accounts . The company ’ s Gmail Android app is also introducing a new security feature to warn users about possible phishing attempts Attack.Phishing . It 's tempting Attack.Phishing to install apps and assume they 're safe . But users and businesses need to be careful when linking accounts to third-party apps , which might be asking for more access than they need , Cloudlock 's Kaya said . `` Hackers have a headstart exploiting this attack , '' she said . `` All companies need to be thinking about this . ''

The ransomware was delivered via a phishing attack Attack.Phishing and malicious attachments that locked them out of all their systems . The Lansing Board of Water & Light chose to pay Attack.Ransom $ 25,000 in bitcoin because it was cheaper than replacing all the infected computers and software , which would have cost up to $ 10 million . As it is , the incident Attack.Ransom cost them $ 2.5 million to wipe the infected computers and beef up their security controls , much of which was covered by insurance .