When tragedy strikes , criminals invariably prey on people ’ s best intentions . Scammers have been using Hurricane Harvey-themed messages to trick Attack.Phishing people into opening phishing emails and links on social media sites , which can steal login information , infect machines with malware , or con victims out of money . US-CERT , a cybersecurity arm of the U.S. Department of Homeland Security , issued a warning about the threat on Monday . “ [ R ] emain vigilant for malicious cyber activity seeking to capitalize on interest in Hurricane Harvey , ” the advisory read . “ Emails requesting donations from duplicitous charitable organizations commonly appear after major natural disasters. ” As the advisory notes , a common scam during and after natural disasters is for fraudsters to pretend Attack.Phishing to set up relief funds and request donations . Fortune has seen several suspicious online profiles and personas that , although their legitimacy couldn ’ t be determined , raised several red flags : a small number of followers , unverified accounts , no apparent links to accredited charities , and no means to track where proceeds go . Zack Allen , threat operations manager at ZeroFOX , a social media-focused cybersecurity startup , says the ruse is a typical one . “ Cybercriminals are opportunists and , sadly , a crisis like Hurricane Harvey is a prime example of their preying on humanity ’ s empathy and trust , ” he wrote in an email to Fortune . “ People all over the world quickly rushed to their social media accounts to find the best avenues to donate to victims , but these same avenues are ideal for scammers who try to convince Attack.Phishing victims to donate to their fraudulent Hurricane Harvey cause. ” Kevin Epstein , vice president of threat operations at Proofpoint ( pfpt , +1.21 % ) , a cybersecurity firm that provides email protection , said that in recent days he has seen hurricane-related snares such as “ see this terrifying video ” or pleas to “ donate to the relief effort. ” One PDF attachment titled “ hurricane harvey – nueces county news release 11 – it ’ s your chance to help.pdf ” prompted people , when opened , to enter their email username and password , he told Fortune . It ’ s common for fraudsters to take advantage of news du jour to bait Attack.Phishing prospective victims . “ Consistently , attackers use world events as themes for their attacks , ” said Oren Falkowitz , CEO at Area1 Security , a cybersecurity startup that fights phishing Attack.Phishing . He noted that attacks related to tax season and national elections were examples of recent popular lures . A few tips you can use to stay safe : First , keep your software up to date . Hackers often try to compromise devices running outdated software that has security holes . Second , be careful what you click : Don ’ t accept or open unsolicited content from untrusted sources . ( You should even be wary of trusted contacts , as they too may have been compromised . ) Third , be sure the organizations to which you ’ re contributing money are legitimate . Here ’ s a rundown of some reputable charities assembled by Fortune . US-CERT further recommends reviewing these safety guidelines from by the Federal Trade Commission for Hurricane Harvey-related charitable giving , and cross-checking organizations on this directory of national charities from the Better Business Bureau .

Microsoft has issued Vulnerability-related.PatchVulnerability an emergency , out-of-band patch for an Internet Explorer zero-day that was being actively exploited Vulnerability-related.DiscoverVulnerability in targeted attacks . The company says that it learned about the vulnerability through a report from Google . CVE-2018-8653 affects Vulnerability-related.DiscoverVulnerability a range of versions of Internet Explorer from 9 to 11 , across Windows 7 to 10 and Windows Server . The vulnerability amounts to a remote code execution exploit , and it was first spotted Vulnerability-related.DiscoverVulnerability by Google 's Threat Analysis Group . Microsoft explains Vulnerability-related.DiscoverVulnerability that a problem with Internet Explorer 's scripting engine could be exploited Vulnerability-related.DiscoverVulnerability by an attacker to execute arbitrary code on a victim 's computer . In a short security advisory , the company says : Today , we released Vulnerability-related.PatchVulnerability a security update for Internet Explorer after receiving a report Vulnerability-related.DiscoverVulnerability from Google about a new vulnerability being used in targeted attacks . Customers who have Windows Update enabled and have applied Vulnerability-related.PatchVulnerability the latest security updates , are protected automatically . We encourage customers to turn on automatic updates . Microsoft would like to thank Google for their assistance . In a more detailed security vulnerability posting , Microsoft explains the impact of the problem : A remote code execution vulnerability exists in Vulnerability-related.DiscoverVulnerability the way that the scripting engine handles objects in memory in Internet Explorer . The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user . An attacker who successfully exploited Vulnerability-related.DiscoverVulnerability the vulnerability could gain the same user rights as the current user . If the current user is logged on with administrative user rights , an attacker who successfully exploited Vulnerability-related.DiscoverVulnerability the vulnerability could take control of an affected system . An attacker could then install programs ; view , change , or delete data ; or create new accounts with full user rights . In a web-based attack scenario , an attacker could host a specially crafted website that is designed Attack.Phishing to exploit the vulnerability through Internet Explorer and then convince Attack.Phishing a user to view the website , for example , by sending Attack.Phishing an email . The security update addresses Vulnerability-related.PatchVulnerability the vulnerability by modifying Vulnerability-related.PatchVulnerability how the scripting engine handles objects in memory .

Microsoft has seen Vulnerability-related.DiscoverVulnerability its share of issues as of late , and now a seemingly simple patch is causing serious issues to certain laptops running the 2016 Anniversary Update . The update was originally released Vulnerability-related.PatchVulnerability to prevent a zero-day attack on IE . Per Microsoft , this was the issue being fixed Vulnerability-related.PatchVulnerability : A remote code execution vulnerability exists in Vulnerability-related.DiscoverVulnerability the way that the scripting engine handles objects in memory in Internet Explorer . The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user . An attacker who successfully exploited Vulnerability-related.DiscoverVulnerability the vulnerability could gain the same user rights as the current user . If the current user is logged on with administrative user rights , an attacker who successfully exploited Vulnerability-related.DiscoverVulnerability the vulnerability could take control of an affected system . An attacker could then install programs ; view , change , or delete data ; or create new accounts with full user rights . In a web-based attack scenario , an attacker could host a specially crafted website that is designed Attack.Phishing to exploit the vulnerability through Internet Explorer and then convince Attack.Phishing a user to view the website , for example , by sending Attack.Phishing an email . The security update addresses Vulnerability-related.PatchVulnerability the vulnerability by modifying how the scripting engine handles objects in memory . But now that fix is causing a pretty big problem of its own : it ’ s preventing certain laptops from booting . The affected machines are part of a pretty small bunch—only Lenovo laptops with less than 8 GB of RAM running the 2016 Anniversary Update ( 1607 ) —but it ’ s still a pretty bad problem to have . Fortunately , there ’ s a way to bypass the failed boot by restarting into the UEFI and disabling Secure Boot . It ’ s also noted that if BitLocker is enabled that you may have to go through BitLocker recovery after disabling Secure Boot . On the upside , Microsoft is working with Lenovo to correct Vulnerability-related.PatchVulnerability the issue and will release Vulnerability-related.PatchVulnerability a fix sometime in the future . I just wouldn ’ t count on it before the end of the year . Until then , be careful when updating devices , especially if they happen to be Lenovo laptops with limited RAM .

A spam campaign targeting German users has increased its chances of successfully tricking users into installing malware , by embedding several pieces of the victim 's personal information into its poisoned email messages . The campaign , which has been active since at least January 2017 , begins when a user receives an email written entirely in German . Its message informs the recipient they 've attempted to pay for something online but that the transaction did not complete successfully The user must re-submit payment , the email demands , otherwise they could be penalized by a collection agency or even law enforcement . Sample of spam message seen targeting German users . Most of us know better than to fall for this type of scam , and the attackers know it . Which is why they 've outfitted Attack.Phishing their attack emails with a technique that 's designed to convince Attack.Phishing the recipient the notice is legitimate . Andrew Brandt , director of threat research at Symantec , elaborates on this point in a blog post : `` The key detail of each message was the fact that the recipient ’ s full name , mailing address , and telephone number were embedded in the middle of the message . '' Brandt does n't elaborate on how the attackers obtain Attack.Databreach users ' personal information . Technically , bad actors can use Google and other tools to easily find these details . Seeing your personal information is enough to sway most users , so much so that a recipient would probably open the double-zipped attachment and thereby expose themselves to Nymaim.B . For its command and control ( C & C ) server , this banking trojan uses afegesinge [ dot ] com . At one point in time , 13 other malware executables communicated with it . Back in April 2016 , for instance , BBC News reporter Shari Vahl and ZDNet journalist Zack Whittaker separately spotted malicious emails in their inboxes that said they owed money to a collection agency , and included their real-life address information to make the messages appear more convincing . Unlike the German campaign , however , the UK attack Attack.Phishing sought to trick Attack.Phishing users into clicking on links that led them to Maktub ransomware . No matter how convincing an email seems to be , it always pays to double check these kinds of claims by calling the company purportedly making the claim to confirm the message ’ s authenticity ( or to prove that it is false ) . '' Aside from confirming with the alleged sender , users should maintain an up-to-date security solution on their computers , implement software updates as soon as they become available , and delete any suspicious emails .