We’ve all heard about cryptocurrencies like blockchain or Bitcoin. What’s less well known is how this market works, why people invest in it, how they earn money, and what mistakes can lead to instant ruin. Our three posts on blockchain and cryptocurrencies, NFTs, and the metaverse cover the crypto basics. Today, we take a dive into a topic made hot by Donald Trump’s victory in the U.S. presidential election: alternative cryptocurrencies such as meme coins.

For those with little time to spare, here’s the TL;DR: Since 2021, the market capitalization of meme coins has fluctuated wildly between $8 billion and $103 billion, with towering ups and crashing downs. The chances of losing money greatly outweigh those of making it, and the number of scams is high even by crypto market standards. So the moral is: don’t invest money that you can’t afford to lose — even into something that bears the name of the current U.S. President.

For those with a little more time on their hands, let’s take a look at some joke cryptocurrencies, explore what — if anything — they have in common with NFTs, and tell you what precautions to take if you’re determined to invest in this high-risk market.

Check out how meme-coin market capitalization has changed over the past few years. Source

Meme coins and altcoins — what are they?

Technically, meme coins (aka meme tokens, meme cryptocurrencies) are a type of altcoin; that is — alternative cryptocurrencies. “Alternative” purely in the sense of not being the largest and most widespread  of cryptoassets: Bitcoin and Ethereum. Historically, altcoins tended to be launched as independent blockchain platforms, but today they’re more likely to piggyback an existing popular blockchain platform, such as Solana.

To get a sense of the volatility of the meme coin market, compare the price and capitalization of certain randomly-chosen tokens in three weeks from late January (top) to mid-February (bottom), 2025. Source

In their issuance and circulation mechanisms, most altcoins offer holders some tangible benefits — from low fees and high transaction speeds to pegging to real-world assets. However, meme coins, of which Dogecoin was the first, were initially issued as a joke, and a chance to invest in a fleeting social trend — to show one’s love for a meme, or support for an actor, public figure, or media personality. Although a meme coin is a cryptocurrency, its value is determined primarily by how enthusiastic people are to invest in it. As a result, these crypto assets are prone to sharp price spikes, depending on who wrote what on social media, whether people liked an actor’s new movie, and other such factors.

Meme coins and NFTs — similarities and differences

Both meme coins and NFTs use blockchain technology to store ownership info and transaction history. But unlike cryptocurrencies — where any two coins are equivalent and interchangeable, just like a couple of hundred-dollar bills, each individual NFT is unique, and hence the name: non-fungible tokens. Each token secures ownership of some unique digital asset — imparting collector value to NFTs.

And because collector value is largely subjective, NFTs, like meme coins, are highly susceptible to hype, speculation, and wild price swings.

Top meme coins

This section will age fast, but at the time of posting, the biggest meme coins by market capitalization are Dogecoin (ticker symbol: DOGE), Shiba Inu (SHIB), Pepe (PEPE), OFFICIAL TRUMP (TRUMP), and Bonk (BONK) — with the first exceeding $39 billion, and the last just below $1.5 billion. The TRUMP meme coin was nowhere in the vicinity of this top list a month ago — further proof of just how fickle this market is.

The pack leader, Dogecoin, however, is a real survivor. More than a decade old, its value hovered between $0.0001 and $0.0002 for the first two years, and rarely nudged past $0.01 in the following four. However, after being endorsed by Elon Musk in 2021, it briefly soared to $0.63, before sinking to around $0.06. It spiked again last November to over $0.4 after the presidential victory of the crypto-supporting Trump — over whom Musk appears to have some influence.

Price dynamics of the oldest meme coin, Dogecoin (DOGE). Source

TRUMP, MELANIA, and BARRON

The new U.S. President’s family deserves a separate chapter in our story because it perfectly illustrates the essential properties of meme coins.

Just three days before taking office in 2025, Trump announced the launch of his eponymous meme coin, which climbed to $75 in just two days, then halved, and has been steadily falling over the past three weeks — dropping to around $19 at the time of posting. Technically, TRUMP is issued on the Solana blockchain, with a total “mintage” of one billion coins. However, only 200 million were released into circulation, while the rest remained under the control of CIC Digital LLC and Fight Fight Fight LLC — both affiliated with the Trump Organization.

Price dynamics of the OFFICIAL TRUMP meme coin (TRUMP). Source

With the issue structured in this way, the Trump Organization can dictate both prices and demand, since it controls significantly more coins than are on the open market. It can make money by selling coins at high prices — both saturating the market and driving prices down. Or it can choose not to sell, and instead wait for an uptick in market sentiment to maximize profits. Value dilution due to increased supply primarily hits those who bought the coins at peak value and hype — favoring both buyers who got the coins cheaply, and those who issued the coin in question.

This approach has drawn criticism from many in the crypto industry, such as Nick Tomaino: “Trump owning 80% and timing launch hours before inauguration is predatory and many will likely get hurt by it”.

Blockchain analysis firm Chainalysis showed that in the first few days after the launch, almost 80% of the 600,000 buyers earned less than $100 on the token, and barely recouped their investment. Tellingly, 50% of TRUMP buyers were crypto first-timers who had only created a wallet and plunged into the market specifically for this deal.

A few weeks later, almost all TRUMP investors were out of pocket. At the same time, a select group of 21 “whales” (buyers of 500,000+ tokens) made over $214 million in the first days of the meme coin’s circulation.

In all fairness, the website distributing the coins does state that buying them represents “an expression of support for, and engagement with, the ideals and beliefs embodied by the symbol $TRUMP”, and is not to be seen as an investment.

Two days after the TRUMP announcement, the First Lady followed suit with the launch of her own meme coin. Having briefly risen above $12, just a day later MELANIA took a downward turn and spent a couple of days at the $3-5 range, before stabilizing at around $1.4. Just as the MELANIA launch news broke, TRUMP plummeted.

Naturally, all this hullabaloo over “political” meme coins could hardly escape the attention of scammers. Blockchain platforms witnessed a mushrooming of tokens with TRUMP as the ticker symbol or in the description — despite having nothing to do with the “official” meme coin.

The most eye-catching was the meme coin in the name of the U.S. president’s youngest son, Barron Trump. Aided by a profile on the Pump.fun website (where anyone can quickly launch their own meme coin) plus a handful of X posts pretending to be related to an investigation and leaked insider information, in just a few hours the unofficial meme token scored a market capitalization of $460 million. However, when proof of “presidential” origin failed to materialize, the token crashed by 95%.

Major meme coin and NFT scams

Rug pull (exit scam). The most common scam associated with newly-issued crypto assets. Scammers mislead buyers about the origins of a particular coin or NFT project and the value of the tokens, sell a bunch of them, and vanish. The purchased tokens remain with the new owners but rapidly depreciate. In the case of meme coins, this scheme is often implemented with a celebrity allegedly issuing their own token, which later turns out to be a hoax. In the case of NFTs, buyers are promised non-existent privileges or collector value. An infamous case was the Baller Ape Club NFT, which led to one of the first indictments for NFT fraud. According to Chainalysis, almost one in 20 tokens issued in 2024 may have been rug pulls; while in 2021, these scams brought crypto investors a total loss of $2.8 billion.

“Namesake” attack. For easy identification on crypto exchanges and other crypto platforms, each token is assigned a unique code known as a ticker — just like on traditional exchanges: BTC, USDT, TRUMP, and so on. But in reality, the buying and selling of tokens is based not on tickers, but on long, hard-to-read smart contract addresses. A common attack exploits this duality. Scammers create their own tokens (altcoins) with a different contract address in the blockchain — but under the same ticker as a popular token, for example, TRUMP. Sometimes the scheme might even work when the ticker is different, and the big-draw name simply appears in the coin description. Such tokens are often launched on a different blockchain where the original coin isn’t traded. All these scenarios boil down to the same thing: the victim buys a totally different crypto asset, which likely has no value.

The website selling genuine TRUMP tokens states the associated smart contract address explicitly. However, scammers can create a copy of the website and post a different smart contract address

Honeypot tokens. These are tokens whose smart contract doesn’t allow their sale. In other words, you can invest money in them, but not withdraw it. This scam is often combined with the “namesake” attack.

Drainers. Our separate post covers this threat in detail. Thinking they’re buying meme coins or NFTs, victims enter their credentials on a fake website and have their crypto wallets emptied. The bait website either mimics the official one, or offers a fake promotion such as a token airdrop.

Phishing and malware. Under the guise of social media posts by celebrities, messages from technical support, and countless other pretexts, attackers swindle private keys and seed phrases from crypto holders, as well as install malware on their computers and phones to siphon off crypto-related information. The outcome is always the same: the loss of all funds in the crypto wallet.

There are other, more exotic ways of stealing cryptocurrency: hacking old Bitcoin wallets through encryption algorithm bugs, fake hardware crypto wallets, and infected games like Mario Forever or tanks.

There are even Robin Hood scams targeting crypto thieves themselves. A juicy bait is dangled before their eyes — for example, “leaked” credentials of wallets supposedly containing hundreds of thousands of dollars or seed phrases for real crypto wallets — but after paying a “fee” to withdraw the funds, they discover that a withdrawal isn’t possible.

Our blog is home to dozens of other gripping detective stories about crypto scams. Sadly, the list is expanding daily, so subscribe now to keep up to date with all the latest threats.

How not to lose money on crypto, NFTs, and meme coins

1. Don’t invest in crypto assets if you have any doubts about your financial situation or the stability of global markets, or don’t feel sufficiently qualified.
2. Don’t invest in crypto assets (or anything else) what you can’t afford to lose.
3. If you need crypto assets for payment purposes, use coins with low volatility, such as USDT stablecoins, and don’t buy more crypto than you need to settle the account.
4. If you’re investing in crypto assets for profit, be prepared to closely monitor the market dynamics and react quickly. This is a daily job, all the more so for meme coins — you need to track social media trends and strike when the market is hot. Cryptocurrency speculation (on meme coins in particular) is very strong in Asia, so you may have to adjust your “trading day” to the Far Eastern time zone.
5. Give preference to projects and tokens that have been on the market for a while and earned a certain reputation.
6. If buying a newly launched token, make sure it isn’t a rug pull or Ponzi scheme. This will require researching the reputation of the project creators and the token’s technical features. If the project’s smart contracts have been audited, study the results. The lack of such an audit isn’t a red flag per se, but it should put you on your guard. If it’s a meme coin linked to a celebrity, look at their official social media accounts and profiles, and make sure they were actually involved.
7. Buy tokens on large platforms that have internal standards and comply with legal regulations. Examples include Binance and Coinbase. When getting information about a token, especially its smart contract address, make sure you visit the official site and not a fake. Don’t enter crypto wallet credentials, card details, or other sensitive information on third-party sites.
8. Carefully check smart contract and crypto wallet addresses to avoid buying a “namesake”.
9. Be careful when searching for crypto-related sites, news, and social media accounts, and be wary of messages sent to you in email and messaging apps. Crypto investors are frequent targets of phishing and pig butchering
10. Install comprehensive security solutions on all your devices to protect against malware and websites designed to steal crypto assets. We recommend Kaspersky Premium, which offers additional privacy protection and data-leak monitoring tools, plus the built-in online payment protection system Safe Money.

The information in this article is for informational purposes only and does not constitute investment advice. The instruments discussed may not match your investment profile, financial situation, investment experience, or investment goals.

Kaspersky official blog – ​Read More

Three out of four organizations worldwide use hybrid clouds, and three-quarters of them consider their IT migration and modernization projects to be successful. But what is success — and how does a successful IT project affect the business and capabilities of a company? Authors of the Enterprise Application Modernization: A Journey through Container-Based Cloud Architecture Transformation study tried to answer these questions and to summarize the available information on how the transition to cloud and container infrastructure affected the activities of companies that have made this transformation.

The economic arguments in favor of the transition turned out to be weighty. In the studied organizations, IT operating costs decreased by an average of 31%, and infrastructure costs by 45%, including routine maintenance costs that decreased by 52%. More importantly, for the first time in many years, businesses were able to unburden their IT teams from the tasks of supporting old code, and use their resources for new developments. In large organizations, IT services spend up to 80% of the budget on legacy IT support, and the transition to modern infrastructure not only speeds it up, but also frees up additional personnel for innovation. Software update cycles are ultimately accelerated by 65%, ensuring a quick response to market changes and better satisfaction of user needs. The authors call the transition to container and microservice architectures in the cloud environment, as well as automated assembly lines, the “three pillars” of efficiency that are responsible for all these radical improvements.

Part of the study is devoted to information security issues. Thanks to this, you can see what contribution various information security tools make to improving the efficiency of IT development, and what indicators you should strive for in your organization. We decided to analyze the main principles and tools and explain how they’re implemented in the updated version of Kaspersky Cloud Workload Security.

Automatic application and monitoring of information security policies

A key challenge for IT and information security is maintaining visibility and control over all IT assets, and this task has become more complex with the transition to hybrid cloud infrastructure. The diversity of assets and management tools results in increased costs and time spent on managing this “zoo” for the company. Therefore, unification of management, compliance control, creation and application of policies should be one of the priority goals in IT transformation projects. If the selected set of information security tools is able to solve this problem in the company’s cloud infrastructure, IT and information security services will save 73% of the time spent on policy management and achieving security compliance.

The practical embodiment of this principle can be seen in the new version of Kaspersky Cloud Workload Security, a solution that provides comprehensive protection for container infrastructure, cloud servers, and virtual machines. Several tools at once simplify work with policies and give administrators a centralized overview and control over the entire infrastructure. The security analysis function of the orchestrator and its clusters helps quickly find problems by structuring them by problem type. Automatic container profiling allows you to improve the security policies applied in the infrastructure with minimal human intervention, as well as to find abnormally operating containers for detailed analysis.

The unified cloud console of Kaspersky Hybrid Cloud Security provides an overview of the cloud or hybrid infrastructure, and allows security personal to instantly update policies for large groups of IT assets or simultaneously run tasks on them.

As for virtual and physical servers, the lightweight agent that protects them performs several functions related to compliance and security posture in automatic mode: from automatic patch management and system hardening to detailed event logging and the use of a role-based access control system (RBAC).

Container scanning in the DevSecOps pipeline

Integration of automated cybersecurity checks at all stages of development and operation of an IT product is the key to significantly increasing the level of security while reducing the workload of IT and information security teams and improving all metrics of the IT system’s “health”. Companies that have implemented a comprehensive approach to container security report a 79% reduction in the number of security-related incidents, and the elimination of 94% of known vulnerabilities at the stages before the deployment of the IT system. As a result, it’s possible to reduce the risk of incidents in the operated system by 89%, the risk of failure at the deployment stage by 68%, and at the same time reach a 99.97% level of unification of the configuration of similar containers. The unification is important because scanning containers is used not only to check for component vulnerabilities and malware, but also the for detection of insecure configurations, as well as typical developer errors, such as API keys and other secrets embedded directly in the code. Kaspersky Cloud Workload Security also implements integration with the HashiCorp Vault, allowing you to securely store solution secrets in this secrets manager software. Kaspersky Cloud Workload Security supports control of container image signatures, and integrates all checks directly with the DevOps pipeline, which helps developers not to take malicious and vulnerable images as a basis of their projects, as well as interrupt the process product development if critical security defects are detected. In general, KCWS helps the development team implement a shift-left approach, in which testing and quality assurance are performed at the early stages of development, including verification of APIs, container configurations, and microservice interactions. All this allows you to find and fix errors earlier, reducing the cost of maintaining and testing of the final product.

Effective monitoring of running processes

Despite numerous preliminary checks of images, runtime environments, and other infrastructure components, monitoring running containers, virtual servers, and the computing environment in which all this occurs remains a critical security task. According to the authors of the study, these measures allow detecting 87% of threats in the first half-minute after their occurrence, and preventing 96% of unauthorized access attempts.

Monitoring results in significant costs: additional computing load on cloud services, multiplied by the number of servers and clusters, as well as man-hours of SOC specialists. Therefore, computing and cost efficiency are critical requirements for both the containerization infrastructure itself and its security system.

This aspect is carefully thought out in Kaspersky Cloud Workload Security. For virtual and physical servers, Light Agent technology saves up to 30% of computing resources in a private cloud, and in a container infrastructure, security agents are launched in separate containers to prevent the performance degradation of the entire cluster. The system has excellent scalability and can protect clusters with up to ten thousand nodes.

Savings start right from the installation of the product — from flexible licensing terms adapted to a specific infrastructure, to effective security settings and rules “out of the box” that reduce the time of initial setup significantly.

Rapid incident response

How to prepare for a situation when an attacker has successfully penetrated the system? In this case, the information security team should have playbooks for incident response, and information security systems should provide the necessary tools. In an IT infrastructure equipped with a comprehensive cloud security system, the response time (MTTR), according to research, is reduced by an impressive 71%. The real difference can be seen in the example of a fast ransomware attack: will it be considered a routine information security incident, or a full-scale paralysis of the entire business for several days or weeks?

To simplify response, the new version of Kaspersky Cloud Workload Security has a container forensic function that permits investigating policy violations and gaining deeper insight into both specific violating events and events that occurred in a close time frame. Event logs in a running container have additional fields that are often needed when investigating an incident. Protection and logging are also carried out on the orchestrator nodes. In addition, event logs can now be sent directly from agents to SIEM systems. Comprehensive logging simplifies detection of the source of an attack, helps compare events that are registered during this attack, or detects vulnerabilities and other risks.

The transition to container and cloud infrastructures usually begins with economic necessity and the requirements of a competitive market. But in order to successfully make the transition and get the promised benefits, it’s important not to outweigh them by creating new high cyber-risks, or implementing an information security approach that will be economically ineffective. These negative scenarios can be avoided by implementing a comprehensive and well-scalable cloud security system, such as Kaspersky Cloud Workload Security.

Kaspersky official blog – ​Read More

In a strongly worded advisory, the FBI and the U.S. Cybersecurity and Infrastructure Security Agency (CISA) have urged software developers to cease unsafe development practices that lead to “unforgivable” buffer overflow vulnerabilities. 

“Despite the existence of well-documented, effective mitigations for buffer overflow vulnerabilities, many manufacturers continue to use unsafe software development practices that allow these vulnerabilities to persist,” the agencies said in the February 12 Secure By Design alert. “For these reasons—as well as the damage exploitation of these defects can cause—CISA, FBI, and others designate buffer overflow vulnerabilities as unforgivable defects.” 

The agencies said threat actors leverage buffer overflow vulnerabilities to gain initial access to networks, thus making them a critical point for preventing attacks. 

We’ll look at the prevalence of buffer overflow vulnerabilities, some examples cited by CISA and the FBI, and guidance for secure development and use of memory-safe programming languages. 

Buffer Overflow Vulnerabilities: Prevalence and Examples 

The FBI-CISA guidance specifically mentions the common software weaknesses CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), along with stack-based buffer overflows (CWE-121) and heap-based buffer overflows (CWE-122). 

The phrase “buffer overflow” occurs in 67 of the 1270 vulnerabilities in CISA’s Known Exploited Vulnerabilities (KEV) catalog, or 5.28% of the KEV database. The words “buffer” and “overflow” occur in 84 of the KEV vulnerabilities (6.6%). 

CISA and the FBI cited six examples of buffer overflow vulnerabilities in IT products: 

• CVE-2025-21333, a Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege vulnerability 
• CVE-2025-0282, a stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version 22.7R2.3 
• CVE-2024-49138, a Windows Common Log File System Driver Elevation of Privilege vulnerability 
• CVE-2024-38812, a VMware vCenter Server heap-overflow vulnerability 
• CVE-2023-6549, an Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Citrix Systems’ NetScaler ADC and NetScaler Gateway 
• CVE-2022-0185, a heap-based buffer overflow flaw in the way the legacy_parse_param function in the Filesystem Context functionality of the Linux kernel verified the supplied parameters length (the CWE in this case was CWE-190, Integer Overflow or Wraparound). 

“These vulnerabilities can lead to data corruption, sensitive data exposure, program crashes, and unauthorized code execution,” the agency guidance said. “Threat actors frequently exploit these vulnerabilities to gain initial access to an organization’s network and then move laterally to the wider network.” 

They added that “the use of unsafe software development practices that allow the persistence of buffer overflow vulnerabilities—especially the use of memory-unsafe programming languages—poses unacceptable risk to our national and economic security.” 

Memory-Safe Software Development 

The agencies urged manufacturers “to take immediate action to prevent these vulnerabilities from being introduced into their products. … Software manufacturer senior executives and business leaders should ask their product and development teams to document past buffer overflow vulnerabilities and how they are working to eliminate this class of defect.” 

Customers should hold manufacturers accountable by requesting a Software Bill of Materials (SBOM) and a secure software development attestation, the FBI and CISA said. 

For development teams, the agencies recommended the following secure by design practices to prevent buffer overflow vulnerabilities: 

• Memory-safe languages should be used whenever possible “to shift the burden of memory management from the developer to the programming language’s built-in safety features.” They added that developers should never disable or override memory safety guarantees in languages when it’s possible to do so, and that using a memory-safe language in one part of a software package will not fix memory-unsafe code in other libraries. 

• A phased transition plan for implementing memory-safe languages should be used for upgrading existing codebases while using technologies to limit memory vulnerabilities in existing code. “Ideally, this plan should include using memory-safe languages to develop new code and—over time and when feasible—transition their software’s most highly privileged/exposed code to memory-safe languages,” the agencies said. 

• Enable compiler flags that implement compile time and runtime protections against buffer overflows to the extent that application performance allows, and “implement canaries that alert if an overflow occurs.” 

• Conduct unit tests with an instrumented toolchain such as AddressSanitizer and MemorySanitizer that checks source code for buffer overflows and other memory safety issues. 

• Perform adversarial product testing that includes static analysis, fuzzing, and manual reviews to ensure code safety and quality throughout the development lifecycle. 

• Publish a memory-safety roadmap that outlines plans to develop new products with memory-safe languages and to migrate older ones based on risk. 

• Conduct root cause analysis of past vulnerabilities, including buffer overflows, to identify patterns. “Where possible, take actions to eliminate entire classes of vulnerabilities across products, rather than the superficial causes,” the agencies said. 

The alert said eliminating buffer overflow vulnerabilities “can help reduce the prevalence of other memory safety issues, such as format string, off-by-one, and use-after-free vulnerabilities.” 

Conclusion 

As an initial entry point for attackers into a network, the importance of buffer overflow vulnerability prevention can’t be overstated. Development teams would be wise to implement CISA and the FBI’s advice to the maximum extent possible. 

Customers also have a role to play by demanding memory-safe documentation from suppliers. But they also shouldn’t neglect basic cybersecurity practices for the eventual vulnerabilities that will slip past even the most vigilant development teams. Zero trust, risk-based vulnerability management, segmentation, tamper-proof backups and network and endpoint monitoring are all critically important practices for limiting the damage from any cyberattacks that do occur. 

The post FBI, CISA Urge Memory-Safe Practices for Software Development  appeared first on Cyble.

Blog – Cyble – ​Read More

Cybercriminals around the world keep honing their schemes to steal accounts in WhatsApp, Telegram, and other popular messaging apps – and any of us could fall for their scams. Only by becoming a victim of such an attack can you fully appreciate how vital a tool instant messaging has become, and how diverse the damage from hacking a WhatsApp or Telegram account may be. But better not to let it come to that, and to learn to recognize key hijacking scams in order to prevent them in time.

Why hijack your WhatsApp or Telegram account?

A stolen account can be appealing because of its content, access rights, or simply the fact that it’s verified, linked to a phone number, and has a good reputation. Having stolen your Telegram or WhatsApp account, cybercriminals can use it in a variety of ways:

• To send spam and phishing messages on your behalf to all your contacts – including private channels and communities.
• To write sob stories to all your friends asking for money. Worse yet – to use AI to fake a voice or video message asking for help.
• To steal accounts from your friends and family by asking them to vote in a contest, “gifting” them a fake Telegram Premium subscription, or employing some other fraudulent scheme – of which there are many. Coming from someone the recipient knows, messages like this tend to inspire greater trust.
• To hijack a Telegram channel or WhatsApp community you manage.
• To blackmail you with the contents of your chats – especially if there’s sexting or other compromising messages.
• To read your chats quietly, which may have strategic value if you’re a businessman, politician, military or security officer, or civil servant.
• To upload a new photo to your account, change your name, and use your account for targeted scams: from flirting with crypto investors (pig butchering) to requests from the victim’s boss (boss scams).

Due to this variety of applications, criminals need new accounts all the time, and anyone can become a victim.

WhatsApp, Telegram, and QQ quishing

Scammers used to steal accounts by tricking people into giving them text verification codes (required to log in), or by intercepting these codes. But since this method is no longer as effective, the focus has shifted to trying to link an additional device to the victim’s account. This works best when using phishing schemes based on QR codes – known as quishing.

Attackers either put up their own ads or carefully stick malicious QR codes on top of someone else’s to overlay the legitimate code. They can also print a QR code on a flyer and drop it in a mailbox, post it on a social network or website, or simply send it by email. The pretext can be anything: an invitation to join a neighborhood chat; connect to an office, campus, or school community; download a restaurant menu or claim a discount; or view cinema showtimes or extra information on movies and other events.

The code alone can’t cause your account to be hijacked, but it can lure you to a scam website containing detailed instructions telling you where to click in the messaging app, and what to do after that. The site shows you another, dynamically generated, QR code, which the attackers’ server requests from WhatsApp or Telegram when it asks the service to link a new device to your account. And if you, determined to enjoy every benefit civilization has to offer, decide that another code won’t hurt and follow the instructions, then the device used by the attackers will get access to all your data in the app. In fact, you can see it in the “Devices” or “Linked devices” sections of Telegram or WhatsApp, respectively. However, this attack is designed for those who aren’t very familiar with messaging app settings, and who might not check such submenus regularly. Incidentally, users of QQ, China’s most popular messaging app, are also targeted by similar attacks.

Malicious polls, fraudulent gifts, and girls… undressing

Aside from QR codes, scammers may also attack you by sending seemingly harmless links, such as those for “people’s choice” votes, instant lotteries, or giveaways. On Telegram, they like to mimic the interface used for receiving a Premium subscription as a gift.

Typically, you get to such pages through messages from friends or acquaintances whose accounts have already been compromised by the same scammers. The homepage is always full of catchy phrases like “vote for me” and “claim your gift”.

A variation on the scam involves messages from a “messaging app security service”. You might get contacted by someone using a name like “Security” or “Telegram security team”. They offer to protect your data by transferring your account to a secure account clicking a link and enabling “advanced security options”.

Lastly, you could get an ad for a service or bot that offers something useful or fun – like an AI chatbot or a… nude generator.

There’s another potential scam scenario for Telegram: since 2018, the service has offered website owners authentication of visitors using the Telegram Login Widget. It’s a real, functioning system, but scammers take advantage of the fact that few people know how this authentication is supposed to work – replacing it with a phishing page to steal information.

In any of these scenarios, once you’re through the enticing landing page, you’ll be asked to “sign in to your messaging app”. This procedure might involve scanning a QR code or simply entering your phone number and the OTP code on the website. This part of the website is typically disguised as a standard WhatsApp or Telegram authentication interface – creating the illusion that you’ve been redirected to the official website for login. In reality, the entire process is happening on the attackers’ own site. If you comply and enter the data or scan the code, cybercriminals will immediately gain control of your messaging app account. Your only reward? Some kind of thank-you message like your premium subscription will activate within 24 hours (it won’t; who knew?!).

Hacking a smartphone with a fake WhatsApp or Telegram app

An old yet still effective way to hijack accounts is by using trojanized mods; that is – modified versions of messaging apps. This threat is especially relevant for Android users. You can come across ads touting “improved” versions of popular messaging apps on forums, in groups chats, or simply in search results. WhatsApp mods often promise the ability to read deleted messages and see the statuses of those who hid them, while Telegram fans are promised free Premium features.

Downloading and installing a mod like this infects your phone with malware that can steal the messaging account along with all the other data on the device. Interestingly, Android users can encounter spyware-infected mods even in the “holy of holies”: the official Google Play store.

What happens to a hijacked Telegram or WhatsApp account?

The fate of your hijacked account depends on the attackers’ intentions. If their goal is espionage or blackmail, they’ll just quickly download all your chats for analysis, and you may not notice anything at all.

If cybercriminals want to send fraudulent messages to your contacts, they’ll immediately delete sent messages by using the “delete for me only” feature to make sure you don’t notice anything for as long as possible. However, sooner or later, you’ll start receiving messages from surprised, outraged, or simply vigilant friends, or you yourself will notice traces of an unauthorized presence.

Another consequence of hacking may be the messaging service’s reaction to the spam. If recipients report your messages, your account may become restricted or blocked – preventing you from sending messages for several hours or days. You can appeal the restrictions by using a special button, such as “Request a Review” in the message from the moderators, but it’s best to first ensure that you have exclusive control over your account and wait at least a few hours afterward.

Telegram treats all devices linked to an account equally, which means scammers can take over your entire account and kick you out by disconnecting all your devices. However, to do this, they’d need to remain logged in unnoticed for a whole day: Telegram has a 24-hour waiting period before one can log out other devices from a newly connected account. If you’ve been locked out of your own Telegram account, read our detailed recovery guide.

On WhatsApp, the first device you use to log in to your account becomes the primary one, and other devices are secondary. This means hackers can’t pull off that trick there.

How to protect yourself from WhatsApp and Telegram account hijacking

You can find detailed instructions on how to secure your Telegram, WhatsApp, Signal, and Discord in our separate guides. Let’s go over the general principles again:

• Be sure to enable two-factor authentication (also variously known as “cloud password” or “two-step verification”) in the messaging app, and use a long, complex, and unique password or passphrase.
• On WhatsApp, you can choose a passkey instead of a password. This protection is more reliable.
• Avoid taking part in giveaways and lotteries. Don’t accept gifts that you didn’t expect – especially if you need to log in to some websites through the messaging app to receive them.
• Learn how legitimate authorization through Telegram looks, and immediately close any websites that look different. To put it simply, during a legitimate authorization process, all you need to do is click the “Yes, I want to go to such-and-such website” button within the Telegram chat with the bot. No scanning or entering of codes is required.
• Check your WhatsApp and Telegram settings regularly to see what devices are connected. Disconnect any that look old or fishy.
• Always use official messaging apps downloaded from trusted sources like Google Play or the App Store, Galaxy Store, Huawei AppGallery, and other major app stores.
• Be more careful with desktop messaging clients – especially at the office.
• Use a reliable protection system on all your devices to avoid visiting phishing sites or installing malware.

Kaspersky official blog – ​Read More

Overview

Cyble’s weekly industrial control system (ICS) vulnerability report to clients warned about internet-facing medical imaging and critical infrastructure asset management systems that could be vulnerable to cyberattacks.

The report examined six ICS, operational technology (OT), and Supervisory Control and Data Acquisition (SCADA) vulnerabilities in total, but it focused on two in particular after Cyble detected web-exposed instances of the systems.

Orthanc, Trimble Cityworks Vulnerabilities Highlighted by CISA

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued advisories alerting users to vulnerabilities in medical imaging and asset management products.

Orthanc is an open-source DICOM server used in healthcare environments for medical imaging storage and retrieval, while Trimble Cityworks is a GIS-centric asset management system used to manage all infrastructure assets for airports, utilities, municipalities, and counties.

In a February 6 ICS medical advisory, CISA said the Orthanc server prior to version 1.5.8 does not enable basic authentication by default when remote access is enabled, which could result in unauthorized access by a malicious actor. The Missing Authentication for Critical Function vulnerability, CVE-2025-0896, has been assigned a CVSS v3.1 base score of 9.8, just below the maximum score of 10.0.

Orthanc recommends that users update to the latest version or enable HTTP authentication by setting the configuration “AuthenticationEnabled”: true in the configuration file.

Cyble provided a publicly accessible search query for its ODIN vulnerability search tool, which users can use to find potentially vulnerable instances.

“This flaw requires urgent attention, as Cyble researchers have identified multiple internet-facing Orthanc instances, increasing the risk of exploitation,” the Cyble report said. “The exposure of vulnerable instances could allow unauthorized access to sensitive medical data, manipulation of imaging records, or even unauthorized control over the server. Given the high stakes in healthcare cybersecurity, immediate patching to version 1.5.8 or later, along with restricting external access, is strongly recommended to mitigate potential threats.”

CVE-2025-0994 is an 8.6-rated Deserialization of Untrusted Data in Trimble Cityworks that was reported to CISA by Trimble, which quickly patched the vulnerability and issued mitigation guidance. CISA issued an advisory on the vulnerability, which affects Cityworks versions prior to 15.8.9 and Cityworks with office companion versions prior to 23.10, and also added the vulnerability to CISA’s Known Exploited Vulnerabilities catalog.

Cyble provided an ODIN search query for users to check for exposed Cityworks instances and a hash query for ODIN subscribers.

Recommendations for Mitigating ICS Vulnerabilities

Cyble recommends several important controls for mitigating ICS vulnerabilities and improving the overall security of ICS systems. The measures include:

1. Staying on top of security advisories and patch alerts issued by vendors and regulatory bodies like CISA. A risk-based approach to vulnerability management reduces the risk of exploitation.
2. Implementing a Zero-Trust  Policy to minimize exposure and ensure that all internal and external network traffic is scrutinized and validated.
3. Developing a comprehensive patch management strategy that covers inventory management, patch assessment, testing, deployment, and verification. Automating these processes can help maintain consistency and improve efficiency.
4. Proper network segmentation can limit an attacker’s potential damage and prevent lateral movement across networks. This is particularly important for securing critical ICS assets, which should not be exposed to the Internet if possible and properly protected if remote access is essential.
5. Conducting regular vulnerability assessments and penetration testing to identify gaps in security that might be exploited by threat actors.
6. Establishing and maintaining an incident response plan and ensuring that it is tested and updated regularly to adapt to the latest threats.
7. All employees, especially those working with Operational Technology (OT) systems, should be required to undergo ongoing cybersecurity training programs. The training should focus on recognizing phishing attempts, following authentication procedures, and understanding the importance of cybersecurity practices in day-to-day operations.

Conclusion

These vulnerabilities show the danger that medical and critical infrastructure system vulnerabilities can pose to patients, utilities, airports, and other sensitive environments. The organizations and CISA responded rapidly in these cases, but now users must do the same and ensure that the systems are patched and properly protected.

Regardless of the sector, staying on top of ICS vulnerabilities and applying good cybersecurity hygiene and controls can limit risk. This includes limiting internet exposure and properly protecting assets that must be accessed remotely.

To access the full report on ICS vulnerabilities observed by Cyble, along with additional insights and details, click here. By adopting a comprehensive, multi-layered security approach that includes effective vulnerability management, timely patching, and ongoing employee training, organizations can reduce their exposure to cyber threats. With the right tools and intelligence, such as those offered by Cyble, critical infrastructure can be better protected, ensuring its resilience and security in an increasingly complex cyber landscape.

The post Cyble Warns of Exposed Medical Imaging, Asset Management Systems appeared first on Cyble.

Blog – Cyble – ​Read More