A daily look at the relevant information security news from overnight - 17 June, 2022

Episode 247 - 17 June 2022

Office 365 Attack- https://thehackernews.com/2022/06/a-microsoft-office-365-feature-could.html

Wallet Recovery Flaw -
https://www.bleepingcomputer.com/news/security/metamask-phantom-warn-of-flaw-that-could-steal-your-crypto-wallets/

Naked Phishing- https://www.infosecurity-magazine.com/news/nakedpages-phishing-toolkit/

QNAP DeadBolted -
https://www.bleepingcomputer.com/news/security/qnap-thoroughly-investigating-new-deadbolt-ransomware-attacks/

WordPress Ninja vuln -
https://www.securityweek.com/exploited-vulnerability-patched-wordpress-plugin-over-1-million-installations

Hi, I’m Paul Torgersen. It’s Friday June 17th, 2022, and this is a look at the information security news from overnight.

From HackerNews.com
A potentially dangerous piece of functionality has been discovered in the Microsoft 365 suite that could help threat actors encrypt files stored on SharePoint and OneDrive. The attack hinges on the AutoSave feature, which allows a number of older file versions after users make edits. As the number is reached, the oldest file version gets deleted as the newest is saved. So attackers can either encrypt that available number plus 1, or reduce the number available to something smaller, like 1. Details and a link to the Proofpoint research in the article.

From BleepingComputer.com:
MetaMask and Phantom are warning of a new vulnerability called Demonic, that could expose a crypto wallet's seed phrase and allow attackers to steal any NFTs and crypto stored there. It is caused by how web browsers save contents of non-password fields as part of a standard “restore session”. Browser wallet extensions, such as Metamask, Phantom, and Brave, use an input field that is not designated as a password field, so the recovery phrase is saved in plain text form. MetaMask and Phantom have both patched the flaw, however, no word yet from Brave.

From Infosecurity-Magazine.com:
Researchers at CloudSEK have spotted a new phishing toolkit for sale across the various cybercrime forums. The “NakedPages,” toolkit is designed to run on Linux machines, runs JavaScript, is fully automated, and comes preloaded with more than 50 phishing templates and site projects. A link to the CloudSEK advisory in the article.

From BleepingComputer.com:
QNAP is warning customers to secure their devices against a new campaign of attacks pushing the DeadBolt ransomware. The company is urging users to update their Network Attached Storage devices to the latest firmware version and ensure they're not exposed to remote access over the Internet. The campaign appears to target QNAP NAS devices running QTS 4.x.

And last today, from SecurityWeek.com
The WordPress Ninja Forms plugin, which helps administrators add customizable forms to their WordPress sites, has a vulnerability that appears to have been exploited in the wild. The flaw was identified in the Merge Tag functionality of the plugin, and carries a severity rating of 9.8. The Ninja Forms plugin has over a million installations. WordPress performed a forced update to fix the issue, but administrators are urged to...