The SURF Security Lifeguard Report

Keeping you afloat in dangerous times

Welcome to the second SURF Security Lifeguard Report, our roundup of the top cybersecurity stories over the past few days. As always, there’s plenty here to keep your cyber-strategy on the right track. And a few titbits you might not know about SURF Security.

Failure to use MFA cited in a fifth of cloud breaches

Multi-factor authentication (MFA) is not fool proof. But it provides an important bulwark against phishing attacks. Unfortunately, new research from Thales reveals that a lack of MFA was the cause of nearly a fifth (17%) of cloud-related breaches over the past 12 months. This matters, because 47% of corporate data held in the cloud is sensitive, the report claims. The top targets for attack are SaaS applications (31%), cloud storage (30%) and cloud management infrastructure (26%).

SURF Security enables organisations to enforce MFA for each employee at the browser level, by requiring it at login or on selected pages.

Major supply chain attack hits 100,000+ websites

Visitors to over 100,000 websites using a popular JavaScipt CDN service are being redirected to malicious sites. Earlier this year a Chinese company acquired the domain for the popular Polyfill[.]io service, and modified the JavaScript code that’s automatically deployed on websites embedding scripts from cdn.polyfill[.]io. This is putting unwitting web users at risk of data theft, clickjacking and more.

SURF Security flags the modified script as malicious, preventing users from visiting the infected websites and being redirected to something worse.

IT leaders think GenAI is too risky for use in security

European IT decision makers are split down the middle when it comes to using GenAI for cybersecurity, according to a new study. While 46% of respondents claim they’re proactively looking at how to incorporate the technology in their security strategy, 44% are concerned that data exposure will make it “difficult or impossible” to use GenAI. A further 37% argue that the tech is “not safe to use in cybersecurity”. Similar concerns surround use of GenAI across the enterprise.

SURF Security offers a range of mechanisms to mitigate GenAI security and privacy risks, including the masking of personally identifiable information, restricting access for non-privileged users, preventing the inclusion of prompts containing sensitive data, and disabling paste functions.

LA breach hit hundreds of employees across over 20 departments

A large-scale phishing campaign targeting Los Angeles County in February breached 25 of the county’s 38 departments and impacted 283 employees, it has emerged. Hackers managed to steal the logins of 53 employees who fell for the email-based social engineering effort. At least 200,000 medical records were compromised, but the real impact could be far higher. The Department of Health claims employees “clicked on the link located in the body of the e-mail, thinking that they were accessing a legitimate message from a trustworthy sender.”

SURF Security offers comprehensive protection from social engineering, including domain, reputation and SSL certificate checks to block access to phishing sites.

Big-name retailer the latest victim of Snowflake account breaches

A luxury retailer in the US has become the latest corporate victim of a large-scale data theft and extortion campaign targeting Snowflake customers. Names, contact information, dates of birth and gift card details on 64,000 customers were stolen and put up for sale on the dark web. The threat actor accessed the affected Snowflake accounts by using credentials previously obtained via infostealer malware. Those impacted did not have MFA enabled.

Wordpress plugins modified to hijack websites

At least five WordPress plugins have been backdoored in another ambitious supply chain attack. This time, the threat actors behind it inserted malware into the plugin updates so that, when installed, they created an attacker-controlled administrative account providing full control over the compromised site. As many as 36,000 websites could be impacted. The purpose of the campaign appears to be to insert SEO spam into the compromised sites, although the threat actors could do worse.

SURF Security would have prevented website admins from downloading the malicious plugin updates in the first place.

?