Thursday 6th February 2025

Good morning! If you thought hackers were just after your passwords, think again—they’re eyeing everything from your crypto wallets to government databases. ???♂???

In today’s edition, we’re looking into the wild world of cybersecurity: Spanish police just nabbed a hacker who targeted NATO and the US Army, AWS users are facing a sneaky threat to their S3 buckets, and a new wave of malicious apps is swiping crypto wallet recovery phrases right from your phone.

Enjoy!

Spanish Police Nab Alleged Hacker Behind 40 Cyberattacks

In a cybercrime thriller fit for a Netflix special, Spanish police arrested a suspected hacker in Alicante accused of launching 40 cyberattacks on high-profile targets, including NATO, the US Army, and Spain’s Ministry of Defence. The suspect reportedly used multiple aliases to breach critical databases, leaking sensitive information about government employees and internal documents, some of which were sold on dark web forums like BreachForums.

Authorities began investigating in early 2024 after a Madrid business association reported a data leak, eventually tracing the suspect with help from Europol, the US Homeland Security Investigations (HSI), and Spain’s National Cryptologic Center. A raid at the suspect’s home uncovered numerous electronic devices and 50 crypto accounts.

Despite the severity of the charges, which could land the hacker up to 20 years in prison, the suspect was released after a court hearing with his passport confiscated to prevent escape. Authorities haven’t ruled out additional charges—or accomplices.

The Hidden Threat Lurking in Your AWS S3 Buckets

If you’re storing data on AWS S3, you might want to double-check your bucket names. A rising cybersecurity threat known as S3 bucket namesquatting exploits predictable naming patterns, allowing bad actors to hijack buckets before legitimate users can claim them. This can lead to data breaches, traffic redirection, or even the creation of unauthorised admin accounts.

One recent incident saw hackers exploiting static S3 buckets and Amazon Route 53 to redirect users to shady websites, damaging customer trust and forcing security teams into crisis mode. Many companies aren’t even aware they’re vulnerable until it’s too late.

AWS recommends customizing S3 bucket names and locking down public access, but tools like Varonis take it a step further. Varonis automates the detection and remediation of misconfigured buckets, ensuring sensitive data stays secure. In the era of cloud-first strategies, neglecting these vulnerabilities could cost more than just data—it could cost your reputation.

Malicious SDK in Popular Apps Targets Crypto Wallets

If you've recently downloaded apps from Google Play or the App Store, you might want to double-check your phone. Security researchers at Kaspersky uncovered a malicious software development kit (SDK) embedded in Android and iOS apps, designed to steal cryptocurrency wallet recovery phrases using optical character recognition (OCR) stealers. Dubbed “SparkCat,” this is the first known case of such malware being found on the App Store.

On Google Play alone, infected apps like ChatAi were downloaded over 242,000 times before being removed. The malicious SDK, disguised as an analytics tool, scans your photos for wallet recovery phrases and uploads sensitive data to command-and-control servers.

While some of the 28 infected apps are region-specific, experts warn the malware could operate globally. If you’ve downloaded any suspicious apps recently, uninstall them immediately and consider a factory reset. And whatever you do, don’t store your recovery phrases in screenshots—stick to offline storage to keep your crypto safe.