Gone Phishin' Volume 6: Mid-to-late September, 2022

Is it that time again? It is! It's another action-packed edition of our Gone Phishin' column, where we keep you updated on the biggest, bestest stories in cybersecurity of the last two weeks. Want to see more Gone Phishin', perhaps every week? Drop us a line.

American Airlines

About 1,700 individuals (including employees and customers) had their personal data breached by a "malicious actor" who hacked into American Airlines using phishing techniques. Back in July, American Airlines discovered a data breach in their network. They let the general public know at the end of September, a full 3 months after the breach actually happened. Shares for the airline were down 2.6% after the news broke. The personal data affected includes passport numbers, medical records (in some cases), phone numbers, home addresses, and drivers license information, according to Reuters.

2K

If you're even tangentially into video games, chances are you've heard of 2K games. They're one of the biggest gaming studios in the world and responsible for the ever-popular NBA2K basketball video game series, as well as Borderlands, PGA golfing sims, the Bioshock franchise (which was at one point set to be a series of movies directed by Steven Spielberg), and many other properties.

However! The inclusion of 2K Games on this list isn't out of pure gaming respect. If you happened to reach out to their 'Help' desk recently, there's a good chance that you may have been sent an email or a series of emails asking you to provide 2K account info as well as other personal identifying information. Here's the kicker: there's a strong chance those emails weren't from 2K. That's because 2K had their Zendesk hacked and were sending out malicious emails with Redline malware attached to them, disguised as some sort of "free game" file, according to Bleeping Computer. If you were one of the unlucky people who chose to interact with their emails, the malware enables the hacker(s) to read your passwords in your autofill, amongst other things. In a Tweet posted September 20th, 2K is asking you to change all your passwords, enable multi-factor authentication, and (perhaps most concerning of all) "check your account settings to see if any forwarding rules have been added or changed on your personal email accounts." 

LinkedIn

Depending on how fancy-schmancy you are at your office, there's a very real possibility you've never had to interact with LinkedIn's "Navigator" or "Enterprise" functionalities. Amongst other things, these two tiers offer a service called SmartLink which gives users the ability to send up to 15 documents at once using a single link. Can you see where this is going? If you can, congrats, pat yourself on the back and take the rest of the day off: hackers have abused this service and are using it to bypass email security protocols and have unsuspecting users enter (you guessed it) their company credit cards and also their personal identifying information. According to Cofense—who first broke the story—this particular "stint" of hackery only took place in Slovenia, although it caused enough of a ruskus for LinkedIn to issue a statement saying "Our internal teams work to take action against those who attempt to harm LinkedIn members through phishing." Which, I hate to say it, is exactly what they've said every other time phishing has been detected on their platform. Perhaps some more accountability is in order.

An update to the GTA6 / Uber leaks

Do y'all remember a couple of weeks back when the GTA6 leak was all over the news, including our own blog? Well, they've caught the guy. Turns out he was a 17 year-old boy(!) from Oxfordshire, a county in England. The young man—identifiable only by the initials AK due to UK laws—is part of a hacking group named Laspu$$ that has also been responsible for hacks on Samsung, Cisco, and Microsoft. If/when the trial goes to court, AK possibly faces charges on both sides of the Atlantic as the FBI is also looking into the case. The hacker also claimed to have access to KONE (a Finnish company who are major names in elevators and escalators), Bank of Brasil, Take2Games, and DoorDash.

GTA6 is projected to make $3.5b in the year it is released, with $2.5b every year thereafter if the same "freeplay-but-pay-to-get-better-stuff" strategy of GTA Online is used for the upcoming game.

‍