Office 365 Attack, Wallet Recovery Flaw, WordPress Ninja vuln, and more.

Infosec Overnights - Daily Security News

A daily look at the relevant information security news from overnight - 17 June, 2022
Episode 247 - 17 June 2022
Office 365 Attack- https://thehackernews.com/2022/06/a-microsoft-office-365-feature-could.html
Wallet Recovery Flaw -
https://www.bleepingcomputer.com/news/security/metamask-phantom-warn-of-flaw-that-could-steal-your-crypto-wallets/
Naked Phishing- https://www.infosecurity-magazine.com/news/nakedpages-phishing-toolkit/
QNAP DeadBolted -
https://www.bleepingcomputer.com/news/security/qnap-thoroughly-investigating-new-deadbolt-ransomware-attacks/
WordPress Ninja vuln -
https://www.securityweek.com/exploited-vulnerability-patched-wordpress-plugin-over-1-million-installations
Hi, I’m Paul Torgersen. It’s Friday June 17th, 2022, and this is a look at the information security news from overnight.
From HackerNews.com
A potentially dangerous piece of functionality has been discovered in the Microsoft 365 suite that could help threat actors encrypt files stored on SharePoint and OneDrive. The attack hinges on the AutoSave feature, which allows a number of older file versions after users make edits. As the number is reached, the oldest file version gets deleted as the newest is saved. So attackers can either encrypt that available number plus 1, or reduce the number available to something smaller, like 1. Details and a link to the Proofpoint research in the article.
From BleepingComputer.com:
MetaMask and Phantom are warning of a new vulnerability called Demonic, that could expose a crypto wallet's seed phrase and allow attackers to steal any NFTs and crypto stored there. It is caused by how web browsers save contents of non-password fields as part of a standard “restore session”. Browser wallet extensions, such as Metamask, Phantom, and Brave, use an input field that is not designated as a password field, so the recovery phrase is saved in plain text form. MetaMask and Phantom have both patched the flaw, however, no word yet from Brave.
From Infosecurity-Magazine.com:
Researchers at CloudSEK have spotted a new phishing toolkit for sale across the various cybercrime forums. The “NakedPages,” toolkit is designed to run on Linux machines, runs JavaScript, is fully automated, and comes preloaded with more than 50 phishing templates and site projects. A link to the CloudSEK advisory in the article.
From BleepingComputer.com:
QNAP is warning customers to secure their devices against a new campaign of attacks pushing the DeadBolt ransomware. The company is urging users to update their Network Attached Storage devices to the latest firmware version and ensure they're not exposed to remote access over the Internet. The campaign appears to target QNAP NAS devices running QTS 4.x.
And last today, from SecurityWeek.com
The WordPress Ninja Forms plugin, which helps administrators add customizable forms to their WordPress sites, has a vulnerability that appears to have been exploited in the wild. The flaw was identified in the Merge Tag functionality of the plugin, and carries a severity rating of 9.8. The Ninja Forms plugin has over a million installations. WordPress performed a forced update to fix the issue, but administrators are urged to confirm they are using the fixed version.
That’s all for me this week. Have a great weekend. Like and subscribe, and until Monday, be safe out there.