Plus, Cookie Theft allows easy YouTube takeovers, and the FBI warns the public of unemployment scams

Forrester has released its annual prediction guide, in which it anticipates that 2022 will see an increased demand from employees to work remotely, so much so that 30% of the companies that don’t support remote working will see their staff’s resignation rates rise to 2.5%. The guide, called Predictions 2022: Disruptive Forces Necessitate Bold Decisions, also suggests that the 50% of U.S. adults who “regularly make purchases from brands that align with their personal values” will drive “10 big mainstream brands” to change the way they work. Forrester predicts customer demand for brands to commit to certain ESG values (environmental, social, and governance) “will only grow stronger.” 

Among the many other predictions in the guide, Forrester says that 60% of cybersecurity incidents in 2022 will involve third parties. According to Avast Security Evangelist Luis Corrons, this makes sense. “Globalization in technology is a fact,” he said. “All companies are full of third parties. Every company in the world uses software developed by third parties, which explains all the supply chain attacks we have already seen – a trend that has been growing for the last few years.” For more on Forrester’s predictions, see ZDNet. 

Hackers use “pass-the-cookie” attacks to take over YouTube accounts

Google Threat Analysis Group (TAG) reported last week that Cookie Theft malware has been responsible for thousands of high-profile YouTube channel takeovers. The scam begins with a phishing email to the YouTube creator where bad actors pose as a real company and pretend to want to collaborate. If the creator clicks the email’s attachment, they unknowingly download Cookie Theft malware to their system. The malware steals “session cookies,” which allows the bad actors to forego any log-in requirements and immediately be in the creator’s account. Since May 2021, Google says it has blocked 1.6 million of these messages to targets. For more on this story, see the Google TAG report.

FBI issues PSA to warn of unemployment benefit scams

The FBI’s Internet Crime Complaint Center (IC3)  issued a public service announcement stating that cybercriminals are using spoofed unemployment benefit websites to defraud people of their data “The fake websites prompt victims to enter sensitive personal and financial information. Cyber actors use this information to redirect unemployment benefits, harvest user credentials, collect personally identifiable information, and infect victim’s devices with malware,” the PSA reads. One way users can recognize these scams, the IC3 advises, is by looking for spelling mistakes in the email address or domain name. Other possible outcomes from the scam include ransomware infection and identity theft.

Can SQL injection fool speed traps?

One tech-savvy driver came up with an inventive way to fool speed traps – by taping an SQL injection code to the front of their car. The reason this tactic might work is because the image recognition software used in traffic cameras is completely digital, capturing all characters in the image. In this case, the SQL injection taped to the front of the car is a command to delete the record of the car’s license plate. A photo of the car has been floating around the internet for seven years, but it is unknown whether or not the ploy worked. For more on this story, see Hackaday. 

Governments drive ransomware gang REvil offline

According to Reuters, after an international operation hacked into Russian ransomware gang REvil’s servers, one of REvil’s leaders posted, “The server was compromised, and they were looking for me.” He then disappeared from the internet and REvil went offline. REvil was responsible for the Colonial Pipeline attack earlier this year, which caused fuel shortages up and down the east coast. “The FBI, in conjunction with Cyber Command, the Secret Service and like-minded countries have truly engaged in significant disruptive actions against these groups,” said VMWare head of cybersecurity strategy Tom Kellerman. “The gloves have come off.”

This week’s ‘must-read’ on The Avast Blog

With the news around Covid-19 vaccine hesitancy and social media picking up globally, we decided to examine whether there was a correlation between where people spend time online and their attitudes toward the vaccine. Read up to discover what we found.