Connect with us

Cybersecurity

Screen-Spying Trojan Exposes Private Chats On Signal, Telegram And WhatsApp

Published

on

Researchers warn of a new Android malware strain, Sturnus, capable of capturing private messages from popular encrypted messaging apps without breaking encryption, highlighting the growing risks of device-level compromise.

Security firm ThreatFabric first identified Sturnus this fall. Initially assumed to be a standard banking trojan, researchers discovered the malware has far broader capabilities, including full device control and the ability to capture sensitive information from apps like Signal, WhatsApp, and Telegram.

Screen-Based Attacks Undermine Encryption

Sturnus does not decrypt or break app-level encryption. Instead, it exploits a fundamental vulnerability of compromised devices: the moment a user reads a message on screen, the malware copies it in real time.

Security analysts stress that this is a classic side-channel attack. “Your encryption may be perfect, but if the device itself is compromised, the screen becomes a window into all sensitive communication,” said Aditya Sood, VP at Aryaka.

The malware leverages Android’s Accessibility Services, designed for users with disabilities, to log conversations, contacts, and message histories. Unlike network-level attacks, this approach bypasses the protections of end-to-end encryption without violating cryptographic boundaries.

A Threat to Organizations as Well as Consumers

While most mobile spyware targets individual users, Sturnus poses risks to businesses and institutions that rely on encrypted messengers for confidential communication. Executives, attorneys, journalists, and activists often use these platforms to exchange sensitive information, and a single compromised device could expose entire conversation threads.

Sturnus appears to spread through deceptive tactics, such as fake software update prompts mimicking legitimate applications like Google Chrome. This social-engineering approach highlights that even simple malware can be highly effective when it exploits user trust.

CISA Issues Warnings About Messaging App Spyware

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) also recently issued an advisory on spyware targeting encrypted messaging platforms. While it did not specifically name Sturnus, the agency highlighted familiar threats:

  • Phishing attacks and malicious QR codes linking accounts to attacker devices.
  • Zero-click exploits requiring no user interaction.
  • Impersonation of trusted messaging apps.

CISA’s guidance emphasizes best practices for users: verify unexpected alerts, avoid untrusted QR codes, limit device linking, and scrutinize authentication requests.

The Bottom Line: Device Security is Critical

ThreatFabric researchers concluded: “From the moment the device is compromised, every sensitive exchange becomes visible to the operator, with no cryptographic protection left to rely on.”

The Sturnus malware underscores a critical truth in cybersecurity: even the strongest encryption cannot protect data on a compromised device. Users and organizations alike must prioritize device security, cautious installation practices, and vigilance against social-engineering attacks.

Continue Reading
Advertisement
Click to comment

Leave a Reply

Your email address will not be published. Required fields are marked *

Cyber Crime

Telangana Doctors Lose Nearly ₹30 Crore to Cyber Fraud Since September 2024

Published

on

By

Cybercriminals have defrauded doctors across Telangana of nearly ₹30 crore since September 2024, prompting authorities to strengthen awareness campaigns and cybersecurity education within the healthcare sector.

The alarming figures were revealed during a cyber awareness programme organized by the Telangana Cyber Security Bureau (TGCSB) in Hyderabad. Senior officials warned that healthcare professionals are increasingly becoming targets of sophisticated online scams despite their educational and professional backgrounds.

Healthcare Professionals Under Growing Cyber Threat

Addressing representatives from various medical associations, TGCSB Director Shikha Goel highlighted the rising number of cybercrime incidents involving doctors and healthcare workers. She emphasized that cybercriminals are exploiting digital platforms to target individuals across all professions, including highly qualified medical practitioners.

Officials stressed that vigilance, awareness, and prompt reporting remain the strongest defenses against cyber fraud. The event focused on strengthening cooperation between law enforcement agencies and the medical fraternity to improve preparedness against evolving cyber threats.

More than 70 office-bearers from medical organizations across Telangana attended the session, including presidents, secretaries, treasurers, and senior representatives.

Investment Scams Responsible for Major Financial Losses

According to TGCSB data, at least 735 doctors have reported cybercrime-related incidents since September 2024, with total losses reaching approximately ₹29.88 crore.

Business and investment fraud emerged as the most damaging category, accounting for losses of ₹22.39 crore involving 127 victims. Investigators noted that fraudsters often lure professionals with promises of high returns, fake investment opportunities, and deceptive business schemes.

Authorities also reported a wide range of other cyber offences affecting doctors, including digital arrest scams, identity theft, impersonation fraud, fake advertisements, job-related scams, insurance fraud, cryptocurrency fraud, UPI-related cheating, matrimonial scams, and sextortion cases.

Authorities Stress Importance of Rapid Reporting

The Telangana Cyber Security Bureau urged victims to report cybercrime incidents immediately, especially during the critical “golden hour” after a fraudulent transaction occurs.

Officials explained that timely complaints through the national cybercrime helpline 1930 and the official cybercrime reporting portal can significantly improve the chances of freezing suspicious transactions and recovering stolen funds.

The bureau further warned that cybercriminals are employing increasingly advanced techniques to deceive victims, making awareness and quick action more important than ever.

Medical Associations Join Awareness Drive

Representatives from associations of paediatricians, cardiologists, dentists, orthopaedic surgeons, gynaecologists, and hospital administrators participated in the discussions. The groups pledged to work closely with authorities to spread cybersecurity awareness through hospitals, clinics, medical conferences, and professional training programmes.

Officials believe that expanding cyber awareness among healthcare professionals will play a key role in reducing financial fraud and strengthening digital security across the state’s medical community.

As cyber threats continue to evolve, law enforcement agencies are encouraging doctors and other professionals to remain cautious when responding to investment offers, unknown communications, and requests for sensitive financial information online.

Continue Reading

AI & Technology

Google Lawsuit Cites 9,000 Fake Websites Linked to Phishing Operation

Published

on

By

Google has launched a major legal offensive against an alleged international cybercrime operation accused of orchestrating large-scale phishing attacks that targeted internet users through fake websites, deceptive text messages, and artificial intelligence-powered scams.

According to the technology giant, the lawsuit is aimed at dismantling a sophisticated criminal network known as the “Outsider Enterprise,” which is allegedly responsible for stealing sensitive information, including passwords, payment card details, and personal data from victims across multiple regions.

Thousands of Fake Websites Identified

Google claims its security teams uncovered an extensive digital infrastructure supporting the operation. Investigators reportedly traced approximately 9,000 fraudulent websites and more than one million malicious URLs connected to the network.

The company alleges that the group distributes phishing toolkits that enable cybercriminals to launch convincing scams at scale. These fraudulent campaigns often impersonate trusted organizations and well-known brands, making it difficult for users to distinguish legitimate communications from malicious ones.

Google stated that the operation has already resulted in significant financial losses for consumers, amounting to millions of dollars.

AI and Messaging Platforms Used in Fraud Campaigns

The lawsuit alleges that the cybercrime network operates from China and uses messaging platforms to coordinate activities and distribute phishing resources.

Security investigators claim the group leveraged artificial intelligence technologies to enhance the effectiveness of its scams. By using AI-generated content and automated phishing tools, attackers were reportedly able to create more convincing messages and fake websites designed to trick users into revealing confidential information.

These campaigns primarily relied on text-message phishing, commonly known as “smishing,” where victims receive fraudulent messages containing links to counterfeit websites.

Millions of Suspicious Messages Detected

Google reported a sharp increase in phishing-related activity during a recent monitoring period. The company said Android users submitted reports of approximately 55,000 spam text messages within a two-week timeframe.

During the same period, security systems identified around 2.5 million text messages containing links associated with websites allegedly created by the Outsider Enterprise network.

The scale of the operation highlights the growing sophistication of cybercriminal groups that increasingly use automated technologies to expand their reach and target larger numbers of victims.

FBI Supports Ongoing Investigation

Google confirmed it is working closely with the Federal Bureau of Investigation (FBI) to disrupt the network and identify those responsible.

Cybersecurity officials have warned that criminals are rapidly adopting artificial intelligence tools to make online scams more believable and harder to detect. Law enforcement agencies believe stronger collaboration between technology companies, telecommunications providers, and government authorities is essential to combating these evolving threats.

An FBI Cyber Division representative noted that cybercriminal groups are increasingly building organized business models around impersonating trusted brands and exploiting consumer trust for financial gain.

Collaboration With Telecom Providers

Beyond legal action, Google is expanding partnerships with major telecommunications companies to strengthen protections against fraudulent messages and online scams.

The company said it will continue working with industry stakeholders to block malicious communications before they reach consumers and support legislative efforts aimed at improving long-term cybersecurity protections.

As phishing attacks become more sophisticated through the use of artificial intelligence and automated tools, cybersecurity experts continue to urge users to verify links, avoid sharing sensitive information through unsolicited messages, and report suspicious activity immediately.

Continue Reading

Cyber Crime

India’s Largest Cybercrime Hackathon Announced by FCRF; Winners to Be Felicitated at FutureCrime Summit

Published

on

By

The Future Crime Research Foundation (FCRF) has announced the launch of FCRF Hackathon 2026, a large-scale online competition designed to test and enhance cybercrime investigation skills through realistic digital crime scenarios. The event aims to bring together cybersecurity professionals, digital forensics experts, students, researchers, law enforcement personnel, and technology enthusiasts from across the country.

Registration for the competition will remain open until July 5, 2026, with organizers positioning the initiative as a practical learning platform focused on real-world cyber investigations rather than traditional coding challenges.

Participants to Tackle Realistic Cybercrime Scenarios

Unlike conventional hackathons that primarily focus on software development or programming, the FCRF Hackathon 2026 will immerse participants in simulated cybercrime cases that mirror modern digital threats.

Competitors will be required to analyze evidence, investigate attack patterns, reconstruct incident timelines, and prepare detailed findings based on available digital data. The challenge is designed to evaluate investigative thinking, forensic analysis, and problem-solving abilities in complex cyber environments.

Organizers stated that participants will encounter scenarios involving ransomware attacks, digital fraud, identity theft, AI-driven cyber threats, social engineering campaigns, and other emerging forms of cybercrime.

Open to Professionals, Students, and Cybersecurity Enthusiasts

The online format allows individuals from diverse backgrounds to participate from any location. Eligibility extends to cybersecurity practitioners, digital forensics professionals, researchers, faculty members, law enforcement officers, working professionals, and students pursuing undergraduate or postgraduate studies.

The competition has been structured to provide hands-on exposure to cybercrime investigations, evidence handling, threat analysis, forensic methodologies, and investigative reporting practices.

According to organizers, the hackathon is intended not only as a competitive event but also as an educational experience that helps participants develop practical skills relevant to today’s evolving cyber threat landscape.

All eligible participants who successfully complete the challenge requirements will receive an official certificate recognizing their participation.

Cyber Threat Landscape Inspires Challenge Design

The foundation noted that cybercriminals are increasingly leveraging advanced technologies such as artificial intelligence, deepfakes, automated attack tools, and sophisticated social engineering tactics to conduct large-scale fraud and cyberattacks.

To reflect these evolving risks, the hackathon’s scenarios have been designed around contemporary cybercrime challenges that demand evidence-based investigations and analytical decision-making.

Participants will be expected to present logical conclusions supported by digital evidence rather than simply identifying correct answers, mirroring the approach used in real-world cybercrime investigations.

Winners to Receive Recognition at FutureCrime Summit 2026

The top five performers, including winners and runners-up, will receive special recognition during FutureCrime Summit 2026, one of India’s leading conferences focused on technology-enabled crime and cybersecurity.

In addition to certificates of excellence, selected participants will receive complimentary access to the summit, scheduled to take place in New Delhi on August 6 and 7, 2026.

The event is expected to bring together senior law enforcement officials, cybersecurity leaders, digital forensics experts, policymakers, defence professionals, researchers, and technology industry representatives to discuss emerging cyber threats and security challenges.

Organizers believe the recognition will provide winners with valuable networking opportunities and exposure to leading professionals working in cybercrime investigation, digital security, artificial intelligence, and fraud prevention.

Interested candidates can register for the competition before the July 5 deadline and take part in what is expected to be one of the country’s largest cybercrime-focused investigative challenges.

Continue Reading

Trending

Copyright © 2022 420 Reports Marijuana News & Information Website | Reefer News | Cannabis News