Home Page

7 hours ago

The Era of AI-Powered Phishing
There is a lot of discussion about how artificial intelligence (AI) is impacting cyber threats and cybersecurity. The most immediate and wide-reaching impact for the everyday person is social engineering. Social engineering is the act of manipulating, deceiving, or tricking individuals into revealing sensitive information, bypassing security controls, or committing fraud. Cyber threat actors use several platforms for social engineering schemes, the most common being email and SMS text phishing . Many cyber threat actors engaging in these schemes are not native English speakers. As such, users could reasonably rely on red flags, such as spelling or grammatical mistakes, to tip them off that something was suspicious in these messages.

With readily accessible generative AI (GenAI) programs powered by large language models (LLMs) such as ChatGPT, cyber threat actors can create grammatically correct, highly personalized phishing messages at scale. In more targeted attacks, cyber threat actors use AI programs to gather information about individuals via their social media accounts and other online sources to craft highly personalized messages.

While some GenAI platforms block answers to prompts outside of set guardrails, such as “Create a malware program to target Windows 10 operating systems,” there is nothing inherently malicious about a prompt such as “you are a professional in an accounts receivable department. Craft an email requesting a client to pay my company for (service rendered) in the amount of (invoice amount) based on a service contract.” Therefore, the GenAI program will return a very well-crafted email that these cyber threat actors can use to target individuals and organizations.
Instead of relying on traditional red flags in the message's content, users must now verify the senders of these emails. If someone receives an email asking them to click a link or open an attachment and provides sensitive information, such as an account username and password or financial information, they are advised to contact the sender to determine its validity. This contact should be made using official phone numbers known to be legitimate. In addition, an email received from a known contact may have been sent from a compromised (hacked) account. Therefore, in addition to exercising caution with emails from unknown accounts, users must scrutinize and verify emails received from trusted contacts.
SMS text messages are increasingly used in social engineering schemes. As with email phishing, GenAI is helping cyber threat actors craft convincing messages, often impersonating known and trusted organizations. The New Jersey Motor Vehicle Commission (NJ MVC) has been repeatedly impersonated in several SMS text phishing campaigns over the last year. These messages attempt to convince users to click the included link and provide personal and financial information to pay a fictitious fine or another payment due. These messages appear official; however, NJ MVC only texts users regarding scheduled appointments. They do not send text messages demanding payment, requesting sensitive information, or notifying users of a license or registration suspension. With this SMS text phishing scheme and others that impersonate organizations and companies, users should visit official websites and applications to log in to accounts or call official phone numbers to verify any requests or messages received.
Recommendations

• Confirm the source of an email before clicking links, providing sensitive information, or opening attachments, even if the email appears to be sent from a known and trusted contact.
• Avoid clicking links delivered in text messages and avoid replying to text messages. Phone numbers can be spoofed to appear legitimate and are not a reliable verification option.
• Navigate directly to official websites or applications for account information or actions, rather than clicking links in emails and text messages.
The Recovery Aftermath of Compromised Accounts
The NJCCIC continues to receive reports of compromised email, communication, and social media accounts of New Jersey residents. Compromised accounts include Microsoft, Gmail, AOL, Discord, WhatsApp, Facebook, Instagram, and TikTok. Account compromises enable threat actors to access sensitive data and conduct further malicious activity, such as social engineering schemes, data exfiltration, extortion, and other scams. Therefore, it is critical to safeguard all accounts, especially if one is linked to other accounts.

Once threat actors compromise an account, they can change the recovery email address, phone number, password, multi-factor authentication (MFA) method, personally identifiable information (PII), and other details, potentially locking victims out of their accounts. The recovery process for a compromised account may be automated or require a manual submission to the official email provider or communication or social media platform. Depending on the provider or platform, verification of identity and account ownership may include answering specific questions about the account, using familiar and frequently used devices or networks, and identifying recent messages, contacts, or posts before the compromise. Account owners may also be required to submit government-issued ID, credit card information, or a video selfie for proof of identity or age.
Account compromise can be prevented by exercising caution with communications, links, and attachments, and enabling MFA , choosing authentication apps or hardware tokens over SMS text-based codes. If an account is compromised, the device may also be compromised and infected with malware; therefore, it is recommended to proceed with the recovery process through official channels or platforms on secure, clean devices and networks. Once access is regained and if applicable, terminate all active sessions or devices, remove any unauthorized email forwarding rules, check the account for malicious messages or posts, and update any information that was changed by the threat actors. Additionally, if the MFA method is linked to the threat actor’s phone number, remove it and set up an authentication app or hardware token.

Recommendations

• Keep systems and browsers up to date.
• If personally identifiable information (PII) has been compromised, review the Identity Theft and Compromised PII NJCCIC product for additional recommendations and resources, including credit freezes and enabling MFA on accounts.
• Exercise caution with anyone calling to verify your identity before restoring your account, requesting remote access to your computer to “fix” the account, or claiming to recover your account for a fee.
• Report malicious cyber activity to the NJCCIC and the FBI's IC3.
Don’t Be Fooled Into Downloading Vidar
The NJCCIC has observed a rise in attacks distributing Vidar Stealer. Vidar operates as a Malware-as-a-Service (MaaS) information stealer and was first identified in 2018. It can gather passwords, cookies, auto-fill data, cryptocurrency wallets, files, device information, and installed software. Over time, it has experienced many updates and improvements, including a recent change that shifted the base script from C++ to C. Some of the new features of the 2.0 version include:

• Using a "reflective DLL injection" method to retrieve encryption keys directly from a browser's active memory, bypassing security features used by popular browsers.
• Hiding its Command & Control (C2) server addresses in the descriptions of legitimate social media profiles on platforms, making its network traffic look like normal social media browsing.
• Adding "null bytes" to its executable to trick anti-virus (AV) software, expanding the file to over 500MB. Many AV scanners ignore files this large to conserve system resources.
Since Vidar is sold as part of a MaaS model, there are several distribution methods to watch for. One common method involves compromised websites that often unknowingly host the malicious ClickFix lure. If the end user follows the instructions from the prompt, Vidar will be downloaded and installed on their device. Other observed distribution methods include mentions in YouTube video descriptions, bundling with pirated software downloads, pretending to be gaming cheats or mods, and appearing as legitimate downloads for popular free software. ... See MoreSee Less

DWI Arrest

Drug Arrest

Drug Arrest

Burglary and Theft Arrests

Drug Arrest

DWI and Drug Arrest