Security researchers at HUMAN have taken down a gigantic ad fraud operation, dubbed VASTFLUX, that affected 11 million devices, 1,700 applications, and 120 publishers. “VASTFLUX” is a derivation of “fast flux” (a cybercrime evasion technique) and “VAST” (a digital ad template abused in the operation). HUMAN is a private organization that aims to prevent cybercrime, focusing on bot detection.

PayPal sends security incident notifications about a credential stuffing attack that affected nearly 35,000 users. The attack occurred between Dec. 6. to Dec. 8. 2022. During the two-day window, the attackers gained access to highly sensitive information, including account holders’ full names, dates of birth, postal addresses, social security numbers, and tax identification numbers.

Trend Micro researchers have revealed how the port-forwarding feature within GitHub Codespaces is a vulnerability which cybercriminals could abuse to deliver and host malware. The researchers found that threat actors could abuse the public sharing of forward ports to create a malware server. All cybercriminals need to do to avoid detection and suspicion is use a legitimate GitHub account. As of yet, the security vulnerability hasn’t been exploited in the wild.