Researchers: Weak Security Defaults Enabled Squarespace Domains Hijacks: At least a dozen organizations with domain names at domain registrar Squarespace saw their websites hijacked last week. Squarespace bought all assets of Google Domains a year ago,… bit.ly/4cDZ9y1

Global Microsoft Meltdown Tied to Bad Crowdstrike Update: A faulty software update from cybersecurity vendor Crowdstrike crippled countless Microsoft Windows computers across the globe today, disrupting everything from airline travel and financial… bit.ly/3WsOJeW

Phish-Friendly Domain Registry “.top” Put on Notice: The Chinese company in charge of handing out domain names ending in “.top” has been given until mid-August 2024 to show that it has put in place systems for managing phishing reports and suspending… bit.ly/3LBA9vz

Crooks Bypassed Google’s Email Verification to Create Workspace Accounts, Access 3rd-Party Services: Google says it recently fixed an authentication weakness that allowed crooks to circumvent email verification needed to create a Google Workspace… bit.ly/3LFl8J1

Don’t Let Your Domain Name Become a “Sitting Duck”: More than a million domain names -- including many registered by Fortune 100 firms and brand protection companies -- are vulnerable to takeover by cybercriminals thanks to authentication weaknesses at a… bit.ly/4dpjkQh

U.S. Trades Cybercriminals to Russia in Prisoner Swap: Twenty-four prisoners were freed today in an international prisoner swap between Russia and Western countries. Among the eight Russians repatriated were five convicted cybercriminals. In return,… bit.ly/4dmyply

Low-Drama ‘Dark Angels’ Reap Record Ransoms: A ransomware group called Dark Angels made headlines this past week when it was revealed the crime group recently received a record $75 million data ransom payment from a Fortune 50 company. Security experts… bit.ly/3SxjWLB

Cybercrime Rapper Sues Bank over Fraud Investigation: In January, KrebsOnSecurity wrote about rapper Punchmade Dev, whose music videos sing the praises of a cybercrime lifestyle. That story showed how Punchmade's social media profiles promoted… bit.ly/3AgwXmI

Six 0-Days Lead Microsoft’s August 2024 Patch Push: Microsoft today released updates to fix at least 90 security vulnerabilities in Windows and related software, including a whopping six zero-day flaws that are already being actively exploited by… bit.ly/3yAtcYQ

NationalPublicData.com Hack Exposes a Nation’s Data: A great many readers this month reported receiving alerts that their Social Security Number, name, address and other personal information were exposed in a breach at a little-known but aptly-named… bit.ly/4cngfPS

National Public Data Published Its Own Passwords: New details are emerging about a breach at National Public Data (NPD), a consumer data broker that recently spilled hundreds of millions of Americans' Social Security Numbers, addresses, and phone numbers… bit.ly/3SVYFM9

Local Networks Go Global When Domain Names Collide: The proliferation of new top-level domains (TLDs) has exacerbated a well-known security weakness: Many organizations set up their internal Microsoft authentication systems years ago using domain names… bit.ly/4710EnS

New 0-Day Attacks Linked to China’s ‘Volt Typhoon’: Malicious hackers are exploiting a zero-day vulnerability in Versa Director, a software product used by many Internet and IT service providers. Researchers believe the activity is linked to Volt… bit.ly/4cJEiIQ

When Get-Out-The-Vote Efforts Look Like Phishing: Multiple media reports this week warned Americans to be on guard against a new phishing scam that arrives in a text message informing recipients they are not yet registered to vote. A bit of digging… bit.ly/3T7uFNm

Owners of 1-Time Passcode Theft Service Plead Guilty: Three men in the United Kingdom have pleaded guilty to operating otp[.]agency, a once popular online service that helped attackers intercept the one-time passcodes (OTPs) that many websites require as… bit.ly/3Za0fh3

Sextortion Scams Now Include Photos of Your Home: An old but persistent email scam known as "sextortion" has a new personalized touch: The missives, which claim that malware has captured webcam footage of recipients pleasuring themselves, now include a… bit.ly/4cXdSmZ

Bug Left Some Windows PCs Dangerously Unpatched: Microsoft Corp. today released updates to fix at least 79 security vulnerabilities in its Windows operating systems and related software, including multiple flaws that are already showing up in active… bit.ly/4ek3sPG

The Dark Nexus Between Harm Groups and ‘The Com’: A cyberattack that shut down some of the top casinos in Las Vegas last year quickly became one of the most riveting security stories of 2023: It was the first known case of native English-speaking hackers… bit.ly/4ekxOBB

Scam ‘Funeral Streaming’ Groups Thrive on Facebook: Scammers are flooding Facebook with groups that purport to offer video streaming of funeral services for the recently deceased. Friends and family who follow the links for the streaming services are… bit.ly/3Bl1iAQ

This Windows PowerShell Phish Has Scary Potential: Many GitHub users this week received a novel phishing email warning of critical security holes in their code. Those who clicked the link for details were asked to distinguish themselves from bots by… bit.ly/3XvmCeI