Typosquatting

Cybersecurity researchers flagged a new typosquatting campaign targeting RubyGems users using a Windows-based information stealer. This campaign steals browser credentials and crypto wallets. OpenSourceMalware discovered the threat, which is currently being tracked under the moniker StubMaker.

The article discusses three instances where the author or their child misdialed toll-free numbers, resulting in calls to premium rate services. Each time, a recorded message prompted a charge, but the calls were hung up and redialed correctly. The issue is attributed to typosquatting on phone numbers in Canada.

Typosquatting is now a supply chain problem, with attackers embedding lookalike domains inside legitimate third-party scripts running on web properties. This type of attack can no longer be solely blamed on user error. Detection requires specialized methods beyond current security stacks.

APT41, a China-backed threat group, is targeting major cloud providers including AWS, Google, Azure, and Alibaba using typosquatting techniques to deliver undetectable backdoors and harvest cloud credentials. The group's tactics aim to obscure command-and-control communication within cloud environments.