In today’s cybersecurity news…

Spotify music library scraped

A pirate activist group called Anna’s Archive scraped Spotify’s music library, collecting 256 million rows of track metadata and 86 million audio files totaling around 300 terabytes of data and says it plans to distribute it as a “preservation archive.” Anna’s Archive describes this as a mission to safeguard “humanity’s musical heritage.” This violates copyright and Spotify’s terms. The company confirmed the unauthorized access to scrape public metadata and bypass DRM to access some audio files, but says it’s disabled the accounts involved, added safeguards, and there’s no indication user account data was compromised. (Billboard)

CISA’s ASUS Live Update CVE update

Last week we told you CISA added a new vulnerability to its Known Exploited Vulnerabilities list, but the issue appears to document the 2018–2019 ShadowHammer supply-chain attack against ASUS Live Update, which wouldn’t be a new or active threat. The compromised software is end-of-life, fixes were issued years ago, and no supported ASUS devices appear to be affected, with the recent activity reflecting retrospective documentation rather than new exploitation. (BleepingComputer)

DDoS disrupts France’s postal and banking services

France’s national postal service La Poste says a suspected DDoS attack disrupted its websites and mobile apps, slowing deliveries and knocking some digital services offline. The outage also affected La Banque Postale’s online banking and mobile app, though card payments, ATMs, and in-store transactions continued to work. There’s no evidence customer data was compromised. Some post offices operated at reduced capacity as teams worked to restore services. (The Record)

Fake delivery websites hit holiday shoppers

Cybercriminals ramped up fake delivery websites by 86% in the past month, targeting holiday shoppers with phishing texts and emails posing as postal alerts, according to NordVPN data. DHL was the most impersonated carrier, while fake USPS sites surged 850% month over month, exploiting urgency around delayed packages to steal personal and financial information. Losses from text-message fraud continue to climb, with FTC data showing $470 million lost in 2024. (Infosecurity Magazine)

Huge thanks to our sponsor, ThreatLocker

Uzbek users attacked by SMS stealers

Security researchers at Group-IB say Android users in Uzbekistan are facing a new wave of SMS stealer malware attacks spread via Telegram, with multiple threat groups using sophisticated droppers, obfuscation, and social engineering. The malware steals banking credentials and funds, quietly persists on devices, and spreads by hijacking victims’ Telegram accounts to target their contacts. Group-IB says the campaign marks a significant jump in operational maturity since October. (Dark Reading)

Fake WhatsApp API package steals data

Researchers from Koi security say a malicious npm package called “lotusbail”, posing as a legitimate WhatsApp API, has been downloaded more than 56,000 times and can steal messages, contacts, media, and authentication tokens while silently linking an attacker’s device to a victim’s WhatsApp account for persistent access. The malware mimics the Baileys WhatsApp Web library, intercepts WebSocket traffic, exfiltrates encrypted data, and remains active even after removal unless the linked device is manually revoked. (The Hacker News)

Interpol-led action decrypts ransomware strains

Interpol says Operation Sentinel led to 574 arrests, the takedown of more than 6,000 malicious links, and the decryption of six ransomware strains across 19 countries, mainly in Africa. Authorities also recovered $3 million, with cases tied to more than $21 million in losses, including business email compromise, ransomware, and large-scale fraud, with private-sector help from firms including Trend Micro and Shadowserver. Interpol says cyberattacks targeting sectors like finance and energy in Africa are accelerating. (BleepingComputer)

South Korea to require facial recognition for mobile numbers

South Korea will require facial recognition when registering new mobile phone numbers starting March 23rd, following a pilot program, as part of a broader push to curb identity theft and voice phishing scams. The policy applies to major carriers and MVNOs and comes after more than 21,000 phishing cases this year and a major breach at SK Telecom that exposed SIM data from nearly 27 million users. (The Record)