Articles of interest from the week of June 3, 2019

Phishing attacks that bypass 2-factor authentication are now easier to execute

Penetration testers and attackers have a new tool in their arsenal that can be used to automate phishing attacks in a way that defeats two-factor authentication (2FA) and is not easy to detect and block. The tool makes such attacks much easier to deploy, so organizations should adapt their anti-phishing training accordingly. (By Lucian Constantin, CSO)

Cybersecurity: You're Probably Over-Confident About Your Defenses or Under-Prepared for a Breach

A survey by cybersecurity company Palo Alto Networks and British pollster YouGov found that 68 percent of people believe they're doing all they can to protect themselves against cyberattacks. The Trust in a Digital Replace report set out to examine the attitudes of the general public when it came to cybersecurity, privacy and technology in the modern world. (By Danny Palmer, ZDNet)

Hollywood Lie: Bank Hacks Take Months, Not Seconds

A report published today by cyber-security firm Bitdefender gives one of the best views we ever got into the inner-workings of a modern bank heist, and more particularly, a bank heist carried out by Carbanak, a group of hackers responsible for stealing more than one billion euros from banks all over the world. (By Catalin Cimpanu, ZDNet)

Shade Ransomware Expands to U.S. Targets

Shade, a ransomware known to target Russian victims, has been spotted in several recent campaigns scoping out new locations – including in the U.S. and Japan. (By Lindsey O'Donnell, Threatpost)

Employees are Almost as Dangerous to Business Security as Hackers and Cybercriminals

Non-malicious insiders are among the top three threat actors, according to an ISACA report. (By Alison DeNisco Rayome, TechRepublic)

A New Approach for Combating Insider Threats

An insider threat can encompass anything from a gullible employee falling for a spearphishing email, to unaware new hires sharing data inappropriately – all the way to a rogue employee stealing company data. (By Lindsey O'Donnell, Threatpost)