NEW RESEARCH - I'm pretty proud we were able to pound out and ship a piece on this within 3 days. But its importance may get lost in the news cycle.

While we continue to struggle with things like keeping private keys secret, we're also busy introducing autonomous, nondeterministic agents into every place possible that are subject both to all the problems we still struggle with *AND* largely interminable new problems that can't be easily guardrailed-away.

Sure, this is a Chinese company so it's difficult for many folks to envision the same thing happening in the US, but we are 100% setting ourselves up for it, and companies and professionals not gleefully joining in the regressions are being continually punished.

This is a warning sign, and unfortunately, we will fail to heed it.

https://dti.domaintools.com/research/exposure-of-tls-private-key-for-myclaw-360-in-qihoo-360-security-claw-ai-platform

We're currently tracking crypto, recruitment, and task scams that all share the same site structure, keeping their template designers busy 24/7, and appearing on thousands of fresh domains daily.

While you may be familiar with their modus operandi, please take a moment to inform your less security-savvy friends and family with the warning signs:

- Distributed via unsolicited job offers (more on this topic soon) and 'make money online' social media groups—sometimes even shared by other victims, including people you know, in the hope of increasing their earnings via referral bonuses.
- Promise high returns with seemingly little to no effort or risk, almost certainly too good to be true.
- Often abuse well-known brands to appear legitimate, with recent campaigns mimicking Adidas, Lidl and Macy's, among others.
- Start with requests for small payments that increase as the perceived earnings grow, with most transactions using the cryptocurrency Tether (USDT), a stablecoin linked to the US dollar.
- Scam domains are sometimes lookalikes, mimicking the legitimate brand, combined with numbers or generic terms like 'invest' or 'vip'.

Scammers typically create a sense of urgency and pressure victims into acting quickly without thinking. Many will fall into the sunk cost fallacy, being made to feel that investing one more time will allow them to get their promised reward.

The outcome can be devastating, with victims often reported as losing their life savings, racking up debts, and even unwittingly convincing other family members to participate in the scam.

Recently observed examples of these shared structure investment scams have used lookalike domains registered through Alibaba and protected by Cloudflare:

- `adidaso[.]top`
- `macys[.]name`
- `lidl02-vip[.]com`

#scam #investment #dns #threatintel #cybercrime #cybersecurity #infosec #infoblox #infobloxthreatintel

Weekly summary is out..

https://ctoatncsc.substack.com/p/cto-at-ncsc-summary-week-ending-november-cf6