Plus, FishPig gets hacked and Rewards for Justice pays off.

Chris Hartman, senior director of fuels, forecourt, advertising, and construction at convenience store chain Rutter’s believes that autonomous stores may be the next big thing in retail tech. Autonomous stores function without a human cashier and offer their customers easy and frictionless checkout. One such example is the Amazon Go store, which allows members to put their desired items in a virtual cart and then simply walk out with their purchases. 

Autonomous stores completely change the retail experience by eliminating the need to wait in line. “I think we’re still discovering how to do this best, because it’s so new and the landscape is shifting quickly,” Hartman commented. “However, I think the principle behind mobile payments would be to understand how to be versatile in your acceptance of payment. Then, the next major step in this area is likely autonomous stores. That will change the game.” For more on this story, see VentureBeat.

Attackers use WeTransfer for Lampion attacks

A new phishing campaign uses WeTransfer to send malicious files that initiate a Lampion malware attack. Lampion is a data-stealing malware that was first observed in 2019. Attackers launching this most recent campaign use compromised company accounts to send would-be victims a WeTransfer link in a phishing email that tries to trick them to download a “Proof of Payment” document. If they do, it starts a sequence that culminates with Lampion laying its own login forms over bank login pages. Once the victim enters their credentials, that data is sent to the attacker. For more on these types of attacks, see BleepingComputer. 

FishPig hacked and used to backdoor ecommerce servers

Ecommerce software maker FishPig, which is used by as many as 200,000 websites, has been hacked, and attackers are using it to create backdoors in customer systems. “We are still investigating how the attacker accessed our systems and are not currently sure whether it was via a server exploit of an application expert,” said Ben Tideswell, the lead developer at FishPig. Threat actors used FishPig’s fee-based Magento 2 modules to carry out a supply chain attack earlier this summer. “This has all been cleaned up now and multiple defenses have been installed to stop this from happening again,” Tideswell commented. See Ars Technica for more. 

Lorenz ransomware gang exploits Mitel VoIP

The Lorenz ransomware gang exploited a critical-severity vulnerability in Mitel MiVoice VoIP appliances to gain access to a victim’s network. Researchers reported that the exploit was a remote code execution bug in MiVoice Connect, which gave attackers a reverse shell to the victim’s network. The gang used known tools to perform credential dumping, and the follow-up network and domain enumeration activities before moving laterally to access two privileged administrator accounts with compromised credentials. Organizations are advised to upgrade to Mitel MiVoice Connect version R19.3, which was released in July 2022. See SecurityWeek for more. 

FBI says “Rewards for Justice” bounty program bears fruit

At the Billington Cybersecurity Summit in Washington last week, FBI Assistant Director for Cyber Bryan Vorndran announced to the crowd that Rewards for Justice, the State Department’s program offering rewards of up to $10 million for tips leading to the apprehension of cybercriminals is actually working. “It’s essentially incentivizing individuals who have intimate knowledge of a criminal conspiracy, whether nation-state or not, to report to the U.S. government….That has actually borne fruit at this point,” Vorndran said. The FBI’s cyber division rolled out Rewards for Justice in August 2020. To learn more about the program, see Cyberscoop. 

This week’s must-read on the Avast blog 

Sending sexy photos can be really fun, but it does come with increased risk of literal exposure. Here are seven questions to ask yourself before sending that sexy photo..