This article is very interesting: A real clever phishing attack for corporate computer users

I find this article real valuable to read especially for corporate IT Departments: New phishing scam uses legit software to hijack computers, but the real story is even wilder

Hope it is helpful for some.

Taking into account the current world events - all the major corporations abide to their Country/State monopoly/demands - for so called "state security/affairs" . Profit is still relevant ofc - so spying/monitoring user/corporate/governmental data - is a cat and mouse game with a heavy emphasis on denial, maybe even intended as a last result. But, it's not like times of global peace - where monopolized profit was the main interest. Even tho, that's when backdoor features like Intel Management Engine (IME) and AMD Platform Security Processor (PSP) - were created, while Microsoft or Apple's OSX - nobody really knows what they're sending home - since both have an ecosystem which revolves around uploads/downloads/updates with only basic or/and obscure info - on what they're gathering. Not to mention, every Update adds new features future emphasis on this direction - and then there's the obscure A.I. side of this story.

Coincidentally, 2 days ago OpenAI (ChatGPT) - officialized their colaboration. And many are uninstalling the app as a result. Personally, i respect their initiative on making that public - instead of playing their own cat and mouse game (till some whistleblower or a breach reveals such intents). Like Facebook kept playing and got caught - payed a fine (for selling their users data), then changed their tactic - but still caught in the act, paid another fine - and probably kept doing it to this day.

Weird tech times we live in. I'm missing the 90s...

Thanks for your escalation of the subject.

The article referred to in my post is a new type of danger and quite scary, in my opinion.

A gang of hackers sets up a company legally and that company is accredited by official authorities for legitimate certificate conferral. This company is a shell company, a front corporation. Then this gang of hackers uses the legitimate certificate to bypass security measures of the operating systems and antivirus programs to install malicious software onto target computers in an attempt to steal sensitive data, most probably blueprints of new innovations, etc..

The other types of data mining you refer to in your post are also very scary and may lead to the futures of the whole nations.

Happy computing.

The phony certificate company angle is interesting.

In the case of this specific malware though, our users don’t have full-time admin rights, and we block PowerShell from getting to the Internet. Those two things go a long way toward hindering the current crop of malware miscreants.

WDAC allows you to create execution policies which only allow executables or scripts signed by a known list of trusted certs to run. All other files are banned from running. Exceptions can be made for known applications.

The problem is a lot of this stuff is more work to implement, so only the largest or most secure organizations bother. In theory, a proper WDAC would force someone with a new or unknown app to run it past their IT team. They still might be tricked, but there's more visibility than automatically trusting any digitally signed app that shows up on the network.

You could also use WDAC in the opposite way. That is, some
of the payload executables are signed, and you could use WDAC to block those certificates, if allowlisting is too cumbersome.