Threat Intelligence Bulletin: 12/30/2022

Breach Disclosure: Foros del Web

An alleged data breach at Foros del Web, an online programming and computer science discussion forum, exposed 266,226 email addresses, hashed passwords, and usernames, which were subsequently shared on a deep web platform.

Standing Intelligence Requirements

For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Details

Foros del Web, an online programming and computer science discussion forum, allegedly suffered a security incident, in which 266,226 email addresses, hashed passwords, and usernames were leaked, which were subsequently shared on a deep web platform. Other notable information leaked in this package includes birthdays, IP address, location, social media profiles, and user activity. The threat actor did not disclose the ultimate source of the data breach or how it was exploited.

Recommendations

If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account
Enable multi-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

The Underground Economist: Volume 2, Issue 24

Welcome back to The Underground Economist, Volume 2, Issue 24, an intelligence focused blog series illuminating Dark Web findings in digestible tidbits from our ZeroFox Dark Ops intelligence team. The Dark Ops team scours the Dark Web, extending visibility and engagement into places traditional security teams can’t reach to share meaningful and insightful intelligence on the trends and tactics threat actors are leveraging across the Dark Web and criminal underground. Here’s the latest for the week of December 23, 2022.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full piece here.

Breach Disclosure: Meyson

An alleged data breach at Meyson, a France-based online armory store, exposed 149,216 email addresses, which were subsequently shared on a deep web platform.

Standing Intelligence Requirements

For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Details

Meyson, a France-based online armory store, allegedly suffered a security incident, in which 149,216 email addresses were leaked, which were subsequently shared on a deep web platform. Other notable information leaked in this package includes name and company. The threat actor did not disclose the ultimate source of the data breach or how it was exploited.

Recommendations

If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account
Enable multi-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Breach Disclosure: Movie Forums

An alleged December 2022 data breach at Movie Forums, an online movie discussion forum, exposed 38,247 email addresses, hashed passwords, and/or usernames, which were subsequently shared on a deep web platform.

Standing Intelligence Requirements

For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Details

In December 2022, Movie Forums, an online movie discussion forum, allegedly suffered a security incident, in which 38,247 email addresses, hashed passwords, and/or usernames were leaked, which were subsequently shared on a deep web platform. Other notable information leaked in this package includes user ID and IP address. The threat actor did not disclose the ultimate source of the data breach or how it was exploited.

Recommendations

If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account
Enable multi-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Breach Disclosure: Franzy's online

An alleged data breach at Franzy's online, an online household products store based in Modica (Italy), exposed 11,056 email addresses, which were subsequently shared on a deep web platform.

Standing Intelligence Requirements

For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Details

Franzy's online, an online household products store based in Modica (Italy), allegedly suffered a security incident, in which 11,056 email addresses were leaked, which were subsequently shared on a deep web platform. No passwords were found in this breach. Other notable information leaked in this package includes name, phone number, postal address, gender, and date of birth. The threat actor did not disclose the ultimate source of the data breach or how it was exploited.

Recommendations

If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account
Enable multi-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Breach Disclosure: TECHNIK-PROFIS

An alleged data breach at TECHNIK-PROFIS, a Germany-based online electronics and electrical appliances store, exposed 115,097 email addresses, which were subsequently shared on several deep web platforms.

Standing Intelligence Requirements

For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Details

TECHNIK-PROFIS, a Germany-based online electronics and electrical appliances store, allegedly suffered a security incident, in which 115,097 email addresses were leaked, which were subsequently shared on several deep web platforms. Other notable information leaked in this package includes name, phone number, and postal address. The threat actor did not disclose the ultimate source of the data breach or how it was exploited.

Recommendations

If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account
Enable multi-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Twitter Data Leak

Product Serial: F-2023-01-05a

TLP:CLEAR

In this flash report, ZeroFox Intelligence shares details on the Twitter data leak.

Standing Intelligence Requirements

PII

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full report here.

Scope Note

ZeroFox Intelligence is derived from a variety of sources, including—but not limited to—curated open-source accesses, vetted social media, proprietary data sources, and direct access to threat actors and groups through covert communication channels. Information relied upon to complete any report cannot always be independently verified. As such, ZeroFox applies rigorous analytic standards and tradecraft in accordance with best practices and includes caveat language and source citations to clearly identify the veracity of our Intelligence reporting and substantiate our assessments and recommendations.All sources used in this particular Intelligence product were identified prior to 1:00 PM (EST) on January 5, 2023; per cyber hygiene best practices, caution is advised when clicking on any third-party links.

Key Findings

A threat actor has shared what they claim is Twitter data of 200 million users in a hacker forum.
The leaked data includes names, email addresses, and usernames and is completely publicly available.
The leaked data is likely a result of a Twitter API vulnerability that was previously patched.
At this time, security researchers have not independently verified how much of this data, if any, is reused from previously-leaked Twitter data.
The presence of the email account data in the leak increases the likelihood of phishing, impersonation, and other social engineering attacks.

Breach Disclosure: Coinmine

An alleged July 2022 data breach at Coinmine, a U.S.-based company that deals with crypto mining hardware, exposed 7,696 email addresses, which were subsequently shared on a deep web platform.

Standing Intelligence Requirements

For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Details

In July 2022, Coinmine, a U.S.-based company that deals with crypto mining hardware, allegedly suffered a security incident, in which 7,696 email addresses were leaked, which were subsequently shared on a deep web platform. No passwords were found in this breach. Other notable information leaked in this package includes name, organization, phone number, postal address, and Twitter handle. The threat actor did not disclose the ultimate source of the data breach or how it was exploited.

Recommendations

If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account
Enable multi-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Breach Disclosure: Tokensoft

An alleged November 2022 data breach at Tokensoft, a U.S.-based crypto launch platform, exposed 4,341 email addresses and/or usernames, which were subsequently shared on a deep web platform.

Standing Intelligence Requirements

For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Details

In November 2022, Tokensoft, a U.S.-based crypto launch platform, allegedly suffered a security incident, in which 4,341 email addresses and/or usernames were leaked, which were subsequently shared on a deep web platform. No passwords were found in this breach. Other notable information leaked in this package includes full name, wallet addresses, IP address, and location. The threat actor did not disclose the ultimate source of the data breach or how it was exploited.

Recommendations

If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account
Enable multi-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Breaking News: 2022-12-30 - 2023-01-05

Ukraine shuts down fraudulent call center claiming 18,000 victims

A group of imposters operating out of a Ukrainian call center defrauded thousands of victims while pretending to be IT security employees at their banks. The scammers defrauded approximately 18,000 citizens of the Republic of Kazakhstan of a yet unknown amount of money.

See the full report here: https://www.bleepingcomputer.com/news/security/ukraine-shuts-down-fraudulent-call-center-claiming-18-000-victims/

Netgear warns users to patch recently fixed WiFi router bug

Netgear has fixed a high-severity vulnerability in its routers and advised customers to update their devices to the latest available firmware as soon as possible. The flaw impacts multiple Wireless AC Nighthawk, Wireless AX Nighthawk (WiFi 6), and Wireless AC router models.

See the full report here: https://www.bleepingcomputer.com/news/security/netgear-warns-users-to-patch-recently-fixed-wifi-router-bug/

Crypto platform 3Commas admits hackers stole API keys

An anonymous Twitter user published a set of 10,000 API keys allegedly obtained from the 3Commas cryptocurrency trading platform. The Twitter user claimed the leaked set is just 10% of the 100,000 API keys they hold and said that they plan to publish them all in the following days. Users are advised to reissue their keys on all linked exchanges.

See the full report here: https://www.bleepingcomputer.com/news/security/crypto-platform-3commas-admits-hackers-stole-api-keys/

Google Home speakers allowed hackers to snoop on conversations

A bug in Google Home smart speaker allowed installing a backdoor account that could be used to control it remotely and to turn it into a snooping device by accessing the microphone feed. Google fixed all relevant problems in April 2021.

See the full report here: https://www.bleepingcomputer.com/news/security/google-home-speakers-allowed-hackers-to-snoop-on-conversations/

Indian Railways denies report of data breach from IRCTC server

The Ministry of Railways in India has denied reports about a potential data breach of Indian Railway Catering and Tourism Corporation (IRCTC) and said that the data breach was not from the IRCTC servers. It was reported that hackers have stolen the data of 30 million people who have booked railway tickets in Indian Railways.

See the full report here: https://www.livemint.com/news/india/indian-railways-denies-report-of-data-breach-from-irctc-server-11672280891122.html

Ransomware gang cloned victim’s website to leak stolen data

The ALPHV ransomware operators are using unconventional extortion tactics and, in at least one case, created a replica of the victim's site to publish stolen data on it.

See the full report here: https://www.bleepingcomputer.com/news/security/ransomware-gang-cloned-victim-s-website-to-leak-stolen-data/

Ransomware gang apologizes, gives SickKids hospital free decryptor

The LockBit ransomware gang has released a free decryptor for the Hospital for Sick Children, saying one of its members violated rules by attacking the healthcare organization. SickKids is a teaching and research hospital in Toronto that focuses on providing healthcare to sick children.

See the full report here: https://www.bleepingcomputer.com/news/security/ransomware-gang-apologizes-gives-sickkids-hospital-free-decryptor/

PyTorch discloses malicious dependency chain compromise over holidays

PyTorch has identified a malicious dependency with the same name as the framework's "torchtriton" library. This has led to a successful compromise via the dependency confusion attack vector. PyTorch admins are warning users who installed PyTorch-nightly over the holidays to uninstall the framework and the counterfeit "torchtriton" dependency.

See the full report here: https://www.bleepingcomputer.com/news/security/pytorch-discloses-malicious-dependency-chain-compromise-over-holidays/

LockBit ransomware claims attack on Port of Lisbon in Portugal

A cyberattack hitting the Port of Lisbon Administration (APL), the third-largest port in Portugal, on December 2022, had been claimed by the LockBit ransomware gang. The Port of Lisbon is part of the critical infrastructure in Portugal's capital city, being one of the most accessed ports in Europe, due to its strategic location, and serving container ships, cruise ships, and pleasure crafts.

See the full report here: https://www.bleepingcomputer.com/news/security/lockbit-ransomware-claims-attack-on-port-of-lisbon-in-portugal/

Canadian mining firm shuts down mill after ransomware attack

The Canadian Copper Mountain Mining Corporation (CMMC) in British Columbia has announced that it was the target of a ransomware attack that impacted its operations. CMMC, partly owned by Mitsubishi Materials Corporation, is an 18,000-acre claim that produces an average of 100 million pounds of copper per year and has an estimated mineral reserve capacity for another 32 years.

See the full report here: https://www.bleepingcomputer.com/news/security/canadian-mining-firm-shuts-down-mill-after-ransomware-attack/

New Linux malware uses 30 plugin exploits to backdoor WordPress sites

A previously unknown Linux malware has been exploiting 30 vulnerabilities in multiple outdated WordPress plugins and themes to inject malicious JavaScript.The main functionality of the trojan is to hack WordPress sites using a set of hardcoded exploits that are run successively, until one of them works.

See the full report here: https://www.bleepingcomputer.com/news/security/new-linux-malware-uses-30-plugin-exploits-to-backdoor-wordpress-sites/

Google to Pay USD 29.5 Million to Settle Lawsuits Over User Location Tracking

Google has agreed to pay a total of USD 29.5 million to settle two different lawsuits brought by Indiana and Washington, D.C., over its "deceptive" location tracking practices. The search and advertising giant is required to pay USD 9.5 million to D.C. and USD 20 million to Indiana after the states sued the company for charges that the company tracked users' locations without their express consent.

See the full report here: https://thehackernews.com/2023/01/google-to-pay-295-million-to-settle.html

CISA Warns of Active exploitation of JasperReports Vulnerabilities

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two years-old security flaws impacting TIBCO Software's JasperReports product to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The flaws, tracked as CVE-2018-5430 (CVSS score: 7.7) and CVE-2018-18809 (CVSS score: 9.9), were addressed by TIBCO in April 2018 and March 2019, respectively.

See the full report here: https://thehackernews.com/2022/12/cisa-warns-of-active-exploitation-of.html

Toyota Kirloskar Motor reports data breach system

Toyota Kirloskar Motor revealed that some personal information of its customers may have been exposed online, adding that the extent of the intrusion is being confirmed. The Bengaluru-headquartered company said that the Indian Computer Energy Response Team (CERT-In) had been alerted to the breach.

See the full report here: https://cio.economictimes.indiatimes.com/news/digital-security/toyota-kirloskar-motor-reports-data-breach-system/96671563

Ransomware impacts over 200 govt, edu, healthcare orgs in 2022

Ransomware attacks in 2022 affected more than 200 hundred large organizations in the U.S. public sector in the government, educational, and healthcare verticals. The ransomware threat in the U.S. struck 105 counties, 44 universities and colleges, 45 school districts, and 24 healthcare providers.

See the full report here: https://www.bleepingcomputer.com/news/security/ransomware-impacts-over-200-govt-edu-healthcare-orgs-in-2022/

RedZei Chinese Scammers Targeting Chinese Students in the U.K.

Chinese international students in the U.K. have been targeted by persistent Chinese-speaking scammers for over a year as part of an activity dubbed RedZei (aka RedThief). To bypass steps taken by users to prevent scam calls, the campaign used a new pay-as-you-go U.K. phone number for each wave so as to render phone number-based blocking ineffective.

See the full report here: https://thehackernews.com/2023/01/redzei-chinese-scammers-targeting.html

Ongoing Flipper Zero phishing attacks target infosec community

A new phishing campaign is exploiting the increasing interest of security community members towards Flipper Zero to steal their personal information and cryptocurrency. Flipper Zero is a portable multi-functional cybersecurity tool for pen-testers and hacking enthusiasts.

See the full report here: https://www.bleepingcomputer.com/news/security/ongoing-flipper-zero-phishing-attacks-target-infosec-community/

Over 60,000 Exchange servers vulnerable to ProxyNotShell attacks

More than 60,000 Microsoft Exchange servers exposed online are yet to be patched against the CVE-2022-41082 remote code execution (RCE) vulnerability, one of the two security flaws targeted by ProxyNotShell exploits.

See the full report here: https://www.bleepingcomputer.com/news/security/over-60-000-exchange-servers-vulnerable-to-proxynotshell-attacks/

Rail giant Wabtec discloses data breach after Lockbit ransomware attack

U.S. rail and locomotive company Wabtec Corporation has disclosed a data breach that exposed personal and sensitive information. Wabtec is a U.S.-based public company producing state-of-the-art locomotives and rail systems.

See the full report here: https://www.bleepingcomputer.com/news/security/rail-giant-wabtec-discloses-data-breach-after-lockbit-ransomware-attack/

Poland warns of attacks by Russia-linked Ghostwriter hacking group

The Polish government is warning of a spike in cyberattacks from Russia-linked hackers, including the state-sponsored hacking group known as GhostWriter. The government claims that hostile cyber-activities have intensified, targeting public domains and state organizations, strategic energy and armament providers, and other crucial entities.

See the full report here: https://www.bleepingcomputer.com/news/security/poland-warns-of-attacks-by-russia-linked-ghostwriter-hacking-group/

BitRAT malware campaign uses stolen bank data for phishing

Threat actors behind a recent malware campaign have been using the stolen information of bank customers in Colombia as lures in phishing emails designed to infect targets with the BitRAT remote access trojan. Security personnel have found that the infrastructure of an undisclosed Colombian cooperative bank had been hijacked by attackers while investigating BitRAT lures in active phishing attacks.

See the full report here: https://www.bleepingcomputer.com/news/security/bitrat-malware-campaign-uses-stolen-bank-data-for-phishing/

Royal ransomware claims attack on Queensland University of Technology

The Royal ransomware gang has claimed responsibility for a recent cyberattack on the Queensland University of Technology and begun to leak data allegedly stolen during the security breach. The university is focused on scientific, technological, engineering, and mathematical studies and has received significant government funding to back its research in recent years.

See the full report here: https://www.bleepingcomputer.com/news/security/royal-ransomware-claims-attack-on-queensland-university-of-technology/

Synology fixes maximum severity vulnerability in VPN routers

Taiwan-based NAS maker Synology has addressed a maximum (10/10) severity vulnerability affecting routers configured to run as VPN servers. The vulnerability, tracked as CVE-2022-43931, was discovered internally by in the VPN Plus Server software and was given a maximum CVSS3 Base Score of 10 by the company.

See the full report here: https://www.bleepingcomputer.com/news/security/synology-fixes-maximum-severity-vulnerability-in-vpn-routers/

Meta to fight EUR 390 million fine for breaching EU data privacy laws

The Irish Data Protection Commission (DPC) has fined Meta EUR 390 million after finding that it forced Facebook and Instagram users to consent to personal data processing for targeted advertising. The decision comes after the conclusion of two investigations into Meta's data processing operations.

See the full report here: https://www.bleepingcomputer.com/news/security/meta-to-fight-390-million-fine-for-breaching-eu-data-privacy-laws/

New SHC-compiled Linux malware installs cryptominers, DDoS bots

A new Linux malware downloader created using SHC (Shell Script Compiler) has been spotted in the wild, infecting systems with Monero cryptocurrency miners and DDoS IRC bots. According to the researchers who discovered the attack, the SHC loader was uploaded to VirusTotal by Korean users, with attacks generally focused on Linux systems in the same country.

See the full report here: https://www.bleepingcomputer.com/news/security/new-shc-compiled-linux-malware-installs-cryptominers-ddos-bots/

Rackspace confirms Play ransomware was behind recent cyberattack

Cloud computing provider Rackspace has confirmed that the Play ransomware operation was behind a recent cyberattack that took down the company's hosted Microsoft Exchange environments. This follows a report which detailed a new exploit used by the ransomware group to compromise Microsoft Exchange servers and gain access to a victim's networks.

See the full report here: https://www.bleepingcomputer.com/news/security/rackspace-confirms-play-ransomware-was-behind-recent-cyberattack/

200 million Twitter users' email addresses allegedly leaked online

A data package reportedly containing email addresses of over 200 million Twitter users has been published on a popular hacker forum for about USD 2. A Twitter API vulnerability had been abused before being patched in January 2022, leading to several threat actors leaking and selling user datasets (and increasing the likelihood of phishing, impersonation, and other social engineering attacks). More such leaks can be expected in future, as a result other breaches using the same bug (before it was patched).

See the full report here: https://www.bleepingcomputer.com/news/security/200-million-twitter-users-email-addresses-allegedly-leaked-online/

Zoho urges admins to patch critical ManageEngine bug immediately

Business software provider Zoho has urged customers to patch a critical security flaw (CVE-2022-47523) affecting multiple ManageEngine products. Successful exploitation provides attackers with unauthenticated access to the backend database and allows them to execute custom queries to access database table entries.

See the full report here: https://www.bleepingcomputer.com/news/security/zoho-urges-admins-to-patch-critical-manageengine-bug-immediately/

Hackers abuse Windows error reporting tool to deploy malware

Hackers are abusing the Windows Problem Reporting (WerFault.exe) error reporting tool to load malware into a compromised system's memory using a DLL sideloading technique. The use of this Windows executable is to stealthily infect devices without raising any alarms on the breached system by launching the malware through a legitimate Windows executable.

See the full report here: https://www.bleepingcomputer.com/news/security/hackers-abuse-windows-error-reporting-tool-to-deploy-malware/

Toyota, Mercedes, BMW API flaws exposed owners’ personal info

Almost twenty car manufacturers and services contained API security vulnerabilities that could have allowed hackers to perform malicious activity, ranging from unlocking, starting, and tracking cars to exposing customers' personal information.The security flaws impacted well-known brands, including BMW, Roll Royce, Mercedes-Benz, Ferrari, Porsche, Jaguar, Land Rover, Ford, KIA, Honda, Infiniti, Nissan, Acura, Hyundai, Toyota, and Genesis.

See the full report here: https://www.bleepingcomputer.com/news/security/toyota-mercedes-bmw-api-flaws-exposed-owners-personal-info/

Qualcomm Chipsets and Lenovo BIOS Get Security Updates to Fix Multiple Flaws

Qualcomm released patches to address multiple security flaws in its chipsets, some of which could be exploited to cause information disclosure and memory corruption. The five vulnerabilities – tracked from CVE-2022-40516 through CVE-2022-40520 – also impact Lenovo ThinkPad X13s laptops.

See the full report here: https://thehackernews.com/2023/01/qualcomm-chipsets-and-lenovo-bios-get.html

Hackers steal $3.5M worth of digital assets from GMX whale

On Jan 3, 2023, various GMX whale community members spotted suspicious movements of GMX tokens. Following this, security personnel flagged the transactions as an exploit that drained USD 3.4 million worth of GMX tokens from a GMX whale.

See the full report here: https://cointelegraph.com/news/hackers-steal-3-5m-worth-of-digital-assets-from-gmx-whale

Train ticketing platform RailYatri hit by data breach

Indian train ticketing platform RailYatri confirmed that it suffered a data breach in December 2022, shortly after the Railway Ministry denied that user data was being sold on the dark web leaked from the Railways’ side. The security breach was observed on December 28, 2022 and was fixed within a few hours.

See the full report here: https://www.thehindu.com/business/Industry/train-ticketing-platform-railyatri-hit-by-data-breach/article66339367.ece

CircleCI warns of security breach

CircleCI, a software development service, has disclosed a security incident and is urging users to rotate their secrets. The secrets that customers are advised to rotate include the ones stored as project environment variables or in contexts. The CI/CD platform claims having a user base comprising more than one million engineers.

See the full report here: https://www.bleepingcomputer.com/news/security/circleci-warns-of-security-breach-rotate-your-secrets/