www.wyocan.org
www.cyberwyoming.org/alliance
307-314-2188, PO Box 2332, Laramie, WY 82073
School Remittance Ruse:
A Wyoming resident reported a phishing attempt where a scammer spoofed a school counselor's email to send a fraudulent "remittance statement" to a parent of a student who had already graduated from the school. The email appeared to come from the counselor and the counselor later confirmed that their account had been hacked. The scam email contained a fake Microsoft 365 document-sharing link, likely designed to steal login credentials. CyberWyoming Note: Avoid clicking links in unexpected emails, even if they appear to come from a trusted source. Always check the sender’s actual email address, scroll to the end for spoofing signs, and if in doubt, verify by contacting the sender through a known, separate channel like a phone call.
Pump the Brakes:
A citizen reported receiving a scam email appearing to be from Shell Delivery with the subject "Shell Delivery Failed! Please confirm jBX5." The email claims the recipient has been selected for a survey about Shell store promotions and offers a chance to win a Bosch Portable Tire Air Compressor. The email encourages participation in the survey with a reward, includes a link to get started, and allows for unsubscribing. It also contains two attachments, one labeled "receipt" and another with random numbers. CyberWyoming Note: This is a common phishing scam, where attackers impersonate reputable companies to steal personal information. Never click on links or download attachments from unknown or suspicious emails, especially those promising rewards or prizes. Always verify the sender's email address and be cautious of unsolicited requests for sensitive data.
Amazon Ditches Alexa Privacy Setting:
Amazon is removing an option that allowed users to opt out of sending Alexa voice commands to the company, raising concerns about privacy in the AI age. When using Alexa, all voice recordings are sent to Amazon’s cloud, where they are stored and used for training its AI. The removal of this privacy option highlights the increasing demand for personal data. This change serves as a reminder of the growing data collection practices of Alexa devices.
– Brought to you by Secure the Village & Washington Post
washingtonpost.com/technology/2025/03/18/amazon-alexa-privacy-voice-recordings/
New Phishing Attack Shifts Focus to Macs:
A sophisticated phishing attack originally aimed at Windows users has now shifted to target Mac users. The attackers are trying to steal Apple ID credentials by using deceptive pop-up alerts disguised as security warnings. This campaign, which previously used Microsoft's servers to appear legitimate, has adapted to bypass new security features in Windows browsers like Edge, Chrome, and Firefox. Now, with those protections in place, the attackers are focusing on Safari users, using pop-ups that freeze the webpage to make the warning seem more convincing. While more advanced users may spot the scam, less tech-savvy individuals could be vulnerable.
– Brought to you by Secure the Village & 9to5Mac
9to5mac.com/2025/03/20/this-is-one-of-the-most-sophisticated-phishing-attacks-ever-made-against-mac-users/
FBI Denver Warns of Online File Converter Scam:
The FBI Denver warns of a scam where free online file converters spread malware, often leading to ransomware attacks. These tools steal sensitive data like personal, banking, and cryptocurrency info. Victims should report the scam to www.ic3.gov and take action by:
- Updating antivirus software and scanning files before opening.
- Contacting banks and securing accounts.
- Changing passwords on a trusted device.
To protect yourself, stay cautious online and be aware of potential risks.
fbi.gov/contact-us/field-offices/denver/news/fbi-denver-warns-of-online-file-converter-scam
23andMe Files for Bankruptcy:
23andMe has voluntarily filed for Chapter 11 bankruptcy to maximize value through a court-supervised sale process. The company will continue its operations as usual, and there will be no changes to how customer data is managed or protected. 23andMe has secured up to $35 million in financing to support ongoing operations during the proceedings. Any potential buyer will be required to comply with data privacy laws. The company remains committed to transparency and safeguarding customer information. CISA reports that due to 23andMe's Chapter 11 bankruptcy and plans to sell customer data, if you have used 23andMe, you should consider following the guidance below to delete your data:
- https://oag.ca.gov - California Attorney General's Office
- https://www.eff.org - Electronic Frontier Foundation
23andMe Press Release: investors.23andme.com/news-releases/news-release-details/23andme-initiates-voluntary-chapter-11-process-maximize
MS-ISAC and CISA Patch Now Alert:
The Multi-State Information Sharing and Analysis Center (MS-ISAC) or the Cybersecurity & Infrastructure Security Agency (CISA) has published a patch now (update your software) alert for CrushFTP, IBM AIX, Mozilla Firefox, Splunk, and VMware Tools. If you use these products, make sure the software (or firmware) is updated.
Data Breaches in the News:
X (Twitter), Oracle Health (Cerner), NSW Online Registry, Numotion, Western Alliance Bank, WideOpenWest (Large ISP), Monro, Atlas CPAs & Advisors PLLC, and Sunnking Sustainable Solutions. Note: If you have an account with any of these companies, be sure to change your password and consider placing a credit freeze on your accounts through the three credit reporting agencies: TransUnion, Experian, and Equifax.
Please report scams you may experience to phishing@cyberwyoming.org to alert your friends and neighbors.
Other ways to report a scam:
- Better Business Bureau Scam Tracker: bbb.org/scamtracker/us/reportscam
- Wyoming Attorney General’s Office, Consumer Protection
- File a complaint with the Federal Trade Commission at reportfraud.ftc.gov
- Get steps to help at www.IdentityTheft.gov
- Report your scam to the FBI at www.ic3.gov/complaint
- Reported unwanted calls to the Federal Trade Commission’s Do Not Call Registration. Online at donotcall.gov/report.html or call 1-888-382-1222, option 3
- Office of the Inspector General: oig.ssa.gov
- If you believe someone is using your Social Security number, contact the Social Security Administration’s (SSA) fraud hotline at 1-800-269-0271.
- AARP Fraud Watch Network (any age welcome) Helpline 877-908-3360
- IRS: report email scams impersonating the IRS to phishing@irs.gov
- Call the Wyoming Senior Medicare Patrol (SMP) for assistance with potential Medicare fraud, abuse, or errors at 1 800 856-4398
- Victim Support: The AARP Fraud Watch Network and Volunteers of America (VOA) created a new, free program to provide emotional support for people impacted by a scam or fraud, called ReST. Visit www.aarp.org/fraudsupport to learn more about the free program and register
