The Department of Information and Communications Technology (DICT) has clarified that there will be no further extension for SIM card registration in the Philippines. With the July 25, 2023 deadline set by the national government looming, only 60.75 percent of the total 168 million SIM (Subscriber Identity Module) cards have been registered so far, leaving over 40% of Filipinos at risk of deactivation and social engineering tactics such as phishing. Scammers are taking advantage of the situation, employing SMS messages to lure users into sharing personal information via bogus registration links, posing a persistent and dangerous threat.

The increasing number of unregistered SIM cards exposes users to potential deactivation of their mobile services, disrupting their communication capabilities. Additionally, as the deadline approaches, the risk of phishing attacks intensifies. Cybercriminals exploit SMS messages to deceive unsuspecting victims into divulging sensitive information, such as One-Time Passwords (OTPs), which grant them unauthorized access to accounts.

In a typical phishing attack, scammers will send fraudulent messages claiming to be from legitimate sources, like telecommunications companies, urging recipients to register their SIM cards by clicking on a link provided. Unsuspecting users, driven by fear of deactivation, may fall into the trap and unwittingly share their personal details, enabling cybercriminals to gain control over their accounts and exploit them for financial gain.

Palo Alto Networks shares some of the measures one can take to guard oneself against phishing attacks as the SIM card registration deadline approaches:

 

Exercise caution when presented with unknown links: Be wary of links received from unfamiliar numbers or sources, especially those claiming to be from your telecom provider. Avoid clicking on suspicious links, as they may lead to fraudulent websites designed to steal your personal information.

Scrutinize links for anomalies: Check for misspellings or unusual URLs in the links provided. Phishers often employ tactics such as using slight variations of genuine domain names to deceive users.

Research official SIM registration procedures: Familiarize yourself with your network provider's legitimate process for SIM registration. This will help you distinguish between genuine communications and phishing attempts.

Stay informed on security measures: Some telecom providers and other organizations, such as banks, proactively block links via SMS to combat phishing attacks. Stay up-to-date with the security measures implemented by your trusted apps or organizations to enhance your protection.

Leverage Multi-Factor Authentication (MFA): Activating MFA provides an extra layer of security, acting as a vital firewall for your devices during this heightened risk period.

"Phishing attacks will persist as the SIM card registration deadline draws nearer. Cybercriminals' primary goal is to seize control of your number and exploit your OTPs to steal your money," said Steven Scheurmann, Regional VP for ASEAN at Palo Alto Networks. "To stay safe, it's crucial to think before you click and remain vigilant whenever you need to share sensitive information. Embracing the Zero Trust principle and granting the least privilege to your personal data can significantly bolster your defenses against phishing threats."

 

Palo Alto Networks, the global cybersecurity leader, has recently found a surge in Android malware that is pretending to be the popular AI Chatbot ChatGPT. The malware emerged following the release of OpenAI's GPT-3.5 and GPT-4, targeting users interested in using the ChatGPT tool.

A Meterpreter Trojan disguised as a "SuperGPT" app and a "ChatGPT" app are found to send premium-rate text messages, resulting in charges for the victims that are pocketed by threat actors. Considering that Android users can download applications from various sources other than the official Google Play store, there is potential for users to obtain applications that have not been vetted by Google.

Key findings include:

Impersonation of ChatGPT: A new android malware has emerged, disguising itself as ChatGPT. This surge coincided with the release of OpenAI's GPT-3.5 and GPT-4, targeting users interested in ChatGPT.

Meterpreter Trojan: The malware includes a Meterpreter Trojan disguised as a "SuperGPT" app. It enables remote access to infected Android devices upon successful exploitation.

Certificate Attribution: The digital code-signing certificate used in the malware samples is associated with an attacker identified as "Hax4Us." The certificate has been used across multiple malware samples.

SMS to Premium-Rate Numbers: A cluster of malware samples, masquerading as ChatGPT-themed apps, sends SMS messages to premium-rate numbers in Thailand. These numbers incur charges for the victims, facilitating scams and fraudulent activities.

The invention of passwords in the 1960s changed the digital world as we know it. Passwords are now an unconscious standard practice in our lives; from your first pet to the street you grew up on, they are deeply ingrained in our minds. Passwords today are the primary guardians of our privacy, personal data, and finances.

Despite this knowledge, passwords are often viewed complacently, even though simple, easy-to-guess passwords are insecure. Your dog’s name, spouse’s name, birthdate, and other words and phrases related to your life that are easily discoverable on your social media profiles are easy for attackers to discover.

While the onus of ensuring security and protecting data does lie on the companies that collect and store this data, there is quite a bit consumers can do on their end to secure their credentials. World Password Day 2023 is driven by the purpose of raising awareness about the importance of strong passwords and encouraging individuals and organizations to take steps to improve their password security. With the increasing prevalence of cyberattacks and data breaches, it is more important than ever to use strong and unique passwords to protect our online accounts and personal information.

Based on research, 91% of people know that using the same password on multiple accounts is a security risk, yet 66% continue to use the same password anyway. Steven Scheurmann, Regional Vice President for ASEAN at Palo Alto Networks, provides simple but effective measures to make passwords the primary guardian of your personal and professional.

Set guidelines for passwords that prevent password spraying: Ensure long passwords with a good mix of different character types—letters, numbers, and special characters. An 8-character password is easier to guess by a computer than a 16- or 24-character password.

Avoid vulnerable passwords that are easily guessed or already compromised. If you go and Google ‘commonly used passwords," you’ll see a list that any attacker uses when trying to guess passwords. If there is a default password on an internet-facing device or even internally. Change it ASAP!

Avoid reusing passwords: Everyone hates remembering passwords; some great options are using the passphrase options. We can use it to create unique passwords that are easy to remember. Be wary of password managers; several have been hit recently, and some of them multiple times. But they can also be an option.

Require password updates at set frequencies: This is a pain, but consider it the standard operating procedure for business risk reduction. It doesn’t take that long to do and helps secure the organization if a set of credentials is stolen or phished somehow.

Use multi-factor authentication methods: If a password is stolen or guessed, no matter how hard you’ve tried to be unique, having other methods to confirm it is you trying to get to a resource or a web service you use is vital. Many different cloud, security, and operating system vendors have a multi-factor authentication app that you can install on your phone to link to almost every website that supports it.

By taking these steps, individuals and organizations can help improve their password security and protect their online accounts and personal information. Learn more about how to create a stronger cybersecurity posture with an intelligent, automated, artificial intelligence (AI)-driven security operations center by checking out Palo Alto Networks’ World Password Day webinar.