---
title: "Cyber Security News Update, Week 35 of 2020 | DuoCircle"
description: "Who are the most targeted brands for scams? Microsoft, Apple and Amazon. Today we have a scam to tell you about for all three. First, Outlook."
image: "https://www.duocircle.com/images/og-default.png"
canonical: "https://www.duocircle.com/blog/announcements/cyber-security-news-update-week-35-of-2020/"
---

Quick Answer

Cybersecurity headlines for the week of August 28, 2020\. An Outlook phishing email from a Sophos analysis used a friendly self-service tone instead of urgency to trick recipients into a credential-harvesting page. An Amazon scam impersonated order confirmations to push fake support calls. An Apple scam used 'Apple ID locked' messages to steal iCloud credentials. A pair of ATM jackpotting attacks against US machines were detected, with Diebold Nixdorf warning of black-box attacks. The University of Utah disclosed it paid roughly $457,000 to ransomware operators after a NetWalker attack on its College of Social and Behavioral Science. Image-bank Freepik confirmed a breach exposing 8.3 million user records, including hashed passwords for Flaticon users. Phishing roundup items cover other lures of the week.

Share 

[ ](https://www.linkedin.com/sharing/share-offsite/?url=undefined%2Fblog%2Fannouncements%2Fcyber-security-news-update-week-35-of-2020%2F "Share on LinkedIn") [ ](https://twitter.com/intent/tweet?text=Cyber%20Security%20News%20Update%2C%20Week%2035%20of%202020&url=undefined%2Fblog%2Fannouncements%2Fcyber-security-news-update-week-35-of-2020%2F "Share on X/Twitter") [ ](https://www.facebook.com/sharer/sharer.php?u=undefined%2Fblog%2Fannouncements%2Fcyber-security-news-update-week-35-of-2020%2F "Share on Facebook") [ ](https://reddit.com/submit?url=undefined%2Fblog%2Fannouncements%2Fcyber-security-news-update-week-35-of-2020%2F&title=Cyber%20Security%20News%20Update%2C%20Week%2035%20of%202020 "Share on Reddit") [ ](mailto:?subject=Cyber%20Security%20News%20Update%2C%20Week%2035%20of%202020&body=Check out this article: undefined%2Fblog%2Fannouncements%2Fcyber-security-news-update-week-35-of-2020%2F "Share via Email") 

![DuoCircle blog post image](https://media.mailhop.org/duocircle/images/2020/08/check-DMARC-record-2561.jpg) 

_Who are the most targeted brands for scams?_ Microsoft, Apple and Amazon. Today we have a scam to tell you about for all three. First, [Outlook](https://nakedsecurity.sophos.com/2020/08/21/outlook-mail-issues-phishing-dont-fall-for-this-scam/).

_The interesting thing about this scam, is the tact the scammers took_. “Out are the **implied threats**, the exclamation points (!!!) and the money ($$$) you might lose if you don’t act right now; in are the happy and unexceptionable ‘here’s a problem that you can fix all by yourself without waiting for IT to help you’ messages of a sort that many companies are using these days to reduce support queuing times.” _You can catch more flies with honey than vinegar_.

## Amazon Scam

Next up is [Amazon](https://www.onlinethreatalerts.com/article/2018/8/25/the-amazon-account-locked-phishing-scams-being-sent-by-cybercriminals/). “_Amazon users, be aware of fake ‘Account Locked’ emails, which claim your Amazon accounts have been locked for security reasons_. The fake email messages are being sent by cybercriminals to those who do not have [email security service](/), and the links in them go to **phishing websites** that steal personal and financial information, go to malicious websites that infect computers or mobile devices with malware, go to fraudulent websites that will ask visitors to complete surveys that the cybercriminals behind the scam will get paid for, or go to websites that ask visitors to buy counterfeit or fake products or services.” You’ve been warned.

## Apple Scam

Finally we come to [Apple](https://www.ricksdailytips.com/your-icloud-account-has-been-breached-scam/). “The latest Apple-related scam is a variation of this **recurring scam** in which the scammers call you from out of the blue and tell you _your machine has been infected with a virus or is experiencing some other serious problem_ that needs to be taken care of right away. Now scammers pretending to be Apple reps are calling potential victims to inform them that their _iCloud accounts have been breached_ and they’ll need to gather some information from them in order to get the situation cleared up ASAP. Of course, the person calling isn’t an Apple rep and the potential victims’ iCloud accounts haven’t been breached at all.” Now you’re up to speed on scams.

[![ransomware](https://media.mailhop.org/duocircle/images/2020/08/check-DMARC-record-2562.jpg)](https://media.mailhop.org/duocircle/images/2020/08/check-DMARC-record-2562.jpg)

## Phishing Phrontier

One-way hacker go after you is to go directly at you. But a _more effective way is to go at you indirectly, via some other website_. To that end, we introduce you to the hackers that are using the popular website Canva to attack other users.

From [SC Magazine](https://www.scmagazine.com/home/security-news/phishing/hackers-hijack-design-platform-to-go-phishing/), “Australian design platform Canva unwittingly provided **phishing campaigns** with graphics, making threat actors’ schemes appear more legitimate as _they pilfer credentials through social engineering trickery_. Hackers hijacked the graphic design site, owned by the fast-growing company, and used it to leverage other brands like SharePoint, Microsoft Office and DocuSign in their messages.” That’s called coming in through the backdoor.

## ATM Breach

File this under “_it would have been nice to know this before they resolved the problem_.” Too late.

What’s too late? According to [Help Net Security](https://www.helpnetsecurity.com/2020/08/21/atm-illegal-cash-withdrawals/), “ATM manufacturers Diebold Nixdorf and NCR have fixed a number of **software vulnerabilities** that _allowed attackers to execute arbitrary code with or without SYSTEM privileges_, and to make illegal cash withdrawals by committing deposit forgery and issuing valid commands to dispense currency.” Free money from ATMs? We can only dream about such things.

## Body Count

_Just because a cruise line is shut down due to the pandemic, doesn’t mean that hackers won’t go after it_. And that’s exactly what happened this week to Carnival Cruise Lines.

According to [Security Week](https://www.securityweek.com/carnival-corp-hacked-guest-and-worker-information-accessed), “Carnival Corp. says it was the victim of a **ransomware attack** that likely got some personal information about the cruise company’s guests and employees. _The attack accessed an encrypted portion of technology systems for one of the cruise line’s brands_ and certain data files were downloaded.” It’s no vacation running a vacation company.

## University of Utah Breach

The University of Utah can’t catch a break. Last month we [reported](/announcements/cyber-security-news-update-week-31-of-2020/#more-20960) that the university was hit with a **phishing attack** that “potentially involved the protected health information of up to **10,000 patients**.”

Now a [report](https://www.securityweek.com/university-utah-pays-457000-ransomware-operators) has come out that the university paid over **$450K in ransomware** for a different breach. “_The attack resulted in the CSBS servers becoming temporarily inaccessible_. Both employee and student information were impacted in the attack. The university notified appropriate law enforcement entities, and the university’s Information Security Office (ISO) investigated and resolved the incident in consultation with an external firm that specializes in responding to **ransomware attacks**.” Might be time to redouble the cybersecurity effort in Utah.

[![phishing attack](https://media.mailhop.org/duocircle/images/2020/08/check-DMARC-record-2560.jpg)](https://media.mailhop.org/duocircle/images/2020/08/check-DMARC-record-2560.jpg)

## Freepik Breach

_Our biggest data breaches of the week is courtesy of the Freepik Company_, a company that apparently specialized in free pics. What is the body count this time? How about **8.3 million users**.

According to an article in [Security Week](https://www.securityweek.com/freepik-discloses-data-breach-impacting-83-million-users), “The attackers exploited an **SQL injection vulnerability** in Flaticon, which allowed them to access user information. _The company reveals that for 4.5 million of the affected users no hashed password was leaked_, because federated logins (with Google, Facebook and/or Twitter) were used, exclusively. For these users, only the email address was leaked. For 3.77 million users, both the email address and a hash of the password were leaked. 3.55 million of these passwords were hashed using bcrypt, while for the remaining **229,000 salted MD5** was used.” Stay safe out there.

And that’s the week that was.

![Brad Slavin](https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg) 

Brad Slavin 

General Manager

General Manager at DuoCircle. Product strategy and commercial lead across the email security portfolio.

## Secure your email infrastructure

Protect, authenticate, and deliver. Contact our team to find the right solution.

[Contact Sales](/contact/) [Explore Products](/products/) 

Share this article

[ ](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fwww.duocircle.com%2Fblog%2Fannouncements%2Fcyber-security-news-update-week-35-of-2020%2F) [ ](https://twitter.com/intent/tweet?text=Cyber%20Security%20News%20Update%2C%20Week%2035%20of%202020&url=https%3A%2F%2Fwww.duocircle.com%2Fblog%2Fannouncements%2Fcyber-security-news-update-week-35-of-2020%2F) [ ](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fwww.duocircle.com%2Fblog%2Fannouncements%2Fcyber-security-news-update-week-35-of-2020%2F) Copy 

Related Articles

- [ ![spam](https://media.mailhop.org/duocircle/images/2021/07/sender-policy-framework-7535.jpg)  Alert: Fix SPF & DKIM Settings For Your Email Forwarding Set Up Through Microsoft o365 SMTP Server Or Your Emails May End Up In Spam News ](/blog/announcements/alert-fix-spf-dkim-settings-for-your-email-forwarding-set-up-through-microsoft-o365-smtp-server-or-your-emails-may-end-up-in-spam/)
- [ ![Spam](https://media.mailhop.org/duocircle/images/2016/05/spf-permerror-3256.jpg)  April Spam Filtering Uptime Report News ](/blog/announcements/april-spam-filtering-uptime-report/)
- [ ![Spam Filtering](https://media.mailhop.org/duocircle/images/2023/02/spf-record-tester-7226.jpg)  Changes to Spam Filtering Technology News ](/blog/announcements/changes-to-spam-filtering-technology/)
- [ ![Cyber Security](https://media.mailhop.org/duocircle/images/2020/01/spf-permerror-7312.jpg)  Cyber Security News Update, Week 1 of 2020 News ](/blog/announcements/cyber-security-news-update-week-1-of-2020/)

## Related Articles

[  News 3m  Alert: Fix SPF & DKIM Settings For Your Email Forwarding Set Up Through Microsoft o365 SMTP Server Or Your Emails May End Up In Spam  Jul 20, 2021 ](/blog/announcements/alert-fix-spf-dkim-settings-for-your-email-forwarding-set-up-through-microsoft-o365-smtp-server-or-your-emails-may-end-up-in-spam/)[  News 1m  April Spam Filtering Uptime Report  May 4, 2016 ](/blog/announcements/april-spam-filtering-uptime-report/)[  News 2m  Changes to Spam Filtering Technology  Feb 8, 2023 ](/blog/announcements/changes-to-spam-filtering-technology/)[  News 4m  Cyber Security News Update, Week 1 of 2020  Jan 3, 2020 ](/blog/announcements/cyber-security-news-update-week-1-of-2020/)

```json
{"@context":"https://schema.org","@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}],"sameAs":["https://www.linkedin.com/company/duocircle","https://x.com/duocirclellc","https://www.facebook.com/duocirclellc","https://www.g2.com/products/phish-protection-by-duocircle/reviews","https://github.com/duocircle","https://www.crunchbase.com/organization/duocircle-llc"],"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://support.duocircle.com"},"knowsAbout":["Email Security","Email Authentication","SPF","DKIM","DMARC","Phishing Protection","Spam Filtering","SMTP Relay","Email Deliverability","Email Forwarding"]}
```

```json
{"@context":"https://schema.org","@type":"WebSite","name":"DuoCircle LLC","url":"https://www.duocircle.com","description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]}}
```

```json
[{"@context":"https://schema.org","@type":"BlogPosting","headline":"Cyber Security News Update, Week 35 of 2020","description":"Who are the most targeted brands for scams? Microsoft, Apple and Amazon. Today we have a scam to tell you about for all three. First, Outlook.","url":"https://www.duocircle.com/blog/announcements/cyber-security-news-update-week-35-of-2020/","datePublished":"2020-08-28T18:23:28.000Z","dateModified":"2025-05-19T13:20:11.000Z","dateCreated":"2020-08-28T18:23:28.000Z","author":{"@type":"Person","@id":"https://www.duocircle.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://www.duocircle.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin runs DuoCircle, the company behind DMARC Report, AutoSPF, Phish Protection, and Mailhop. His focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement).","image":"https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://www.duocircle.com/blog/announcements/cyber-security-news-update-week-35-of-2020/"},"articleSection":"announcements","keywords":"","wordCount":876,"image":{"@type":"ImageObject","url":"https://media.mailhop.org/duocircle/images/2020/08/check-DMARC-record-2561.jpg","caption":"DuoCircle blog post image","width":900,"height":600},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}},{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Blog","item":"https://www.duocircle.com/blog/"},{"@type":"ListItem","position":2,"name":"News"},{"@type":"ListItem","position":3,"name":"Cyber Security News Update, Week 35 of 2020","item":"https://www.duocircle.com/blog/announcements/cyber-security-news-update-week-35-of-2020/"}]}]
```

```json
{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://www.duocircle.com/"},{"@type":"ListItem","position":2,"name":"Blog","item":"https://www.duocircle.com/blog/"},{"@type":"ListItem","position":3,"name":"News","item":"https://www.duocircle.comundefined"},{"@type":"ListItem","position":4,"name":"Cyber Security News Update, Week 35 of 2020","item":"https://www.duocircle.com/blog/announcements/cyber-security-news-update-week-35-of-2020/"}]}
```

```json
{"@context":"https://schema.org","@type":"BlogPosting","headline":"Cyber Security News Update, Week 35 of 2020","description":"Who are the most targeted brands for scams? Microsoft, Apple and Amazon. Today we have a scam to tell you about for all three. First, Outlook.","url":"https://www.duocircle.com/blog/announcements/cyber-security-news-update-week-35-of-2020/","datePublished":"2020-08-28T18:23:28.000Z","dateModified":"2025-05-19T13:20:11.000Z","dateCreated":"2020-08-28T18:23:28.000Z","author":{"@type":"Person","@id":"https://www.duocircle.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://www.duocircle.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin runs DuoCircle, the company behind DMARC Report, AutoSPF, Phish Protection, and Mailhop. His focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement).","image":"https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://www.duocircle.com/blog/announcements/cyber-security-news-update-week-35-of-2020/"},"articleSection":"announcements","keywords":"","wordCount":876,"image":{"@type":"ImageObject","url":"https://media.mailhop.org/duocircle/images/2020/08/check-DMARC-record-2561.jpg","caption":"DuoCircle blog post image","width":900,"height":600},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}}
```