Privacy has become an asset for individuals and a target for cyberattackers. However, there is an increasing number of instances where privacy by design is not sufficient as a standalone principle, in particular, due to the innovativeness of attackers. Have all organizations considered how this "new oil" will motivate cyberattackers to come up with innovative exploitation scenarios? A new approach consists of pretending to submit an apparently valid data protection request with an attached executable file that represents their data subject access request, hiding, in reality, malware that is aimed at gathering credentials or sensitive data. Such an attack does not require Dark Web perpetrators' resources, or skills. It can be commenced by anyone and such malware may spread quickly in the internal network of the targeted organization....

By: Larisa Munteanu , Mark Povey

Full Abstract and Presentation Materials:
https://www.blackhat.com/eu23/briefi...