Hackers steal data of 2 million in SQL injection, XSS attacks

ResumeLooters, a financially motivated cybercrime group, exploited SQL injection and XSS vulnerabilities across 65 job-board and retail sites in the APAC region to steal personal data for over two million job seekers; they used common open-source scanning and exploitation tools, injected malicious scripts and phishing forms, gained administrator access on some sites, and attempted to sell the data via Telegram.