People who visit adult websites are being exposed on a daily basis to malware, phishing, and malicious spam campaigns, with premium accounts used on these websites that get stolen ending up on dark web markets. While visitors of adult websites being targeted by threat actors is definitely not something new, during 2018 cybercriminals increased their activity dramatically, with attacks targeting adult website credentials, for example, increasing by 300%. Users who were looking around the web for adult content have been safer during 2018, with the number of attacks dropping by roughly 36% from more than a million in 2017 to around 650,000 last year. However, while malware targeting adult content viewers declined in diversity, cybercriminals still managed to push out a larger amount of malware samples throughout 2018. Credential-stealing attacks saw a 300% boost in numbers. According to Kaspersky Lab's year in review report of cyber threats targeting online adult content viewers, credential stealing malware now focuses on a smaller number of websites, cutting down the list from  Brazzers, Chaturbate, Pornhub, Myfreecams, Youporn, Wilshing, Motherless, XNXX, and XVideos, down two only two websites: PornHub and XNXX. To drop malware payloads on their targets' computers, threat actors disguised them as videos on malicious websites they control and used search query results manipulation as the main technique to make sure that their victims were funneled to their first stage infection vectors. In total, in 2018 87,227 users downloaded malware disguised as adult content in 2018, 8% of them have used their company's network instead of using a personal Internet connection. For facts and figures visit OUR FORUM.

Microsoft's Edge web browser comes with a hidden whitelist file designed to allow Facebook to circumvent the built-in click-to-play security policy to autorun Flash content without having to ask for user consent. According to the initial bug report filed by Google Project Zero's Ivan Fratric on November 26: In Microsoft Windows, there is a file edgehtmlpluginpolicy.bin that contains the default whitelist of domains that can bypass Flash click2play and load Flash content without getting user confirmation in Microsoft Edge. The current version of the previously secret Edge whitelist will only allow Facebook to bypass the Flash click-to-play policy on its facebook.com and apps.facebook.com domains, a policy which is currently enforced for all other domains not present on this list. In his bug report, the security researcher also highlighted the security implications of having a Flash autorun whitelist bundled with a web browser, especially given the number of Flash security patches issued by Adobe almost every month. However, back in November, the security researcher initially found in the whitelist the sha256 hashes of 58 domains on Windows 10 v1803, which he was able to decrypt and obtain the names of 56 sites. The choice to encrypt the entries added to the whitelist and the decision to keep Facebook's domains whitelisted even after this month's Patch Tuesday are two other questions that only Microsoft can answer. While Microsoft managed to get around to partially address the issue reported by Fratric back in November 2018, the security researcher is still dumbfounded by Redmond's choice to use a Flash whitelist in the first place. We have the contents of the hidden whitelist posted on OUR FORUM.