AI; it's only just getting started. The threat from Google alerts.
And WhatsApp wins its case against the maker of Pegasus spyware.
Sophisticated
A recurring theme this year has been the increasing sophistication of online scams. This is largely down to AI, which has revolutionised both the simplest and the most complex scams. But we ain’t seen nothing yet. Cybercrime is a vast business, with one survey putting annual revenues in 2023 at $8.15 trillion. Forrester estimates that figure will rise to $12 trillion next year, and AI makes it relatively simple to try to take a slice of it.
One of this year’s most significant advances in AI has been the development of AI agents. These are entities that understand the environment around them, meaning that, to a large degree, they can operate without human interaction. They can automate large-scale attacks such as phishing campaigns and identify weaknesses in traditional security systems so that they can be bypassed. Cloning identities is (almost literally) child’s play, and we expect to see this technique exploited even further this year. Google’s conclusion is that AI will be used to “develop and scale more convincing phishing, vishing, SMS, and other social engineering attacks.”
At a geopolitical level, it’s safe to predict that the world is only going to become more unstable in 2025, creating fertile ground for attackers. This year illustrated the deep links between nation states and cyber criminals; something particularly visible in the case of Russia. Given the general level of threat, it’s essential to make sure basic security measures are in place;
-
Ensure systems and devices are updated.
-
Adopt and enforce phishing-resistant multi-factor authentication.
-
Make sure an effective governance framework is in place.
-
Make awareness of cyber risks a key priority for everyone.
Threats
Google: Again and again, we’ve seen attackers use Google services as the mechanism to target their victims. In one of the latest examples, Brian Krebs recounts the sorry tale of a couple of people who lost huge sums in cryptocurrency ($4.7 million and $450,000). In their case, the key to the scam was to persuade them to click “Yes” on prompts to recover their Google accounts. The process began with a call from a real Google phone number to warn about an attempt to hack a Gmail account. That was followed up by email security alerts generated with Google forms so that they appeared to come from a legitimate address. We expect to see more and more use of this technique, so it’s vital to be aware of it.
Parcel: We’d be surprised if you or someone you know hasn’t received a fake delivery alert over the past few weeks. NatWest says it’s this year’s fastest growing scam. Mind you, Nat West lists all the other techniques which aren’t far behind, notably those leveraging social media marketplaces.
In brief
Spyware: The maker of Pegasus spyware has been found liable for hacking WhatsApp’s systems by sending malicious software to thousands of targeted phones. The US federal court ruled that the case - which has been proceeding for five years - should proceed to trial but only to determine how much the NOS Group should pay in damages.
Phones: The US believes Russia, China, Israel and Iran are the “primary countries” reportedly “using telecom assets of other nations to exploit U.S. subscribers.” That information is courtesy of Senator Ron Wyden, who wrote to the Department of Defense asking it to investigate its failure to secure unclassified phone communications from foreign espionage. His letter makes for uncomfortable reading, laying bare the extent of US insecurity.
Smeared: The Indian government has a long record of pursuing journalists who publish things it doesn’t like. In the latest example, an online smear campaign was deployed against a reporter who covered alleged corporate malfeasance at one of India’s largest corporate groups. The campaign claimed that the journalist had fundraised for an opposition party and gave “Chinese money” to a person accused of involvement in the 2020 Delhi riots. CPJ
Thanks for reading. We wish you and yours all the very best for 2025.