Tariffs; fraudsters rejoice. WhatsApp desktop risk.
AI used to surveil US government workers. Signalgate blamed on iPhone contacts. UK SMEs bear the cost of poor cybersecurity controls.
Tariffs
While global stock and bond markets gyrate, President Trump’s grand economic plan is already affecting US consumers. Shortly after Nintendo paused pre-orders for its Switch 2 console, Razer stopped taking orders for a high-end gaming laptop. Blackmagic Design, a leading professional video equipment manufacturer, said it would increase prices, but only for US shoppers. And Apple customers are reported to have been rushing to buy iPhones because of fears that tariffs will push up prices.
In Apple’s case, some analysts believe it has limited room for passing on increased costs to its customers. They argue that the iPhone already faces a challenging market, with lukewarm demand and the risk that significant price rises might cause it to lose market share. President Trump has already floated the possibility of relief for companies hit hardest by the tariffs. Nevertheless, Apple is said to have chartered cargo flights to send 600 tons of iPhones from India to the US to beat the changes.
Of course, fraudsters are already taking advantage of the chaos. PreCrime Labs says scammers have been busily registering domains as launchpads for financial scams. One called “US Customs and Tariffs” aims to convince visitors that they’re required to make payments to a legitimate government entity. There are also multiple new websites trying to attract clicks by using “tariff” along with items that could be affected, including wine, health and e-commerce.
Threats
WhatsApp: It’s worth remembering that the desktop versions of messaging solutions like WhatsApp and Signal are inherently less secure than the smartphone versions. To illustrate, Meta has just released an update to fix an issue in WhatsApp for Windows that could have been exploited to trick users into executing malicious code on their devices.
Removable: A Moscow-backed group has been targeting a Western military mission in Ukraine with infected removable drives. Symantec says the drives contained software designed to steal Word documents, PDF files and XLS spreadsheets.
Spyware: A sneaky Android spyware app is trying to steal users’ passwords by demanding they enter them in order to uninstall it. TechCrunch explains how to defeat the trick.
China: Western intelligence agencies are warning of a renewed campaign targeting perceived opponents of the China Communist party with spyware. They include supporters of Taiwanese independence and Tibetan rights but the agencies say the indiscriminate nature of the campaign means the threat is far wider. The spyware is spread by bundling it with what appear to be genuine apps. Protection involves taking care never to install apps from anywhere except official stores.
PDF: Any email containing a PDF should be treated as a potential threat. Last year they accounted for 22% of all malicious email attachments, according to Check Point Research.
SourceForge: Attackers are abusing the SourceForge software distribution platform to distribute fake add-ins for Microsoft Office. Although SourceForge is theoretically open to abuse, it’s uncommon to see it used for the distribution of malicious software. Kaspersky
AI
Watching: Elon Musk’s DOGE team has deployed an AI tool to surveil the internal communications of at least one government agency, according to Reuters. It says the tool is designed to monitor chats for disloyalty and negative comments about Donald Trump and Elon Musk.
Default: Shopify’s CEO has told employees that they must prove jobs can’t be done by AI before they ask for more staff or resources. CNBC
Passport: Last week it was receipts. This week, a researcher says he used ChatGPT-4o to create a fake passport good enough to pass digital identity checks used by major financial platforms. Security Affairs
A1: AI quote of the week comes courtesy of the new US Education Secretary Linda McMahon (key task; dismantle her department). In conversation at an education conference, she referred repeatedly to AI as A1. Go figure.
Fooled: Google AI overviews picked up an April Fool story and presented it as real news, specifically that a small Welsh town had been recognised by the Guinness World Records as having the most roundabouts per square kilometre. BBC
Trump
Signalgate: The White House has blamed the way iPhones manage contacts for the inclusion of a leading journalist in a supposedly secure Signal chat group. We’re not completely convinced by the explanation but it does serve to highlight the need to be extremely careful when adding or storing contacts. Above all, it’s vital to call them something that distinguishes them from similar names. The Guardian
Vindictive: President Trump has ordered an investigation into the former head of the US cybersecurity agency on the grounds that he exceeded his authority by countering falsehoods during the 2020 presidential election.
In brief
Costs: A lack of access to technology, little to no staff training, and competing priorities are costing UK small and medium-sized enterprises up to £3.4 billion in cyber incidents every year, according to Vodafone Business. Meanwhile, the UK government’s latest annual data breach survey shows a rise in the number of ransomware attacks. Last year, 1% of all organisations were affected (about 19,000 in total), up from 0.5% in 2023.
Spyware: A court document has revealed that NSO’s Pegasus spyware was used to target 1,223 WhatsApp users in 51 different countries during a 2019 hacking campaign. The document, part of Meta’s lawsuit against NSO, breaks down the countries where victims and targets were located. Top of the list is Mexico (with a third of the cases) but it also includes Western countries, including Spain, the Netherlands, France and the UK. The profit for NSO; $40 million. TechCrunch CTech
Romance: Five money launderers have been convicted in the UK for using romance fraud to steal £3.25 million from at least 40 victims. As is often the case, the scumbags were relentless, pursuing victims until they had no money left.
Public: A UK court has told the government it can’t keep secret its attempt to force Apple to give it access to user data. The Investigatory Powers Tribunal said the authorities’ efforts were a “fundamental interference with the principle of open justice.”
Targeting: Phishing kits are employing a clever technique to frustrate security researchers’ attempts to identify them. Usually, researchers enter fake email addresses to investigate campaigns. The new tactic means fake login forms are only displayed when a user enters a specific email address that the attackers are targeting. Cofense
Teens: Meta is expanding its security protections for “teen accounts” from Instagram to Facebook and Facebook Messenger. The feature prevents children under 16 from changing privacy settings without a parent’s approval. Whether or not the age verification controls themselves are effective is a different matter entirely.
Oracle: After initially denying a breach, the company has now sort of admitted that part of its infrastructure was accessed and data stolen. It took Oracle weeks to finally fess up and the way it phrased its admission has been widely ridiculed. Not least by The Register.
Peeping: Lax security at the University of Maryland is alleged to have allowed a pharmacist to install a key logger on at least 400 computers in order to spy on users at work and at home.
Updates
Microsoft: Monthly set of security updates addresses 125 Windows issues, including a previously unknown (zero-day) vulnerability that has already been exploited by a ransomware group. There’s also an emergency update for Office 2016 to fix an issue that has been causing the applications to crash.
Patch Tuesday: Other companies issuing monthly updates included from Adobe, SAP, Ivanti, Fortinet, VMware, and AMD.
Juniper: Multiple updates to address vulnerabilities in Junos OS, Junos OS Evolved, and in third-party dependencies in Junos Space. They include 11 high-severity bugs in Junos OS.