The scale of the cyber threat faced by journalists and media organisations.
AI and privacy. Russia bars users with wiped phones. And the horrifying impact of sextortion.
Scale
A flurry of stories this week underlines the extent to which cyber attacks are targeting journalists, media organisations and NGOs. Connectivity giant Cloudflare says one of its projects blocked 108.9 billion such attacks in the 12 months to the end of April, triple the number for the previous year. “Many of the targets were investigative journalism outlets operating in regions under government pressure (such as Russia and Belarus), as well as NGOs focused on combating racism and extremism, and defending workers’ rights,” Cloudflare says.
Also this week, The Citizen Lab detailed how spyware produced by the Israel company Paragon Solutions was used against two journalists in Europe. The attacks exploited a vulnerability in Apple’s iOS software that enabled the spyware to be installed without the user doing or seeing anything (a ‘zero-click’ attack). Apple says the issue could be used to create a booby-trapped photo or video which was then shared via an iCloud Link. Italy has admitted using the spyware, and the contract with Paragon has been terminated - although an Italian company is reported to have stepped in to fill the vacancy.
Meanwhile, cybersecurity firm iVerify has found traces of suspicious activity on iPhones belonging to users in the US and EU. It says the individuals were linked to media organisations, AI companies and political campaigns, including the Harris Walz run for the US presidency. According to iVerify, all had been targeted previously by groups linked to the Chinese government. In this case the exploited issue appears to have involved iOS’ “nickname” feature. For its part, Apple said it strongly disagreed with the claims of a targeted attack against its users.
Alas, there are limited defences against these sorts of attacks. Keeping a phone updated with the latest software is essential but can’t defend against ‘zero-day’ vulnerabilities which the manufacturer doesn’t know about. Both Apple and Google have specific modes that make their devices safer at the cost of features and usability. Unfortunately, the reality is that if a nation state is willing to deploy sophisticated spyware against an individual, there is only going to be one winner.
Threats
ClickFix: A warning that the issue we covered last week also affects Mac users. ClickFix disguises itself as a challenge to prove a user is human (rather than a computer). It works by trying to persuade the user to run a command that installs malicious software, often designed to steal information. The version targeting Mac devices specifically goes after passwords. As with all these attacks, the defence is to be aware of how they work and never follow instructions to copy data and paste it into a terminal prompt. CloudSEK
Jobs: A hacking group is impersonating job seekers in a campaign focussed on recruiters. The group uses convincing resumes and phishing sites to deliver information stealing software. One of their preferred platforms is LinkedIn (aka the ‘phisherman’s friend’). DomainTools
Booking: Travel reservations are a great method for defrauding victims, and Booking.com is a favoured vehicle. Malwarebytes has an example which involved a request for prepayment for a hotel reservation. The request even appeared in Booking.com’s message centre. As usual with this type of attack, it was the hotel rather than Booking.com that had been compromised. Malwarebytes has advice, notably to check by phoning a travel provider before agreeing to make an unexpected payment.
Reset: One of the most common phishing tactics involves messages urging the target to reset a password or multi-factor authentication code. These always rely on creating a sense of urgency. The key is to ask yourself whether you initiated the reset and to simply ignore the message if you didn’t.
Poser: A researcher specialising in Middle East/China relations has a good example of a well-crafted impersonation email. The lure posed as an invitation from Bloomberg to take part in a podcast.
AI
Privacy: Researchers have shown how attackers can obtain data from Microsoft 365 Copilot without the user doing anything - or being aware of what’s happening. The attack begins with a malicious email containing text unrelated to Copilot and formatted to look like an ordinary business document. There’s no evidence that the vulnerability has been exploited but it illustrates the importance of thinking carefully about what information is provided to AI agents. That’s particularly true given OpenAI’s announcement that ChatGPT now ingests data from Google Workspace, Microsoft 365, Dropbox, Box, SharePoint and OneDrive. It’s also worth noting that a US court has ruled that OpenAI must preserve ChatGPT logs (including deleted and sensitive prompts). And If you’re interested in the potential risk of AI, Varonis has just published a not very comforting report (R). One headline; “90% of organizations have exposed sensitive data that can easily be surfaced by AI.”
Stalker: On the subject of privacy, Vox examines how AI could be used to weaponise the data that we’ve spent years sticking on social media. It gives the example of a picture of a beach that looks much like any other but which OpenAI’s o3 promptly identified correctly.
Cash: OpenAI may be spending vast sums of money, but it’s also generating huge revenues. Two and a half years after launching ChatGPT, it says it’s now earning $10 billion in annual recurring revenues. CNBC
Meta: Mark Zuckerberg has approved plans to invest in a new artificial intelligence research programme dedicated to pursuing “superintelligence,” according to The New York Times. Superintelligence is a pretty imprecise term that refers to a hypothetical AI system capable of exceeding human cognitive abilities - and which moves beyond the other imprecise goal of artificial general intelligence (AGI).
Robots: China is to carry out extensive trials of intelligent robots to provide care for the elderly. Organisations have been told the robots must be capable of cooking and cleaning, helping people to walk outside, and lifting individuals when necessary. Ministry of Industry and Information Technology
Trump
Disorder: The Trump administration has scrapped or revised cybersecurity executive orders issued by Presidents Biden and Obama. Among the affected projects are requirements for software vendors to demonstrate compliance with new federal security standards. Cybersecurity Dive
Data: The US Supreme Court has ruled that the so-called Department of Government Efficiency can access sensitive data stored by the Social Security Administration. The three liberal justices on the court dissented, saying the decision creates “grave privacy risks.” Given DOGE’s appalling security practices and the sweeping nature of social security data, it’s hard to disagree.
In brief
Russia: The government has been denying entry to Ukrainians with phones that show evidence of having been wiped. According to court documents, the affected travellers had deleted their image galleries, messenger chats, or YouTube history. Meanwhile, there’s evidence of Moscow’s extensive surveillance of messaging platforms. An NGO says it has details showing the federal security service (FSB) has intercepted messages between Russian citizens and Ukrainian groups on Telegram. And The New York Times reports on an FSB project focussed on China’s WeChat platform (though we’re not suggesting Russia is unique in that).
Sextortion: At least three dozen teenage boys in the US have killed themselves since 2021 after being targeted in sextortion schemes, according to the National Center for Missing and Exploited Children. The Wall Street Journal has heartbreaking case studies and explains how attackers exploit Apple’s iMessage platform to gain the trust of victims and lure them into sharing explicit images. Above all, the story underlines how important it is to talk about these issues with young people so they don’t feel isolated.
Portable: Canada’s privacy regulator has revealed that in 2022 the Royal Canadian Mounted Police lost a USB key containing information on informants, victims, witnesses, and staff. The device was unencrypted and its contents were copied and sold by criminal groups. Needless to say, common sense and data protection regulations dictate that portable storage containing sensitive data must always be encrypted. CBC
Dissection: Google’s Mandiant unit has a detailed analysis of how vishing works. Vishing is the ugly term applied to attacks which use voice calls and social engineering to gain initial access to networks or persuade people to pay fake invoices. This type of technique has been prominent in recent attacks on retail groups and is often deployed against IT help desks. Mandiant has good advice on how to defend against the tactic.
Sources: The Guardian and Cambridge University academics have devised a delightfully elegant way for potential sources to contact the newspaper securely. CoverDrop makes use of a secure messaging module in The Guardian’s mobile news app. It works by hiding important messages among decoy chaff generated by the module. The solution is open source and we can see it being adopted much more widely. University of Cambridge NiemanLab
Outage: If you found some online services weren’t working yesterday afternoon, you weren’t alone. Google Home, Spotify, Discord and Snapchat were among those affected. The cause of the problems was Google Cloud which in turn caused outages at Cloudflare which underpins much of the internet’s connectivity. TechCrunch
France: As we mentioned last week, France ordered pornography sites to enforce strict age-verification measures. As a result, at 5pm last Friday Pornhub blocked access in France. By 5.30pm, ProtonVPN had recorded a 1000% increase in registrations.
Updates
Microsoft: Monthly set of security updates includes fixes for 66 vulnerabilities, one of which is being actively exploited. Shortly after releasing the updates, Microsoft warned that there was a compatibility problem with some Windows 11 devices. If you’re affected, Microsoft says a revised update should be along shortly.
Patch Tuesday: Other monthly updates from Adobe (254 issues), SAP, Ivanti, Salesforce, Fortinet, Dell, SolarWinds, Intel, and AMD.
Thunderbird: Mozilla has released a fix for a vulnerability in its email client that could have been exploited to leak Windows credentials.
Apple: Its developer conference saw a raft of announcements, including a decision to start naming its operating systems according to the year of release (e.g. iOS 26, macOS26 etc.) From a security perspective, the most interesting features focus on screening calls and messages. When iOS 26 detects an unknown number, it will answer and ask the caller for their name and purpose. It will then decide whether to pass on the call. All this happens on the device, unlike a similar Android feature which runs in the cloud. Apple will apply similar screening to messages by auto-replying to unknown senders and demanding they identify themselves.