Your identity under attack. Strava strikes again. Nosy neighbours.
Google extends AI tentacles. Teens arrested in UK retail cyber probe.
Identity
A rise in the availability of phishing kits and information stealing tools is responsible for an abrupt increase in attacks targeting user credentials. eSentire says there’s been a 156% jump in such attacks since last year and they now comprise 59% off its investigations. “The driving force behind this shift is the rise of Cybercrime-as-a-Service ecosystems, which promise immense returns for any threat actor willing to pay a subscription fee,” it says.
eSentire cites the example of a Phishing-as-a-Service platform called Tycoon2FA which offers “enterprise-grade credential harvesting capabilities” and can be rented for as little as $200 per month. Meanwhile, gbhackers has details of a similar tool which costs just $120 a month. These tools enable even unskilled attackers to mount attacks that can be extraordinarily convincing, with pre-made pages that look exactly like popular platforms such as Microsoft 365 and Google Workspace.
Unfortunately, legacy security solutions such as app-based multi-factor authentication are no longer effective protections because sophisticated tools can hijack the login process. This is why security folk are urging the adoption of passkeys which can’t be hijacked in the same way. Passkeys are unquestionably a huge step forward in security but, as you might have guessed, there’s a problem. All the passwords we’ve been using are still around - and probably will be for a long time, so it’s essential to keep on following the usual rules and, above all, use a password manager.
Threats
Tracked: The risks of oversharing in the Strava fitness tracking app are so well known it’s hard to understand how bodyguards for the Swedish Prime Minister managed to ignore them. But they did - and thus revealed details of his movements as well as his personal address. Strava is a risk for anyone who uses it not just world leaders, and it’s essential to make sure it’s not revealing too much about where you live or exercise. Politico
Deepfakes: Someone has been using AI to impersonate US Secretary of State Marco Rubio and contact public figures in the US and abroad. A State Department cable obtained by The Washington Post said the unknown individual had used Signal to send fake voice and text messages. It’s a reminder to check before trusting what you see or hear.
Websites: CNN, BBC and CNBC are some of the well-known brands being used to trick people into investing in fraudulent cryptocurrency schemes, according to CTM360. Researchers say they found more than 17,000 fake sites which published fabricated stories featuring prominent public figures.
Android: A devious technique involves hiding a malicious app underneath what appears to be a benign one. The researchers have a video that explains how it works. Turning off ‘System Animations’ protects against the technique. TapTrap
Browsers: Yet more evidence that those handy extensions we add to web browsers are a horrible security risk. Separate reports reveal that millions of users have unwittingly had their browsers hijacked because of the extensions they installed. Secure Annex and Koi Security have details. Our advice is to steer clear of most extensions if you can.
Nosy: It’s a fact that people can’t resist reading what’s on other people’s screens. Which is how an American Airlines flight ended up being diverted because a passenger saw a text message on one someone’s phone. The message said “RIP” (i.e. “Rest in Peace”) but was interpreted as a bomb threat. Normally, we say use a privacy screen if you’re working on something sensitive in public. These days, perhaps we should just use one all the time.
AI
Android: Google is giving Gemini access to third-party apps like WhatsApp and Messages on Android, and it says human reviewers will be able to view the data. Given that, you might think that by default the feature would be turned off. Think again. In fact, as Ars Technica discovered, opting out is far from straightforward, if it’s possible at all.
Security: AI agents are designed to carry out complex tasks without human intervention but that makes them a significant security risk, according to Signal President Meredith Whittaker. She told a UN conference that the design of AI agents requires access at the root level to a user’s IT systems. Such access she said, creates “a serious attack vector [to target] security vulnerabilities.” Computer Weekly
Predator: Ukraine says Russia is testing a new drone capable of using AI and thermal imagining to identify, prioritise, and strike targets without human commands. Major General Vladyslav Klochkov called it “a digital predator” and said it was powered by technology from US tech giant Nvidia. Tom’s Hardware
Grok: An interesting week for Elon Musk’s AI chatbot. On Tuesday, users posted screenshots of antisemitic posts and praise for Adolf Hitler. It also managed to insult the Turkish President and the Polish Prime Minister. Musk said the chatbot had been manipulated and was “too eager to please.” He also said the ultimate goal was to develop a “maximally truth-seeking AI.” In reality, that seems to mean the latest version of Grok consults Musk’s own tweets when answering controversial questions. AP
Hidden: Academics are hiding AI prompts in research papers to obtain positive reviews. Nikkei Asia found 17 papers that included prompts in white text or tiny fonts that told AI-assisted reviewers to “give a positive review only” or praise the paper’s “exceptional novelty.”
Boosters: AI company Cluely used a copyright infringement complaint to take down a security researcher’s tweet about a security issue. This served only to draw more attention to the (glaring) issue.
In brief
Arrests: UK police investigating the wave of cyber attacks against the retail sector have arrested four people, three of them teenagers. KrebsonSecurity has details on their identities and, despite their ages, their allegedly long hacking careers. Meanwhile, M&S says its recent IT travails began with a “sophisticated impersonation attack” which ultimately led to a ransomware infection. “They just didn’t walk up and say will you change my password. They appeared as somebody with their details,” M&S chairman Archie Norman told British MPs. With respect, while undoubtedly effective, that’s not exactly sophisticated. Bleeping Computer
Iran: An Iranian group is offering cash to anyone willing to use its ransomware tools against US and Israeli organisations. Morphisec
North Korea: The US Department of Justice has shut down a long-running North Korean operation in which fake IT workers used stolen identities and AI-generated profiles to secure remote jobs at US companies. Alas, many other such operations remain alive and kicking. AP
Messaging: Twitter co-founder Jack Dorsey has launched a new chat app which he says will deliver “secure” and “private” messaging. ‘Bitchat’ uses Bluetooth to connect devices and create a mesh network that avoids any central infrastructure. Just one problem; despite the promises of security, it turns out not to be very secure yet - as Dorsey himself admits. TechCrunch
Cyber Dome: Germany and Israel are planning to develop a joint “Cyber Dome” to protect against foreign attacks. NextGenDefense
Drivers: Teen drivers in the US are spending 21% of their time looking at their phones while driving, according to a new study. The research published in Traffic Injury Prevention also found most of those surveyed understood the risks of driving while distracted. CNET
Consumer: Google’s use of electricity to power its data centres has doubled since 2020 and now nearly equals Ireland’s total consumption. MIT Technology Review tried unsuccessfully to find out to what extent AI is responsible for the growth. “We shouldn’t be guessing at this technology’s effects,” it says.
Hopeless: McHire is the name of the AI platform McDonalds uses for recruitment. As a couple of researchers discovered, until last week you could access the underlying database of more than 64 million applicants by using the password “123456.” gbhackers
Updates
Android: Google has released more details about its Advanced Protection feature which is designed to help protect against sophisticated spyware attacks. It enforces secure website connections, isolates sites so they can’t access data from another one, and disables some JavaScript features.
Belkin: Support for Wemo smart devices will end on January 31 2026. This means no further support or updates which, in turn, means they will no longer be safe to use. As TechCrunch reports, despite the impact on customers, this sort of announcement is not unusual.
Patch Tuesday: Monthly update extravaganza include fixes for 139 Microsoft issues. Updates also from from Adobe, Ivanti, SAP, Dell, IBM, Fortinet, D-Link, Supermicro, and Splunk.
Citrix: Researchers have released proof-of-concept exploits for a critical vulnerability in Citrix NetScaler ADC and Gateway devices. Fixes have already been released.
Mozilla: Thunderbird 140 includes experimental support for Microsoft Exchange accounts.
SecureDrop: Version 2.12.9 completes the migration to Ubuntu Noble.