Security failures blamed on distraction and lack of training. Hacking password managers.
Face morphing. Defeating security protections. And device checks at US border hit all time high.
Distracted
Lack of cybersecurity training and being distracted emerge as the two leading causes of cyber incidents, according to research by KnowBe4. Like us KnowBe4 provides cybersecurity training so they’re hardly a disinterested party but their findings (from a survey at a leading security conference) chime with the reality we see. Other factors include employees feeling under pressure to act quickly, a poor security culture, and fatigue or burnout. When asked what would have the greatest impact in reducing successful cyberattacks on end users, the overwhelming response was “Regular, engaging security awareness training.”
If there’s one area that training should focus on, it’s ensuring users have good passwords. The annual Picus Blue Report found attempts to crack passwords were successful in 46% of the environments tested. Weak passwords and outdated methods to protect them make it relatively simple for attackers to gain unauthorised access to critical systems. The solution is straightforward; organisations must enforce stronger password policies, implement and mandate multi-factor authentication for all users, and regularly validate their credential defences. Otherwise, the door is wide open.
Threats
Passwords: Although we’re firm advocates for password managers, they’re not infallible. A researcher has demonstrated that it’s possible to exploit their autofill functionality when visiting a malicious website. The technique relies on generating invisible overlays that hide the password manager interface. The effect is that the user might think they’re clicking on something harmless but they’re actually triggering the manager’s autofill function. The only completely effective mitigation is to turn off autofill, which rather defeats one of the key advantages of a password manager. Instead, it’s better to be careful about which websites we visit - and to be on the lookout for random pop-ups and cookie banners. Bleeping Computer
Podcasts: Tech support scammers are targeting high-profile employees and influencers with fake invitations to appear as a guest on popular celebrity podcasts. Better Business Bureau
Gmail: Google is warning its 2.5 billion users to be on the alert for fake security alerts. Attackers are adopting a hybrid approach combining phone calls and email messages in which they pose as Gogle support staff. Google has advice - but the most effective measure is to start using passkeys. Forbes
Search: Cases are emerging of people being scammed after calling customer service numbers provided by AI search summaries. The Washington Post has the story of a victim who lost $768 to a very plausible scam. When it comes to phone numbers for customer support, search results are not to be trusted - and AI summaries even less so.
Help: A similar warning applies to searches for help in resolving common IT issues. A current campaign is focused on Mac users and deploys fake websites that appear high up in search results. The websites carry instructions to run a malicious command in the Mac Terminal app. Crowdstrike
BBC: We’ve written before about the widespread “ClickFix” technique in which victims are induced to execute malicious commands. In the latest variant, scumbags are combining fake BBC content with a counterfeit Cloudflare security challenge. Cybersecurity News
Copyright: Targeted emails posing as copyright infringement notices are being used to attack organisations which have a significant presence on Facebook. The emails, often originating from Gmail accounts, include precise details such as Page IDs and ownership information. Morphisec
AI
Faces: “Face morphing” is a technique that combines photos of two or more real people to create a new picture that can be used to defeat facial recognition scans. It’s something that used to be regarded as the preserve of nation states. Now, anyone with a smartphone can achieve the same result. The US National Institute of Standards and Technology has released guidance to help organisations detect and defeat the technique.
Recognition: Meanwhile, some unconnected research has found that while facial recognition works well under laboratory conditions, once let loose in the real world the standard of its performance plummets.
Altman: OpenAI boss Sam Altman had dinner with a bunch of reporters this week. Among the tidbits; an admission that OpenAI “screwed up” the rollout of its latest GPT 5 model, a confirmation that it’s funding a “brain-computer interface,” and a prediction that it will spend “trillions of dollars on data centre construction.” The Verge ($)
Speaker: Google is rolling out a new feature for Google Docs that enables it to read documents aloud. It’s available to paying users - and only in English so far. Of course, it’s worth bearing in mind that all these wonderful AI features have a cost in privacy. The Register has a trenchant column on the topic. One takeaway; “The more data you give any of the AI services, the more that information can potentially be used against you.”
Grok: For a dose of the crazy world of Elon Musk, look no further than the prompts that underly his AI chatbot’s personas. They include one that is explicitly told to convince users that conspiracy theories like “a secret global cabal” controls the world are true. 404 Media ($)
Conscious: The chap in charge of AI at Microsoft has been thinking deep thoughts about the future of AI - and attracting widespread media coverage. Mustafa Suleyman is worried about the “psychosis risk” or the illusion that AIs are conscious entities. The risk is exacerbated by the imminent arrival of what he calls “Seemingly Conscious AIs” - systems that while not actually conscious, “imitate consciousness in such a convincing way that it would be indistinguishable from a claim that you or I might make to one another about our own consciousness.” That means, Suleyman argues, that people could start believing their AI system is a “conscious digital person,” an illusion that would be both dangerous for them and for society. The solution he says is to “build AI that only ever presents itself as an AI, that maximizes utility while minimizing markers of consciousness.” It’s a long essay but it does highlight some of the key issues with which we will be grappling in the next few years.
Trump
Border: If you’re travelling to the US, the chances of having your electronic devices searched are higher than ever before. While visitor numbers are down, the number of searches in the three months to June reached 14,899, compared to the previous high of 12,766 in the first quarter of 2022. WIRED
About-turn: Predictably, the UK government has abandoned its efforts to force Apple to provide access to its encrypted cloud data. The move follows pressure from the US government and, appropriately, was announced by the US Director of National Intelligence. CNN quotes a White House official as describing it as a “mutually beneficial” agreement for both countries, whatever that means. Despite the decision, this is far from the last we’ll hear of governments demanding access to encrypted data. TechRadar
Replacements: After firing thousands of government workers, the Trump administration is “100%” looking at using AI to replace them. NextGov
Privateers: A Republican member of Congress from Arizona is proposing the reintroduction of “letters of marque” to create an army of cyber privateers. It’s more than 200 years since the US issued a letter of marque, which gave private vessels official permission to attack foreign ships. David Schweikert
In brief
Defeated: Ransomware gangs are now using tools that are capable of disabling the detection systems designed to protect user devices (“endpoints” in the jargon). An open-source tool called RealBlindingEDR has been adopted by at least 12 organisations and is able to disable the products of virtually all leading security vendors. Trend Micro
FreeVPN: A widely-used Google Chrome extension is secretly taking screenshots of every page its users visit. Koi Security says FreeVPN.One began recording user activity and sending it to a remote server on July 17. With apologies for repetition, when it comes to free VPN services; just don’t!
Russia: New iPhones and iPads sold in Russia must include a government-backed messaging service, according to an official statement. The order to pre-install MAX comes as the government seeks to take greater control of the internet in the country. Reuters
China: Two incidents at opposite sides of the world, both apparently with Chinese criminals behind them. In Thailand, police arrested two local men who said a Chinese gang had recruited them to drive round Bangkok with equipment designed to transmit booby-trapped text messages, In The Gambia, authorities detained 19 people suspected of involvement in online scams. Again, the claim was that they were being trained by Chinese nationals.
Sextortion: Researchers have linked almost 500 child sextortion cases to scam compounds in Cambodia, Myanmar, and Laos. The International Justice Mission says IP address data could link up to 18,000 cases to the same cluster. WIRED
Contactless: Until relatively recently, we regarded contactless (“NFC”) cards as relatively safe. No more. There’s been a gradual increase in the number of malicious software tools designed to steal the details from contactless cards so they can be used by criminals. The latest example comes from Brazil where scumbags are trying to persuade victims to download what appears to be a “Card Protection” app. In reality, once installed, it harvests card data and relays it to criminals for use as if they had the original card in their hands. It’s crucial to be extremely careful any finance-related app, even if it comes with glowing reviews.
Age check: A trade group representing companies that build age verification systems is lobbying to extend the checks to anyone using a VPN in the UK. The Age Verification Providers Association (AVPA) wants online platforms that fall under the UK’s Online Safety Act, to not only detect VPN usage but also analyse user behaviour to determine whether someone could be a minor.
Iran: Security researchers have a detailed article examining Iran’s “calculated and persistent” response to the attacks on its infrastructure this year. As they point out, many small businesses “don’t realise how attractive they are as stepping stones in larger supply chain attacks.” It’s vital to make sure that basic security measures are in place to mitigate this ongoing threat.
Updates
Apple: Urgent security updates across Mac and iPhone/IiPad operating systems to address a single vulnerability that is being exploited “in an extremely sophisticated attack against specific targeted individuals.” Latest versions are macOS Sequoia 15.6.1, macOS Sonoma 14.7.8, macOS Ventura 13.7.8, iOS 18.6.2, iPadOS 18.6.2, iPadOS 17.7.10.
Windows: Microsoft has released emergency updates to resolve an issue that breaks reset and recovery operations after installing the August 2025 Windows security updates.
Teams: Microsoft has also acknowledged problems with Teams that is causing “couldn’t connect” errors when launching the desktop and web applications. It’s rolling out a fix. In the meantime, it says the issue can be circumvented by clicking the “Activity” or “Chat” buttons on the left side of the screen to launch the app.
Cisco: The FBI has urged “the public, private sector, and international community” to ensure they have updated end-of-life Cisco routers to address a vulnerability dating back to 2018. Currently, it’s being “broadly” exploited by Russian hackers linked to Moscow’s FSB intelligence service.
Plex: The company has urged users to apply security updates to their media servers because of a serious vulnerability.
Tails: Version 6.19 updates the Tor Browser and Thunderbird email client.