Spyware and the age of "technofascism." LastPass users under attack again.
Security risks of AI browsers. Another outage; this time at Microsoft. And why your spelling might be getting worse.
Spyware
Old spyware companies never die, they just respawn - as demonstrated by Italian spyware vendor Hacking Team which has re-emerged in Belarus and Russia. Kaspersky attributed a wave of malicious software infections to Memento Labs which acquired the remnants of Hacking Team in 2019. Kaspersky says the campaign stretches as far back as 2022 and has targeted multiple organisations in Russia, including media outlets, universities, research centres, government agencies, and financial institutions. According to Kaspersky, infections occurred when victims clicked on personalised invitations from the organisers of an international summit on global politics and economics. Memento’s chief executive told TechCrunch that the spyware spotted by Kaspersky did indeed belong to his company. He blamed a government customer for using an outdated version of Memento’s product.
All this is by way of emphasising that spyware remains a very real risk - and the organisations that purchase it often fail to follow instructions for its use. It’s part of what security researcher and journalist Micah Lee calls the Age of Technofascism. In a talk to a security conference, Lee outlined some practical steps to protect personal data and mitigate the threat from surveillance. Although there’s a vast amount of material published about cybersecurity, most of it boils down to doing the basics; installing updates, using sensible passwords and multi-factor authentication, and adopting passkeys where possible. Other steps depend on the threats you’re currently facing. It may be impossible to eliminate all of them, but reducing your risk is definitely realistic.
Threats
LastPass: The password manager company is warning users about a new campaign based on fake death notices. The phishing messages claim a family member has uploaded a death certificate and has requested access to the target’s password vault. A handy link to cancel the request is included which, if followed, prompts for the user’s master password. LastPass says the campaign is associated with a group that focusses on theft of cryptocurrency.
Forex: Fraudulent copies of legitimate cryptocurrency and forex exchanges have become a key threat in Asia, with organised crime groups operating at extraordinary scale. The attackers initiate contact on social media or messaging platforms and have developed a sophisticated approach to convincing their targets to part with their funds. Group-IB
Telegram: A modified version of the Telegram X app is being used to take control of Android devices. It’s being marketed through adverts in other apps. (Telegram X is an experimental “go-faster” version of the main messaging app.) Dr.Web
Authentication: A reminder about the prevalence of phishing kits that provide subscribers with a turnkey service for stealing credentials, including two-factor authentication codes. Barracuda says it’s been tracking one example and has seen nearly a million attacks associated with it since July. The phishing lures exploit well-known brands, including DocuSign and Adobe. Barracuda
AI
Browsers: More warnings about the security risks of AI browsers, such as Open AI’s recently launched OpenAI Atlas. The aim of OpenAI and its peers is to supplant Google Chrome et al as the main front door to the internet. The issue is that if they’re to be really useful, AI-powered browsers need access to and editing permissions for email, calendars, and contacts (and possibly much more). The problem is that research has demonstrated that these browsers are susceptible to malicious instructions hidden on a web page. At present, our view is they don’t offer sufficient gain to balance the potential risk from using them.
Face: OpenAI’s new video app Sora 2 has an option that lets anyone make videos with your face. The results, as Katie Notopolous discovered when she turned it on, can be disturbing. In her case, someone had created a video in which she appeared to be pregnant. When she looked at the account of the user who made the video about her, she found it was full of such material. It’s part of a flood of fetish content that Sora 2 is being used to generate.
Expenses: AI tools are responsible for a surge in creating fake expenses, according to expense software platforms. “These receipts have become so good, we tell our customers, ‘do not trust your eyes’, SAP Concur told the Financial Times.
LinkedIn: A note for the diary. LinkedIn users in Europe, Canada and Hong Kong have until November 3 to opt out of having their data used for AI training. Data harvested from LinkedIn will be shared with affiliates of Microsoft, which owns the platform. Opting out is easy, just go to Settings | Data Privacy. While you’re there, you might also make sure you’re not oversharing your information. LinkedIn profiles are hugely useful to attackers.
False: The Institute for Strategic Dialogue says widely-used chatbots cited sources linked to the Russian state in up to 25% of answers about the war in Ukraine. It’s the result of a process known as “LLM grooming” which involves influencing AI large-language models by creating misleading content that is then used to train them.
Voice: It’s possible to create a convincing copy of someone’s voice with just a photograph, according to Australia’s national science agency. It hasdeveloped a system that learns connections between appearance and vocal traits such as pitch and tone, then produces speech accordingly. Apparently, it worked well enough to reveal the limitations of current voice deepfake detectors.
Unreal estate: AI is making its way into estate agents’ listings, bringing home hunters a new set of stresses. WIRED explores the wacky world of AI-generated walkthroughs which turn empty houses in luxuriously-appointed magazine shoots.
Trump
Travel: Over the past year, the US searched more phones and electronic devices at the country’s border than ever before. Customs and Border Protection says that for the 12 months up to the end of September 55,424 searches were conducted, a 17% increase over the previous year. It’s still a tiny fraction of the more than 70 million annual visitors to the US but do be aware that the probability of your device being searched depends on who you are, where you’ve been, and probably the mood of the border agent you come across. WIRED
Scans: 404 Media reports on what appears to be widespread use of facial recognition technology by Immigration and Customs Enforcement to check people’s identity and immigration status. The Department of Homeland Security refused to comment on use of facial recognition technology.
In brief
Down: Last week Amazon, this week Microsoft with a reminder about the fallibility of the platforms on which many modern services rely. On Wednesday, the Azure platform experienced an eight-hour outage due to what Microsoft said was a software defect that allowed a faulty deployment to bypass safety validations. (The problems coincided with Microsoft announcing its latest quarterly results which included revenues of $49 billion from its cloud services.) Forbes has some sensible, if exacting, suggestions on how organisations might mitigate the effects of the next outage.
Guilty: A former executive with a company that makes hacking tools and exploits for Western governments has pleaded guilty to selling exploits to a Russian broker. For three years, Peter Williams exploited his role as general manager of an L3 Harris unit to steal at least eight exploits. Details revealed in court suggest the buyer was Operation Zero, a St. Petersburg-based company widely believed to be linked to the Russian government. Cyberscoop
Gmail: This week brought more breathless reports about millions of Gmail accounts being breached. In fact, as Google explained, the compromised credentials are a compilation of credentials stolen from multiple platforms over a period of years. The problem with this sort of irresponsible reporting is that it creates the perfect climate for phishing emails telling people they need to change their Gmail password.
Routers: Have you changed the default administrator password for your internet router? And have you updated its firmware? If you have you’re in the minority. A survey by Broadband Genie found that 81% of users leave the password unchanged and 84% have never updated the firmware. Passwords matter less if they’re unique - though we still recommend changing them. Keeping firmware updated is critically important.
Numbers: Europol has urged governments to cooperate on measures to prevent caller ID spoofing, saying mechanisms are needed to track down and identify the origin of such calls. Telecommunication companies should then use the information to block spoofed calls, which are a mainstay of fraud and scams.
Family Sharing: A mother has described how Apple’s Family Sharing feature can be weaponised after a relationship breaks down. At present, the feature gives complete control to one parent and the other one can’t make any changes even if they’ve been awarded custody of their children. WIRED
Spilling: If you’re an iPhone user and you’ve noticed more spelling errors, it might not be you! A YouTuber has a video showing the wrong character appearing even when he pressed the correct key. You might think Apple’s ever-infuriating autocorrect feature was responsible but in fact it seems more likely it’s a problem with iOS 26. ZDNet
Updates
Microsoft: Another emergency update, this time to deal with a vulnerability in Windows Server Update Services that is already being exploited.
Chrome: An important security update for Google’s web browser which addresses 20 issues, many of them rated “High Severity.” New version numbers are: 142.0.7444.59/60 on Windows, 142.0.7444.60 on macOS, and 142.0.7444.59 for Linux users. We can’t overstate how important it is to keep your web browser updated.
XTwitter: Anyone using a hardware security key or a passkey as an authentication method needs to re-enroll them by November 10 otherwise you’ll be locked out of your account. The change is part of X’s drive to eliminate any trace of Twitter, including retiring the Twitter.com domain.
WhatsApp: Support for passkeys is being rolled out as a way to protect chat backups. It’s a far more secure solution than simple passwords and much simpler than the 64-character encryption keys that were introduced in 2021.