Compromised accounts and our addiction to bad passwords. WhatsApp screen sharing scam.
2026; the year of AI crime. US extends photo checks. Meta earns big from scam adverts.
Credentials
Compromised account details are behind most security breaches this year, with attackers relying on social engineering and human error rather than sophisticated exploits. Fortinet says this emerges as a clear trend from a survey of its work during the first half of the year. As Fortinet points out, there is a very “low skill barrier” to buying some stolen credentials and using a remote desktop programme to move through a victim’s network. Defending against these trends requires monitoring behaviour to identify unusual patterns, implementing effective multi-factor authentication, controlling access to resources, and limiting remote access tools.
The number of credentials exposed in data breaches continues to be astonishing. We often talk about Have I Been Pwned (HIBP) which lets you check whether your online credentials have been exposed by some feckless platform. This week its founder said he had just finished processing nearly 2 billion email addresses together with 1.3 billion unique passwords, 625 million of which he had never seen before. The problem is that people still use the same password for different accounts meaning, as HIBP puts it, “a breach of a forum to comment on cats often exposes data that can then be used to log in to the victim’s shopping, social media and even email accounts.”
Given all this, it’s depressing if not surprising that so many people continue to make disastrously bad choices when it comes to security. Comparitech has published the 100 most common stolen passwords based on an analysis of more than 2 billion leaked on breach forums this year. Hardy annuals like admin and password are still in the top 10, with 123456 taking pride of place at number one. You might not do this sort of thing but we guarantee you know someone who does. It’s why we think cybersecurity should be talked about more often - and why everyone should use long, strong, unique passwords - and an app to manage them.
Threats
WhatsApp: A long-running scam involves asking people to share their screen during a WhatsApp video call. ESET warns this is gaining traction at the moment, with scumbags exploiting it to steal data, identities and money. The scam usually begins with someone claiming to be from a bank, phone company or even a friend or relative (see Codeword below).
Fakes: Attackers are exploiting the interest in AI by churning out fake versions of popular apps, including ChatGPT, DALL·E, et al. Appknox says some are relatively harmless while others are more sophisticated - and dangerous.
LinkedIn: A warning to be wary about malicious links received via direct messages on LinkedIn. Push Security has an example of a multi-stage process that ends with a page of document links. Clicking on any of them results in a fake Microsoft login page.
Diplomats: A Chinese-linked espionage campaign is exploiting a Windows shortcut vulnerability to target European diplomats and achieve remote access to their devices. The risks of Windows LNK files are long-standing and it’s essential to watch out for them, especially if they arrive in compressed ZIP files. Arctic Wolf
Scammed: A nasty story about an elderly Canadian couple who lost $710,000 in a tech support scam that began with fake error messages on their laptop. Over the course of five months, the scammers convinced the victims to purchase gold and transfer Bitcoin via ATM machines. This type of fraud is a real and abiding threat that particularly affects older people. CTV News
Teams: A notorious gang has been exploiting online adverts on Bing to place fake adverts for Microsoft Teams. If clicked, the user is taken to a convincing copy of the real Microsoft page that in reality contains an installer for the malicious software. Expel
AI
Standard: Google warns that 2026 is the year when attackers “will move decisively from using AI as an exception to using it as the norm.” As a particular risk, it points to “prompt injection” where instructions are subverted in order to bypass an AI application’s security restrictions. It also highlights “highly-manipulative AI-enabled social engineering” which will result in “hyperrealistic impersonations of executives or IT staff.”
Threats: Depressingly, generative AI tools are also being used to create hyperrealistic death threats. The New York Times has a case study of an Australian activist who received a picture of herself hanging from a noose, dead, and another of herself on fire, screaming. AI companies say they’ve put guardrails in place to stop this sort of thing. As analysts have pointed out, clearly they don’t work. One described them as being “more like a lazy traffic cop than a firm barrier.”
Codeword: On the subject of deepfakes, do consider creating a codeword known only to your friends and family. Impersonation scams are so ridiculously cheap and easy that everyone needs a way to defend against them.
Paywalls: The new wave of AI browsers can access paid-for content without paying for it, according to research by Columbia Journalism Review. It found Chat GPT and Perplexity’s browsers could access a subscriber-exclusive article in MIT Technology Review, while the standard interfaces could not.
Trump
Election: Normally, the US cybersecurity agency runs an election day situation room to share information on physical and cyber threats with local and state authorities. But of course these are not normal times and this year it didn’t. The agency has fired thousands of workers and Bloomberg reports that the remaining election security staff have been prohibited from contacting state election officials.
Scans: The Department of Homeland Security is extending its biometric screening programme to cover all entry and exit points to the US. It means all foreign visitors will be photographed when they enter the US, regardless of their age or whether they arrive by land, sea or air. Fox News
Phone: You may not have been wondering what has happened to the much trumpeted Trump phone, but we have. At the time of writing, it’s still missing two months after it was due to launch. At least, that was the original date. The website for the phone now just talks about a launch “later this year.” We’re not holding our breath.
In brief
Meta: Some eye-opening reporting from Reuters which has seen internal documents from Meta in which it projected earning about 10% of its $16 billion annual revenues from adverts for scams and banned goods. It also appears that rather than blocking known scammers, Meta preferred charging them higher rates. Meanwhile, the UK advertising regulator has published a list of the four biggest scam adverts last year. They were celebrity impersonation ads for diet pills and dodgy investment schemes, AI and deepfake scams, travel-related adverts offering improbably big savings, and campaigns promising big name brands at low prices most of which were designed to steal personal information.
Infighting: Internal conflicts during a crisis cause more damage than the actual cyberattack, at least that’s what a survey of 480 senior US cybersecurity leaders found. Cytactic’s report suggests a key issue is the perception that information security requirements slow down operations. CSO Online
Chat: NPR has spotted an ingenious way to create ad-hoc chatrooms. It works by taking over the comments sections of old podcasts. It’s a little like the well-worn spy trope of using messages on games platforms to hold secret conversations. But what could be more innocent than the page for NPR’s Ted Radio Hour…
Buses: Oslo’s public transportation agency conducted a security audit of its electric buses and found that its Chinese models could be remotely disabled by the manufacturer. Thousands of the vehicles have been sold across Europe, Africa, Latin America and the Asia-Pacific region in recent decades. AP
Russia: Telecom operators are blocking calls and SMS messages used by Telegram and WhatsApp’s two-factor authentication service in an apparent attempt to stop new user registrations. Kodurova
Wearable: Camera-enabled glasses and AI-enabled listening pendants allow anyone with enough money to become surveillance operatives. “How is any of this even legal - let alone ethical?” asks The Verge. Its conclusion is that technology is moving far too quickly for laws to keep up. Instead, it reckons “social shaming” is the most powerful check on non-consensual recording.
Spoofing: The UK’s largest mobile phone operators say they will upgrade their networks to eliminate scammers’ ability to spoof phone numbers. As part of a new Telecoms Charter with government, the change will take place within the next 12 months. About bloody time. Home Office
SonicWall: State-sponsored attackers were behind the security breach in September that exposed backups of customers’ firewall configuration files, according to SonicWall’s investigation. It insists that an independent audit confirmed the incident didn’t affect the company’s products or source code.
Comedian: That President Xi. What a joker. He presented a couple of Xiaomi smartphones to his South Korean counterpart, who asked if “the line was secure.” “You can check if there’s a backdoor,” the Chinese President promptly replied with a broad (and rarely seen) smile. Bloomberg
Updates
Apple: The next set of operating system updates has landed, with changes across Apple’s products. There are fixes for more than 100 vulnerabilities as well as some new features and a bunch of cosmetic changes. The new versions are iOS/iPad 26.1 and iOS/iPadOS iOS 18.7.1, macOS Tahoe 26.1, macOS Sequoia 15.7.2 and macOS Sonoma 14.8.2. No serious issues have been reported with these new versions, so they should be installed immediately.
Microsoft : Yet more problems for Windows users, which prompted TechRadar to vent their spleen about “the many annoying issues that plague the user experience.” The most serious affects both Windows 10 and 11 systems and could result in them starting up in BitLocker recovery mode - and staying there if the user doesn’t know their encryption key. Microsoft has admitted that some Windows 10 users have been receiving incorrect warnings about no longer receiving support. And it appears to have fixed a problem when trying to shut down Windows.
Teams: Meanwhile, Microsoft has issued updates to address four vulnerabilities in its Teams messaging platform that could have allowed malicious users to impersonate other users, alter messages and notifications, and fake identities in audio and video calls. Check Point
Edge: On the plus side (providing it works), Microsoft has added a new security feature to its web browser. Scareware Blocker is designed to spot fullscreen popups and fake warnings, aka “scareware.”