The irresistible rise of spyware. Phishing up.
Agentic browsers best avoided, according to Gartner. Hand over your socials if you want to visit the US. Exploiting that issue we talked about last week. And Porsche demonstrates how the modern car doesn't work.
Spyware
Spyware maker Intellexa is alive and kicking vigorously despite US sanctions, according to leaked documents. The files, which were analysed by Amnesty International, show that among its recent customers is the Pakistan government. The documents also show that Intellexa had the ability to access its solutions while they were being used by its customers. This is significant because spyware manufacturers frequently claim to have no knowledge about who their products are targeting. In the case of Intellexa’s Predator solution, it’s clear that not only could the company access the spyware but also much of the information it gathered.
Intellexa uses multiple mechanisms to infect target devices. Key amongst them are the exploitation of previously unknown “zero-day” vulnerabilities in commonly-used apps and operating systems. Google says Intellexa develops many of these itself, but also buys them from other people and organisations. There’s a thriving market in such vulnerabilities, with brokers willing to pay millions of dollars for a chain of vulnerabilities. Intellexa also uses the mobile advertising ecosystem to infect targeted devices. Merely visiting a website that carries a specially designed advert is sufficient.
Last year, the UK and France launched the Pall Mall Process which aims to build international efforts to address the proliferation of spyware. The reality is such efforts simply won’t work because too many powerful customers are willing to pay too much money to surveil people they don’t like. Even the Pall Mall Process talks about addressing the “irresponsible use” of cyber intrusion tools, implying that responsible use is fine. From the perspective of a potential target, it’s nigh impossible to defend against mercenary spyware. There are (expensive) apps that scan for signs of compromise but better to accept that if a government wants to access a device, most likely it can.
Threats
Phished: Successful phishing attacks rose by 400% this year compared to 2024, according to SpyCloud. It says nearly 40% of the stolen identities belonged to corporate users, with phishing a far greater threat than malicious software. This week, Sekoia.io has details of a phishing attack that targeted Reporters Without Borders. It says attackers connected to Russia’s FSB impersonated known contacts to send emails, often with attachments missing from them. The aim was to make the victim request the document in the hope they would be more likely to open it.
Events: Russian government-linked attackers are also impersonating high-level European security conferences to target potential attendees. They use detailed social-engineering techniques, including WhatsApp conversations, to try to obtain credentials for Microsoft and Google accounts. Their approach involves very convincing copies of genuine websites. We advise extreme caution if you receive invitations to events or forums, even if they appear to come from someone you know. Volexity
Photos: The FBI is warning that images posted on social media are being used as fake “proof of life” photos in virtual kidnapping ransom scams. As the FBI says, “Scammers portray a false sense of urgency. Stop and think; do the kidnapper’s claims make sense?”
ChatGPT: Watch out for adverts on Google that appear to be for guides to installing a ChatGPT tool for macOS. In fact, they’re for instructions designed to persuade victims to run malicious commands on their Macs. The sneaky bit is that the adverts lead to a link beginning chatgpt.com/share/. The hope is that this will make people think it’s an official ChatGPT guide, even though there’s a notice on the page saying it’s not. The giveaway is that the guide asks the user to open Terminal and run a command which, as we keep on saying, no-one should ever do. Kaspersky
AI
Agents: Research giant Gartner has a simple message about “agentic browsers.” Just don’t! Here, ‘agentic’ simply means a browser that can carry out tasks on websites without the user doing anything, and Gartner has a long list of examples, including entering sensitive data and even completing mandatory cybersecurity training. It says the risks could be mitigated but doing so involves so much work that it reckons organisations won’t do it properly, or at all. Hence just don’t!
Deleted: A separate report shows how a seemingly inocuous email could exploit the power of an agentic browser to wipe the entire contents of a user’s Google Drive. The issue is caused by giving the browser access to and control over Gmail. Straiker’s research focuses on Perplexity’s Comet AI browser but the issue applies to all such tools.
Deepfakes: As if Keir Starmer doesn’t have enough to deal with, a network of TikTok accounts is exploiting the British Prime Minister’s unpopularity to harvest millions of views of fake TikTok videos. NewsGuard found the 73 accounts had amassed nearly a million followers with posts making false claims about non-existent plans for draconian new laws. One example; “New UK rule requires bed time by 10pm or face £100 fine.”
Integration: Chatbots are rapidly becoming part of everyday life, according to research from Microsoft. It said usage patterns painted “a picture of rapid and deep social integration” and users had “tacitly agreed to weave AI into the fabric of their daily existence, turning to it for code reviews at 10 am and existential clarity at 2 am.”
Doxxed: Elon Musk’s AI chatbot appears to have been providing people’s home addresses in response to minimal prompting. Futurism says out of 33 tests, only once did Grok decline to produce an address for the name it was given. It was also happy to spit out a bunch of other information that wasn’t requested, including phone numbers, email addresses and details of family members. Futurism asked X for a comment. It didn’t get one.
Trump
Socials: Proposals to demand access to five years of “social media” from foreign tourists shouldn’t really come as a surprise. The Trump administration has been gradually imposing ever more radical controls on visitors. The latest (which came into force last week) involves “enhanced vetting” of applicants for H-1B visas for highly skilled workers. Under the order, officials will refuse applications from anyone who has worked on content moderation, misinformation, disinformation, or fact-checking. As for the social media proposal, it would also require the disclosure of all personal and business email addresses used in the last decade, five years of phone numbers for the applicant and their families; the names of family members (parents, spouses, siblings, and children) as well as their dates, places of birth, and countries of residence. The public has 60-days in which to comment on the proposals which would apply to countries which are members of the visa-waiver scheme.
Wiper: A man in Atlanta has been arrested and charged for allegedly deleting data from a Google Pixel phone before a member of Customs and Border Protection agents were able to search it. 404 Media ($)
China: The Financial Times reports that the US has halted plans to impose sanctions on China’s spy agency over recent hacks of US telecommunication companies. The paper says staff have been told to prioritise trade deals and not anger Chinese counterparts.
Contractors: Government hiring US style. Two brothers were jailed in 2015 for stealing information from US State Department networks. Following their release, they were hired as contractors but subsequently fired. The Justice Department says they promptly responded by destroying some 96 government databases. (It also says one of them then asked an AI chatbot how to cover their tracks.) Bleeping Computer
In brief
React: Last week, we banged on about a serious vulnerability in a widely-used web development tool. A week on and Palo Alto Networks says the issue has been used to attack more than 50 organisations, with victims in the US, Asia, South America and the Middle East. Given that scans suggest there are 644,000 vulnerable domains, the real figure is probably higher. Despite this, one security expert told Cyberscoop that not all security teams were taking the issue seriously. So, about par for the course.
Syria: In awareness sessions for journalists, we highlight the threat from mobile phone operators in authoritarian states. Documents found following the fall of the Assad regime reveal the extent to which one Syrian company collaborated with the regime’s intelligence apparatus. They show that Syriatel provided unfettered access not only to customer information but, when possible, to their conversations as well. OCCRP
Ransomware: The US Treasury Department says ransomware gangs earned over $2.1 billion between 2022 and 2024. Total payments declined last year but ransomware remains a significant threat, as evidenced by the many high profile attacks this year. It’s also worth pointing out that the Treasury figures are based on the payments it knows about, and don’t include cases that organisations keep secret.
Social media: While Australian under 16s are now banned from social media, adults can continue to post content about them online. Some teenagers - and some privacy campaigners - have been pointing out the contradiction. As with pretty much everything to do with social media, there’s no simple answer but from a security perspective it would be far better to minimise the amount of content shared online - and heavily limit access to anything that is posted.
Crime: Children as young as seven are being referred to Britain’s national cybercrime intervention programme. The National Crime Agency told Sky News that the average age of referrals is 15, most of them gamers aged 10 to 16. “You have to really pay attention to what your kid’s doing. You may think ‘my kid would never do that’, but don’t be so sure,” one former cybercriminal said.
Ads: Meta says it will ask users next month if they’d like to have less data about them collected at the cost of losing some personalised adverts. It sounds good on the surface, but Meta has multiple ways of tracking what we do online - so, at the risk of sounding cynical, its offer simply means it can achieve what it needs by other means.
Metaverse: Back in 2021, Mark Zuckerberg hired 10,000 people in the EU to help build the “metaverse,” which was described as the “next computing platform.” He even renamed his company Meta. Four years and $71 billion later, the Wall Street Journal reports on plans for cuts of up to 30% in the division responsible for the technology. But a Bloomberg columnist argues that far from giving up on his ambitions, Zuckerberg has just rebranded them and chosen a slightly different route to realise them.
Tracking: A group of researchers has called for changes to the design of messaging apps, saying delivery receipts pose privacy risks to users. The researchers say they created “specifically crafted messages that trigger delivery receipts allowing any user to be pinged without their knowledge or consent.” It’s a reminder that while end-to-end encryption protects content, that protection doesn’t extend to message metadata.
LastPass: It’s only taken three years but the UK data protection regulator has fined the password manager’s British subsidiary £1.2 million for a double data breach that affected up to 1.6 million customers. The regulator “found that LastPass failed to implement sufficiently robust technical and security measures.” We continue to recommend the use of password managers. We don’t recommend LastPass.
Porsched: Hundreds of Porsches in Russia stopped working last week, apparently not because they were hacked but because their Vehicle Tracking Systems lost satellite connectivity. According to a leading local dealer, the vehicles interpreted the loss as a potential theft so they immobilised themselves. Although satellite signals are relatively easy to disrupt, it doesn’t appear the outage in Russia was deliberate. It does underline the reality that cars are now computers on wheels - and computers go wrong. Autoblog
Updates
Chrome: Emergency updates to address another previously unknown “zero-day” vulnerability which is being actively exploited. That’s the eighth such security issue this year, or rather it’s the eighth we know about.
Android: Google is expanding a pilot program for a feature designed to detects scam attempts during a live call. The feature is now available in the UK after tests in Brazil and India.
Patch Tuesday: Monthly security updates from Adobe, Microsoft,IBM, SAP, Ivanti, Citrix, F5, Cisco, Fortinet, Firefox, andZoom.
Tails: Version 7.3.1 updates key components and includes important security fixes.