In the grey zone between peace and war. Pornography site faces ransomware demands.
The AI-powered vending machine that went bonkers. Cyber privateers. Meta sued over suicides.
The grey zone
Russia is testing the UK “with tactics that are just below the threshold of war,” according to the new head of MI6. In her first speech as head of the country’s Secret Intelligence Service, Blaise Metreweli said the UK now operates in a “grey zone” between peace and war. She pointed to efforts to spread chaos as a deliberate feature of Russian strategy, enabled by cyberattacks on critical infrastructure, drones near sensitive sites, and propaganda operations. Countering disinformation would require cross society action, including teaching children to evaluate sources and recognise manipulative algorithms that “trigger intense reactions, like fear,” she said.
Metreweli’s comments came as Amazon said it had disrupted a “years-long” Russian campaign to penetrate Western critical infrastructure. Russia’s GRU was behind the efforts to steal credentials and compromise misconfigured devices, with a particular focus on the energy sector, Amazon said. “Going into 2026, organizations must prioritise securing their network edge devices and monitoring for credential replay attacks to defend against this persistent threat,” the company warned. It added that Russia is also trying to access corporate systems by targeting collaboration and wiki platforms, as well as cloud-based project management tools.
Vulnerabilities in the US power grid are also the focus of intense Chinese research. Analysis by Strider found 2,723 papers, many of them by entities connected to China’s military and security services. It says at least 225 of them related to potential attacks against the US grid, including multiple publications that ran attack simulations to test new concepts, methods, and tools. Given this, it’s probably not ideal that China supplies a critically important component in the US electricity network. Meanwhile, Beijing has been busily exploiting the React2Shell vulnerability that we’ve been writing about for the past couple of weeks. As the MI6 chief said, “Our world is more dangerous and contested now than it has been for decades.” We may not be at war at the moment, but both Russia and China are behaving as if we will be.
Threats
Pornhub: The pornography website says it’s facing ransomware demands after a data breach at a third-party analytics provider. It says a “limited set of analytics” about some premium users were accessed. In English, that seems to mean watch history, search history, and downloads. However, the third-party provider says it has no evidence that its recent security incident included any Pornhub data. It’s all a bit mysterious, but the reason for including this in ‘Threats’ is to remind everyone that nothing online is guaranteed to be truly private. As we often say, it’s a good idea to do online only what you would be happy to see published online. Bleeping Computer
WhatsApp: You’re probably already well aware of the Facebook scam that begins with a message saying someone has seen your photo. A variation on it is being used to gain access to WhatsApp accounts. It works by exploiting the platform’s device-linking feature. Gen Digital (formerly Symantec and Norton) has the details.
Piracy: Tempting as it might be to download pirated copies of movies and games, they’re a horrible risk. In the latest example of this, a fake copy of box office hit ‘One Battle After Another’ is hiding malicious software inside the embedded subtitle files. Bitdefender
PayPal: Attackers are abusing a legitimate feature to send realistic-looking emails advising the recipient they bought an expensive item. As you might expect, the messages include a phone number to cancel or dispute the payment that takes you straight to the scammers. Although the email is clearly fake, the sender’s address is “service@paypal.com.” It’s a reminder that if you want to dispute a payment, get in touch with the provider directly, never through a link or a phone number you’re sent. Bleeping Computer
Awards: A hilarious campaign is using the offer of executive awards to target gullible businesspeople. Anyone foolish enough to engage with the “Cartier Recognition Program” will receive instructions to run malicious commands on their computer. Which is probably what they deserve. Trustwave
Extensions: Four popular browser add-ons have been harvesting the contents of chatbot conversations of more than 8 million people and sending them back to the developers. The extensions in question are Urban VPN Proxy, 1ClickVPN Proxy, Urban Browser Guard, and Urban Ad Blocker. Urban VPN even received a Featured badge in Google’s Chrome web store. Extensions are a vile risk. Steer clear unless you’re 100% sure they’re genuine. The Register
AI
Work: Brian Merchant has been collecting personal accounts for a series called AI Killed My Job. He’s covered tech workers, translators, and artists. The latest instalment features copywriters, and they’re frankly dispiriting stories. It’s behind a paywall, so here’s a flavour; “you go from knowing you are valuable and valued, with all the hope in the world of a full career and the ability to provide other people with jobs…to being relegated to someone who edits AI drafts of copy at a steep discount because ‘most of the work is already done.’”
Images: OpenAI has released a new image generation tool that makes photorealistic manipulation as simple as typing a sentence. What makes it different (and faster and cheaper than previous versions) is that it regards images and texts as the same thing. This makes it more flexible - and able to produce more convincing output, with obvious potential for misuse. Ars Technica has a good explanation.
Glasses: MSC Cruises has banned passengers from wearing smart glasses in public spaces, citing privacy concerns. “Devices capable of covertly or discreetly recording or transmitting data (e.g. smart glasses) are not allowed in ships’ public areas,” according to the company’s new luggage policy.
Monitors: Forbes reports from Beverly Hills High School where AI-powered surveillance tools are everywhere. Even the toilets have smoke detector-shaped devices that capture audio and listen for sounds of distress.
Sales: A delightful article in the Wall Street Journal recounts what happened when Anthropic’s Claude chatbot was given the chance to run a vending machine in the newsroom. You might guess how it went. “Within days, [it] had given away nearly all its inventory for free—including a PlayStation 5 it had been talked into buying for ‘marketing purposes.’ It ordered a live fish. It offered to buy stun guns, pepper spray, cigarettes and underwear. Profits collapsed. Newsroom morale soared.” the paper reports.
Trump
Privateers: The Trump administration is preparing an executive order to allow private companies to carry out offensive cyber operations on behalf of the government, according to sources quoted by Bloomberg. Its report says the drive to enlist private companies reflects a growing view within the intelligence community and the administration that the US needs more capacity to fight hostile hacking groups that often work with abundant foreign state support.
Talent: After doing its best to get rid of hundreds of thousands of government employees and dismantling many technology units, the Trump administration is now seeking new talent. The “United States Tech Force” will hire an initial cohort of some 1,000 technologists who will be placed in agencies for two-year stints. NextGov
In brief
Suicide: The families of two teenage boys who killed themselves are suing Meta, claiming it ignored the rising danger of sexual blackmail schemes targeting teens on Instagram. The families, from the US and Scotland, said their boys sent intimate photos to an Instagram contact believing they were a girl of their own age. In reality of course, they were part of highly organised sextortion gangs who threaten to publish the pictures unless they receive a “ransom” payment. This is a very real and present danger face by teenagers, and it’s essential to talk to them about it.
Belarus: The authorities are deploying spyware on the smartphones of local journalists during police interrogations. RESIDENT.NGO says a journalist was made to unlock his phone in the presence of security agents and leave it in a locker while he was questioned. Similar tactics have been observed in China, Kenya, Russia, and Serbia.
Access: A data breach at South Korea’s largest online retailer resulted from a former employee who retained access to internal systems after leaving the company. The incident at Coupang exposed information about 33.7 million customers and took place in June but was only discovered last month. The breach has led to a surge in phishing activity in the country, with some two-thirds of the population affected. The “Joiner Mover Leaver” process is painful but essential. Bleeping Computer
Messages: One of the key obstacles to the creation of bogus social media accounts can be bypassed for as little as a few cents at a time, according to University of Cambridge research. It shows that throwaway phone numbers are readily available to receive the text messages that are meant to ensure an account is genuine - and to combat disinformation. Reuters
Imposters: Fake subpoenas continue to fool tech giants including Apple and Amazon into handing over customer data to hacking groups. A member of one group told WIRED that virtually every major US technology company - and plenty of minor ones - had been tricked by fake requests. This isn’t a new problem - we’ve been highlighting it in awareness sessions for years - but companies still seem incapable of dealing with it.
TV: Texas is suing five of the biggest TV makers, accusing them of “secretly recording what consumers watch in their own homes” and creating a “mass surveillance system.” The lawsuits accuse Sony, Samsung, LG, Hisense, and TCL of deceptively prompting users to activate a feature that captures screenshots of a TV’s display in order to support targeted adverts.
RIP: In a snapshot of modern manufacturing trends, the maker of Roomba robotic vacuum cleaners and the pioneer in the sector has filed for bankruptcy protection in the US. iRobot has been acquired by a Chinese company that actually makes most of the machines, and which also supplies many of the other similar devices on the market. Robotic vacuums suck up more than dirt; just like human cleaners they’re privy to oodles of often highly sensitive details. Which, one way or another, will be available to China.
Updates
Apple: Most iPhones and iPads need to be updated to version 26.2 in order to install the latest security fixes. Previously, this version was only available to the most recent models. Now, only the iPhone XS, iPhone XS Max and iPhone XR models are excluded and remain on version 18.7.3.
Translate: Google has rolled out live translation for Android with support for all headphones.
SonicWall: Urgent update to address a vulnerability in the SonicWall SMA1000 Appliance Management Console (AMC).
Telegram: Support for passkeys has been added to iOS and Android apps.