A great time to become a cyber criminal. Tricking WhatsApp users. Abusing Grok.
Venezuela and critical infrastructure. Meta's rogue advertisers.
Rookies
It’s easier than ever to set yourself up as a cyber criminal with the number of phishing-as-a-service (PhaaS) toolkits doubling during 2025, according to analysis by Barracuda. These kits remove the hard work from launching a phishing campaign and have become worryingly sophisticated. Among their features are anti-analysis measures, multi-factor authentication bypass, and stealth deployment that make them harder to detect using traditional measures. The most common themes they use are related to payments, finance, legal, and HR. All are designed to persuade the recipient to click a link, scan a QR code, or open an attachment. AI enables the messages to be highly convincing.
Alas, the threat is only going to grow. AI can be used to create granular profiles of targets and use the information to launch precisely targeted attacks. While technical defences can provide some protection, many of the phishing kits rely on human error to work. A strong security culture and regular awareness sessions remain fundamental, as does a focus on the basics. While phishing kits may be capable of bypassing security measures, frequently they don’t need to. As Hudson Rock reports, in many of last year’s high-profile data breaches multi-factor authentication wasn’t even turned on.
Threats
WhatsApp: A phishing campaign is trying to trick users into linking malicious devices to their WhatsApp accounts. The attack begins with an unsolicited message saying, “Hey, I just found your photo!” with a link to a fake Facebook login page requesting the user’s phone number. This sets off a process which looks like Facebook verification but actually allows the attacker to link their device to the user’s WhatsApp account. Gen
Google: Attackers are sending very convincing fake “Google” emails that evade spam filters, route victims through trusted Google-owned services, and ultimately lead to a lookalike Microsoft 365 sign-in page designed to harvest usernames and passwords. Many media businesses have been targeted in the campaign which begins with routine enterprise notifications such as voicemail alerts, and file access or permission requests. CheckPoint
Extensions: Browser add-ons continue to be a really serious security threat. The latest targets Chrome, Firefox, and Microsoft Edge users through 18 extensions that collect online meeting-related data including URLs, IDs, topics, descriptions, and embedded passwords. Koi Security reckonsthey’re the work of a Chinese group. While convenient, we continue to advise against using most extensions unless you’re sure they’re genuine.
Alerts: Fake Apple security alerts continue to be a problem for Mac and iPhone/iPad users. They work by displaying a popup message warning that the device is infected or at risk. The aim is to steal information and/or persuade the user to call a premium-rate phone number. VPNoverview has a useful guide on how to configure devices to stop them.
Hotels: A new social engineering campaign is targeting the hospitality sector in Europe. It’s employing fake Windows “Blue Screen of Death” screens to trick users into running malicious software. It’s part of the ClickFix tactic that we’ve described multiple times. It’s relatively easy to spot because it asks the user to open a Windows Run dialogue box and paste a command into it which, obviously, is a particularly bad idea. Bleeping Computer
Updates: The new year marks an opportunity for scumbags to send emails telling us we need to check or update security settings. Forbes says Apple and Amazon users are being targeted in this way. Protection is simple; if you do want to update account settings, open a new browser tab and go to the relevant site by typing its name. Never follow a link to do anything important to an account.
AI
Grok: Elon Musk appears to have given into public pressure and limited access to his AI tool’s image creation feature following an outcry over its use to generate sexually explicit and violent content. Regulators around the world had demanded action but until today the only response had been to say such material would be removed and it was up to users to obey policies that prohibit its creation. The feature hasn’t been turned off completely, instead access will be limited to paying subscribers. While the focus has been on images posted on X, WIRED reports that Grok’s website and app have been used to produce far more graphic, sometimes violent, sexual imagery.
Recommendations: Large Language Models are prone to making stuff up, designed to be sycophantic to users, and have internalised biases in the data on which they were trained. As John Naughton argues, these are problems that the AI giants could solve or mitigate if they wanted to. Since they don’t, Naughton has some excellent suggestions on using AI. Among them, be extra cautious when AI models (appear to) generate substantive ideas as opposed to refining existing arguments, and be sceptical. Or, put another way, don’t trust and do verify.
Health: Open AI has launched ChatGPT Health which it describes as “a dedicated experience that securely brings your health information and ChatGPT’s intelligence together.” According to OpenAI, more than 230 million people worldwide already turn to ChatGPT for health or wellness answers every week. Given that number, the potential for misleading information is obvious. The new service is available to all users, unless they’re in the EU, UK or Switzerland.
Gmail: Google is launching a new AI feature which will summarise incoming emails. It says while its AI assistant will effectively take over the Gmail inbox, messages won’t be used to train its models. Google argues that the volume of emails has increased to the extent that users need help to triage them.
Trump
Venezuela: The seizure of Nicolás Maduro underlined the vulnerability of critical infrastructure to cyber attack. Although President Trump referred only obliquely to a “certain expertise” that “largely turned off the lights of Caracas,” there was a documented loss of internet connectivity in the city at the time of the US raid. While the US may be celebrating the success of the attack, in reality its own infrastructure is just as vulnerable as Venezuela’s and continues to be much studied and penetrated by Washington’s adversaries.
Travel: US Customs and Border Protection carried out 55,318 searches of electronic devices at ports of entry in the year to September 30 2025. While sharply up on previous years, it still represents less than 0.01% of travellers to the US. That said, anyone with exotic stamps in their passport and/or with a significant social media profile is much more likely to be pulled over for a “secondary” inspection. The New York Times has a good overview and sensible suggestions for safe travel to today’s United States.
In brief
Meta: As regulators press the social media giant to crack down on rogue advertisers on Facebook and Instagram, the company has drafted a “playbook” to stall them. Reuters has seen internal documents that reveal its tactics, including efforts to make scam ads “not findable” when authorities search for them.
Romancing: Also courtesy of Reuters, a glimpse into the tactics used in romance-related scams (known horribly as “pig-butchering”). The guides - found in raids in the Philippines - include the apercus, “A woman’s IQ is zero when in love” and “as long as the emotions are in place, the client’s money will naturally follow.” The handbooks also show the care with which detailed fake personas are created to ensnare their victims.
WhatsApp: Meta has begun addressing vulnerabilities in the messaging platform that can be exploited to expose user metadata. This appears to be in response to long-running research showing how with only a phone number a device’s operating system can be fingerprinted. This is an essential element in highly targeted attacks which rely on measures tailored to the specific operating system in use. Security Week
NordVPN: The company has denied claims that its internal Salesforce development servers were breached, saying attackers obtained “dummy data” from a trial account on a third-party automated testing platform.
Russia: The government’s internet blackout is now “unprecedented in both scale and technical sophistication” according to a report by Top10VPN. It says the crackdown has been “sustained and systemic, combining nationwide blackouts, selective service throttling, and targeted protocol interference.” A favoured tactic is to allow users to download only the first few kilobytes of data from most Western websites. While not preventing access completely, this obviously renders them unusable.
Pivot: Online dating companies are moving their focus to Asia as their apps struggle in North America and Europe. “Women are no longer relying on family and friends to introduce them to their future partners — they don’t want to leave it to chance,” one chief executive told the FT.
Updates
Logitech An impressively dodgy start to the year for the accessory manufacturer which has apologised to Mac users after their mice stopped working properly. Logitech blamed the issues on an expired developer certificate.
D-Link: We doubt this will affect many of our readers but just in case…there’s a serious vulnerability in a bunch of DSL gateway appliances that reached end of life some 5 years ago. As always, once support ends so does a device’s useful life. VulnCheck