The "fifth era" of cybercrime, powered by AI.
More reasons not to trust browser extensions. ChatGPT launches ads...and age prediction. The perils of printers. New breaches. And rewriting Wikipedia for billionaires.
The AI effect
There’s been lots of talk about the impact of artificial intelligence on cybercrime; now Group-IB has come up with some specifics, and they’re not comforting. “Adversaries are industrialising AI, turning once specialist skills such as persuasion, impersonation and malware development into on-demand services available to anyone with a credit card,” it says. Perhaps most worrying is that crime groups have given up misusing mainstream chatbots and instead have created their own large language models that are “more stable, capable, and have no ethical restrictions.” Group-IB has identified at least three active vendors who are offering such models with subscriptions ranging from $30 to $200 per month.
“Deepfake-as-service” means that we really can’t trust what we see or hear. In monitoring dark web forums, Group-IB found a thriving marketplace for “synthetic identity kits,” with AI video actors, cloned voices, and even biometric datasets for as little as $5. “Attackers are harvesting samples with as little as 10 seconds of audio from social media, webinars or even past phone calls to create convincing clones,” the company says. It argues that all of this amounts to a new era in which speed, volume, and sophisticated impersonation fundamentally change the nature of attacks and what’s needed to stop them. Specifically, it says defence rests on “intelligence-led strategies” and “cross-border collaboration between the private sector, law enforcement, and regulators.” In the meantime, online life has just become significantly more risky.
Threats
Extensions: Pretty much every week brings yet another story about browser add-ons being weaponised to attack users. The latest examples include Chrome extensions masquerading as enterprise productivity tools and an ad blocker. As we keep on saying, extensions simply can’t be trusted so they should be avoided unless you’re absolutely, 100% sure they’re safe.
LinkedIn: A decent way to begin the new year would be to check your social media settings to minimise the amount of personal information you’re sharing. If you have a LinkedIn account, that would be the best place to start; not for nothing is the platform known as ‘the phisherman’s friend.’ It now has more than one billion users, many of whose profiles are filled with exactly the details an attacker can use to tailor a targeted phishing email. Education, volunteering, career information are all gold dust for scumbags. We recommend sharing only the most basic details publicly - and exercising maximum scepticism with any unprompted messages on the site.
LastPass: The password manager is warning users about a new phishing campaign that aims to trick users into handing over their master passwords. It involves phishing emails advising them to create a local backup of their password vaults in the next 24 hours because of upcoming maintenance. The link in the email leads to a fake LastPass site that prompts users to enter their master password, something LastPass will never ask for.
Zendesk: The customer management platform has a feature that allows support tickets to be created without having to register an account. Unsurprisingly, this is being abused in a vast spam campaign with some people saying they’ve been receiving some 800 messages in an hour. Until now, the messages appear to be a nuisance rather than containing malicious software. Bleeping Computer
AI
Ads: A year after its boss described ads plus AI as “uniquely unsettling,” OpenAI is to begin testing advertising in the ChatGPT app for some US users. The ads will appear “at the bottom of answers in ChatGPT when there’s a relevant sponsored product or service.” OpenAI says advertising will not influence ChatGPT’s responses and it won’t sell user data to advertisers. WIRED
Age gate: OpenAI is also beginning a global rollout of an age prediction tool designed to determine whether a ChatGPT user is under 18. “The model looks at a combination of behavioral and account-level signals, including how long an account has existed, typical times of day when someone is active, usage patterns over time, and a user’s stated age,” OpenAI says.
Perilous: AI agents that autonomously carry out tasks pose a threat to secure apps such as Signal, according to Meredith Whittaker, president of the Signal Foundation. Deeper integration of AI agents is “pretty perilous” for encrypted services because of the range of access they require, Whittaker said in an interview with Bloomberg.
Leaky: Think twice before using one of the many AI-powered apps that have sprung up in Apple and Google’s store. Research suggests many are failing to protect users’ information. In one example (now fixed), Chat & Ask AI was found to be exposing the entire chat history of over 18 million users.
News: Referral traffic from Google to news sites fell by a third in 2025, according to data in the latest Reuters Digital News Report. The fall is ascribed mainly to Google’s AI summaries feature, with publishers that rely on lifestyle content saying they have been particularly affected.
Principles: Anthropic has produced a new “constitution” for its Claude AI model. It describes it as a crucial part of the “model training process” and says it aims to explain “the context in which Claude operates and the kind of entity we would like Claude to be.” Unlike a previous version which told Claude what it should do, the new document sets out to explain to Claude why it should behave in certain ways, and debates the sort of “entity” the model is (without reaching a definitive answer).
Trump
Printer: More evidence that whistleblowing and enterprise printers make for a poisonous combination. An FBI affidavit reveals that an IT specialist charged with unlawfully retaining national defence information was identified through use of his office printer. The affidavit says the contractor had taken precautions to hide the names of files by taking screenshots of the content and pasting them into a new Microsoft Word document. Unhappily for him, the contractor’s employer could see not only the typical metadata stored by printers, such as file names, file sizes, and time of printing, but was using software that stored the content itself. It’s worth adding that anything printed on the device would also have carried an invisible code identifying the time, date and printer ID. Meanwhile, a judge has blocked the FBI from accessing the devices of a Washington Post reporter whose home was raided as part of its investigation into government leaks.
In brief
Breaches: Under Armourand Eurail are the latest companies to fess up to letting crooks get hold of their customers’ personal details. The breaches affect 72 million Under Armour users and the details are relatively limited. Eurail (aka Interrail) hasn’t given any numbers but the information involved is much more serious and includes passport details and possibly health data.
Bluetooth: Hundreds of millions of wireless earbuds, headphones, and speakers are vulnerable to silent hijacking due to a flaw in Google’s Fast Pair system, according to researchers at KU Leuven. Under the system, devices are supposed to accept new pairing requests only when the user explicitly places them in pairing mode. In practice, the researchers say many products will accept a new connection request at any time. That could allow an attacker to pair their own device and, for example, activate a microphone without the user’s knowledge. Google says it has been working with manufacturers on fixes.
Cheats: Not only is the UK driving test hard but it’s also a challenge just to get an appointment to take it. Not surprising then that the number of cheating cases soared by almost 50% last year. There were 1,100 cases in which people used Bluetooth headsets during the theory test, while candidates were also prosecuted for using people to impersonate them during the practical element. BBC
Reddit: There’s been a sharp rise in the number of people seeking cybersecurity advice on Reddit. Researchers from Google and University College London analysed four years of activity. From 2021 to 2023 it stayed relatively level but in 2024 the number of people asking for help rose by over 66%. These posts were not news stories or general discussions but rather individuals trying to understand a problem or decide what to do. Scams were the main issue of concern. Of course, scammers might also monitor Reddit to provide their own advice.
Ireland: The Irish data protection regulator has collected only 0.5% of fines it has issued over the past 6 years. The Irish Times reports that the Data Protection Commission has announced €4.04 billion in fines, mostly on multinational technology companies, but of that total, €4.02 billion remains uncollected. Critics have frequently accused the Commission of being pro-business and for failing to prosecute violations of EU privacy law.
Russia: The communications regulator plans to use AI technology to analyse internet traffic and automatically detect VPN users. It intends to roll out the system this year. Forbes Russia
Jordan: Authorities used Cellebrite digital forensic software to extract data from phones belonging to at least seven Jordanian activists and human rights defenders between late 2023 and mid 2025, according to Citizen Lab. This took place while the activists were detained for criticising Israel’s campaign against Gaza, Citizen Lab says.
Quantum: 90% of companies aren’t ready for the security threats posed by quantum computing, according to research from Bain & Company. It surveyed 180 companies and found only one in 10 had implemented defences against such threats, despite expectations they will be seen within the next five years. A key issue will be the ability of quantum computers to break existing encryption standards.
Rewrite: An elite London PR firm has been rewriting Wikipedia entries for billionaire and government clients, according to the Bureau for Investigative Journalism (BIJ). Portland Communications was spotted doing this for Qatar in the run-up to the football World Cup. After it was exposed, former employees told the BIJ that the company continued the practice but hired middlemen to carry it out. (Portland’s founder is now the British Prime Minister’s Director of Communications.)
Updates
Microsoft: There’s an emergency update for Windows 11 which is designed to fix an issue that stopped devices shutting down. Microsoft says the issue was connected to Secure Launch (which is supposed to protect computers when they’re starting up).
Fortigate: There’s a new wave of attacks targeting FortiGate firewalls exploiting a vulnerability that wasn’t properly patched last month. The issue is the single sign-on feature, so it’s essential to ensure this is disabled. Arctic Wolf
Cisco: Urgent update for Unified Communications products to address a previously unknown (‘zero-day’) vulnerability that is being actively exploited.
Zoom: Update to address vulnerability in Node Multimedia Routers (MMRs).
Atlasssian: Updates Bamboo, Bitbucket, Confluence, Crowd, and Jira products include fixes for 32 security critical or severe vulnerabilities.
Oracle: Customarily voluminous Critical Patch Update has 337 entries, 235 of them aim to address issues that arte remotely exploitable without authentication.
TP-Link: Update for a serious vulnerability that can be exploited to take control of more than 32 of its VIGI C and VIGI InSight series professional surveillance camera models.