The evolution of attackers' tactics.
A worrying mobile spyware platform, on sale on Telegram. The problem with Open Claw (or whatever it's called this week). Threats of violence in the US. And when "deleted" doesn't mean gone.
Evolution
Ransomware isn’t going away but attackers are changing how they use it. Picus Labs calls the new approach “sleeperware” and says (R) rather than encrypting data, groups are increasingly focused on stealing data “to keep the host alive for long-term exploitation.” It likens this to a parasitic infection where the goal is to “inhabit the host, feed on its identity, and weaponise its infrastructure.” Picus urges organisations to shift their strategy from “hunting files” to “hunting behaviour”, with a focus on testing whether an adversary is already inside their infrastructure.
The threat from AI tools is also evolving, according to Google’s Threat Intelligence Group. It says sophisticated hacking groups in China, North Korea and Iran are using Google’s Gemini AI tool to support their attacks by refining malicious software and researching targets. In one example, it observed a known Chinese group using Gemini to compile information on specific people in Pakistan. In another, it saw Iranian attackers providing Gemini with the biography of a target and asking it to craft a persona or scenario designed to persuade them to engage.
Threats
Mobile: Don’t underestimate the risk posed by mobile devices. iVerify has a worrying report about a spyware platform that’s being marketed on Telegram and which comes with customer support and ongoing updates.
“Taken together, this is a complete mobile compromise toolkit, the kind that used to require nation-state investment or bespoke exploit development, now sold on Telegram,” iVerify says.
Zoom: North Korean attackers targeted a cryptocurrency executive using a fake Zoom call, deepfake video, and a compromised Telegram account. They claimed there were audio problems with the call and persuaded him to run malicious code. Alas, he did and his Mac was infected. Be sceptical about meeting requests, even if they’re from someone you know. Mandiant
Snapchat: A reminder to never hand over security codes to anyone, especially if they’ve turned up unexpectedly. A 27-year-old Illinois man has admitted that this was how he managed to access at least 59 women’s Snapchat accounts. After gathering phone numbers and email addresses, he triggered Snapchat’s legitimate login process, which sent six-digit security codes directly to victims’ devices. Posing as Snapchat support, he then sent more than 4,500 anonymous messages, claiming the codes were needed to verify or secure the account.
Telegram: Attackers are taking over accounts by using malicious QR codes that exploit the messaging platform’s genuine authentication mechanisms. The initial lure suggests the user should scan the code to ensure their device remains connected. In fact, scanning it authenticates the attacker’s device. Cyfirma
Outlook: An abandoned Microsoft Outlook add-in was used to steal 4,000 Microsoft account credentials, plus credit card details and banking information. AgreeTo was an open-source meeting scheduler and had been left in the Office Store despite no longer being maintained. Koi says this is the first incident of its kind. Like browser extensions, third-party add-ins for Office apps are best avoided whenever possible.
Romance: Happy Valentine’s Day for tomorrow. And keep an eye out for romance scams, even if they come with convincing audio and video. Thanks to AI, it’s never been easier to create a fake persona and scumbags will doubtless be thinking this is a great time to deploy one.
AI
OpenClaw: OpenClaw (previously Clawdbot and Moltbot) continues to raise security concerns. It’s an “agentic” AI platform, meaning it can carry out tasks on its own. To do that, it needs broad access to user data. That makes it powerful - and dangerous. A new version fixes more than 40 vulnerabilities, but frankly using it is a risky venture at the moment. The Register
Quitting: Several senior AI executives resigned this week, with the head of Anthropics’ safeguards research team warning that the “world is in peril.” Mrinank Sharma said, “We appear to be approaching a threshold where our wisdom must grow in equal measure to our capacity to affect the world, lest we face the consequences.” Meanwhile, the Wall Street Journal has an interesting profile of a philosopher employed by Anthropic “to teach AI morals.”
Search Party: Amazon’s Super Bowl advert was intended as a heart-warming vision of using Ring doorbells to reunite owners with missing pets. The idea is to network the cameras together and use AI to analyse the resulting video to identify the errant animals. The reaction to the advert wasn’t quite what Amazon expected. Calling it a “surveillance nightmare,” the Electronic Frontier Foundation said the company had previewed “a world where biometric identification could be unleashed from consumer devices to identify, track, and locate anything - human, pet, and otherwise.” Perhaps not coincidentally, Ring has just cancelled its integration with the controversial Flock surveillance system, saying it “would require significantly more time and resources than anticipated.”
Viral: Have you received an AI-created caricature yet? It involves telling ChatGPT a bunch of information about yourself which is then used to create a caricature. At the risk of spoiling the fun, it’s not a great idea security-wise. In fact, it amounts to a supercharged version of filling in social media surveys about first concert, favourite band etc. BBC
Toys: An AI toy manufacturer exposed 50,000 logs of chats with children to anyone with a Gmail account because it failed to take the most basic security measures. Simply by logging into Bondu’s web portal, researchers found themselves looking at children’s private conversations with their stuffed toys, their likes and and dislikes, and their favourite snacks and dance moves. WIRED
Trump
Threats: Violent online rhetoric targeting leading US public officials increased more than threefold between 2021 and 2025, according to analysis by the Institute for Strategic Dialogue. It says around 47% of the recorded threats were against President Trump. Its verdict, “Overall, the data reveals an ecosystem in which threatening language has become normalised, alongside a rise in real-world violent incidents, some with devastating impact.”
In brief
Camera: The search for the missing mother of a US news anchor has cast light on what technology companies do with video data they receive. Even though Nancy Guthrie wasn’t paying a subscription for her Nest security camera and the device was destroyed, Google was still able to retrieve vital video evidence from its “backend systems.” Nest cameras work by uploading video clips to Google’s systems and the content is only kept for three hours unless the user is paying a subscription. But in this case video clips were accessed nine days later. It’s a good reminder that in the online world, you shouldn’t assume deleted means data is actually destroyed. Ars Technica
Ads: According to Juniper Research (R), online social platforms earned nearly $5.2 billion from malicious or scam ads in Europe last year. Juniper analysed publicly available data to study ads on Facebook, Instagram, TikTok, Snapchat, X and LinkedIn, across 11 European markets including the UK. It found that European users saw 993 billion social media ad impressions last year, generating $52bn in revenue.
Stalkerware: A hacktivist has leaked more than 536,000 records after stealing them from a Ukrainian company that sells stalkerware products. The data includes email addresses and partial payment information for individuals who bought spyware and phone-tracking tools including Geofinder, uMobix, and Peekviewer. TechCrunch
Russia: As Russia tightens controls on the digital domain, it has effectively blocked access to WhatsApp, a day after it did the same to Telegram. The government is seeking to force users to adopt a state-backed messaging app. Numerous other services and domains have been blocked including The BBC and Deutsche Welle. FT
Epstein: Following the publication of 3.5 million pages of documents related to the late sex offender Jeffrey Epstein, Bellingcat says multiple X users have asked Grok AI to “unblur” or remove the black boxes covering the faces of children and women in images that were meant to protect their privacy.
Discord: Age verification checks will be required next month with all users receiving “teen-appropriate” content until they take a video selfie or upload a government ID. Following a data breach at a third party supplier, Discord is seeking to reassure users that its new system will be secure.
Glasses: The US Air Force has joined two cruise lines and Delta airlines in banning the use of smart glasses. In the case of the Air Force, the obvious risk of recording sensitive information makes us wonder why the ban has taken so long. For the travel industry, there have been long-running concerns about recording people without their consent.
Palantir: The Swiss government has ended its contract with the US analytics company after concluding it represented a national security risk. The Swiss Armed Forces warned there was a significant likelihood that the US government would be able to access confidential Swiss data. NewsCase
Updates
Apple: Security updates to address a previously unknown ‘zero-day’ vulnerability that has been lurking in that was exploited in an “extremely sophisticated attack” targeting specific individuals. The issue affected a range of operating systems. The new versions are iOS 18.7.5, iPadOS 18.7.5, macOS Tahoe 26.3, tvOS 26.3, watchOS 26.3, and visionOS 26.3.
Microsoft: Latest set of monthly updates includes fixes for 58 issues, including six zero-day vulnerabilities that it says are being exploited.
Patch Tuesday: Monthly updates from Adobe, IBM, SAP, Fortinet, Cisco, and Ivanti.