The role of cyber in modern warfare. Stealing access to systems instead of hacking them.
Anthropic makes nice to Pentagon. Using online advertising for surveillance. Trickle-down spyware. And real cybercriminals probably don't wear hoodies.
Iran
While much attention hasfocused on kinetic weapons, cyber operations have played a key role in the Iran war. “Coordinated space and cyber operations effectively disrupted communications and sensor networks across the area of responsibility, leaving the adversary without the ability to see, coordinate, or respond effectively,” the US Joint Chiefs of Staff Chairman said. In practical terms, the Financial Times says this included Israeli disruption of the cellular network around the location of Iranian leader Ali Khamenei to prevent warnings of an imminent attack reaching him. The FT also reports that Israel had longstanding access to Tehran’s traffic cameras, enabling them to minutely track the Iranian leadership’s movements and routines.
The operation also targeted Iran’s state-owned TV to broadcast speeches by Donald Trump and Israeli Prime Minister Benjamin Netanyahu. Media sites, including the state news agency IRNA, were hijacked to display content about the attacks and discredit the regime. Unidentified hackers accessed a popular prayer app and used it to send messages urging Iranian military personnel to surrender their weapons in return for amnesty (while also obtaining precise location data). Meanwhile, in Israel, text messages are being used to lure people into installing a fake version of the government’s “Red Alert” emergency app.
The US-Israeli attacks on Iran came shortly after Google published a report emphasising the central role of cyber in modern warfare, and that this begins long before any shots are fired. Google says both nation-state actors and criminals are targeting the companies that design and manufacture military technology. As examples, Google points to Russia’s focus on companies and technologies linked to the war in Ukraine, North Korean and Iranian operations using fake job offers or recruitment campaigns to compromise defence employees, and Chinese attempts to steal intellectual property and gain long-term access to defence networks. Many of these efforts seek to compromise individual accounts. Google warns that protecting the defence supply chain is becoming as crucial as defending military systems themselves.
Threats
Cloudflare: The internet infrastructure giant (which handles about 20% of global web traffic) says attackers are increasingly focused on stealing access to online accounts rather than breaking into systems. Automated programs carry out most login attempts, often testing usernames and passwords leaked in earlier data breaches. Criminals are also using malware that steals the digital “login keys” stored on devices, allowing them to enter accounts without passwords, while hiding activity inside legitimate cloud and email services. Recommended defences include strong multi-factor authentication (preferably passkeys or security keys), keeping devices updated, checking accounts for breached passwords, securing email domains, and treating unexpected payment or login requests with caution.
LastPass: The password manager is yet again the subject of a phishing campaign. It’s warning that criminals are sending emails posing as the company and urging users to “secure” or back up their password vaults. The messages link to convincing fake login pages designed to steal master passwords. As always, don’t click links to do anything important - and treat urgent security alerts with suitable scepticism. Security Week
Extensions: More evidence of the risks posed by adding extensions to browsers. LayerX warns that any extension could potentially be used to deliver malicious software, even those requesting few permissions. The issue stems from the built-in ability of extensions to alter webpages, which means they could tamper with downloaded files and insert hidden code. With apologies for repetition, extensions should be avoided whenever possible. (More on this in ‘AI’ below.)
Ads: Criminals continue to merrily exploit the online advertising ecosystem while the technology giants appear incapable of doing anything substantive about it. The Media Trust says the number of malicious ads and redirects rose sharply last year, overtaking email as the primary vehicle for delivering malicious software. Fraudsters often target people searching for solutions to a technical problem. A recent example involved someone running out of storage space on their Mac. The first result of a Google search was a scam trying to get the user to run malicious commands. Search results simply can’t be trusted. It’s as simple as that.
OAuth: Attackers are abusing Microsoft’s single sign-in system by sending phishing emails that link to genuine pages which then quietly redirect victims to malicious websites or malicious software downloads. Because the link begins on a trusted Microsoft domain, it can appear legitimate. Avoid logging in via email links and go directly to the website instead.
Facebook: KnowBe4 has a good explanation of a common scam that begins with scumbags hijacking a friend’s account. They use it to send messages containing video links designed to tempt recipients into opening them. If they do, the link leads to a page with an “I’m not a robot” challenge. Clicking it takes the user to another page asking permission to enable notifications. If granted, a deluge of spam and misery will follow. Our advice: don’t allow browser notifications. Ever.
Google: Attackers are sending victims to a lookalike Google security page that walks them through a series of steps supposedly designed to protect their account. In reality, the process installs a web-based app that can read clipboard data, capture one-time login codes and harvest other sensitive information. Never install software or run “security checks” from unsolicited pages, just go directly to your account if you need to. Bleeping Computer
AI
Weaponised: While Anthropic tries to repair relations with the Trump administration, OpenAI appears to be suffering a severe case of remorse over its rushed deal with the Pentagon. After public concerns that OpenAI’s tools might be used for mass surveillance, CEO Sam Altman said the company was working with the Pentagon to “make some additions in our agreement.” All this tap-dancing does little to hide the reality that AI will be a key tool in government arsenals. As Foreign Affairs notes, procurement documents shows the extent to which China is pushing for complete integration of AI tools into its military, intelligence, and cyber operations.
Caution: The AI agent that Google embeds in its Chrome browser had a serious vulnerability that enabled extensions to hijack camera, microphone, and file access. This is exactly the issue that has led to warnings about the risk of the headlong rush to deploy agentic AI that can operate autonomously. AI can be enormously useful but we don’t believe it’s safe to give it broad access to content and systems…or everything that happens in web browsers. Malwarebytes
On sale: Data brokers are using browser extensions to sell access to sensitive personal data captured during chatbot conversations. An AI expert told The Register that the extensions purport to offer free VPNs or ad blockers but in fact are designed to intercept interactions with chatbots.
Users: OpenAI claims it now has 900 million weekly active users, a 350% increase in 18 months (though some 1.5 million cancellations were reported following its deal with the Pentagon). At the same time, Anthropic is making it easier for users to migrate to its Claude chatbot by enabling the import of past conversations with rival services.
Billed: A user on X claims to be using the OpenClaw agent to send 50,000 invoices to leading US companies, and says 2% pay up without checking. The alleged result, as of the weekend, was $1.7 million in payments. The claim is probably bollocks, but it’s a reminder to check what checks are in place to verify invoices for small sums.
Preaching: And finally, the Pope has warned priests not to use AI to help write their sermons. Vatican News reports that he told them to resist “the temptation to prepare homilies with Artificial Intelligence,” saying “the brain needs to be used, so our intelligence must also be exercised a little so as not to lose this capacity.”
Trump
Tracking: US Customs and Border Protection is buying data from online advertisers to track people’s precise movements, according to an internal document obtained by 404 Media. The information comes from apps like video games, dating services, and fitness trackers, providing near real-time location data without a warrant or going through mobile operators.
Fake: The captain of the US Olympic hockey team was forced to disown a doctored White House TikTok video in which he appeared to insult Canadians as “maple syrup eating (expletives).” “It’s clearly fake because it’s not my voice and not my lips moving,” Brady Tkachuk said. Also clearly improbable since as well as leading the US team, Tkachuk is captain of the Ottawa Senators.
In brief
Trickle down: The problem with sophisticated government exploits is that sooner or later many end up in the hands of criminals. This appears to be the case with a spyware kit designed to target older iOS devices. Google explains how “Coruna” was first used by a customer of a surveillance vendor, then by a suspected Russian espionage group, and now by Chinese fraudsters. Coruna doesn’t work against iOS versions later than 17.2.1, providing an excellent reason to ensure devices are kept up to date.
Extortion: Insurance claims to cover data theft and extortion attacks exceeded ransomware payments for the first time last year. Cyber insurance provider Resilience says demands to suppress stolen data comprised 49% of all extortion claims in the first half of the year but grew to 65% in the second half. Basically, organisations now have effective recovery plans that allow them to restore data if necessary - so crooks have pivoted to threatening to publish the data unless victims pay up.
Glasses: Britain’s data protection regulator says it will contact Meta amid concerns about the privacy of content from its AI-powered smart glasses. Swedish media reports say outsourced workers tasked with improving Meta’s AI systems routinely review footage showing everything from everyday conversations to far more intimate scenes. “She came out of the bathroom naked,” one report’s headline reads ($). The Register
TV: Several smart TV makers are offering fewer adverts if users allow their devices to join a global data-collection network. The Verge says ($) the feature enables a TV to crawl the web, harvesting data as it goes. The resulting information is then sold to companies, including those training AI models.
Creep: A 22-year-old Alabama man has pleaded guilty to extortion, cyberstalking, and computer fraud charges after hijacking the social media accounts of hundreds of young women (including minors). Jamarcus Mosley impersonated friends of his victims to obtain account recovery codes and passwords, then used them to take control of the accounts.
Age: Forget those clichés of hoodie wearing youths crouched in front of a computer screen. Cyber criminals are mostly 25-44 year-olds working in highly structured organisations that resemble conventional businesses. The figures come from Orange Cyberdefense’s Security Navigator report, which is based on 418 law-enforcement actions around the world.
Updates
Android: Google has released security updates to address 129 security vulnerabilities, including an actively exploited flaw in a Qualcomm display component. Google Pixel devices receive these updates immediately. Other manufacturers take longer to release them, but they should be installed as soon as they’re available.
Cisco: Attackers are actively exploiting two security flaws in Catalyst SD-WAN Manager. Cisco is urging administrators to upgrade vulnerable devices.