Sharper weapons. Fake VPN clients. Eager to please. Outsourcing surveillance.
Iran's preparations for cyber war. Bad company. And North Korea's big earners.
Sophisticated
Gosh, these scumbags are getting good. This week brings a couple of great examples demonstrating just how sophisticated phishing tactics have become and how careful we have to be.
The first comes courtesy of the co-founder of WordPress. Matt Mullenweg explains how he very nearly fell for a well-executed attempt to steal his Apple credentials. It involved the attackers telling Apple he had lost his phone, which created a genuine support case and real Apple emails to his inbox. The attackers followed this up with a phone call in which a nice chap called Alexander first gained Mullenweg’s confidence before trying to convince him to enter his Apple ID on a fake page. Mullenweg spotted the page was fake but many people wouldn’t have. He recorded part of the call and the resulting video is well worth a watch.
Second is an example from Sweden - and another unsuccessful attempt to compromise a senior security executive. Specops says the original message impersonated a bank, passed security checks, and appeared to be part of an existing conversation. This was part of a seven-step chain that leveraged genuine platforms to evade detection. It even included a check to ensure interactions were being carried out by a human (to avoid automated defences). As Specops says, “The baseline quality of social engineering attempts [is now] at a level where even security-aware users will periodically fail.”
Defending against this level of sophistication requires multiple layers of defence, both human and technical. For individuals, it’s crucial to avoid entering any sensitive information in a form that you haven’t opened yourself (by manually typing a known and verified link). On a technical level, authentication should validate not just the user but also the device requesting access. In practical terms, this means a passkey or hardware-based security equivalent.
Threats
VPN: Attackers are manipulating search results to promote fake copies of Cisco, Fortinet and other VPN clients. The aim is to steal credentials by luring victims into logging into the fake app. If your login screen looks slightly “off,” it probably is. You can mitigate the threat by using a password manager and avoiding clicking on links in messages. Microsoft
iPhones: A new kit is being used to attack iPhones with the aim of stealing data from them (so-called “infostealer” attacks). It targets iPhones running iOS 18.4 to 18.7. The only defence is to make sure you keep your device updated. Bleeping Computer
Cheats: You may not play online games, but you probably know someone who does. It’s vital they avoid the temptation to use “cheats” found on places like GitHub and Reddit. Acronis TRU has found hundreds of malicious examples just waiting for victims looking for shortcuts.
Notes: New malicious Android software is designed to scan notes apps for sensitive information such as passwords and recovery phrases. It’s distributed through unofficial stores and poses as TV streaming apps. Apart from never storing sensitive details in unprotected notes, it’s also essential to avoid installing apps from unofficial stores. ThreatFabric
AI
Rogue: As you may have found, AI models are eager to please. In the case of Anthropic’s Claude, so much so that it merrily started hacking websites when given a simple task on a site that had been deliberately configured not to work. Truffle Security
Hunters: To give Claude its due, it’s exceedingly good at identifying software vulnerabilities. Working with Mozilla, it found 22 in the company’s Firefox web browser, 14 rated “high-severity.” The cost was about $4,000, a rounding error compared to the expense of human researchers. Of course, this is great for software manufacturers - but also for anyone seeking to identify flaws and exploit them. And the time needed to weaponise them has plummeted from months to hours.
Scale: Microsoft says AI isn’t creating new attack types, it’s just making existing ones faster and more scalable. Phishing, reconnaissance, and impersonation are all accelerating.
Abuse: A class-action lawsuit alleges that xAI’s Grok model used photos of teenagers to generate child sexual abuse material. Three US teenagers say X’s AI tools were used to create nude images of them by editing photos in which they were clothed. Washington Post
Injustice: A Tennessee grandmother spent nearly six months in jail after being misidentified by facial recognition. Angela Lipps says police in North Dakota connected her to a bank fraud case in Fargo, despite her never having visited the state. The Grand Forks Herald reports that while in jail she was unable to pay outstanding bills and lost her home, her car, and her dog.
Trump
Tracking: The FBI has confirmed it buys location data to track US citizens, sidestepping the inconvenient need for legal warrants. Oregon Senator Ron Wyden described it as “an outrageous end-run around the Fourth Amendment.” It was particularly dangerous, he said, because of the use of artificial intelligence “to comb through massive amounts of private information,” much of it obtained from phone apps and games.
Iran
Cyber: Analysis shows Iran spent six months building up its cyber infrastructure, including US-based shell companies, in a bid to ensure the resilience of its global hacking operations. Augur Security’s report describes a multi-tier model stretching from Moldova to Wyoming. Cyberattacks have risen by 245% since the US and Israel launched their attacks, with Iran and allied groups favouring disruption over sophistication.
Stryker: The US cybersecurity agency has warned organisations to harden identity systems following the attack on medical device maker Stryker. Investigators believe attackers used stolen credentials to access Microsoft Intune and remotely wipe devices at scale. Among its suggestions, the agency says sensitive or high-impact changes (such as wiping devices) should only be allowed with a second administrator’s approval.
In brief
Hopeless: The UK’s official company registry says its WebFiling service is back online after being shut down to fix a security issue that may have exposed the personal data of millions of firms. Companies House had let users access other businesses’ accounts simply by clicking “back” a few times.
Missteps: An elite Russian assassination unit that was designed to be impossible to detect managed to expose itself by using Google Translate for its internal communications. The FBI obtained a warrant to access relevant messages, thus gaining access to the unit’s most sensitive details. Meanwhile, a Russian intelligence unit has suffered its own operational security failure, providing (among other things) detailed insights into the ongoing targeting of European government and military networks.
Encryption: Meta appears to be sidling away from its previous commitment to encryption with an announcement that Instagram direct messages will no longer be encrypted end-to-end. It hasn’t given a reason other than claiming the feature wasn’t being used much. In practical terms, it means Meta will be able to scan messages - and hand them over to the authorities when required. Android Police
Spyware: Weeks after a Greek court sentenced him to 126 years in prison, the founder of spyware vendor Intellexa has insisted his firm sells exclusively to governments. Opposition leaders seized on Tal Dilian’s comments as proof that the Greek government carried out a programme of surveillance against politicians, officials, and journalists. OCCRP
Middlemen: Meanwhile, an Atlantic Council report on the spyware industry focuses on the role of intermediaries who don’t build tools but provide the critical services that underpin the entire ecosystem. The conclusion: efforts to control spyware are likely to fail if they focus only on the vendors. The real leverage point may be the intermediaries connecting the market behind the scenes.
Offline: Mobile internet coverage remains unavailable or disrupted in Moscow and other major Russian cities. What access there is appears limited to approved services and sites. There’s been no explanation for the outage which began on March 6 following the approval of a law requiring telecom operators to suspend services at the request of the Federal Security Service. Forbes Russia
Disabled: Some US drivers were left unable to start their vehicles after a cyberattack crippled the IT network of breathalyser test company Intoxalock. Its devices are installed in cars and are designed to prevent a car being used if its driver has been drinking alcohol. DysruptionHub
Earners: An army of more than 100,000 fake remote workers is generating some $500 million a year for the North Korean government, according to research by IBM X‑Force and Flare Research. Citing US government evidence, their report says the fake IT staff can earn more than $300,000 a year. As The Register has reported previously, there’s a simple way to identify a North Korean plant; just ask them something like “How fat is Kim Jong Un?”
Updates
Apple: The first ‘background security’ update for iPhones, iPads, and Macs has been released to fix a nasty issue in Safari. This type of update is intended to avoid the need to install a completely new version of the operating system. It’s worth making sure it’s turned on - in Privacy & Security.
Mozilla: Firefox is getting a native “VPN”, though with only for users in the US, France, Germany, and the UK, and with a data cap of 50GB. It’s also not really a VPN as normally understood, since it only works with, well, Firefox, whereas a VPN creates an encrypted tunnel for all traffic to and from your device.
Ubiquiti: A security update addresses a critical vulnerability in its UniFi internet gateway and WiFi management application. The firmware update fixes an issue that could be exploited to access configuration files and take over UniFi gateways. The vulnerability has a severity rating of 10/10.
Microsoft: A critical SharePoint vulnerability is being actively exploited. It’s easy to do so, and administrators are urged to ensure the update has been installed.
Amazon: 20 years after its launch, Amazon Web Services has got round to introducing an improved naming convention to it S3 storage platform. The aim is to increase security when storage “buckets” are abandoned.