Tech giants face pushback. Targeting Signal. The risks of AI autonomy.
US router ban plan raises more questions than answers. Quantum computing timeline. And divorce and a £170m crypto theft - allegedly.
Pushback
We suggested this might be the year technology giants began to feel some regulatory chains around their ankles. This week saw some firm steps in that direction. First came a verdict in New Mexico where a juryfound Meta liable for $375 million in damages for failing to protect young people from online harm, such as sexual predators. Dozens of other states have filed similar cases. Then in Los Angeles, a jury ordered Meta and Google to pay $6 million to a 20-year-old woman to settle claims that their apps were addictive and caused a mental health crisis. Again, thousands of similar cases are waiting to be heard.
The sums involved are small compared to previous casesbrought by the US Federal Trade Commissionand the European Union, but the principles underlying the latest cases mayprove more significant than the financial penalties themselves. In Los Angeles, rather than focusing on content, the case rested on claims that products had been deliberately designed to be addictive. Lawyers pointed to features like infinite scroll, autoplay videos, notifications and beauty filters, all of which were wholly the responsibility of the technology companies. Unsurprisingly, Meta and Google say they’ll appeal. A long legal process is just beginning, with some observers predicting it will end up in the US Supreme Court.
Threats
Signal: Following last week’s Dutch warning, the FBI says thousands of Signal accounts have been compromised in a coordinated campaign linked to Russian intelligence. Attackers pose as Signal support and trick users into sharing authentication codes, allowing them to link their own device and read messages. Journalists and officials are key targets. Never share login or linking codes with anyone; support teams don’t ask for them, attackers do.
Jobs: Recruitment processes are being exploited to deliver information-stealing software. The tactic uses Google Forms and aims to persuade recipients to download a file that purports to be a project brief or job description. Recruitment is increasingly popular among attackers, so it’s essential to be sceptical about unsolicited job offers and to verify the sender before opening anything. Malwarebytes
Microsoft 365: OAuth 2.0 is a core authentication mechanism used across online platforms. It’s what supports features like “Sign in with Facebook” and similar services, and it’s central to how Microsoft authenticates logins. Not surprisingly, attackers are very focused on compromising it. Huntress has details of an ingenious method targeting Microsoft 365 users. It exploits a legitimate feature used to approve devices without a keyboard and requires the victim to enter a code as part of the login process. In effect, the victim ends up authorising the attacker’s access themselves. The best defence is to treat unexpected login prompts and requests to enter codes with the same suspicion as requests to reset passwords etc.
Software: GitHub is becoming increasingly popular as a way to distribute malicious software disguised as legitimate projects. The files often appear to be useful or well-documented. In some cases, the malicious code is hidden alongside genuine functionality. Until now, this was a niche tactic but it’s becoming more common, making it essential to check anything on GitHub before letting it loose on your device.
ChatGPT: A campaign is targeting Android users with invitations to test fake ChatGPT and Meta advertising apps. If installed, the apps request Facebook credentials, leading to phishing and account takeover. SpiderLabs
Strava: Military personnel continue to reveal sensitive locations through fitness tracking apps like Strava. The latest case involves a sailor who managed to reveal the location of a French aircraft carrier. Prevention is trivially simple. Engadget explains how.
AI
Fake: Have you come across Michael Bennett? He’s an AI-generated singer who appears in fictional America’s Got Talent videos. To say he’s gone viral would be an understatement. But he’s just a ripple on an ocean of fake contentdesigned to make money and/or promote political narratives. The technical quality of the content is extraordinarily high, so much so that many viewers insist they’re real.
Minions: AI agents are easily manipulated and can be turned into obedient tools for attackers. That’s the warning of a leading AI security researcher who has developed ways to exploit all the main AI assistants. “AI is just gullible,” Michael Bargury told The Register. His comments came as Anthropic announced that Claude can now control your computer while you’re away from it. Many technology commentators share our view that when it comes to AI agents, caution should remain the watchword.
Commodities: Premium AI accounts have become a hot commodity in online fraud markets, making it essential to ensure they have the maximum possible protection. Flare via Bleeping Computer
Sex: OpenAI has “indefinitely” paused plans to give ChatGPT a sexualised “adult mode.” The Financial Times says the decision follows resistance from employees and investors.
Bosses: Some US academics have been exploring the frankly nightmarish prospect of managers unleashing digital twins on their teams. Their paper is entitled, “When Your Boss Is an AI Bot: Exploring Opportunities and Risks of Manager Clone Agents in the Future Workplace.” Which sort of says it all.
Trump
Routers: The US Federal Communications Commission says it will ban foreign-made consumer routers on grounds of national security. Manufacturers can apply for exceptions, but approval will require them to agree to move some production to the US. In the meantime, existing devices can continue to be used, reflecting the reality that virtually all routers are manufactured abroad.
In brief
Quantum: Google has just revised its thinking on when quantum computing will be powerful enough to break current encryption techniques. It says progress has accelerated and means it now expects that point to be reached in 2029. Evidence suggests organisations are woefully unprepared, with Bain research showing that 90% lack a funded roadmap to address the risks.
Journalist: An Ecuadorian journalist was shot after being lured to a location by a false tip. The Committee for the Protection of Journalists says José Vinces Oviedo was shot when he visited a graveyard after being told about the discovery of human skulls there. We’re increasingly concerned about the potential for fake content to be used in this way.
Leaky: A study has found that thousands of websites are accidentally exposing sensitive data due to misconfigurations. The issue lies in API credentials that are used by a website to identify itself to services like banks or cloud providers. The authors recommend a number of mitigations, in particular setting strict rules for automated website-building tools.
Fatigue: Prize for this week’s least surprising research finding goes to academics who have concluded that employees are overwhelmed by the security demands placed on them. Equally unsurprising was their warning that this leads to employees becoming disengaged from security practices. We don’t mean to be flippant. This is a real risk, which is why it’s vital to avoid needless security measures such as forcing people to reset passwords without good reason.
Smart TVs: European broadcasters have warned that smart TVs and voice assistants are giving technology giants increasing control over what audiences see and how content is delivered. They’ve urged the European Commission to designate smart TV operating systems and virtual assistant platforms as ‘gatekeepers’ under the EU’s Digital Markets Act.
Scale: Europol has dismantled a network of more than 373,000 sites connected to cybercrime and child sexual abuse material. It says the sites were linked to a single individual, a 35-year-old man based in China.
Costs: Nikkei Asia reports that computer processors are the next component to be affected by the drive to build more AI infrastructure. PC makers such as HP and Dell found that a meaningful gap began appearing at the end of February between the volume of processors needed and the volume they could obtain.
Married: A UK court has heard allegations that a wife used a home security camera to help her steal some £170 million in Bitcoin from her husband. Shortly before their divorce, she’s alleged to have used the camera to capture the credentials needed to access his Bitcoin wallet. As Cointelegraph reports, it’s quite a story.
Updates
Apple: Multiple updates across the entire product range, including for older iPhones and Macs. iOS 26.4 introduces some key changes, including enabling Stolen Device Protection by default and mandating age verification for users in the UK. The age check requirement has already led to complaints that it’s not working. If you’re experiencing problems, 9to5Mac has some suggested fixes.
Microsoft: As long-suffering Windows 11 users know all too well, Microsoft’s recent reliability record has been woefully bad. This week, it had to release an emergency update to fix issues caused by an update issued just days earlier. All this just days after the chap in charge of Windows promised a new commitment to quality.
WhatsApp: Meta is rolling out a feature that uses AI to draft replies to messages based on the context of your conversations. Meta says it will preserve the privacy of messages by running the process on the user’s device. It’s one of a bunch of new features, including the ability for iPhone users to have two WhatsApp accounts logged in at the same time on the same device.
Translate: Google is adding Gemini AI capabilities to its Translate app. It says it will “transform your headphones into a live personal translator on iOS.”
Oracle: An emergency update addresses a serious vulnerability in Oracle Identity Manager.
TP-Link: Updates for multiple issues in the Archer NX router series, including a critical-severity flaw that attackers could exploit to bypass authentication and upload new firmware.