The industrialisation of disinformation. WhatsApp under attack. Shadow AI.
FBI director hacked. Iran warns tech giants. And the success of Apple's Lockdown Mode.
Disinformation
A comprehensive report highlights the role of AI in industrialising global disinformation. In its latest update, the non-profit EU DisinfoLab says “nearly one in three debunked claims now involves AI-generated or AI-manipulated content.” Synthetic content is increasingly realistic and verification efforts are struggling to keep pace, it adds. While geopolitical flashpoints are a focus for such content, EU DisinfoLab says AI-driven disinformation now permeates the information ecosystem, and has become a structural part of it.
Some of the issues in the report:
-
Scale: Analysis of 1,357 claims over a 57-day period found 32% involved AI-generated or AI-manipulated content. Political figures were the most frequent targets, political manipulation the primary motive, and outrage the dominant emotional trigger.
-
Lawslop: YouTube is flooded with fake courtroom dramas, synthetic bodycam footage and deepfake videos of real legal figures. An investigation by Indicator identified 24 channels that amassed more than 1.7 billion views, often blending AI-generated scenes with real footage to make detection harder.
-
Journalist: The German public broadcaster ZDF dismissed its New York correspondent after she used an AI-generated video in a report on US immigration.
Threats
WhatsApp: The messaging platform is the focus of intense attacks, with news of a fake app and a warning about messages containing booby-trapped links. WhatsApp notified some 200 users who had been tricked into downloading a fake app that was actually spyware. And Microsoft says it spotted a campaign using malicious messages to target Windows users. It’s vital to install only official versions of WhatsApp software - and to be cautious about following links in messages, especially if they’re unexpected.
Apple: A hacking kit targeting iPhones has emerged online, meaning what was once a specialist capability is now available to anyone. The kit (dubbed “DarkSword”) allows attackers to compromise devices simply by luring users to a malicious website. No interaction is required, simply visiting one is sufficient. The kit is being used in targeted campaigns, including fake invitations posing as Atlantic Council events. It’s a serious enough issue that Apple has now released updates for older iPhones and iPads to protect against it.
Phishing: “Browser-in-the-browser” attacks are on the rise. These create convincing fake login pop-ups that look identical to real ones, tricking users into entering credentials. The key giveaway: if you can drag the window outside the browser window, it’s fake. If in doubt, close it and navigate manually. SquareX
Children: Fraud groups in Russia are coercing children into photographing their parents’ banking apps and verification codes. Targeting children is nothing new, but this is the first time we’ve seen them used as a means to get to their parents. We doubt it will be the last. It would be hard to overstate the importance of talking to kids about online safety. F6
AI
Security: AI is out of control, in the sense that most organisations don’t know where it’s being used or what data it can access. Tools are being deployed faster than they can be tracked, creating “shadow AI” environments with little oversight. Varonis has a useful analysis of the issue. We should point out that it’s trying to flog a new “security platform” - but the points it raises are important.
Crime: More research points to the growing maturity in the role of AI in cybercrime. CheckPoint says adoption remains relatively limited but interest is widespread, with criminals now using AI not just to write malware but to interact with victims and adapt attacks in real time.
Leak: A bad week for Anthropic after it managed to accidentally leak source code for its Claude coding tool. It’s now scrambling to contain the damage and take down thousands of copies circulating online (including some legitimate ones). TechCrunch
Power: China’s latest five-year plan puts AI at the centre of its global strategy, linking technological dominance with control over information flows and cybersecurity. The Diplomat’s take is that China’s quest for global leadership in AI and cybersecurity threatens free expression and information integrity around the world.
Trump
Hack: Iran-linked attackers accessed the personal email account of FBI director Kash Patel and published stolen material online. Some persuasive research suggests reuse of a previously stolen password was involved. As the X thread suggests, now would be a good time to ask yourself what’s sitting in breach databases, tied to your name, phone and personal email. And are you reusing any passwords?
Content: US agencies have been barred for ten years from pressuring social media platforms to remove content. They can still flag material, but platforms will decide what to do. Reuters
App: “The White House App” (© DJ Trump Inc.) is billed as delivering “unparalleled access to the Trump administration.” A cursory examination reveals it delivers a decidedly varnished Trump worldview highlighting prices that have fallen while ignoring those that haven’t. There’s a button to “Text President Trump,” which auto-populates a new text with “Greatest President Ever!” A developer examined the app’s code. They found that it strips protections from websites opened from inside it. And it tracks the device’s GPS location every 4.5 minutes.
Iran
Escalation: Iran has warned it will target US technology companies operating in the Middle East. On Thursday, an Amazon installation in Bahrain was reportedly damaged following an Iranian strike. Previous strikes have already disrupted cloud infrastructure in the region.
Cyber: Iran is “throwing everything it has” into cyber operations, according to the former head of the US cybersecurity agency. Tehran is combining disruption, intelligence gathering and targeting in support of military activity, Chris Krebs told the Financial Times. Among the Iranian tactics is an attempt to compromise Israeli and UAE municipalities hit by drone and missile strikes. Check Point says it has seen repeated attempt to access their networks by “spraying” multiple username and password combinations against Microsoft 365 accounts.
In brief
Lockdown: Apple is claiming a 100% success rate against attack when Lockdown Mode is enabled on iPhones, iPads and Macs. The feature was launched in 2022 in response to the growing sophistication of attacks against Apple devices. While effective, the defence provided by Lockdown Mode does disable some convenient features. Most people don’t need it, but we do advocate it for anyone who might be a target for sophisticated spyware. TechCrunch
Intercept: A private call between a Politico journalist and an EU official about Hungary and Ukraine was intercepted and published online. A security review failed to find any evidence that Politico’s systems or devices had been compromised, suggesting the intercept took place externally. It’s unclear who was responsible, though the incident comes as Russia seeks to support President Viktor Orbán ahead of general elections on April 12. It’s a good reminder to assume phone calls are not secure.
Passwords: Hong Kong has made it a criminal offence to refuse to provide passwords or access to devices under national security laws. The regulations apply to everyone, including foreign visitors transiting through Hong Kong International Airport. BBC
Government breach: Hackers compromised a mobile device management system used by the Luxembourg government, infecting thousands of official devices. The nature of such systems means they need complete access to devices enrolled in them. It’s essential to protect them accordingly.
Crash: Windows PCs crash three times more often in enterprise environments when compared to Macs, according to research by Omnissa. Its study also found that they remain unpatched for longer while Macs last longer, being replaced every five years on average compared to every three years for Windows.
China: The EU has told a delegation travelling to China next month to leave their phones and laptops at home, citing security concerns. Temporary devices will be issued for the visit. We regard this as a good approach for anyone visiting China. Politico
Space: You can travel to outer space but you can’t escape Outlook problems. As Artemis II heads for the far side of the moon, its commander was forced to ask Mission Control for help with his “personal computing device” and two Microsoft Outlooks, neither of which were working.
Updates
Apple: The prevalence of “ClickFix” attacks has prompted Apple to add a feature to the latest macOS version to try to protect against it. ClickFix works by persuading users to copy and paste malicious code into a terminal window. The new feature warns about potentially malicious pastes, though it doesn’t actually analyse the content itself and definitely shouldn’t be considered foolproof. Bleeping Computer
Google: Ransomware detection is now enabled by default for paid users.
Gmail: US users can now change their email address, meaning choices made in adolescence can be consigned to posterity. Note - there are potential pitfalls with doing this, so it’s worth reading Google’s support document before changing anything.
Proton: The company behind ProtonVPN has launched an end-to-end encrypted video conferencing platform. ‘Meet’ is free to use for the moment and doesn’t require a Proton account.
F5: A critical weakness in F5 BIG-IP is now being exploited in real attacks. Despite this, many instances remain unpatched.
Tails: Version 7.6 of the privacy-focused operating system replaces KeePassXC with Gnome Secrets as its default password manager.