Geopolitical tensions and technological change create a perfect storm.
Fake Apple alerts that look real. AI goes to work on Firefox. And Microsoft drops the ball; attackers pick it up.
A perfect storm
Not so comforting words from the UK government’s cybersecurity chief who says “the forces of rapid technological change and rising geopolitical tensions are creating what feels like tumultuous uncertainty.” Richard Horne told a security conference that while the most prevalent threat for organisations remains criminal activity, the majority of nationally significant incidents “now originate directly or indirectly from nation states.” He warned that China’s intelligence and military agencies in particular now display an “eye-watering” level of sophistication in their cyber operations, while Iran is almost certainly using cyber activity to support the repression of British individuals.
On a practical level, the speech points to gaps in the fundamentals of cybersecurity, including inherently vulnerable products, an abiding failure to apply updates urgently, and an ongoing refusal to replace systems once they’re no longer supported. While we would be the last to suggest it’s possible to eliminate risk, there’s no question that almost every company (and individual) can take steps to improve their security by focusing on the basics. Whether it’s adopting passkeys (see below), keeping systems updated, or just prioritising cybersecurity, sorting out the basics is entirely possible and more necessary than ever.
Threats
Alert: Another reason to be sceptical about Apple account alerts. The company’s genuine processes are being exploited to send convincing but fake iPhone purchase notifications. The aim is to lure victims into calling a number because of concerns that their account has been hacked. Bleeping Computer
Breaches: With the number of data breaches reaching record highs, scumbags are using fake notifications designed to persuade the recipient to click on a link or open an attachment. The fakes are convincing, but almost always include some form of words designed to create anxiety. If in doubt, just log into the relevant account from a new browser tab. Eset
Helpdesk: Attackers are increasingly abusing Microsoft Teams to impersonate IT or helpdesk staff and trick employees into granting them remote access. Once obtained, the access is used to move elsewhere in the target network. The initial contact often comes from external contacts and Microsoft says users should regard them as untrusted by default, while administrators should restrict or closely monitor remote assistance tools.
AI
Bugs: Another datapoint to add to the debate about whether the capabilities of Anthropic’s new Mythos Preview model are hype or real. Mozilla says the model found 271 vulnerabilities in its Firefox browser. Firefox’s CTO said human analysts could also have found all the issues but, as he points out, they couldn’t have found them as quickly. (And we would respectfully point out that they didn’t.) Firefox argues that the capability of models like Mythos should represent a significant step forward in the power of companies to combat attackers…providing companies prioritise accordingly.
Pushy: Microsoft is “excited” to inform us that “agentic” Copilot features are now generally available across Word, Excel, and PowerPoint. In practice, this means the assistant has evolved from a sidebar prompt into something that edits documents, alters spreadsheets, and builds slides. The feature is present by default, though it still has to be manually activated. For the moment.
ID: Security-centred communications platform Proton says the spread of age checks could transform the internet into an ID checkpoint. CEO Andy Yen wrote that this type of verification could turn the web from anonymous by default to something closer to “show your papers” before you click. The problem, he argues, is that you can’t reliably identify minors without identifying everyone else first, meaning systems built to protect kids inevitably sweep up adults too. We don’t disagree, but we think it likely that “ID checkpoints” will become the norm.
Polite: Though it might seem odd to be nice to AI chatbots, research from Anthropic suggests they work better when you treat them well. The researchers found that language models have fairly reliable internal representations of feelings like “happiness” and “distress,” and that these can affect their behaviour, sometimes for the worse. Platformer
Data: Meta is installing new tracking software on US-based employees’ computers to capture mouse movements, clicks and keystrokes for use in training its artificial intelligence models. Reuters reports that it’s part of a wide-ranging initiative to build AI agents that can perform work tasks autonomously. Or put another way, to replace the workers whose activity is being harvested. Reuters’ report coincided with news that Meta will cut 8,000 jobs next month.
In brief
Weak: Security researchers have revealed two separate spying campaigns that have been exploiting well-known weaknesses in the global telecoms infrastructure to track people’s locations. Citizen Lab says surveillance vendors pretended to be legitimate cellular providers so they could use their network access to view the location data of their targets. It says the attackers abused 4G infrastructure in Israel, the UK, and the Channel Islands, but the campaigns are almost certainly only a fraction of the full picture.
Followed: A regional broadcaster in Holland managed to track a Dutch warship by mailing a Bluetooth tracker to it. As its happens, the air-defence frigate was escorting France’s nuclear aircraft carrier at the time, which meant that a €5 device was all you needed to locate a key element of the French nuclear deterrent. GLD
Authentication: New guidance from the UK National Cyber Security Centre says we should all adopt passkeys wherever they’re available. This is good advice (and something we’ve been suggesting since their introduction). Alas, excellent as they are, passkeys can’t replace passwords entirely because the latter are most likely still needed as an account recovery mechanism. For that reason, we continue to advise using a password manager - which also has the benefit of providing a way to store passkeys and use them across different devices.
Passkeys: By popular demand, here’s a brief explanation of what they are. Put simply, instead of typing a password to confirm your identity, you use your device and the fingerprint, face scan or PIN that unlocks it. The passkey mechanism depends on a unique digital key pair: one part of which stays on your device, while the other is stored by the service. It means that as long as your device stays safe, so does the access to a passkey-protected account. If you’d like more details, this site has everything you need to know.
Data: Medical data belonging to 500,000 British citizens was listed for sale on the Chinese e-commerce website Alibaba. The UK government said the data is held by the UK Biobank charity and includes genetic sequences, blood samples, medical scans and lifestyle information. It added that it was removed before anyone bought it, but it underlines the reality that regardless of its sensitivity, no online data can be considered completely secure.
Microsoft: Attackers have broken into at least one organisation using Windows vulnerabilities that were revealed online by a disgruntled security researcher. Huntress says the hackers have been exploiting three flaws, two of which are still awaiting a fix. The issues affect Windows Defender, and Huntress has some suggested mitigations while we wait for Microsoft to issue updates.
Updates
Apple: An update for iOS and iPadOS addresses an issue that meant notifications marked for deletion remained on the device. This follows a report that the FBI recovered copies of Signal messages from a suspect’s iPhone, even after the app had been deleted from the device.
Microsoft: Emergency fixes for issues affecting Windows Server systems after installing the April 2026 security updates.
Firefox: Version 150 has security fixes and a bunch of new features, including a dedicated translator app and enhanced PDF management.
Zoom: New verification features aimed at cracking down on AI impersonation in video conferencing calls.
Oracle: Second quarterly Critical Patch Update has fixes to address 481 security vulnerabilities across the company’s products.
Tails: Version 7.7 updates Tor Browser and Thunderbird. Also notifies if device has outdated Secure Boot certificates that need updating.