The long reach of Chinese surveillance. Phishing still the top threat.
The growing AI security gap. How the spyware business works. Age verification in the EU.
Transnational
More evidence that the long arm of Chinese state surveillance doesn’t stop at its borders. A report from The Citizen Lab details how Chinese state-sponsored hackers conducted two campaigns against journalists, human rights defenders, and exiled ethnic and religious groups. The first targeted the Chinese diaspora, its activists, and the journalists reporting on it. The second specifically targeted journalists who report on China’s state repression tactics.
Both the campaigns relied on social engineering and impersonation of journalists and media figures in an attempt to lure targets to phishing sites. Citizen Lab says it began its investigation after being contacted by a Uyghur-Canadian activist who had received a WhatsApp message that appeared to come from a well-known Uyghur film director and asked him to share his email address, which he did. He then received a message with a link to preview a documentary film. When he clicked on it, a page opened requesting his Google credentials. That’s when he called Citizen Lab.
These techniques are time-worn but still very common. It’s essential to defend against them by checking identities, treating unsolicited links as suspicious, compartmentalising sensitive work, and considering features like Google Advanced Protection or Apple’s Lockdown Mode, which are specifically designed to resist targeted attacks. Anyone covering sensitive topics should also regard unusual contacts as potentially deliberate targeting, rather than coincidence. If something feels wrong, it probably is.
Threats
Ouch: The UK government’s latest Cyber Security Breaches Survey is out and it doesn’t make for pleasant reading. 43% of businesses and 28% of charities reported a cyber incident last year, with phishing by far the most common - and effective - tactic. Although the number of incidents is about the same as the previous year, some of those interviewed for the survey said they had seen an increase in the volume of phishing emails and their effectiveness. That chimes with research from KnowBe4 which says nearly 86% of phishing campaigns it has seen in the past six months have involved some use of AI.
Deepfake: Scammers are using AI-generated videos of celebrities including Taylor Swift and Rihanna to promote shady services on TikTok, according to authentication company Copyleaks. The deepfakes use both video and audio, with realistic-sounding voices and textured filters to mask some of the flaws in the AI-generated visuals.
Extensions: We’re forever warning about the risks of malicious browser add-ons but, as LayerX reports, there’s also cause to be cautious about genuine ones. It found at least 80 widely-used extensions, with some 6.5 million users, that are collecting and selling browsing activity, and it’s perfectly legal because they disclose it in their privacy policies.
Charged: A long-running scam uses “I’m not a robot” checks to persuade victims to send text messages to international premium-rate numbers. Such checks usually require us to identify traffic lights or buses, but these guide victims through multiple “verification” steps and result in dozens of expensive texts. Obviously, no legitimate service will ask you to send a text to prove you’re human. If a CAPTCHA does, ignore it! Infoblox
Tax: Fake tax notifications are a favourite of fraudsters because they’re a perfect way to create a sense of anxiety and urgency. The latest techniques are designed to install a remote access tool and have been focused on Russia and India, though new countries are being added. Kaspersky says China-linked attackers are behind the campaign. The best defence, as always, is scepticism.
AI
Risk: There’s a “widening divide between AI adoption and security readiness,” according to Proofpoint. Its 2026 AI and Human Risk Landscape report found that AI is operational across most functions, including customer support, internal messaging, email workflows, and third-party collaboration. Unsurprisingly, the rush to deployment has not been matched by effective controls, with over half of those who have implemented them unsure if they’d actually work.
Anonymity: Anthropic’s Claude Opus 4.7 model was able to identify an author from 125 words of an unpublished draft. Kelsey Piper says other models weren’t able to match that performance, while Claude even managed to identify her correctly from a 15-year old college application essay. The technique isn’t foolproof…yet, but it’s a glimpse of how what we publish online may be used in the future to identify us and significantly weaken expectations of anonymity.
Sued: Family members of victims of one of Canada’s deadliest mass shootings have sued OpenAI and its CEO Sam Altman in a US court, alleging that the company failed to alert police about the shooter’s activity on ChatGPT. According to one of the complaints, OpenAI’s safety team recommended contacting police after automated systems flagged concerns but the team was overruled. Reuters
Security: OpenAI is rolling out an advanced security mode for ChatGPT accounts. Advanced Account Security disables password logins and only allow access using passkeys or physical security keys. Users who enable the mode will also have past conversations automatically excluded from the training of new models.
Web: Researchers working with data from the Internet Archive have found that a third of websites created since 2022 are AI-generated. Before the launch of ChatGPT in late 2022, the figure was zero. The team (from Stanford, Imperial College London, and the Internet Archive) also found that, despite warnings to the contrary, the influx of AI-generated text has not resulted in a decline in factual accuracy or stylistic diversity. It has, they say, made the web more positive and less verbose.
In brief
Middlemen: After it was caught using Pegasus spyware against journalists and activists, El Salvador turned to intermediaries to secure access to similar technology. The report from investigation outfit The Newsground illustrates how the shadowy world of surveillance technology works in practice. In this case, El Salvador was offered a product billed as being “better than Pegasus,” but balked at the $10.9 million price tag,
Socials: The US Federal Trade Commission says nearly 30% of reported scams last year started on social media, with reported losses reaching $2.1 billion. Most of the scams started on Meta’s platforms, with Facebook far ahead of WhatsApp and Instagram. As the FTC advises, “Limit who can see your posts and contacts on social media. Visit your privacy settings to set some restrictions so scammers have less to work with.”
Tracking: Your smart TV is designed to track viewing habits and fuel targeted advertising. The engine for this is called Automatic Content Recognition (ACR) and it monitors everything on the screen in real-time, feeding your viewing history into a database to build a precise profile of your habits. ZDNet has a guide on how to turn it off.
Gmail: Some Gmail accounts are worth nearly $18,000 a year to Google, according to analysis by Proton (which offers a privacy-focused alternative to Google). There’s a huge range in the value of accounts, driven by the age and location of the user. Over a decade, the average US account represents about $16,000 in advertising value.
Vimeo: The ShinyHunters hacking group is threatening to leak data stolen from video hosting platform Vimeo unless it pays a ransom. The group stole data after first hacking cloud-cost monitoring tool Anodot last month. Since then it has been methodically extorting the tool’s customers. It’s a nasty reminder that data is only as secure as the weakest link in the suppliers and platforms you use. Vimeo
Age: The EU Commission says a new age verification app is ready to deploy and is urging member states to adopt it. The app uses a passport or ID card to check someone’s age. Within hours of its release, researchers began picking it apart and uncovered a host of flaws.
Updates
Microsoft: In the face of repeated problems with Windows Updates, Microsoft has devised a cunning plan; just allow users to pause them - seemingly for as long as they like. Given that updates include fixes for serious vulnerabilities, this is a brave idea. This week, the US cybersecurity agency warned that attackers are exploiting a “zero-click” Windows issue, i.e. one that doesn’t require any user interaction to work. Microsoft has already tried and failed to fix the problem.
Teams: Meanwhile, Microsoft has been working to address an issue that is preventing some Teams Free users from chatting and calling others. Microsoft blames the problem on a “recently deployed backend change.”
Google Messages: Users say conversations are disappearing, in some cases wiping out entire chat histories without warning. The issue appears to be linked to the transition from Samsung’s messaging app to Google Messages, where a behind-the-scenes syncing and indexing process can temporarily (and sometimes permanently) make messages vanish. Google says some of the missing chats may reappear after a delay, but reports suggest that’s not always the case.
cPanel: Update to address severe vulnerability in cPanel which is being actively exploited. cPanel is one of the most widely used web hosting control panel platforms on the internet.
SonicWall: Fixes for three SonicOS vulnerabilities affecting Gen 6, Gen 7, and Gen 8 firewalls. Customers are advised to install them immediately. Incidentally, one insurance provider says one in three cyber-insurance claims filed last year originated from a hacked SonicWall device.
Firefox: Version 150 addresses an issue that allowed websites to track users across sessions, even in private mode or after using the New Identity feature. This affected all Firefox-based browsers, including Tor Browser.
Tails 7.7.1: Emergency release to fix important security vulnerabilities in Tor Browser.