The thriving market for stolen phones. The rise and rise of identity theft.
An AI-generated zero-day exploit. Default credentials. And TikTok thinks Charli D'Amelio is a bunch of blueberries.
Phones
Organised crime gangs are turning stolen iPhones into a full-service fraud operation, in which nicking the phone is just step one. Infoblox has an excellent report explaining how criminals monetise stolen iPhones, even ones with security features that have been activated. It found a thriving ecosystem of Telegram groups selling tools designed to trick owners into handing over PINs and Apple credentials. More than 10,000 phishing websites linked to these operations have been identified, with traffic to them rising 350% last year.
The scams begin just after a phone is stolen, often with a convincing message claiming the device has been found and needs to be verified, usually by logging into Apple services. Some messages include accurate details about the stolen device to appear legitimate. If the victim hands over their PIN or account credentials, criminals can unlock the phone and sell the device for close to its retail value. Interestingly, Infoblox says they’re often more focused on disposing of it for a quick buck rather than exploiting the data inside it.
Some suggested protections:
-
Enable protection: Stolen Device Protection on iPhones, Theft Detection Lock on Android
-
Use a longer PIN: avoid simple 4-digit codes. Better still, use a password
-
Don’t respond to “your phone has been found” messages: unless you initiate contact through official Apple channels
-
Don’t enter Apple credentials via links sent by text or email
-
Use Face ID/Touch ID in public: to reduce shoulder-surfing risk
-
Treat phone theft as a race: remotely lock the device immediately via Find My iPhone (iPhone)/ Find My Device (Android)
-
If the phone is gone for good, wipe it remotely
Threats
Identity: Organisations experienced a sharp increase in the number of identity-related breaches over the last year, according to two new studies. Sophos says 71% of those surveyed experienced at least one such incident. In the UK, Palo Alto Networks put the figure at 83%. Palo Alto also highlighted the issue of “machine identities,” e.g. AI agents that can act autonomously.
Unloved: UK police say romance frauds netted scumbags £102 million last year, an annual increase of 29%. Many incidents go unreported, so the actual figure will be far higher. Victims lost roughly £9,500 on average according to the latest police figures. Almost half of 2025’s total losses came from those aged 55-74.
Hotels: Best Western has been warning customers about a data breach that resulted in the theft of six months’ worth of information. The details include names, email addresses, telephone numbers, and/or home addresses, so basically everything required to construct a convincing phishing attack. The Register
Insiders: One in eight workers at large businesses have either sold their company login credentials or know someone who did, according to research from an anti-fraud group. When we say “workers,” the research found that senior managers were more likely to sell their details than their juniors. Cifas
Footie: A major phishing operation is targeting fans ahead of next month’s FIFA World Cup. Flare says attackers have set up at least 79 phishing sites impersonating the official FIFA website. They look real (not least because they use elements copied from the official site) and come with addresses that are misleading at first glance.
AI
Criminal: Google researchers say a “zero-day” exploit targeting a popular open-source web administration tool was likely generated using AI, in the first such instance it has found. The previously unknown issue could be used to bypass the two-factor authentication (2FA) protection in a popular open-source, web-based system administration tool (that remains unnamed). The vulnerability was addressed before it could be exploited.
Finance: The IMF has warned of the risk from AI-powered cyber attacks, saying they could create a worldwide financial crisis. Financial systems’ dependence on shared cloud services meant the impact of a single vulnerability spread across many institutions, it said.
Rotten: 404 Media captures the growing problem of AI-generated writing which is making large parts of the internet feel bland, repetitive and downright odd. The complaint isn’t really about AI itself, but about being forced to read streams of synthetic emails, blog posts, meeting notes, LinkedIn updates and customer service messages. AI tools are undeniably useful, but over-dependence is a menace to be resisted.
TikTok: The platform is scaling back ambitions for its hilariously bad AI summaries following numerous mistakes and hallucinations. Among its best: a video of celebrity Charli D’Amelio talking to camera which it summarised as a “collection of various blueberries with different toppings”, and a dog-training video which it said was “a captivating display of intricate origami art, meticulously folded from a single sheet”. Business Insider
Trump
Routers: The US Federal Communications Commission seems to have woken up to the reality that banning updates for foreign-made routers would reduce security rather than increase it. The agency’s ban on the sale of such routers stands, but it has extended the cutoff date for updates to the start of 2029.
In brief
Defaults: Default credentials on internet-facing control systems were responsible for incidents at five Polish water facilities. Poland has blamed foreign-linked attackers for the attacks. This is not an issue confined to Poland. In 2024, the US Environmental Protection Agency found that nearly 70% of water utilities inspected by federal officials were in violation of basic cybersecurity standards. Default passwords remain one of the simplest and most preventable causes of critical infrastructure breaches.
Database: Europol built and operated secret data analysis platforms containing passport photos, phone records, financial transactions, and geolocation data belonging to people never suspected of any crime. An investigation by CORRECTIV, Solomon and Computer Weekly quotes former officials as saying the system operated as a “shadow IT environment” without the basic security and data protection safeguards required under EU law. Europol said it had reported its activities in a “transparent manner.”
Venmo: The payments app has finally got round to addressing a privacy issue that was first highlighted in 2018. The problem is that Venmo transactions, accompanying messages, and user contacts have been public by default. Among those caught out by this is US vice-president Vance, whose account provided an unfiltered view of his personal network. Venmo has told The Verge that a new version will mean that by default new users’ posts will only be viewable by friends.
Russia: The head of the country’s human rights council has admitted that the government can’t block VPNs because if they did, “the entire vast internet system could simply collapse.” Under its crackdown, the government has shut access to messaging apps like Telegram and throttled the mobile internet, leading to growing discontent even among citizens who previously supported the Kremlin. RBC
Schools: Depressingly, UK schools have been advised to remove online photos of pupils because blackmailers are using them to create sexually explicit images. The Internet Watch Foundation cites the example of a secondary school which was told manipulated photos would be published online unless it paid a ransom. The Guardian
Mown: Yarbo makes robotic lawnmowers which came with security so poor they could be hacked to run someone over. They also exposed people’s GPS coordinates, WiFi passwords, email addresses, and much more besides. The company has fessed up to its failings and promised to address the issues in an unusually frank and detailed response. But the story illustrates the ongoing risks from internet-connected devices whose security too often fails to match their potential threat. The Verge
Updates
Apple: Updates across current and legacy versions of macOS, iOS, and iPadOS. The releases include macOS Tahoe 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, iOS 18.7.9, iPadOS 18.7.9, iPadOS 17.7.11, iOS 16.7.16, and iOS 15.8.8.
Microsoft: Fixes for 137 security issues, including 31 considered “critical.” Meanwhile, Microsoft has admitted that some customers are experiencing problems when trying to install Office on Windows 365 devices. In the face of the stream of problems with its products, the company says Windows Update will automatically roll back problematic drivers that have been installed through Windows Update.
Linux: Another serious vulnerability has emerged; the second in as many weeks. The latest could be exploited to give an untrusted user higher levels of system access. Users are advised to check their version of Linux for updates. Ars Technica
Zoom: Fixes for critical security issues in Windows and iOS applications.
Patch Tuesday: Also monthly updates from Adobe, Intel, AMD, SAP, IBM, HPE, Dell, ChromeOS, Firefox, Fortinet, Ivanti, Juniper, Synology, TP-Link, Kubernetes, and Exim.
WhatsApp: Users might see an offer from Meta to pay a monthly subscription for “WhatsApp Plus.” Users might be wondering if they should sign up. The answer is “No!” WABetaInfo
Tails: Emergency release to fix a critical Linux security vulnerability (see above), as well as issues in Tor Browser and the Tor client.