Learnings from Verizon's latest report. Attacking Mac users. Google revamps search.

Microsoft dumps SMS authentication. And Dutch police strike again.

Lessons

There’s a looming crisis because of the growing volume of security vulnerabilities and the limited ability of organisations to address them. That’s the main message from Verizon’s latest Data Breach Investigations Report which found that software vulnerabilities were behind 31% of the incidents in its survey. Three-quarters of them involved internet-facing devices such as firewalls and VPNs. And the number of vulnerabilities also increased - by a fifth - while the median time to apply updates rose from 32 to 43 days.

These findings are worrying, but come before the full impact of AI tools is felt. This week, internet giant Cloudflare released findings from tests of Anthropic’s new Mythos AI security model. It concluded that Mythos marks a genuine leap forward in automated research, not just because it’s good at identifying issues but because it can chain them together and test the result until it comes up with a working exploit. Cloudflare concludes that the response to this can’t be to “patch faster” because AI-assisted attackers will win the race. Instead, organisations need to redesign systems to make it harder to exploit vulnerabilities in the first place. Unfortunately, that’s also a race the attackers are better placed to win.

Less theoretically, here are some key takeaways from Verizon’s report:

• Apply updates as quickly as possible.

• Enable MFA everywhere. Adopt passkeys. Avoid SMS authentication. Deploy a password manager.

• Enforce effective access controls and account privileges.

• Ensure backups are isolated from potential attack. Test restore processes.

• Above all, focus on the basics.

Threats

Stealer: A multi-stage process that impersonates Apple, Microsoft and Google is targeting macOS users to steal passwords and other information. SentinelOne says the attack begins on fake download sites for apps such as WeChat or Miro, before running a booby-trapped Apple security update. It’s a complex approach which underlines how attacks on the Mac operating system are borrowing techniques long associated with advanced Windows malware.

Microsoft: An attacker has found a way to exploit an internal Microsoft system to send out waves of spam emails containing a range of scams and lures. The email address involved is msonlineservicesteam@microsoftonline[. ]com which is typically used for official Microsoft notifications. TechCrunch

Invites: Fake event invitations are a long-standing favourite in the phisherfolk’s toolkit. By hijacking well-known brands, it’s much more likely recipients will open a message and initiate the infection process. As so often these days, a campaign spotted by AnyRun involves multiple steps. The key is to remain sceptical about any email or message that asks you to click something. After all, genuine invitations rarely require you to jump through multiple hoops to see the details.

Kuse: Attackers are abusing the legitimate AI collaboration platform Kuse.ai to host fake documents and steal Microsoft passwords. By exploiting compromised supplier email accounts, the attackers are able to generate apparently legitimate links which bypass security filters. The campaign is another example of criminals increasingly abusing legitimate cloud and AI services to make phishing attacks harder to spot. Trend Micro

Aldi: Malwarebytes has an example of a glaringly obvious scam posted on Facebook which Meta should never allowed to see the light of day. The message uses a shortened link to promote a supposedly cheap box of meat from Aldi. As well as being too good to be true, the shortened link should also be a red flag. Meta should be ashamed of its failure to stop these scams. Since it doesn’t, users - particularly older ones - need to be alert to them.

AI

Google: This week saw Google unveil a redesigned search box with AI at its heart. The intelligent search box, it says, accepts text, images, files, video, and open Chrome tabs. And rather than returning a list of links, users get AI-generated interactive experiences and what Google calls “information agents” capable of monitoring the web on your behalf. All this of course better to keep users within Google’s ecosystem where they can generate more revenue. There were lots of other announcements as well. If you’re interested, Six Colors has a good summary.

HMRC: The UK’s tax authority has signed a 10-year, £175 million deal with a London-based company to use its AI tools to identify fraud and fix tax return errors. The technology is designed to combine HMRC data with external sources. It remains to be seen whether taxpayers benefit from fewer errors or simply receive automated accusations more quickly. Quantexa

Fears: The British are feeling more than a little pessimistic about the impact of AI, according to a survey by King’s College London. Among the findings, AI job losses could trigger civil unrest and economic gains will fail to flow further than wealthy investors and large companies. King’s College also found that 15% of respondents said they’d used AI chatbots for health advice instead of contacting a doctor.

Plotters: A group planning a military coup in Romania used ChatGPT to translate messages to and from Russia’s FSB intelligence service. Romanian investigators said they found evidence in ChatGPT logs of the plotters’ deep involvement with the Russian government. A good reminder that AI chatbots and secrecy are not synonymous. Libertatea

Deepfakes: A long-read from 404 Media details the reality of AI-generated sexual imagery and the impact on one community in Pennsylvania. Five teenage girls were targeted by a boy in their school. As the report says, the case has highlighted the challenge for schools and police in responding to deepfake crimes involving children.

Chat: Amazon is introducing AI-generated “podcasts” to Alexa+. The new feature will use synthetic hosts and content pulled from news organisations and online sources to create audio episodes on almost any topic. Amazon suggests, for example, that you can “turn your dinner table conversations into learning opportunities by creating Alexa Podcasts episodes on topics that spark curiosity.” Super.

Trump

Phone: Remember the Trump phone? Well, it’s finally here. Though, despite earlier billing, it’s not made in the USA. It does come with a US flag on the back (albeit with the wrong number of stripes), and is pre-loaded with the Truth Social app. It appears to be based on a 2-year-old HTC model which, even when it was new, didn’t impress reviewers. Meanwhile, Trump Mobile has fixed an issue on its website that reportedly exposed customers’ emails, physical addresses, and full names.

In brief

SMS: In a welcome move, Microsoft is to begin phasing out text messages as a method of authentication and account recovery for personal accounts. Instead, the next time they log in users will be told to create a passkey which, as Microsoft says, is both more secure and theoretically simpler. A password manager will simplify the process of using passkeys across multiple devices. (If you want details of how passkeys work, security expert Scott Helme has a good overview.)

Takedown: Microsoft has disrupted a Russian cybercrime service that sold certificates used to make malicious software appear genuine. Criminals paid thousands of dollars for the certificates which they obtained by abusing a Microsoft service designed to simplify the work of software developers. Microsoft has good advice on how to protect against this type of threat.

SolarWinds: Newly released documents from a 2020 breach reveal that suspected Russian intelligence hackers gained far deeper access to US government networks than previously understood. By hijacking a key administrator account in SolarWinds’ software, the attackers potentially gained access to every treasury.gov email account, allowing them to read, edit or delete data across hundreds of connected accounts. These included staff working on sanctions, terrorism financing and Russia-related investigations. Bloomberg

Training: A large-scale academic study in the US has concluded that phishing training is largely pointless, whether it involves mandatory annual sessions or simulated messages. We agree. For a start, talking about “training” people is misguided, as is expecting an annual session (especially an online module) to improve security. Our approach is to increase awareness and try to keep people interested long after the training is over (hence, in part, this newsletter). It’s understandable that organisations often treat cybersecurity “training” as a tick-box exercise, but not surprising if the people receiving it regard it in the same way.

Access: London’s Metropolitan Police asked technology companies for access to private communications data over 700,000 times in 2025, according to figures obtained by The Register under the Freedom of Information Act. Meanwhile, London Mayor Sadiq Khan has blocked the force from finalising a deal with US technology giant Palantir. Police had been in talks to use AI tools to automate intelligence analysis in criminal investigations.

Grudge: A researcher driven by a personal grievance against Microsoft appears to be behind the release of a series of previously unknown exploits affecting the company’s products. Calling themselves Nightmare Eclipse, the researcher claims Microsoft violated an agreement and “left me homeless with nothing.” The identity of the researcher remains unknown but they have promised to release more exploits, making it essential to apply updates or mitigations as soon as Microsoft issues them. Barracuda

Hoardings: Dutch police are notoriously aggressive, inventive and effective in going after cyber scumbags. Their latest success involves displaying images of suspected fraudsters on billboards to encourage them to give themselves up or to gather tips from the public. 74 of the 100 suspects shown have already been identified.

Updates

Microsoft: Updates for Defender to address two vulnerabilities which are already being exploited. Meanwhile, Microsoft has blamed Apple for persistent location prompts affecting Teams users. The messages ask for permission to use their location for things like GPS and WiFi. Microsoft says a recent macOS security update is responsible.

Firefox: Version 151 includes significant privacy and security improvements, including better protection against tracking by reducing the information revealed to websites.

Cisco: Updates to address a maximum-severity vulnerability in Secure Workload product.

NGINX: Researchers using AI analysis have uncovered an 18-year-old vulnerability in a widely used interface for managing NGINX servers. Administrators are advised to upgrade to NGINX 1.31.0 or 1.30.1 immediately. If that’s not possible, configurations should be reviewed for specific rules that allow the vulnerability to be exploited.

Tails: Version 7.8 updates Tor Browser. It also removes the Thunderbird email client so that it can be installed as additional software (which is intended to ensure that it remains up-do-date).

← Back to all editions