The need to use passkeys. Social phishing. Warning about the power of AI.
Authenticating human web traffic. And an epic fail by a secretive group with elite members.
Passwords and passkeys
As AI-powered phishing attacks increase, so does the need to adopt passkeys wherever they’re available. This doesn’t mean longstanding advice about using strong, unique passwords and multi-factor authentication is wrong - just that the tools to circumvent them are widely available. In one example, cited by Huntress, a platform combined AI, legitimate cloud infrastructure and a genuine Microsoft authentication process to compromise Microsoft 365 accounts “at an unprecedented scale.” The result, it says, was a 1,380% increase in device code phishing attacks detected between July–December 2025 and January–April 2026.
Despite this, passwords remain stubbornly dominant. Reusing them is common, and many users continue to store them in browsers despite this being a lousy idea. Passkeys aren’t a panacea, but they do address a specific problem; they can’t be reused across different services, entered on fake pages or intercepted in the same way as passwords or codes. Although they’re clearly more secure, many major platforms don’t support them yet. Scott Helme has created a site that lists the world’s most popular websites and tells you which have adopted passkeys, and which haven’t. Seven of the top 25 sites globally (including Netflix and Instagram) are laggards. The site also has a useful guide to passkeys themselves.
Threats
Socials: Phishing and scams are surging across social media platforms, according to the Anti-Phishing Working Group. It found threat volumes increased across every major platform in the first quarter of this year, with impersonation accounting for almost 44% of malicious activity - and outright scams a further 27%. Attackers are also becoming more selective about who sees malicious content, hiding fake pages from security scanners and only displaying scams to users arriving via specific searches, adverts or social media links.
WhatsApp: Kaspersky is warning about a technique exploiting a compromised WhatsApp account to send booby-trapped business documents. When run, the files install a genuine security programme that provides the attackers with remote access.
Macs: A campaign targeting macOS devices uses the ‘ClickFix’ technique to trick users into launching what looks like a normal disk image (DMG) installer. Instead, the attack silently mounts additional hidden images and installs an infostealer designed to harvest passwords, browser data and other sensitive information. ClickFix attacks work by persuading the victim to open the Terminal app and paste commands or install a “fix.” Instead, just close the tab. Unit 42
AWS: A phishing campaign has been targeting AWS customers with a near-identical copy of the AWS console sign-in page. The attack begins with an email that appears to come from AWS support, and the main targets were software engineers and IT managers. The phishing kit used in the attacks is capable of intercepting some forms of 2FA. Datadog
Sextortion: You’ve almost certainly seen a email claiming to have total access to all your devices and threatening to publish compromising material unless you pay up. There’s a new wave of these messages at the moment. They’re as much nonsense now as they’ve ever been and should be simply ignored. Malwarebytes
AI
Warning: The Five Eyes intelligence-sharing alliance says powerful AI models capable of devastating cyberattacks could be only months away. Intelligence and cyber agencies are urging governments to take action and address the risks immediately. Suggested measures include the adoption of AI for cyber defence, monitoring new threats, and implementing secure-by-design and secure-by-default principles.
Verification: From next month, Anthropic says it will start verifying the age of some Claude users. It doesn’t say who will be chosen but those who are will have to provide a scan of a government ID and an image or recording of their face. The verification process will be run by Persona; that’s the same company that Discord used until it retreated in the face of customer complaints.
Oops: Meta is “pausing” the collection of employee keystrokes after leaving the information exposed to view by anyone in the company. The programme was designed to collect mouse movements and keystrokes to train AI models. According to WIRED, the exposed information included personal data, performance information, private conversations, and AI prompt histories.
Rotting: Organisations are facing a growing problem of “knowledge decay” as employees use AI to generate work that looks polished but lacks substance. Harvard Business Review says increasing effort is being wasted on verifying reports, emails and presentations, with one survey reporting that four in ten workers had received this kind of low-value AI output, with each example taking almost two hours to resolve.
Reporting: Three reputable UK sports news websites have introduced AI-generated reporters with predictable results, including incorrect scores and players who had long left their clubs. Press Gazette says the sites were bought by digital marketing outfit Clickout Media, which has a history of buying once-viable websites to exploit their reputations to market online casinos.
US
Burners: The Federal Communications Commission has published a proposal to require phone companies to collect “the name, physical address, government-issued identification number, and an alternate telephone number of any new and renewing customer before granting access” to their services. The plan is ostensibly designed to thwart automated calls but would also limit the use of prepaid “anonymous” phones.
In brief
Authentication: With automated web traffic now exceeding human requests, a new initiative aims to verify whether access to a page is legitimate. Cloudflare has joined with browser manufacturers to create a protocol which will provide an anonymous token verifying a page request, importantly without the need for user logins or accursed CAPTCHAs.
Snooping: Advertising intelligence (aka “Adint”) is now one of the leading mechanisms for government surveillance, according to a survey of European spy agencies. Buying access to datasets containing people’s browsing and location data is far easier than tapping undersea cables and internet hubs (though that doesn’t mean governments aren’t doing that as well). It’s another good reason to use an ad-blocker or a privacy-focused browser. FT
Exports: Despite EU regulations, a Bulgaria-based company sold controversial surveillance technology to governments in countries with records of repression, enabling authorities to track mobile phones and eavesdrop on private communications. Documents obtained by Human Rights Watch show that the Bulgarian government approved transactions with law enforcement and intelligence agencies in countries including Azerbaijan, Bahrain, and the United Arab Emirates. Bloomberg
Advice: Apple has updated its advice on what to do if your phone is stolen. Until now, it suggested displaying content information on the lock screen of the device. In the face of thieves exploiting the details, it now explicitly warns against doing so. Apple’s page has useful suggestions that are worth reading. Meanwhile, two UK mobile phone groups have introduced “kill switches” to devices they sell in an attempt to combat theft.
Prices: Microsoft and Apple have announced swingeing price rises across their products, with some increases as much as 25%. Apple points to “an extraordinary surge in demand for memory and storage” due to the rapid expansion of AI data centres. Bloomberg
Breached: LastPass is among at least five security firms whose Salesforce accounts have been affected by a data breach at business intelligence platform Klue. The exposed information includes names, phone numbers and email addresses, so LastPass users should be on their guard for phishing emails exploiting the details.
USB: Nikkei reports (R) that Japan’s Self-Defence Forces used USB drives containing a China-linked virus on computers with access to classified information for nearly a year. They then chose not to disclose the matter even though similar memory sticks were widely available online.
Elite: A secretive network founded by billionaire investor Peter Thiel exposed personal details of its members, among them the US Treasury Secretary, two US senators and a NATO commander. The group, called Dialog, says it was hacked. In reality, it appears that it simply failed to configure a website correctly, leaving the information open to anyone who cared to look. WIRED
Updates
WhatsApp: A new warning will appear on Android and iOS apps before users open chats with unfamiliar phone numbers. Meta hopes that this new feature will help users take a moment to avoid falling for scams. WABetaInfo
Meta: 13 new privacy settings are being added to teen accounts across Facebook, Instagram and WhatsApp. The new settings are designed to help verify children’s age and inform parents of any unusual behaviour.
FFmpeg: The project has addressed a vulnerability that can be used for remote code execution attacks on multimedia servers.
Samsung: A newly disclosed issue could allow attackers to run malicious code on Samsung smartphones released over the past eight years. Devices from Galaxy S9 to S25 are vulnerable. Samsung released a fix in January. Lucid Bit
Microsoft: Support for Windows 10 has been extended until October 2027. There’s no explanation for the extension to the free scheme (which requires signing up). The Extended Security Update scheme had been due to end this October.