Your new car will be watching you. Impersonating big brands to attack job hunters.
Anthropic caught using tracking code. Ancient passwords. And an Instagram setting you might want to change.
Eyes forward
Anyone buying a new car in the EU or the US will soon find it comes with a camera pointed at the driver. New regulations mean that manufacturers must fit an infrared device designed to track the driver’s head position and eye movements, and alert them if they stop looking at the road. The rules are part of wide-ranging changes designed to improve road safety and came into force in the EU on Monday with similar measures due to take effect in the US next year. In the US, the camera will analyse pupil dilation and drowsiness patterns, and use the data to determine whether you’re too tired (or too impaired due to alcohol) to drive.
The measures include relatively strong safeguards to protect drivers’ privacy, but campaigners have questioned whether the mandatory cameras could become another source of personal data. The EU’s regulations require them to operate on a “closed-loop system”, “not continuously record nor retain any data” beyond what is needed to determine driver attention, and ensure the data “shall not be accessible or made available to third parties at any time.” Despite this, critics argue that once cameras become standard equipment, there will inevitably be pressure to expand how the data is used.
Threats
Marketing: A phishing campaign is impersonating more than 30 well-known brands, including Adobe, Netflix, Coca-Cola, and OpenAI, to steal Google account credentials from marketing professionals. The lures are fake job interviews and the campaign uses the names and pictures of genuine recruiters at the impersonated companies. Bleeping Computer
Clipboard: Maccy is a legitimate app for managing Mac clipboards. It’s currently being used as a disguise for a malicious information stealer that has some clever tricks to evade detection. (It’s also designed not to run in Russia and neighbouring countries.) The best protection against this sort of threat is to only install apps from trusted sources and to watch out for installation instructions that are in any way unusual. Jamf
Passkeys: An attacker has been targeting organisations with voice calls trying to persuade Microsoft 365 users to enroll a new passkey. The tactic is exploiting a new capability to allow administrators to run “passkey registration campaigns” for the Entra identity and access management service. Okta
ClickFix: We’re continuing to see multiple versions of this attack which tries to persuade victims to copy, paste and execute a malicious command in their terminal app. The latest impersonates Cloudflare and Google. The uBlock Origin ad blocker has now added support to try to prevent this type of threat by checking websites against a list of those associated with this type of attack.
AI
Tracker: Anthropic has removed a hidden tracker from Claude Code while explaining it was an experiment designed to prevent unauthorised use, seemingly directed at China. It’s an excellent illustration of the need to question how much we know about what’s actually happening when we use AI tools. Ars Technica
Trust: On the same theme, Palantir CEO Alex Karp has been sounding off about the AI giants, saying organisations are privately worried about losing control of their intellectual property. Many of his views reflect Palantir’s recent manifesto on “AI sovereignty” and the importance of retaining control of data. CNBC
Attack: Researchers have documented what they believe is the first example of an AI agent carrying out a complete ransomware attack, from exploiting a known vulnerability and stealing credentials to encrypting data and generating a ransom note. Sysdig says the techniques weren’t new, but the AI adapted to failures and completed the attack with minimal human involvement. It suggests it’s a warning sign of a future in which fewer skills and less knowledge are required to mount such attacks.
Deepfake: In a rare victory against fake content, Google’s SynthID system debunked an AI-generated hoax featuring US senator Mitch McConnell. The widely-circulated picture appeared to show the senator in hospital in a critical condition. Fact-checking site Snopes debunked the image after noting it contained the SynthID watermark designed by Google to identify AI-generated pictures. Meanwhile, parents in the UK have been warned not to publish photos of their children because of the risk they will be used to generate AI deepfakes.
In brief
Credentials: Baby Boomers are more likely than Gen Z users to update their passwords regularly, but both generations are probably using ones they created years, or even decades ago. A survey by NordPass chimes with our own experience - especially the tendency of younger users to store passwords in their web browser (use a password manager instead). We don’t recommend changing passwords regularly unless they’ve appeared in a data breach - and the older they are, the greater the chances they have.
Banks: On the subject of authentication, The Register has a good article illustrating the failure of many banks’ online security. It uses the example of the journalist’s 84-year-old mother who nearly lost $30,000 from her bank accounts after being conned by professional scumbags. They used an alleged suspicious transaction to persuade her to move her savings to an account they controlled. Although the thieves exploited the fact that she was reusing passwords, they also took advantage of the bank’s failure to require secure multi-factor authentication. Despite the well-documented frailty of SMS messages, many financial institutions continue to use them rather than adopting phishing-resistant methods such as passkeys or authenticator apps. If your bank is one of them, it’s worth asking them why.
Influencing: China has been leaning hard into influence campaigns, both in the context of local elections in Taiwan and debate in the US over data centres. In Taiwan, Newsguard says an operation has been targeting men with Threads accounts that appear to belong to attractive young women. In the US, OpenAI identified an operation designed “to manipulate a legitimate debate about American AI and wider tech politics.”
Traced: US prosecutors linked an alleged hacker to a break-in at a luxury jewellery retailer using a persistent Windows device ID. The identifier tied the ID to the account used during the intrusion and to online accounts prosecutors say belong to the 19-year-old alleged member of the Scattered Spider group. DoJ
Age check: Australia’s online platforms are stumbling at the very first step in implementing age checks for users, according to a team that advised the government on its rollout of the restrictions. The researchers found that platforms failed to seek age proof for any of 50 test accounts that declared the user was 16. Reuters
Bugged: World Economic Forum founder Klaus Schwab has filed a criminal complaint following the alleged discovery of a secret listening device in his home office in Geneva. Bloomberg reports that the equipment was found after a routine security inspection, although an initial assessment suggested it had been installed within the last three years.
Updates
Instagram: Meta has launched a new AI feature that lets people create images from your public Instagram posts unless you opt out - which we suggest you should. You can find the setting in the “How others can interact with you” section of the app. Otherwise, anyone could tell ‘Muse AI’ to generate an image (and soon a video) using your likeness. Without notifying you.
Android: Google has introduced stricter protections against attacks that involve guessing device PINs or passwords. Previously, the maximum number of failed attempts was 1,800. It has now been reduced to 20, with much tougher timeouts between incorrect entries. The change is part of Google’s efforts to make it harder for thieves to profit from stolen phones. The latest Android version was released last month, but it will take some time before most phone makers make it available.
Microsoft: Windows Backup for Organizations is to be enabled by default in Windows 11 26H2 everywhere except the EU. The service is designed to back up a device’s settings and installed Microsoft Store apps which it does by storing the information in Microsoft’s cloud. While this isn’t a major privacy issue in itself, it does mean organisations should decide whether to disable the feature or update their governance and privacy documentation rather than simply accepting the new default.