HBO Max Reddit hijacked for malware

Hackers took over an HBO Max Reddit account and directed users to download an app that was actually infostealer malware. The attack exploited trust in a legitimate brand to spread the threat.

Iranian hackers impersonate Norton and KeePass

Iranian-affiliated hackers used fake versions of security brands Norton and KeePass to trick users into installing spyware. The campaign targets political dissidents, journalists, and activists opposed to the Iranian government.

Torrent site iTorrents.org spreads malware

The public torrent repository iTorrents.org was hijacked and began distributing malware-laden files, including a malicious version of Christopher Nolan's The Odyssey. The site remains compromised.

Law enforcement shuts down DDoS site

U.S. authorities took down NightmareStresser, a long-running website that posed as a legitimate stress-testing tool but actually allowed users to launch denial-of-service attacks on websites they didn't own.

Startup detects hidden smart glasses

Bastille Networks developed tools to detect nearby smart glasses in sensitive areas. The technology is designed for businesses and government agencies concerned about unauthorized recording.

AI generates 1M phishing emails in 3 days

A threat actor used AI to send over 1 million highly personalized phishing emails in less than three days, targeting payroll and accounting departments with fake ServiceNow invoices. The emails included actual employee names and company details.

Phishing emails impersonate company leaders

The scam emails were formatted to look like threaded conversations, appearing to come from company leaders directing accounting staff to pay fake bills. This creates false urgency and authority to bypass verification.

AI makes spear-phishing campaigns scalable

Artificial intelligence allows scammers to personalize attacks at massive scale, targeting the human element of security rather than technical defenses. This makes traditional phishing far more effective.

Instagram scammers weaponize copyright strikes

Scammers file false copyright complaints against Instagram accounts, getting them suspended, then demand cryptocurrency to withdraw the complaints. Meta's automated moderation makes accounts vulnerable to this ransom scheme.

No guarantee paying Instagram ransom works

Even if victims pay the cryptocurrency ransom, scammers may not withdraw complaints, and Meta may not restore accounts. The platform has allowed similar attacks since 2023 without fixing the vulnerability.

EFF publishes AI privacy guide

The Electronic Frontier Foundation released a comprehensive guide to AI privacy, explaining differences between cloud-based and on-device AI. It clarifies that opting out of training doesn't mean your data stays private.

Opting out of training isn't enough

Disabling AI training on your data doesn't prevent companies from accessing and using it for other purposes. The EFF guide reminds users that these are separate privacy concerns.

“"do not train using my data" is not the same thing as "do not access my data and use it for other things"”

AI tools handle law enforcement requests

The EFF guide includes links to disable AI training for ChatGPT, Gemini, Claude, and others. It also reminds users to consider how these services respond to law enforcement requests.

Stolen unlocked phone exposes passkeys

If someone steals your unlocked phone, they likely have access to your passkeys and can use them to log into your accounts. Physical device theft bypasses most security measures.

Passkeys aren't unique to phone theft risk

Passkeys are vulnerable to the same physical theft risks as saved passwords. When someone has physical control of your device, all security measures have limits. Lock and wipe your phone remotely immediately if stolen.